@owlmeans/client-panel 0.1.18-rc.6 → 0.1.18-rc.60

package/README.md

@@ -1,6 +1,7 @@
 # @owlmeans/client-panel
 
-Schema-driven React form components with react-hook-form integration, i18n, and action buttons.
+Schema-driven React form components with react-hook-form integration, i18n, action buttons, and the
+headless navigation model.
 
 ## Overview
 
@@ -9,12 +10,13 @@ Schema-driven React form components with react-hook-form integration, i18n, and
 - `InputCtrl` — labeled input field component backed by react-hook-form
 - `useFormRef()` — hook to get a ref for programmatic form operations
 - `FormOnSubmit` — type for form submission handler functions
+- `usePanelNav()` — the model behind a two-layer navigation menu (no JSX)
 - Platform-agnostic: used by React web and React Native frontends
 
 ## Installation
 
 ```bash
-bun add @owlmeans/client-panel
+bun add @owlmeans/client-panel@^0.1.18-rc.60
 ```
 
 ## Usage
@@ -24,12 +26,13 @@ A complete form with submit and cancel actions:
 ```typescript
 import { ClientForm, InputCtrl, ActionCtrl, useFormRef } from '@owlmeans/client-panel'
 import type { FormOnSubmit } from '@owlmeans/client-panel'
+import { appProtocols } from 'my-app-common'
 
 function CreateProjectForm() {
   const formRef = useFormRef()
 
   const onSubmit: FormOnSubmit<CreateProject> = async (data) => {
-    await ctx.module<ClientModule<Project>>('project-create').call({ body: data })
+    await ctx.entrypoint(appProtocols.api.project.create).call({ body: data })
   }
 
   return (
@@ -81,6 +84,62 @@ type FormOnSubmit<T> = (data: T) => void | Promise<void>
 
 Derives default form values from an AJV schema's `default` fields.
 
+## Navigation model
+
+Navigation is declared as data and rendered by the platform package
+(`@owlmeans/web-panel` ships `NavLayout` / `TopNav` / `SideNav` / `Footer`). This package holds only
+the model, so both levels of the menu agree on what is active.
+
+```typescript
+import { usePanelNav } from '@owlmeans/client-panel'
+import type { PanelNavConfig } from '@owlmeans/client-panel'
+
+const config: PanelNavConfig = {
+  sections: [
+    { name: 'home', label: 'Home', items: [{ alias: HOME, label: 'Overview' }] },
+    { name: 'demo', items: [{ alias: web.session }, { alias: web.about }] },
+  ],
+}
+
+const model = usePanelNav(config)
+```
+
+### Types
+
+- `PanelNavItem` — `{ alias, label?, Icon?, hidden? }`; one screen, addressed by entrypoint alias,
+  never by URL.
+- `PanelNavSection` — `{ name, label?, items, hidden? }`; the first menu level. Pressing it goes to
+  the first visible item.
+- `PanelNavConfig` — `{ sections }`.
+- `PanelNavLink` — `{ alias? | href?, label?, open? }`; a footer link.
+- `NavTranslate` — `(key, defaultValue) => string`.
+
+### `usePanelNav(config): PanelNavModel`
+
+Returns `sections` (with `hidden` filtered out), `current` (the active screen's alias or null),
+`active` (its section), `showSide`, `isSectionActive` / `isItemActive`, `goSection` / `goItem`
+(each returning a handler), and `hrefOf(target)`.
+
+- `showSide` is false when the active section holds a single screen — that is where the "one screen,
+  no second level" rule lives; a renderer asks the model rather than counting items.
+- The current screen resolves from the router's `location.state.alias` when present, and otherwise
+  from the pathname matched against entrypoint paths — exact first, then longest prefix.
+  Both are needed: `state` is `window.history.state`, so it is empty on a hard load or deep link. A
+  screen listed in no section finds its section by walking its declared `parent` upward.
+- `hrefOf` resolves a real URL synchronously so a menu entry can be a proper link (focusable,
+  keyboard-operable, openable in a new tab). It returns `undefined` for a path carrying route
+  parameters.
+
+### `navLabelHelper.resolveNavLabel(translate, label, key, alias)`
+
+Resolves a label as literal `label` → `translate(key, defaultNavLabel(alias))` → the humanized
+alias. `translate` always reaches a component as a **prop**, defaulting to `navLabelHelper.defaultNavTranslate`
+(which returns the fallback) — a menu must never read an i18n context implicitly, because an app
+mounted without an i18n provider throws inside render and blanks the page. `navLabelHelper.defaultNavLabel`
+humanizes the last alias segment
+(`my-app:web:user-list` → `User list`). Default key families are `nav.<section>` and
+`modules.<alias>`.
+
 ## Related Packages
 
 - [`@owlmeans/client`](../client) — `useContext`, `useNavigate` used within form components
@@ -94,7 +153,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.52
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/client-panel",
-  "version": "0.1.18-rc.6",
-  "generatedAt": "2026-08-18T14:48:00.543Z",
+  "version": "0.1.18-rc.60",
+  "generatedAt": "2026-10-08T21:27:54.316Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/client-panel/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: client-panel
-description: How to use @owlmeans/client-panel — reusable cross-platform UI panel + form components (auth screens, layouts) shared by web-panel and native-panel. Auto-invoked when importing panel components.
+description: How to use @owlmeans/client-panel — reusable cross-platform UI panel + form components (auth screens, layouts) and the headless navigation model (usePanelNav) shared by web-panel and native-panel. Auto-invoked when importing panel components or building a navigation menu.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,30 +8,176 @@ user-invocable: false
 # @owlmeans/client-panel
 
 **Layer:** Client
-**Install:** `"@owlmeans/client-panel": "^0.1.18-rc.6"` in `dependencies`
+**Install:** `"@owlmeans/client-panel": "^0.1.18-rc.60"` in `dependencies`
 
 ## Key Exports
 
+Everything below is a **root** export — this package has no `./components` or `./helpers`
+subpath. Only auth is split out (see below).
+
+Importing the root also registers the package-owned seven-language `client-panel` bundle. Its
+generic `buttons.submit` fallback is always available after an application imports any root form
+controller; apps may override it through their own `buttons` resource.
+
 | Export | Description |
 |--------|-------------|
-| `components` submodule | Cross-platform panel/form components |
-| `helpers` submodule | Layout / form helpers |
+| `ClientForm` | The form model: `react-hook-form` + an AJV resolver with `coerceTypes` and `ajv-formats`, publishing a `FormContext` and a loader toggle |
+| `FormContext` / `useClientFormContext` | That context, and the hook a renderer reads it with |
+| `useFormI18n()` / `useFormError(name, error?)` | The form's `t`, and a field error resolved to a message — `<field>.errors.<type>` → `errors.<type>` → `lib:errors.<type>`, or `<field>.error` → `lib:errors.form-field` when the error carries no type |
+| `useFormRef<T>()` | The `MutableRefObject<FormRef>` a caller holds to drive a form from outside: `form`, `update`, `loader`, `error` |
+| `InputCtrl` | The headless field controller — resolves `label`/`placeholder`/`hint` from the form namespace when passed `true`, and calls the platform `render` |
+| `ActionCtrl` | The headless submit/action controller — three-tier label lookup (form namespace, the app's `buttons` section, then `client-panel`'s), the loader flag, and the bound `action` |
+| `schemaToFormDefault(schema)` | Initial values derived from an AJV schema, which is what `ClientForm` uses when no `defaults` are given |
+| `PanelContext` / `usePanelHelper()` | Inject `resource`, `ns`, `prefix` or `suppress` into a sub-tree; the parent's values are inherited and overridden field by field |
+| `usePanelI18n(name?, override?)` / `usePanelError(name, error?)` | The panel's `t`, and a `ResilientError` resolved through it |
+| `useStatusMessage(opts)` | `{ message, variant, ok }` for a status surface — a marshalled error's `:` is rewritten to `.` before lookup, so a key written with a colon never matches |
+| `usePanelLayout()` / `useLayoutTitle(name?, alias?)` / `prepareLayoutTitle(title)` | The entrypoint the current layout is rendering, and its translated title |
+| `BlockScaling` | `Full` / `Half` / `Wide` — the sizing vocabulary both platform families render |
+| `usePanelNav(config)` | Headless navigation model behind a two-layer menu |
+| `navLabelHelper` → `.resolveNavLabel`, `.defaultNavLabel`, `.defaultNavTranslate` | Label resolution helpers |
+| `PanelNavConfig`, `PanelNavSection`, `PanelNavItem`, `PanelNavLink`, `PanelNavModel`, `NavTranslate` | Navigation types |
+| `FormProps`, `FormRef`, `FormOnSubmit`, `TFormContext`, `FormFieldProps`, `FormActionProps`, `FormActionRenderArgs`, `InputControllerProps`, `TPanelContext`, `StatusOptions` | The model shapes a renderer is written against |
 
 ## Subpath Exports
 
-- `./auth` — auth-related panel components
-- `./auth/plugins` — pluggable auth panel pieces
+- `./auth` — `useLoginMethods`, `loginProviderHelper` and the login model types
+  (`LoginMethodsModel`, `LoginTermsModel`, `LoginCreditModel`, `LoginProviderConfig`,
+  `LoginProviderModel`, `LoginProviderPlacement`, `UseLoginMethodsOptions`). Importing it also
+  registers this package's own seven-language `client-panel-auth` bundle and the
+  `LoginScreenConfig.provider` augmentation of `@owlmeans/config` by side effect.
+- `./auth/plugins` — the shapes an auth UI plugin is written against: `Ed22519BasicAuthUIPluginForm`
+  and its `Ed22519BasicAuthUIPluginFormSchema`.
+
+`useLoginMethods` is the headless model behind a sign-in screen: which methods are offered, whether
+the terms are confirmed, what the credit line says, and a `select` that is deliberately NOT async
+(the flow may have to open a window inside the click). The rendering lives in `web-panel` — the
+same split the form and navigation models already use. See `login-methods`.
+
+`LoginTermsModel.terms` carries `documents` and `notices` (each `ResolvedTermsDocument[]` from
+`@owlmeans/client-auth/login`) rather than a flat `urls: { terms, privacy, cookies? }` — that field
+is gone; nothing in the repo read it outside this model and its one renderer, so it was dropped
+rather than kept alongside the replacement. It also carries `revisedAt?` and `version`. A renderer
+turns `documents`/`notices` into markup with `loginTermsHelper.termsSentence`
+(`@owlmeans/client-auth/login`), never by re-deriving link/label pairs itself.
+
+`LoginTermsModel.deferred` mirrors `loginTermsHelper.termsDeferred(ctx)`: true once a registered,
+bound `LoginStep` confirms the terms instead of this screen. `LoginMethodsModel.blocked` folds it in
+(`required && !deferred && !accepted`) — a renderer never blocks on `required`/`accepted` alone, or
+it would re-block a screen whose confirmation moved elsewhere.
+
+### The provider disclosure — `LoginMethodsModel.provider`
+
+A sign-in screen that a third party runs for an application (a generated target signing people in
+through the platform's IAM) names both parties: who signs the person in, and on behalf of which
+product. The rules live here, headless, so every renderer discloses the same thing:
+
+- **Config** — `cfg.security.auth.login.provider?: LoginProviderConfig`
+  (`{ name, operator?, info?, placement?: 'top' | 'inline' }`), declared onto `@owlmeans/config`'s
+  `LoginScreenConfig` by module augmentation in `auth/login/provider-config.ts` (the
+  `client-auth/login/terms-config.ts` pattern), never by editing `@owlmeans/config`. The `./auth`
+  barrel re-exports it, so any import of `@owlmeans/client-panel/auth` loads the field; a program
+  that builds the literal without one adds `import type {} from '@owlmeans/client-panel/auth'`.
+- **Model** — `loginProviderHelper.resolve(cfg, brand)` → `LoginProviderModel { name, operator,
+  product, info: string | null, placement }` or `null`. Null unless the provider `name` AND the
+  product (`cfg.brand.name`) are set — a relationship with one party missing is never shown. Blank
+  strings are unset (build-time env arrives as `''`); `operator` defaults to `name`; `placement` to
+  `'inline'` (anything but `'top'` is inline); `info` survives only as an absolute `http(s)` URL or
+  a root-relative path (`//host` and `/\` are refused). `useLoginMethods().provider` carries it.
+- **Copy** — `loginProviderHelper.fill(template, model)` puts `{{provider}}`, `{{operator}}` and
+  `{{product}}` into an ALREADY-TRANSLATED sentence in one pass; names never travel as i18next
+  params. The keys (`login.provider.*`) and the markup belong to `web-panel`.
+- The disclosure is independent of the credit line: `credit.poweredBy: false` never hides who
+  signs a person in.
 
 ## Usage
 
 ```typescript
-import { Panel } from '@owlmeans/client-panel'
-import { LoginPanel } from '@owlmeans/client-panel/auth'
+import { ClientForm, InputCtrl, useFormRef, PanelContext } from '@owlmeans/client-panel'
+import { useLoginMethods } from '@owlmeans/client-panel/auth'
+```
+
+Nothing here renders. A platform package supplies the JSX, and `@owlmeans/web-panel` re-exports
+this package's whole root surface (`export * from '@owlmeans/client-panel'`), so an application can
+reach any of it through the platform package it already imports.
+
+The split is not uniform, and the difference matters when reading a screen:
+
+- **The navigation model is wrapped.** `usePanelNav` has no renderer here; `TopNav`, `SideNav` and
+  `NavLayout` in `@owlmeans/web-panel` are its only rendering, and an app calls those.
+- **The form controllers are used directly.** `ClientForm`, `InputCtrl` and `ActionCtrl` are not
+  wrapped by any platform package: `@owlmeans/web-panel`'s `Form` builds its own `useForm` +
+  `ajvResolver` and takes only `FormContext` and `schemaToFormDefault` from here, its `TextInput`
+  drives `react-hook-form`'s `Controller` itself, and its buttons call `handleSubmit` themselves.
+  An application that wants a form laid out its own way imports the three from this package: it
+  puts its fields inside `ClientForm` and writes the `render` callbacks `InputCtrl` and `ActionCtrl`
+  take.
+
+Read the contracts from the controller you actually use — they differ. `InputCtrl` resolves
+`label`/`placeholder`/`hint` only from a boolean `true` and **drops a string**, while
+`@owlmeans/web-panel`'s `TextInput` honours a string verbatim.
+
+## Navigation model — `usePanelNav`
+
+The **model lives here, the JSX lives in the platform package.** `usePanelNav` is headless and
+cross-platform; `@owlmeans/web-panel` renders it as `TopNav`/`SideNav`/`NavLayout`. Never put a
+rendered menu in this package, and never re-derive active state in a renderer.
+
+Navigation is declared as data. A **section** is the first menu level; its **items** are the screens
+the second level offers while that section is active. An item addresses a frontend entrypoint by
+`alias` and never carries a URL — the router resolves it, so a path that changes shape stays correct
+everywhere it is rendered.
+
+```ts
+import { usePanelNav } from '@owlmeans/client-panel'
+import type { PanelNavConfig } from '@owlmeans/client-panel'
+
+const config: PanelNavConfig = {
+  sections: [
+    { name: 'home', label: 'Home', items: [{ alias: HOME, label: 'Overview' }] },
+    { name: 'demo', items: [{ alias: web.session }, { alias: web.about }] },
+  ],
+}
+
+const model = usePanelNav(config)
 ```
 
-`@owlmeans/web-panel` re-exports these and provides the Material-UI implementations.
+`PanelNavModel` carries `sections` (with `hidden` filtered out), `current` (the active screen's
+alias, or null), `active` (its section), `showSide`, `isSectionActive` / `isItemActive`,
+`goSection` / `goItem` (each returning a handler), and `hrefOf`.
+
+- **`showSide` owns the one-screen rule.** It is false when the active section holds a single
+  screen — a second level offering the page you are already on is noise. A renderer asks the model;
+  it does not count items itself.
+- **Label resolution never touches i18n implicitly.** `NavTranslate` is a
+  `(key, defaultValue) => string` **prop**, defaulting to `navLabelHelper.defaultNavTranslate`,
+  which returns the fallback. An app mounted without an i18n provider (`renderApp` from
+  `@owlmeans/web-client` mounts none) crashes if a menu reaches for the panel i18n context: the hook
+  dereferences `i18n.options` on the empty object `react-i18next` returns without an instance, and a
+  throw inside render blanks the whole app.
+  `navLabelHelper.resolveNavLabel(translate, label, key, alias)` applies the order — literal `label`
+  → `translate(key, humanized)` → `.defaultNavLabel(alias)`, which humanizes the last alias segment
+  (`my-app:web:user-list` → `User list`). Default key families: `nav.<name>` for sections,
+  `modules.<alias>` for items and footer links.
+- **Resolving the current screen needs two sources.** The router's `location.state.alias` is
+  authoritative but is `window.history.state`, so it is null until the first in-app navigation — on
+  a hard page load or a deep link a menu keyed on it alone highlights nothing, on exactly the entry
+  that matters most. The pathname is the fallback: entrypoint paths are matched exactly
+  first, then by longest prefix, so a detail screen under a listed one still belongs to its section.
+  A screen listed in no section resolves its section by walking `route.route.parent` upward.
+- **`hrefOf` gives a menu entry a real URL**, resolved synchronously from
+  `context.entrypoint(protocol).path()` — a protocol composes its path from its own declaration and
+  its ancestors', so matching one is a lookup rather than a guess. It returns undefined for a path
+  carrying route parameters (`:id`) — there is no honest URL for a screen whose address is not
+  known yet. A protocol the app never bound resolves to null and is skipped rather than taking the
+  menu down.
 
 ## Depends On
 
-- `@owlmeans/client`, `@owlmeans/client-auth`, `@owlmeans/client-i18n`
-- `react` (peer)
+- `@owlmeans/client`, `@owlmeans/client-i18n`, `@owlmeans/client-entrypoint`, `@owlmeans/client-route`,
+  `@owlmeans/entrypoint`, `@owlmeans/error`, `@hookform/resolvers`
+- Peers (host-provided): `react`, `react-hook-form`, `ajv`, `@owlmeans/auth`, `@owlmeans/client-auth`,
+  `@owlmeans/config`, `@owlmeans/i18n`, `@owlmeans/router`. No platform UI library — that is the
+  point of the split. (`@owlmeans/auth` and `@owlmeans/client-auth` are marked optional.)
+- `ajv-formats` is imported at module scope by `ClientForm` but is declared in no dependency section
+  of the manifest, which lists `ajv` alone. An install that does not otherwise pull it in fails at
+  import time, so declare `ajv-formats` next to `ajv` in the consuming application.

package/build/auth/i18n/fr.json

@@ -0,0 +1,56 @@
+{
+    "basic-ed25519": {
+        "entityId": {
+            "label": "Identifiant de l’organisation"
+        },
+        "address": {
+            "label": "DID de l’utilisateur"
+        },
+        "privateKey": {
+            "label": "Clé privée"
+        },
+        "submit": "S’authentifier"
+    },
+    "re-captcha": {
+        "guideline": "Nous devons vérifier que vous n’êtes pas un robot. Cliquez dans la case blanche ci-dessous pour prouver que vous êtes humain."
+    },
+    "wallet-provider": {
+        "pin": {
+            "loading": "Chargement…",
+            "guideline": "Utilisez ce code PIN avec toute ressource prenant en charge l’autorisation par portefeuille"
+        }
+    },
+    "wallet-consumer": {
+        "pin": {
+            "label": "Code PIN",
+            "hint": "Scannez le code QR ou générez un code PIN avec votre application OwlMeans ID"
+        },
+        "submit": "Continuer avec le PIN"
+    },
+    "oidp-auth": {
+        "reset": "Réinitialiser",
+        "error": {
+            "socket": {
+                "timeout": {
+                    "rely": "La fenêtre d’authentification a expiré. Actualisez la page pour réessayer."
+                }
+            }
+        }
+    },
+    "oidp-create-id": {
+        "error": {
+            "socket": {
+                "timeout": {
+                    "call": "Délai d’action dépassé. Pour des raisons de sécurité, les actions d’authentification sont limitées dans le temps. Réessayez.",
+                    "rely": "Le code d’authentification a expiré. Réessayez."
+                }
+            },
+            "auth": {
+                "authorization": {
+                    "sequence": "Le processus d’authentification a été interrompu par l’application d’authentification utilisée."
+                }
+            }
+        },
+        "reset": "Actualiser"
+    }
+}

package/build/auth/i18n.js

@@ -1,4 +1,4 @@
-import { addI18nLib } from '@owlmeans/i18n';
+import { i18nHelper } from '@owlmeans/i18n';
 import en from './i18n/en.json' with { type: 'json' };
 import pl from './i18n/pl.json' with { type: 'json' };
 import ru from './i18n/ru.json' with { type: 'json' };
@@ -6,11 +6,13 @@ import be from './i18n/be.json' with { type: 'json' };
 import uk from './i18n/uk.json' with { type: 'json' };
 import es from './i18n/es.json' with { type: 'json' };
 import de from './i18n/de.json' with { type: 'json' };
-addI18nLib('en', 'client-panel-auth', en);
-addI18nLib('pl', 'client-panel-auth', pl);
-addI18nLib('ru', 'client-panel-auth', ru);
-addI18nLib('be', 'client-panel-auth', be);
-addI18nLib('uk', 'client-panel-auth', uk);
-addI18nLib('es', 'client-panel-auth', es);
-addI18nLib('de', 'client-panel-auth', de);
+import fr from './i18n/fr.json' with { type: 'json' };
+i18nHelper.addI18nLib('en', 'client-panel-auth', en);
+i18nHelper.addI18nLib('pl', 'client-panel-auth', pl);
+i18nHelper.addI18nLib('ru', 'client-panel-auth', ru);
+i18nHelper.addI18nLib('be', 'client-panel-auth', be);
+i18nHelper.addI18nLib('uk', 'client-panel-auth', uk);
+i18nHelper.addI18nLib('es', 'client-panel-auth', es);
+i18nHelper.addI18nLib('de', 'client-panel-auth', de);
+i18nHelper.addI18nLib('fr', 'client-panel-auth', fr);
 //# sourceMappingURL=i18n.js.map

package/build/auth/i18n.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/auth/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACzC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA"}
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/auth/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACpD,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA"}

package/build/auth/index.d.ts

@@ -1,2 +1,3 @@
 export * from './i18n.js';
+export * from './login/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA"}

package/build/auth/index.js

@@ -1,2 +1,3 @@
 export * from './i18n.js';
+export * from './login/index.js';
 //# sourceMappingURL=index.js.map

package/build/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA"}

package/build/auth/login/index.d.ts

@@ -0,0 +1,5 @@
+export type * from './types.js';
+export * from './model.js';
+export * from './provider.js';
+export * from './provider-config.js';
+//# sourceMappingURL=index.d.ts.map

package/build/auth/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA"}

package/build/auth/login/index.js

@@ -0,0 +1,4 @@
+export * from './model.js';
+export * from './provider.js';
+export * from './provider-config.js';
+//# sourceMappingURL=index.js.map

package/build/auth/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/login/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,sBAAsB,CAAA"}

package/build/auth/login/model.d.ts

@@ -0,0 +1,10 @@
+import type { LoginMethodsModel, UseLoginMethodsOptions } from './types.js';
+/**
+ * Everything a sign-in screen needs, with no opinion about how it looks.
+ *
+ * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ */
+export declare const useLoginMethods: (opts?: UseLoginMethodsOptions) => LoginMethodsModel;
+//# sourceMappingURL=model.d.ts.map

package/build/auth/login/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAG3E;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAAW,sBAAsB,KAAG,iBAsF/D,CAAA"}

package/build/auth/login/model.js

@@ -0,0 +1,88 @@
+import { useCallback, useMemo, useState } from 'react';
+import { useContext, useNavigate } from '@owlmeans/client';
+import { resolveCredit, LoginOutcome, LOGIN_SERVICE, loginMethodsHelper, loginTermsHelper } from '@owlmeans/client-auth/login';
+import { loginProviderHelper } from './provider.js';
+/**
+ * Everything a sign-in screen needs, with no opinion about how it looks.
+ *
+ * Headless and cross-platform, like `usePanelNav`: the rules about what may be offered, what must
+ * be confirmed first, what the credit line says and who is disclosed as signing the person in are
+ * the same on every platform, and only the rendering differs. A renderer that re-derives any of them will drift from the one that does not.
+ */
+export const useLoginMethods = (opts) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const login = context.service(LOGIN_SERVICE);
+    const cfg = opts?.config ?? context.cfg.security?.auth?.login;
+    const brand = context.cfg.brand;
+    const resolved = useMemo(() => loginTermsHelper.resolveTerms(opts?.terms ?? cfg?.terms), [opts?.terms, cfg]);
+    const credit = useMemo(() => resolveCredit(cfg?.credit, brand, context.cfg.service), [cfg, brand, context]);
+    const provider = useMemo(() => loginProviderHelper.resolve(cfg?.provider, brand), [cfg, brand]);
+    const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved));
+    const [attempted, setAttempted] = useState(false);
+    const [busy, setBusy] = useState(null);
+    const [outcome, setOutcome] = useState(null);
+    const [error, setError] = useState(null);
+    const env = login.env();
+    const all = login.methods({
+        context, env,
+        navigate: (alias, params) => { nav.go(alias, params != null ? { params } : undefined); },
+    });
+    const methods = typeof opts?.methods === 'function'
+        ? opts.methods(all)
+        : opts?.methods ?? all;
+    const deferred = loginTermsHelper.termsDeferred(context);
+    const blocked = resolved != null && resolved.required && !deferred && !accepted;
+    const select = useCallback((method) => {
+        if (blocked) {
+            // Nothing starts, and no window opens. The screen renders the reason instead — which is why
+            // a control must never be `disabled`: a disabled control swallows the click and says nothing.
+            setAttempted(true);
+            return;
+        }
+        setBusy(method.id);
+        setError(null);
+        void method.start({
+            context, env,
+            navigate: (alias, params) => { nav.go(alias, params != null ? { params } : undefined); },
+        }).then(result => {
+            setOutcome(result);
+            // `Redirected` means the browser is leaving; keeping the control busy is honest there.
+            if (result !== LoginOutcome.Redirected) {
+                setBusy(null);
+            }
+        }).catch((e) => {
+            setError(e.message);
+            setOutcome(LoginOutcome.Failed);
+            setBusy(null);
+        });
+    }, [blocked, context, env, nav]);
+    const accept = useCallback((value) => {
+        setAccepted(value);
+        setAttempted(false);
+        loginTermsHelper.acceptTerms(resolved, value);
+    }, [resolved]);
+    return {
+        methods,
+        primary: loginMethodsHelper.primaryLoginMethod(methods),
+        terms: {
+            required: resolved?.required ?? false,
+            accepted: resolved == null ? true : accepted,
+            deferred,
+            attempted,
+            documents: resolved?.documents ?? [],
+            notices: resolved?.notices ?? [],
+            ...(resolved?.revisedAt != null ? { revisedAt: resolved.revisedAt } : {}),
+            version: resolved?.version ?? '',
+            accept,
+        },
+        credit,
+        provider,
+        blocked,
+        busy,
+        outcome,
+        error,
+        select,
+    };
+};
+//# sourceMappingURL=model.js.map

package/build/auth/login/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/login/model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAG9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAA6B,EAAqB,EAAE;IAClF,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAE1D,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5G,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACpF,CAAA;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAE/F,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;KACxF,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAA;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAE/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,4FAA4F;YAC5F,8FAA8F;YAC9F,YAAY,CAAC,IAAI,CAAC,CAAA;YAElB,OAAM;QACR,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,KAAK,CAAC;YAChB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC;SACxF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACf,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,uFAAuF;YACvF,IAAI,MAAM,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO;QACL,OAAO;QACP,OAAO,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE;YACL,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,KAAK;YACrC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC5C,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,EAAE;YACpC,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,EAAE;YAChC,MAAM;SACP;QACD,MAAM;QACN,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,OAAO;QACP,KAAK;QACL,MAAM;KACP,CAAA;AACH,CAAC,CAAA"}

package/build/auth/login/provider/consts.local.d.ts

@@ -0,0 +1,3 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export declare const PROVIDER_PLACEHOLDER: RegExp;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/auth/login/provider/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../../src/auth/login/provider/consts.local.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,QAAyC,CAAA"}

package/build/auth/login/provider/consts.local.js

@@ -0,0 +1,3 @@
+/** The names a provider sentence may carry, matched in one pass. */
+export const PROVIDER_PLACEHOLDER = /\{\{(provider|operator|product)\}\}/g;
+//# sourceMappingURL=consts.local.js.map

package/build/auth/login/provider/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../../src/auth/login/provider/consts.local.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA"}

package/build/auth/login/provider-config.d.ts

@@ -0,0 +1,37 @@
+import type { LoginProviderConfig } from './types.js';
+/**
+ * `LoginScreenConfig.provider`, added by TypeScript module augmentation rather than by editing
+ * `@owlmeans/config` itself.
+ *
+ * `@owlmeans/config` has roughly 85 dependents, and every one of them sits in the same release
+ * closure — a config bump ripples through every package that pins a range against it, whether or
+ * not it touches sign-in. The field below is read by exactly one consumer family (the sign-in
+ * screen's headless model here and its renderers), so it is declared here instead, merged onto the
+ * base interface by TypeScript's own declaration merging — the pattern
+ * `@owlmeans/client-auth/login`'s `terms-config.ts` set.
+ *
+ * This file must be part of whatever a consumer's own compilation actually loads, or the merge
+ * never happens — an ambient augmentation applies only once the compiler has read the file that
+ * declares it. `@owlmeans/client-panel/auth`'s barrel re-exports this module for exactly that
+ * reason, so ANY import from `@owlmeans/client-panel/auth` pulls this augmentation into that
+ * program. An app that builds its `security.auth.login` literal in a file that imports nothing from
+ * it (a config file importing only `@owlmeans/config`) still benefits as long as some other file in
+ * the same `tsc` program does; if none does, add `import type {} from '@owlmeans/client-panel/auth'`
+ * to the file building the literal — an import with an empty type list, kept only to pull this
+ * file into that program's graph.
+ *
+ * `export {}` below is required, not decorative: without at least one top-level import/export this
+ * file is a SCRIPT to TypeScript, not a MODULE, and `declare module '@owlmeans/config'` inside a
+ * script augments the global scope instead of merging onto the named module's exports.
+ */
+declare module '@owlmeans/config' {
+    interface LoginScreenConfig {
+        /**
+         * Who signs a person in on this application's behalf — an identity service the application
+         * does not itself run. Absent, the screen discloses nothing and renders exactly as before.
+         */
+        provider?: LoginProviderConfig;
+    }
+}
+export {};
+//# sourceMappingURL=provider-config.d.ts.map

package/build/auth/login/provider-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config.d.ts","sourceRoot":"","sources":["../../../src/auth/login/provider-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,QAAQ,kBAAkB,CAAC;IAChC,UAAU,iBAAiB;QACzB;;;WAGG;QACH,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B;CACF;AAED,OAAO,EAAG,CAAA"}

package/build/auth/login/provider-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-config.js.map

package/build/auth/login/provider-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config.js","sourceRoot":"","sources":["../../../src/auth/login/provider-config.ts"],"names":[],"mappings":""}