@owlmeans/client-panel 0.1.18-rc.58 → 0.1.18-rc.59

package/README.md

@@ -16,7 +16,7 @@ headless navigation model.
 ## Installation
 
 ```bash
-bun add @owlmeans/client-panel@^0.1.18-rc.58
+bun add @owlmeans/client-panel@^0.1.18-rc.59
 ```
 
 ## Usage
@@ -153,7 +153,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.49
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-panel",
-  "version": "0.1.18-rc.58",
-  "generatedAt": "2026-10-05T21:03:06.410Z",
+  "version": "0.1.18-rc.59",
+  "generatedAt": "2026-10-06T11:45:57.680Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-panel/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/client-panel
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-panel": "^0.1.18-rc.58"` in `dependencies`
+**Install:** `"@owlmeans/client-panel": "^0.1.18-rc.59"` in `dependencies`
 
 ## Key Exports
 
@@ -40,9 +40,11 @@ controller; apps may override it through their own `buttons` resource.
 
 ## Subpath Exports
 
-- `./auth` — `useLoginMethods` and the login model types (`LoginMethodsModel`, `LoginTermsModel`,
-  `LoginCreditModel`, `UseLoginMethodsOptions`). Importing it also registers this package's own
-  seven-language `client-panel-auth` bundle by side effect.
+- `./auth` — `useLoginMethods`, `loginProviderHelper` and the login model types
+  (`LoginMethodsModel`, `LoginTermsModel`, `LoginCreditModel`, `LoginProviderConfig`,
+  `LoginProviderModel`, `LoginProviderPlacement`, `UseLoginMethodsOptions`). Importing it also
+  registers this package's own seven-language `client-panel-auth` bundle and the
+  `LoginScreenConfig.provider` augmentation of `@owlmeans/config` by side effect.
 - `./auth/plugins` — the shapes an auth UI plugin is written against: `Ed22519BasicAuthUIPluginForm`
   and its `Ed22519BasicAuthUIPluginFormSchema`.
 
@@ -63,6 +65,30 @@ bound `LoginStep` confirms the terms instead of this screen. `LoginMethodsModel.
 (`required && !deferred && !accepted`) — a renderer never blocks on `required`/`accepted` alone, or
 it would re-block a screen whose confirmation moved elsewhere.
 
+### The provider disclosure — `LoginMethodsModel.provider`
+
+A sign-in screen that a third party runs for an application (a generated target signing people in
+through the platform's IAM) names both parties: who signs the person in, and on behalf of which
+product. The rules live here, headless, so every renderer discloses the same thing:
+
+- **Config** — `cfg.security.auth.login.provider?: LoginProviderConfig`
+  (`{ name, operator?, info?, placement?: 'top' | 'inline' }`), declared onto `@owlmeans/config`'s
+  `LoginScreenConfig` by module augmentation in `auth/login/provider-config.ts` (the
+  `client-auth/login/terms-config.ts` pattern), never by editing `@owlmeans/config`. The `./auth`
+  barrel re-exports it, so any import of `@owlmeans/client-panel/auth` loads the field; a program
+  that builds the literal without one adds `import type {} from '@owlmeans/client-panel/auth'`.
+- **Model** — `loginProviderHelper.resolve(cfg, brand)` → `LoginProviderModel { name, operator,
+  product, info: string | null, placement }` or `null`. Null unless the provider `name` AND the
+  product (`cfg.brand.name`) are set — a relationship with one party missing is never shown. Blank
+  strings are unset (build-time env arrives as `''`); `operator` defaults to `name`; `placement` to
+  `'inline'` (anything but `'top'` is inline); `info` survives only as an absolute `http(s)` URL or
+  a root-relative path (`//host` and `/\` are refused). `useLoginMethods().provider` carries it.
+- **Copy** — `loginProviderHelper.fill(template, model)` puts `{{provider}}`, `{{operator}}` and
+  `{{product}}` into an ALREADY-TRANSLATED sentence in one pass; names never travel as i18next
+  params. The keys (`login.provider.*`) and the markup belong to `web-panel`.
+- The disclosure is independent of the credit line: `credit.poweredBy: false` never hides who
+  signs a person in.
+
 ## Usage
 
 ```typescript

package/build/auth/login/index.d.ts

@@ -1,3 +1,5 @@
 export type * from './types.js';
 export * from './model.js';
+export * from './provider.js';
+export * from './provider-config.js';
 //# sourceMappingURL=index.d.ts.map

package/build/auth/login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA"}

package/build/auth/login/index.js

@@ -1,2 +1,4 @@
 export * from './model.js';
+export * from './provider.js';
+export * from './provider-config.js';
 //# sourceMappingURL=index.js.map

package/build/auth/login/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA"}

package/build/auth/login/model.d.ts

@@ -3,8 +3,8 @@ import type { LoginMethodsModel, UseLoginMethodsOptions } from './types.js';
  * Everything a sign-in screen needs, with no opinion about how it looks.
  *
  * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
- * be confirmed first and what the credit line says are the same on every platform, and only the
- * rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
  */
 export declare const useLoginMethods: (opts?: UseLoginMethodsOptions) => LoginMethodsModel;
 //# sourceMappingURL=model.d.ts.map

package/build/auth/login/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAAW,sBAAsB,KAAG,iBAoF/D,CAAA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAG3E;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAAW,sBAAsB,KAAG,iBAsF/D,CAAA"}

package/build/auth/login/model.js

@@ -1,12 +1,13 @@
 import { useCallback, useMemo, useState } from 'react';
 import { useContext, useNavigate } from '@owlmeans/client';
 import { resolveCredit, LoginOutcome, LOGIN_SERVICE, loginMethodsHelper, loginTermsHelper } from '@owlmeans/client-auth/login';
+import { loginProviderHelper } from './provider.js';
 /**
  * Everything a sign-in screen needs, with no opinion about how it looks.
  *
  * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
- * be confirmed first and what the credit line says are the same on every platform, and only the
- * rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
  */
 export const useLoginMethods = (opts) => {
     const context = useContext();
@@ -16,6 +17,7 @@ export const useLoginMethods = (opts) => {
     const brand = context.cfg.brand;
     const resolved = useMemo(() => loginTermsHelper.resolveTerms(opts?.terms ?? cfg?.terms), [opts?.terms, cfg]);
     const credit = useMemo(() => resolveCredit(cfg?.credit, brand, context.cfg.service), [cfg, brand, context]);
+    const provider = useMemo(() => loginProviderHelper.resolve(cfg?.provider, brand), [cfg, brand]);
     const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved));
     const [attempted, setAttempted] = useState(false);
     const [busy, setBusy] = useState(null);
@@ -75,6 +77,7 @@ export const useLoginMethods = (opts) => {
             accept,
         },
         credit,
+        provider,
         blocked,
         busy,
         outcome,

package/build/auth/login/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAI9H;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAA6B,EAAqB,EAAE;IAClF,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5G,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACpF,CAAA;IAED,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;KACxF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAA;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAE/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,4FAA4F;YAC5F,8FAA8F;YAC9F,YAAY,CAAC,IAAI,CAAC,CAAA;YAElB,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,KAAK,CAAC;YAChB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;SACxF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACf,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,uFAAuF;YACvF,IAAI,MAAM,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO;QACL,OAAO;QACP,OAAO,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,KAAK;YACrC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE;YACpC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,MAAM;SACP;QACD,MAAM;QACN,OAAO;QACP,IAAI;QACJ,OAAO;QACP,KAAK;QACL,MAAM;KACP,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAG9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAA6B,EAAqB,EAAE;IAClF,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5G,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACpF,CAAA;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAE/F,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;KACxF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAA;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAE/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,4FAA4F;YAC5F,8FAA8F;YAC9F,YAAY,CAAC,IAAI,CAAC,CAAA;YAElB,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,KAAK,CAAC;YAChB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;SACxF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACf,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,uFAAuF;YACvF,IAAI,MAAM,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO;QACL,OAAO;QACP,OAAO,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,KAAK;YACrC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE;YACpC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,MAAM;SACP;QACD,MAAM;QACN,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,OAAO;QACP,KAAK;QACL,MAAM;KACP,CAAA;AACH,CAAC,CAAA"}

package/build/auth/login/provider/consts.local.d.ts

@@ -0,0 +1,3 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export declare const PROVIDER_PLACEHOLDER: RegExp;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/auth/login/provider/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../../src/auth/login/provider/consts.local.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,QAAyC,CAAA"}

package/build/auth/login/provider/consts.local.js

@@ -0,0 +1,3 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export const PROVIDER_PLACEHOLDER = /\{\{(provider|operator|product)\}\}/g;
+//# sourceMappingURL=consts.local.js.map

package/build/auth/login/provider/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../../src/auth/login/provider/consts.local.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA"}

package/build/auth/login/provider-config.d.ts

@@ -0,0 +1,37 @@
+import type { LoginProviderConfig } from './types.js';
+/**
+ * `LoginScreenConfig.provider`, added by TypeScript module augmentation rather than by editing
+ * `@owlmeans/config` itself.
+ *
+ * `@owlmeans/config` has roughly 85 dependents, and every one of them sits in the same release
+ * closure — a config bump ripples through every package that pins a range against it, whether or
+ * not it touches sign-in. The field below is read by exactly one consumer family (the sign-in
+ * screen's headless model here and its renderers), so it is declared here instead, merged onto the
+ * base interface by TypeScript's own declaration merging — the pattern
+ * `@owlmeans/client-auth/login`'s `terms-config.ts` set.
+ *
+ * This file must be part of whatever a consumer's own compilation actually loads, or the merge
+ * never happens — an ambient augmentation applies only once the compiler has read the file that
+ * declares it. `@owlmeans/client-panel/auth`'s barrel re-exports this module for exactly that
+ * reason, so ANY import from `@owlmeans/client-panel/auth` pulls this augmentation into that
+ * program. An app that builds its `security.auth.login` literal in a file that imports nothing from
+ * it (a config file importing only `@owlmeans/config`) still benefits as long as some other file in
+ * the same `tsc` program does; if none does, add `import type {} from '@owlmeans/client-panel/auth'`
+ * to the file building the literal — an import with an empty type list, kept only to pull this
+ * file into that program's graph.
+ *
+ * `export {}` below is required, not decorative: without at least one top-level import/export this
+ * file is a SCRIPT to TypeScript, not a MODULE, and `declare module '@owlmeans/config'` inside a
+ * script augments the global scope instead of merging onto the named module's exports.
+ */
+declare module '@owlmeans/config' {
+    interface LoginScreenConfig {
+        /**
+         * Who signs a person in on this application's behalf — an identity service the application
+         * does not itself run. Absent, the screen discloses nothing and renders exactly as before.
+         */
+        provider?: LoginProviderConfig;
+    }
+}
+export {};
+//# sourceMappingURL=provider-config.d.ts.map

package/build/auth/login/provider-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../../../src/auth/login/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,QAAQ,kBAAkB,CAAC;IAChC,UAAU,iBAAiB;QACzB;;;WAGG;QACH,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B;CACF;AAED,OAAO,EAAG,CAAA"}

package/build/auth/login/provider-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-config.js.map

package/build/auth/login/provider-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config.js","sourceRoot":"","sources":["../../../src/auth/login/provider-config.ts"],"names":[],"mappings":""}

package/build/auth/login/provider.d.ts

@@ -0,0 +1,5 @@
+import type { LoginProviderHelper } from './types.js';
+import './provider-config.js';
+export declare const createLoginProviderHelper: () => LoginProviderHelper;
+export declare const loginProviderHelper: LoginProviderHelper;
+//# sourceMappingURL=provider.d.ts.map

package/build/auth/login/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/auth/login/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,mBAAmB,EAAsB,MAAM,YAAY,CAAA;AAE9F,OAAO,sBAAsB,CAAA;AAE7B,eAAO,MAAM,yBAAyB,QAAO,mBAyD5C,CAAA;AAED,eAAO,MAAM,mBAAmB,qBAA8B,CAAA"}

package/build/auth/login/provider.js

@@ -0,0 +1,55 @@
+import { PROVIDER_PLACEHOLDER } from './provider/consts.local.js';
+import './provider-config.js';
+export const createLoginProviderHelper = () => {
+    /**
+     * A configured value that was actually SET — `''` is how a build-time default spells "unset"
+     * (see `resolveCredit` in `@owlmeans/client-auth/login`, which follows the same rule).
+     */
+    const set = (value) => typeof value === 'string' && value.trim() !== '' ? value.trim() : null;
+    /**
+     * A link a person may be sent to: an absolute http(s) URL, or a path on this origin.
+     *
+     * `//host` is protocol-relative — another origin wearing a path's clothes — and `/\` is read as
+     * the same by browsers, so both are refused along with every other scheme (`javascript:` above
+     * all, since this lands in an `href`).
+     */
+    const link = (value) => {
+        const href = set(value);
+        if (href == null) {
+            return null;
+        }
+        if (href.startsWith('/')) {
+            return /^\/[/\\]/.test(href) ? null : href;
+        }
+        try {
+            const url = new URL(href);
+            return url.protocol === 'https:' || url.protocol === 'http:' ? href : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const resolve = (cfg, brand) => {
+        const name = set(cfg?.name);
+        const product = set(brand?.name);
+        if (name == null || product == null) {
+            return null;
+        }
+        return {
+            name,
+            operator: set(cfg?.operator) ?? name,
+            product,
+            info: link(cfg?.info),
+            placement: cfg?.placement === 'top' ? 'top' : 'inline',
+        };
+    };
+    const fill = (template, model) => {
+        const values = {
+            provider: model.name, operator: model.operator, product: model.product,
+        };
+        return template.replace(PROVIDER_PLACEHOLDER, (match, key) => values[key] ?? match);
+    };
+    return { resolve, fill };
+};
+export const loginProviderHelper = createLoginProviderHelper();
+//# sourceMappingURL=provider.js.map

package/build/auth/login/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/auth/login/provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,sBAAsB,CAAA;AAE7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAwB,EAAE;IACjE;;;OAGG;IACH,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAiB,EAAE,CACnD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAExE;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,CAAC,KAAqB,EAAiB,EAAE;QACpD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;YAEzB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAE,KAAqB,EAA6B,EAAE;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI;YACpC,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;SACvD,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,KAAyB,EAAU,EAAE;QACnE,MAAM,MAAM,GAA2B;YACrC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;SACvE,CAAA;QAED,OAAO,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAA;IAC7F,CAAC,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,EAAE,CAAA"}

package/build/auth/login/types.d.ts

@@ -1,5 +1,5 @@
 import type { LoginMethod, LoginOutcome, ResolvedTermsDocument } from '@owlmeans/client-auth/login';
-import type { LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config';
+import type { BrandSettings, LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config';
 export interface UseLoginMethodsOptions {
     /** Overrides the configuration the context carries. */
     config?: LoginScreenConfig;
@@ -33,12 +33,59 @@ export interface LoginCreditModel {
     poweredBy: boolean;
     line: string | null;
 }
+/** Where the provider disclosure sits: a strip above the card, or a line inside it. */
+export type LoginProviderPlacement = 'top' | 'inline';
+/**
+ * Who actually signs a person in, when that is not the application on whose screen they are.
+ *
+ * Read from `cfg.security.auth.login.provider` (declared onto `LoginScreenConfig` by
+ * `./provider-config.ts`). Blank strings are unset, exactly as they are for the credit line: this
+ * config is filled from build-time environment variables, and an undelivered one arrives as `''`.
+ */
+export interface LoginProviderConfig {
+    /** The sign-in service as a person reads it — "OwlMeans IAM". */
+    name: string;
+    /** Who runs it. Defaults to `name`. */
+    operator?: string;
+    /** "More information" — an absolute http(s) URL or a root-relative path; anything else is dropped. */
+    info?: string;
+    /** Default `'inline'`. */
+    placement?: LoginProviderPlacement;
+}
+export interface LoginProviderModel {
+    name: string;
+    operator: string;
+    /** The application the person is signing in to — `cfg.brand.name`. */
+    product: string;
+    info: string | null;
+    placement: LoginProviderPlacement;
+}
+export interface LoginProviderHelper {
+    /**
+     * The disclosure a sign-in screen renders, or `null` when there is nothing to disclose.
+     *
+     * Null unless both the provider's `name` and the product (`brand.name`) are set — a sentence
+     * relating two parties cannot be written with one of them missing, and a screen that showed half
+     * of it would be worse than one that shows none.
+     */
+    resolve: (cfg?: LoginProviderConfig, brand?: BrandSettings) => LoginProviderModel | null;
+    /**
+     * Put the names into a sentence AFTER it was translated.
+     *
+     * `{{provider}}`, `{{operator}}` and `{{product}}`, replaced in one pass — a name that itself
+     * contains a placeholder is never expanded a second time. The names never travel as i18next
+     * interpolation parameters, so no translation backend gets the chance to escape or format them.
+     */
+    fill: (template: string, model: LoginProviderModel) => string;
+}
 export interface LoginMethodsModel {
     methods: LoginMethod[];
     /** The one a screen highlights and focuses. It is never started automatically. */
     primary: LoginMethod | null;
     terms: LoginTermsModel;
     credit: LoginCreditModel;
+    /** Who signs the person in, on behalf of which product — `null` when the app configured nobody. */
+    provider: LoginProviderModel | null;
     /** True while the terms have not been confirmed and confirming them is required. */
     blocked: boolean;
     /** Id of the method currently starting. */

package/build/auth/login/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnG,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE3E,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAA;IAChC,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,CAAA;CACtE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,6FAA6F;IAC7F,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,kFAAkF;IAClF,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,eAAe,CAAA;IACtB,MAAM,EAAE,gBAAgB,CAAA;IACxB,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CACtC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnG,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE1F,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAA;IAChC,qDAAqD;IACrD,OAAO,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,CAAA;CACtE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAA;IAClB,8FAA8F;IAC9F,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,6FAA6F;IAC7F,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,QAAQ,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0BAA0B;IAC1B,SAAS,CAAC,EAAE,sBAAsB,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,sBAAsB,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,aAAa,KAAK,kBAAkB,GAAG,IAAI,CAAA;IACxF;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,MAAM,CAAA;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,kFAAkF;IAClF,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,eAAe,CAAA;IACtB,MAAM,EAAE,gBAAgB,CAAA;IACxB,mGAAmG;IACnG,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CACtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/client-panel",
-  "version": "0.1.18-rc.58",
+  "version": "0.1.18-rc.59",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -36,16 +36,16 @@
   },
   "dependencies": {
     "@hookform/resolvers": "^5.9.1",
-    "@owlmeans/client": "^0.1.18-rc.51",
-    "@owlmeans/client-i18n": "^0.1.18-rc.50",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.47",
-    "@owlmeans/client-route": "^0.1.18-rc.48",
+    "@owlmeans/client": "^0.1.18-rc.52",
+    "@owlmeans/client-i18n": "^0.1.18-rc.51",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.48",
+    "@owlmeans/client-route": "^0.1.18-rc.49",
     "@owlmeans/error": "^0.1.18-rc.38",
     "@owlmeans/entrypoint": "^0.1.18-rc.41"
   },
   "peerDependencies": {
     "@owlmeans/auth": "^0.1.18-rc.40",
-    "@owlmeans/client-auth": "^0.1.18-rc.58",
+    "@owlmeans/client-auth": "^0.1.18-rc.59",
     "@owlmeans/config": "^0.1.18-rc.44",
     "@owlmeans/i18n": "^0.1.18-rc.39",
     "@owlmeans/router": "^0.1.18-rc.33",
@@ -64,7 +64,7 @@
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
     "@owlmeans/auth": "^0.1.18-rc.40",
-    "@owlmeans/client-auth": "^0.1.18-rc.58",
+    "@owlmeans/client-auth": "^0.1.18-rc.59",
     "@types/react": "^19.3.0",
     "nodemon": "^3.1.14",
     "react-hook-form": "^7.89.0",

package/src/auth/login/index.ts

@@ -1,2 +1,4 @@
 export type * from './types.js'
 export * from './model.js'
+export * from './provider.js'
+export * from './provider-config.js'

package/src/auth/login/model.ts

@@ -4,13 +4,14 @@ import type { CommonConfig } from '@owlmeans/config'
 import { resolveCredit, LoginOutcome, LOGIN_SERVICE, loginMethodsHelper, loginTermsHelper } from '@owlmeans/client-auth/login'
 import type { LoginContext, LoginMethod, LoginService } from '@owlmeans/client-auth/login'
 import type { LoginMethodsModel, UseLoginMethodsOptions } from './types.js'
+import { loginProviderHelper } from './provider.js'
 
 /**
  * Everything a sign-in screen needs, with no opinion about how it looks.
  *
  * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
- * be confirmed first and what the credit line says are the same on every platform, and only the
- * rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
  */
 export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsModel => {
   const context = useContext() as unknown as LoginContext
@@ -24,6 +25,7 @@ export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsMode
   const credit = useMemo(
     () => resolveCredit(cfg?.credit, brand, context.cfg.service), [cfg, brand, context]
   )
+  const provider = useMemo(() => loginProviderHelper.resolve(cfg?.provider, brand), [cfg, brand])
 
   const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved))
   const [attempted, setAttempted] = useState(false)
@@ -90,6 +92,7 @@ export const useLoginMethods = (opts?: UseLoginMethodsOptions): LoginMethodsMode
       accept,
     },
     credit,
+    provider,
     blocked,
     busy,
     outcome,

package/src/auth/login/provider/consts.local.ts

@@ -0,0 +1,2 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export const PROVIDER_PLACEHOLDER = /\{\{(provider|operator|product)\}\}/g

package/src/auth/login/provider-config.ts

@@ -0,0 +1,38 @@
+import type { LoginProviderConfig } from './types.js'
+
+/**
+ * `LoginScreenConfig.provider`, added by TypeScript module augmentation rather than by editing
+ * `@owlmeans/config` itself.
+ *
+ * `@owlmeans/config` has roughly 85 dependents, and every one of them sits in the same release
+ * closure — a config bump ripples through every package that pins a range against it, whether or
+ * not it touches sign-in. The field below is read by exactly one consumer family (the sign-in
+ * screen's headless model here and its renderers), so it is declared here instead, merged onto the
+ * base interface by TypeScript's own declaration merging — the pattern
+ * `@owlmeans/client-auth/login`'s `terms-config.ts` set.
+ *
+ * This file must be part of whatever a consumer's own compilation actually loads, or the merge
+ * never happens — an ambient augmentation applies only once the compiler has read the file that
+ * declares it. `@owlmeans/client-panel/auth`'s barrel re-exports this module for exactly that
+ * reason, so ANY import from `@owlmeans/client-panel/auth` pulls this augmentation into that
+ * program. An app that builds its `security.auth.login` literal in a file that imports nothing from
+ * it (a config file importing only `@owlmeans/config`) still benefits as long as some other file in
+ * the same `tsc` program does; if none does, add `import type {} from '@owlmeans/client-panel/auth'`
+ * to the file building the literal — an import with an empty type list, kept only to pull this
+ * file into that program's graph.
+ *
+ * `export {}` below is required, not decorative: without at least one top-level import/export this
+ * file is a SCRIPT to TypeScript, not a MODULE, and `declare module '@owlmeans/config'` inside a
+ * script augments the global scope instead of merging onto the named module's exports.
+ */
+declare module '@owlmeans/config' {
+  interface LoginScreenConfig {
+    /**
+     * Who signs a person in on this application's behalf — an identity service the application
+     * does not itself run. Absent, the screen discloses nothing and renders exactly as before.
+     */
+    provider?: LoginProviderConfig
+  }
+}
+
+export { }

package/src/auth/login/provider.ts

@@ -0,0 +1,65 @@
+import type { BrandSettings } from '@owlmeans/config'
+import type { LoginProviderConfig, LoginProviderHelper, LoginProviderModel } from './types.js'
+import { PROVIDER_PLACEHOLDER } from './provider/consts.local.js'
+import './provider-config.js'
+
+export const createLoginProviderHelper = (): LoginProviderHelper => {
+  /**
+   * A configured value that was actually SET — `''` is how a build-time default spells "unset"
+   * (see `resolveCredit` in `@owlmeans/client-auth/login`, which follows the same rule).
+   */
+  const set = (value?: string | null): string | null =>
+    typeof value === 'string' && value.trim() !== '' ? value.trim() : null
+
+  /**
+   * A link a person may be sent to: an absolute http(s) URL, or a path on this origin.
+   *
+   * `//host` is protocol-relative — another origin wearing a path's clothes — and `/\` is read as
+   * the same by browsers, so both are refused along with every other scheme (`javascript:` above
+   * all, since this lands in an `href`).
+   */
+  const link = (value?: string | null): string | null => {
+    const href = set(value)
+    if (href == null) {
+      return null
+    }
+    if (href.startsWith('/')) {
+      return /^\/[/\\]/.test(href) ? null : href
+    }
+    try {
+      const url = new URL(href)
+
+      return url.protocol === 'https:' || url.protocol === 'http:' ? href : null
+    } catch {
+      return null
+    }
+  }
+
+  const resolve = (cfg?: LoginProviderConfig, brand?: BrandSettings): LoginProviderModel | null => {
+    const name = set(cfg?.name)
+    const product = set(brand?.name)
+    if (name == null || product == null) {
+      return null
+    }
+
+    return {
+      name,
+      operator: set(cfg?.operator) ?? name,
+      product,
+      info: link(cfg?.info),
+      placement: cfg?.placement === 'top' ? 'top' : 'inline',
+    }
+  }
+
+  const fill = (template: string, model: LoginProviderModel): string => {
+    const values: Record<string, string> = {
+      provider: model.name, operator: model.operator, product: model.product,
+    }
+
+    return template.replace(PROVIDER_PLACEHOLDER, (match, key: string) => values[key] ?? match)
+  }
+
+  return { resolve, fill }
+}
+
+export const loginProviderHelper = createLoginProviderHelper()

package/src/auth/login/types.ts

@@ -1,5 +1,5 @@
 import type { LoginMethod, LoginOutcome, ResolvedTermsDocument } from '@owlmeans/client-auth/login'
-import type { LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config'
+import type { BrandSettings, LoginScreenConfig, LoginTermsConfig } from '@owlmeans/config'
 
 export interface UseLoginMethodsOptions {
   /** Overrides the configuration the context carries. */
@@ -37,12 +37,63 @@ export interface LoginCreditModel {
   line: string | null
 }
 
+/** Where the provider disclosure sits: a strip above the card, or a line inside it. */
+export type LoginProviderPlacement = 'top' | 'inline'
+
+/**
+ * Who actually signs a person in, when that is not the application on whose screen they are.
+ *
+ * Read from `cfg.security.auth.login.provider` (declared onto `LoginScreenConfig` by
+ * `./provider-config.ts`). Blank strings are unset, exactly as they are for the credit line: this
+ * config is filled from build-time environment variables, and an undelivered one arrives as `''`.
+ */
+export interface LoginProviderConfig {
+  /** The sign-in service as a person reads it — "OwlMeans IAM". */
+  name: string
+  /** Who runs it. Defaults to `name`. */
+  operator?: string
+  /** "More information" — an absolute http(s) URL or a root-relative path; anything else is dropped. */
+  info?: string
+  /** Default `'inline'`. */
+  placement?: LoginProviderPlacement
+}
+
+export interface LoginProviderModel {
+  name: string
+  operator: string
+  /** The application the person is signing in to — `cfg.brand.name`. */
+  product: string
+  info: string | null
+  placement: LoginProviderPlacement
+}
+
+export interface LoginProviderHelper {
+  /**
+   * The disclosure a sign-in screen renders, or `null` when there is nothing to disclose.
+   *
+   * Null unless both the provider's `name` and the product (`brand.name`) are set — a sentence
+   * relating two parties cannot be written with one of them missing, and a screen that showed half
+   * of it would be worse than one that shows none.
+   */
+  resolve: (cfg?: LoginProviderConfig, brand?: BrandSettings) => LoginProviderModel | null
+  /**
+   * Put the names into a sentence AFTER it was translated.
+   *
+   * `{{provider}}`, `{{operator}}` and `{{product}}`, replaced in one pass — a name that itself
+   * contains a placeholder is never expanded a second time. The names never travel as i18next
+   * interpolation parameters, so no translation backend gets the chance to escape or format them.
+   */
+  fill: (template: string, model: LoginProviderModel) => string
+}
+
 export interface LoginMethodsModel {
   methods: LoginMethod[]
   /** The one a screen highlights and focuses. It is never started automatically. */
   primary: LoginMethod | null
   terms: LoginTermsModel
   credit: LoginCreditModel
+  /** Who signs the person in, on behalf of which product — `null` when the app configured nobody. */
+  provider: LoginProviderModel | null
   /** True while the terms have not been confirmed and confirming them is required. */
   blocked: boolean
   /** Id of the method currently starting. */