@owlmeans/web-auth-email 0.0.0-stage → 0.1.19

package/build/service.js

@@ -0,0 +1,66 @@
+import { createLazyService } from '@owlmeans/context';
+import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
+import { loginLandingOf } from '@owlmeans/client-auth/login';
+import { EMAIL_LOGIN_SERVICE, EmailAuthError } from '@owlmeans/auth-email';
+import { emailStorageHelper } from './storage.js';
+import { signedInAccount } from './utils/account.js';
+/**
+ * Build the browser-side `EmailLoginClientService` over one protocol tree.
+ *
+ * Every call goes through `ctx.entrypoint(protocol)`, so the application binds the API routes
+ * itself (`bindAll`) — the same split as marketing consent's client.
+ */
+export const makeEmailLoginClient = (protocols, opts = {}) => {
+    const alias = opts.alias ?? EMAIL_LOGIN_SERVICE;
+    let options = null;
+    let screen = opts.screen ?? null;
+    const ctx = () => service.assertCtx(alias);
+    const service = createLazyService(alias, {
+        protocols: () => protocols,
+        options: async (request) => {
+            if (request?.fresh !== true && options != null) {
+                return options;
+            }
+            options = await ctx().entrypoint(protocols.options).call({});
+            return options;
+        },
+        sendPin: async (request) => await ctx().entrypoint(protocols.pin).call({ body: request }),
+        signIn: async (request) => await ctx().entrypoint(protocols.signIn).call({ body: request }),
+        complete: async (view) => {
+            if (view.token == null || view.token === '') {
+                throw new EmailAuthError('answer');
+            }
+            const context = ctx();
+            await context.service(AUTH_SERVICE).authenticate({ token: view.token });
+            // Kept AFTER the token is adopted, so the ticket names the account it belongs to and a sign-in
+            // that failed keeps nothing. Any older ticket is dropped by the sign-in that does not bring one.
+            if (view.offer != null && view.offer !== '') {
+                emailStorageHelper.keepOffer(view.offer, signedInAccount(context));
+            }
+            else {
+                emailStorageHelper.dropOffer();
+            }
+            // The supervisor and Google plugins land the same way: a full load of the landing, which
+            // inside a surrogate window is the dispatcher that hands the session back to the opener.
+            const landings = loginLandingOf(context);
+            const landing = await landings.landAfterLogin();
+            window.location.href = await landings.landingUrl(landing);
+        },
+        passwordStatus: async () => await ctx().entrypoint(protocols.password.status).call({}),
+        passwordPin: async (request) => await ctx().entrypoint(protocols.password.pin).call({ body: request }),
+        setPassword: async (request) => await ctx().entrypoint(protocols.password.set).call({ body: request }),
+        removePassword: async (request) => await ctx().entrypoint(protocols.password.remove).call({ body: request }),
+        declinePassword: async () => await ctx().entrypoint(protocols.password.decline).call({ body: {} }),
+        screen: () => screen,
+        registerScreen: next => { screen = next; },
+    });
+    return service;
+};
+/** Register the client service, unless the application already registered its own under the alias. */
+export const appendEmailLoginClient = (context, protocols, opts = {}) => {
+    const alias = opts.alias ?? EMAIL_LOGIN_SERVICE;
+    if (!context.hasService(alias)) {
+        context.registerService(makeEmailLoginClient(protocols, opts));
+    }
+};
+//# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAKpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAA+B,EAAE,IAAI,GAAgC,EAAE,EAC9C,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAA;IAE/C,IAAI,OAAO,GAAgC,IAAI,CAAA;IAC/C,IAAI,MAAM,GAAqC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAA;IAElE,MAAM,GAAG,GAAG,GAA4B,EAAE,CACxC,OAAO,CAAC,SAAS,CAAwC,KAAK,CAAC,CAAA;IAEjE,MAAM,OAAO,GAA4B,iBAAiB,CAA0B,KAAK,EAAE;QACzF,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;QAE1B,OAAO,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACvB,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAE5D,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,OAAO,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAEvF,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAEzF,QAAQ,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACrB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;YACpC,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAA;YACrB,MAAM,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YAEpF,+FAA+F;YAC/F,iGAAiG;YACjG,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC5C,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;YACpE,CAAC;iBAAM,CAAC;gBACN,kBAAkB,CAAC,SAAS,EAAE,CAAA;YAChC,CAAC;YAED,yFAAyF;YACzF,yFAAyF;YACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;YAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAEtF,WAAW,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAEpG,WAAW,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAEpG,cAAc,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAE1G,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAElG,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;QAEpB,cAAc,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,CAAA,CAAC,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAAgC,EAAE,SAA+B,EAAE,IAAI,GAAgC,EAAE,EACnG,EAAE;IACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAA;IAC/C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IAChE,CAAC;AACH,CAAC,CAAA"}

package/build/state/types.d.ts

@@ -0,0 +1,90 @@
+import type { EmailAuthOptionsView } from '@owlmeans/auth-email';
+import type { EmailRefusal } from '../refusal/types.js';
+/** Which part of the form is showing. `done` = signed in, the browser is leaving. */
+export type EmailLoginStep = 'email' | 'pin' | 'password' | 'done';
+/** The call in flight: mailing a PIN, or signing in (PIN or password). */
+export type EmailLoginBusy = 'send' | 'sign-in';
+/** Why the PIN step is up: a code was asked for, or a password sign-in met an unknown device. */
+export type EmailLoginNotice = 'sent' | 'device';
+/** The whole e-mail sign-in form, as a plain value. */
+export interface EmailLoginState {
+    step: EmailLoginStep;
+    email: string;
+    pin: string;
+    password: string;
+    /** The password field shows what was typed. */
+    reveal: boolean;
+    /** The signed challenge of the PIN mailed last; null until one is. */
+    challenge: string | null;
+    notice: EmailLoginNotice | null;
+    busy: EmailLoginBusy | null;
+    refusal: EmailRefusal | null;
+    /** What the deployment offers; null until `GET options` answered. */
+    options: EmailAuthOptionsView | null;
+    /** The options read failed — the form still works, and the next send asks again. */
+    optionsFailed: boolean;
+}
+/** Everything that changes the form. */
+export type EmailLoginAction = {
+    type: 'options';
+    options: EmailAuthOptionsView;
+} | {
+    type: 'options-failed';
+} | {
+    type: 'email';
+    value: string;
+} | {
+    type: 'pin';
+    value: string;
+} | {
+    type: 'password';
+    value: string;
+} | {
+    type: 'reveal';
+    value: boolean;
+} | {
+    type: 'choose-password';
+} | {
+    type: 'choose-pin';
+} | {
+    type: 'change-email';
+} | {
+    type: 'start';
+    busy: EmailLoginBusy;
+} | {
+    type: 'sent';
+    challenge: string;
+} | {
+    type: 'device';
+    challenge: string;
+} | {
+    type: 'signed-in';
+} | {
+    type: 'refused';
+    refusal: EmailRefusal;
+};
+/**
+ * The e-mail sign-in form as pure transitions — what `useEmailLogin` runs through `useReducer`, and
+ * what a replacement screen or a test can drive without a DOM.
+ */
+export interface EmailLoginStateHelper {
+    /** The empty form on its e-mail step. */
+    initial: (email?: string) => EmailLoginState;
+    /** The next form after `action`. Never mutates `state`. */
+    reduce: (state: EmailLoginState, action: EmailLoginAction) => EmailLoginState;
+    /** A plausible address: one `@`, a dotted domain, no spaces, within the wire bound. */
+    validEmail: (email: string) => boolean;
+    /** The address as it is sent: trimmed and lowercased. */
+    normalizeEmail: (email: string) => string;
+    /** Digits in a PIN — the deployment's own when known. */
+    pinLength: (state: EmailLoginState) => number;
+    /** Password sign-in is offered here. */
+    passwordOffered: (state: EmailLoginState) => boolean;
+    /** What stops "send a PIN" right now (the address), or null when it may go. */
+    sendBlock: (state: EmailLoginState) => EmailRefusal | null;
+    /** What stops "sign in with the PIN" right now, or null when it may go. */
+    verifyBlock: (state: EmailLoginState) => EmailRefusal | null;
+    /** What stops a password sign-in right now, or null when it may go. */
+    signInBlock: (state: EmailLoginState) => EmailRefusal | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/state/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/state/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,qFAAqF;AACrF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAA;AAElE,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,CAAA;AAE/C,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEhD,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,+CAA+C;IAC/C,MAAM,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAC3B,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAC5B,qEAAqE;IACrE,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAA;IACpC,oFAAoF;IACpF,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAA;AAE9C;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,yCAAyC;IACzC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAA;IAC5C,2DAA2D;IAC3D,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,KAAK,eAAe,CAAA;IAC7E,uFAAuF;IACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;IACtC,yDAAyD;IACzD,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,yDAAyD;IACzD,SAAS,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAA;IAC7C,wCAAwC;IACxC,eAAe,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAA;IACpD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,YAAY,GAAG,IAAI,CAAA;IAC1D,2EAA2E;IAC3E,WAAW,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,YAAY,GAAG,IAAI,CAAA;IAC5D,uEAAuE;IACvE,WAAW,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,YAAY,GAAG,IAAI,CAAA;CAC7D"}

package/build/state/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/state/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/state/types.ts"],"names":[],"mappings":""}

package/build/state.d.ts

@@ -0,0 +1,4 @@
+import type { EmailLoginStateHelper } from './state/types.js';
+export declare const createEmailLoginStateHelper: () => EmailLoginStateHelper;
+export declare const emailLoginStateHelper: EmailLoginStateHelper;
+//# sourceMappingURL=state.d.ts.map

package/build/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAqC,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAEhG,eAAO,MAAM,2BAA2B,QAAO,qBA4G9C,CAAA;AAED,eAAO,MAAM,qBAAqB,uBAAgC,CAAA"}

package/build/state.js

@@ -0,0 +1,98 @@
+import { EMAIL_ADDRESS_MAX_LENGTH, EMAIL_PIN_LENGTH } from '@owlmeans/auth-email';
+export const createEmailLoginStateHelper = () => {
+    const address = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    const initial = (email = '') => ({
+        step: 'email', email, pin: '', password: '', reveal: false, challenge: null, notice: null,
+        busy: null, refusal: null, options: null, optionsFailed: false,
+    });
+    const normalizeEmail = (email) => email.trim().toLowerCase();
+    const validEmail = (email) => {
+        const value = normalizeEmail(email);
+        return value.length <= EMAIL_ADDRESS_MAX_LENGTH && address.test(value);
+    };
+    const pinLength = (state) => state.options?.pinLength ?? EMAIL_PIN_LENGTH;
+    const passwordOffered = (state) => state.options?.password === true;
+    const sendBlock = (state) => validEmail(state.email) ? null : { kind: 'email' };
+    const verifyBlock = (state) => {
+        if (state.challenge == null) {
+            // Nothing was mailed for this form yet — the person has to ask for a code first.
+            return { kind: 'code' };
+        }
+        return new RegExp(`^[0-9]{${pinLength(state)}}$`).test(state.pin) ? null : { kind: 'pin-format' };
+    };
+    const signInBlock = (state) => {
+        if (!validEmail(state.email)) {
+            return { kind: 'email' };
+        }
+        if (!passwordOffered(state)) {
+            return { kind: 'password-disabled' };
+        }
+        return state.password === '' ? { kind: 'password-empty' } : null;
+    };
+    const reduce = (state, action) => {
+        switch (action.type) {
+            case 'options':
+                return {
+                    ...state, options: action.options, optionsFailed: false,
+                    // The deployment turned passwords off under an open password step: back to the code.
+                    ...(state.step === 'password' && action.options.password !== true
+                        ? { step: 'email', password: '', reveal: false } : {}),
+                };
+            case 'options-failed':
+                return { ...state, optionsFailed: true };
+            case 'email':
+                return state.step === 'done' ? state : { ...state, email: action.value, refusal: null };
+            case 'pin':
+                return state.step === 'done' ? state : {
+                    ...state, pin: action.value.replace(/\D/g, '').slice(0, pinLength(state)), refusal: null,
+                };
+            case 'password':
+                return state.step === 'done' ? state : { ...state, password: action.value, refusal: null };
+            case 'reveal':
+                return { ...state, reveal: action.value };
+            case 'choose-password':
+                return state.busy != null || !passwordOffered(state) || state.step === 'done' ? state : {
+                    ...state, step: 'password', pin: '', notice: null, refusal: null,
+                };
+            case 'choose-pin':
+                return state.busy != null || state.step === 'done' ? state : {
+                    ...state, step: 'email', password: '', reveal: false, refusal: null,
+                };
+            case 'change-email':
+                return state.busy != null || state.step === 'done' ? state : {
+                    ...state, step: 'email', pin: '', password: '', reveal: false, challenge: null, notice: null, refusal: null,
+                };
+            case 'start':
+                return state.busy != null || state.step === 'done' ? state : { ...state, busy: action.busy, refusal: null };
+            case 'sent':
+                return { ...state, step: 'pin', challenge: action.challenge, notice: 'sent', pin: '', busy: null, refusal: null };
+            case 'device':
+                // A password sign-in on a device the account does not know: the password was NOT checked,
+                // a PIN was mailed instead, and the password is not kept around for later.
+                return {
+                    ...state, step: 'pin', challenge: action.challenge, notice: 'device', pin: '', password: '',
+                    reveal: false, busy: null, refusal: null,
+                };
+            case 'signed-in':
+                // Nothing secret stays in the form while the browser is leaving.
+                return { ...state, step: 'done', pin: '', password: '', reveal: false, busy: null, refusal: null };
+            case 'refused':
+                return {
+                    ...state,
+                    // Completing a sign-in failed after the answer: the person starts over from the address.
+                    ...(state.step === 'done' ? { step: 'email', challenge: null, notice: null } : {}),
+                    busy: null,
+                    refusal: action.refusal,
+                    ...(action.refusal.kind === 'code' ? { pin: '' } : {}),
+                    ...(action.refusal.kind === 'credentials' ? { password: '' } : {}),
+                };
+            default:
+                return state;
+        }
+    };
+    return {
+        initial, reduce, validEmail, normalizeEmail, pinLength, passwordOffered, sendBlock, verifyBlock, signInBlock,
+    };
+};
+export const emailLoginStateHelper = createEmailLoginStateHelper();
+//# sourceMappingURL=state.js.map

package/build/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAIjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAA0B,EAAE;IACrE,MAAM,OAAO,GAAG,4BAA4B,CAAA;IAE5C,MAAM,OAAO,GAAG,CAAC,KAAK,GAAW,EAAE,EAAmB,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;QACzF,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK;KAC/D,CAAC,CAAA;IAEF,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAE5E,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE;QAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAEnC,OAAO,KAAK,CAAC,MAAM,IAAI,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxE,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,gBAAgB,CAAA;IAElG,MAAM,eAAe,GAAG,CAAC,KAAsB,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAA;IAE7F,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAuB,EAAE,CAChE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAEpD,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAuB,EAAE;QAClE,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC5B,iFAAiF;YACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,IAAI,MAAM,CAAC,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IACnG,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAuB,EAAE;QAClE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QAC1B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QACtC,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAmB,EAAE;QACnF,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,SAAS;gBACZ,OAAO;oBACL,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK;oBACvD,qFAAqF;oBACrF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;wBAC/D,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAA;YACH,KAAK,gBAAgB;gBACnB,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;YAC1C,KAAK,OAAO;gBACV,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACzF,KAAK,KAAK;gBACR,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrC,GAAG,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI;iBACzF,CAAA;YACH,KAAK,UAAU;gBACb,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YAC5F,KAAK,QAAQ;gBACX,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;YAC3C,KAAK,iBAAiB;gBACpB,OAAO,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBACtF,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;iBACjE,CAAA;YACH,KAAK,YAAY;gBACf,OAAO,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;iBACpE,CAAA;YACH,KAAK,cAAc;gBACjB,OAAO,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;iBAC5G,CAAA;YACH,KAAK,OAAO;gBACV,OAAO,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YAC7G,KAAK,MAAM;gBACT,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACnH,KAAK,QAAQ;gBACX,0FAA0F;gBAC1F,2EAA2E;gBAC3E,OAAO;oBACL,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;oBAC3F,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;iBACzC,CAAA;YACH,KAAK,WAAW;gBACd,iEAAiE;gBACjE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACpG,KAAK,SAAS;gBACZ,OAAO;oBACL,GAAG,KAAK;oBACR,yFAAyF;oBACzF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,IAAI,EAAE,IAAI;oBACV,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnE,CAAA;YACH;gBACE,OAAO,KAAK,CAAA;QAChB,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW;KAC7G,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,EAAE,CAAA"}

package/build/step.d.ts

@@ -0,0 +1,16 @@
+import type { LoginStep } from '@owlmeans/client-auth/login';
+import type { EmailStorageHelper } from './storage/types.js';
+import type { EmailLoginClientService } from './types.js';
+/**
+ * The post-sign-in "set a password" step.
+ *
+ * Pending only while BOTH hold: this tab keeps an offer ticket from a fresh PIN sign-in (unexpired,
+ * this account's), and the account's password status still says enabled, unset and not declined.
+ * A ticket the status no longer allows is forgotten on the spot. Optional: a status read that throws
+ * or hangs is "not pending" (the login host fails open), so a broken read never blocks a sign-in.
+ *
+ * Its priority sits below the marketing-consent step, so a Terms confirmation and the consent
+ * choices come first.
+ */
+export declare const emailOfferStep: (client: Pick<EmailLoginClientService, 'passwordStatus'>, entrypointAlias: string, storage?: EmailStorageHelper) => LoginStep;
+//# sourceMappingURL=step.d.ts.map

package/build/step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../src/step.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAG5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAGzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,WACjB,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,mBAAmB,MAAM,YACvE,kBAAkB,KAC1B,SAgBD,CAAA"}

package/build/step.js

@@ -0,0 +1,31 @@
+import { EMAIL_OFFER_LOGIN_STEP, EMAIL_OFFER_STEP_PRIORITY } from './consts.js';
+import { emailStorageHelper } from './storage.js';
+import { signedInAccount } from './utils/account.js';
+/**
+ * The post-sign-in "set a password" step.
+ *
+ * Pending only while BOTH hold: this tab keeps an offer ticket from a fresh PIN sign-in (unexpired,
+ * this account's), and the account's password status still says enabled, unset and not declined.
+ * A ticket the status no longer allows is forgotten on the spot. Optional: a status read that throws
+ * or hangs is "not pending" (the login host fails open), so a broken read never blocks a sign-in.
+ *
+ * Its priority sits below the marketing-consent step, so a Terms confirmation and the consent
+ * choices come first.
+ */
+export const emailOfferStep = (client, entrypointAlias, storage = emailStorageHelper) => ({
+    alias: EMAIL_OFFER_LOGIN_STEP,
+    priority: EMAIL_OFFER_STEP_PRIORITY,
+    entrypoint: entrypointAlias,
+    pending: async (ctx) => {
+        if (storage.offer(signedInAccount(ctx)) == null) {
+            return false;
+        }
+        const status = await client.passwordStatus();
+        if (status.enabled && !status.set && !status.declined) {
+            return true;
+        }
+        storage.dropOffer();
+        return false;
+    },
+});
+//# sourceMappingURL=step.js.map

package/build/step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step.js","sourceRoot":"","sources":["../src/step.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAuD,EAAE,eAAuB,EAChF,OAAO,GAAuB,kBAAkB,EACrC,EAAE,CAAC,CAAC;IACf,KAAK,EAAE,sBAAsB;IAC7B,QAAQ,EAAE,yBAAyB;IACnC,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;QACnB,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAChD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAA;QAC5C,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,CAAC,SAAS,EAAE,CAAA;QAEnB,OAAO,KAAK,CAAA;IACd,CAAC;CACF,CAAC,CAAA"}

package/build/storage/types.d.ts

@@ -0,0 +1,42 @@
+/** The part of a Web Storage this package uses. */
+export interface EmailStorageArea extends Pick<Storage, 'getItem' | 'setItem' | 'removeItem'> {
+}
+export interface EmailStorageHelperOptions {
+    /** Where the device id lives. Default: `window.localStorage`, or nothing when it is unavailable. */
+    local?: () => EmailStorageArea | null;
+    /** Where the offer ticket waits. Default: `window.sessionStorage`, or nothing when it is unavailable. */
+    session?: () => EmailStorageArea | null;
+    /** `count` random bytes. Default: `crypto.getRandomValues`. */
+    random?: (count: number) => Uint8Array;
+    /** The clock, in milliseconds. Default: `Date.now`. */
+    now?: () => number;
+}
+/** The offer ticket as it is kept — with the account it was issued to and when it stops counting. */
+export interface StoredEmailOffer {
+    ticket: string;
+    owner?: string;
+    expiresAt: number;
+}
+/**
+ * What a browser keeps for e-mail sign-in: its device id, and a fresh PIN sign-in's offer ticket.
+ *
+ * Every storage access tolerates a browser that refuses site data (private modes, blocked
+ * storage): the device id then lives for the page alone, and no offer is shown.
+ */
+export interface EmailStorageHelper {
+    /**
+     * This browser's device id — 16 random bytes, base64url (22 characters). Created on first use and
+     * kept in `localStorage`; without storage, one id for as long as this page lives.
+     */
+    deviceId: () => string;
+    /**
+     * The waiting offer ticket, or null — also when it has expired, or was issued to another account
+     * than `owner` (when both are known).
+     */
+    offer: (owner?: string) => string | null;
+    /** Keep a PIN sign-in's offer ticket for the offer step, until `EMAIL_OFFER_TTL_SECONDS` pass. */
+    keepOffer: (ticket: string, owner?: string) => void;
+    /** Forget the offer ticket — it was used, declined, or cannot be used any more. */
+    dropOffer: () => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/storage/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;CAAG;AAEhG,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAA;IACrC,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAA;IACvC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,CAAA;IACtC,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,qGAAqG;AACrG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,EAAE,MAAM,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACxC,kGAAkG;IAClG,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACnD,mFAAmF;IACnF,SAAS,EAAE,MAAM,IAAI,CAAA;CACtB"}

package/build/storage/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/storage/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":""}

package/build/storage.d.ts

@@ -0,0 +1,4 @@
+import type { EmailStorageHelper, EmailStorageHelperOptions } from './storage/types.js';
+export declare const createEmailStorageHelper: (opts?: EmailStorageHelperOptions) => EmailStorageHelper;
+export declare const emailStorageHelper: EmailStorageHelper;
+//# sourceMappingURL=storage.d.ts.map

package/build/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACQ,kBAAkB,EAAE,yBAAyB,EAChE,MAAM,oBAAoB,CAAA;AAW3B,eAAO,MAAM,wBAAwB,UAAU,yBAAyB,KAAQ,kBA+F/E,CAAA;AAED,eAAO,MAAM,kBAAkB,oBAA6B,CAAA"}

package/build/storage.js

@@ -0,0 +1,100 @@
+import { EMAIL_DEVICE_ID_PATTERN, EMAIL_OFFER_TTL_SECONDS } from '@owlmeans/auth-email';
+import { EMAIL_DEVICE_ID_BYTES, EMAIL_DEVICE_STORAGE, EMAIL_OFFER_STORAGE } from './consts.js';
+/** A storage area of the page, or null where there is no page or the browser refuses it. */
+const areaOf = (name) => () => {
+    try {
+        return typeof window !== 'undefined' ? window[name] ?? null : null;
+    }
+    catch {
+        return null;
+    }
+};
+export const createEmailStorageHelper = (opts = {}) => {
+    const local = opts.local ?? areaOf('localStorage');
+    const session = opts.session ?? areaOf('sessionStorage');
+    const random = opts.random ?? ((count) => crypto.getRandomValues(new Uint8Array(count)));
+    const now = opts.now ?? (() => Date.now());
+    const valid = new RegExp(EMAIL_DEVICE_ID_PATTERN);
+    /** The id of this page when the browser keeps nothing — still one id, not one per request. */
+    let ephemeral = null;
+    const base64url = (bytes) => {
+        let binary = '';
+        for (const byte of bytes) {
+            binary += String.fromCharCode(byte);
+        }
+        return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    };
+    const read = (area, key) => {
+        try {
+            return area?.getItem(key) ?? null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const write = (area, key, value) => {
+        if (area == null) {
+            return false;
+        }
+        try {
+            if (value == null) {
+                area.removeItem(key);
+            }
+            else {
+                area.setItem(key, value);
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const deviceId = () => {
+        const area = local();
+        const stored = read(area, EMAIL_DEVICE_STORAGE);
+        if (stored != null && valid.test(stored)) {
+            return stored;
+        }
+        if (ephemeral != null) {
+            return ephemeral;
+        }
+        const created = base64url(random(EMAIL_DEVICE_ID_BYTES));
+        if (!write(area, EMAIL_DEVICE_STORAGE, created)) {
+            ephemeral = created;
+        }
+        return created;
+    };
+    const offer = (owner) => {
+        const raw = read(session(), EMAIL_OFFER_STORAGE);
+        if (raw == null) {
+            return null;
+        }
+        let stored = null;
+        try {
+            stored = JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+        if (typeof stored?.ticket !== 'string' || stored.ticket === ''
+            || typeof stored.expiresAt !== 'number' || stored.expiresAt <= now()) {
+            return null;
+        }
+        if (owner != null && stored.owner != null && stored.owner !== owner) {
+            return null;
+        }
+        return stored.ticket;
+    };
+    const keepOffer = (ticket, owner) => {
+        const stored = {
+            ticket, ...(owner != null ? { owner } : {}), expiresAt: now() + EMAIL_OFFER_TTL_SECONDS * 1000,
+        };
+        write(session(), EMAIL_OFFER_STORAGE, JSON.stringify(stored));
+    };
+    const dropOffer = () => {
+        write(session(), EMAIL_OFFER_STORAGE, null);
+    };
+    return { deviceId, offer, keepOffer, dropOffer };
+};
+export const emailStorageHelper = createEmailStorageHelper();
+//# sourceMappingURL=storage.js.map

package/build/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAK9F,4FAA4F;AAC5F,MAAM,MAAM,GAAG,CAAC,IAAuC,EAAE,EAAE,CAAC,GAA4B,EAAE;IACxF,IAAI,CAAC;QACH,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAI,GAA8B,EAAE,EAAsB,EAAE;IACnG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,cAAc,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,uBAAuB,CAAC,CAAA;IAEjD,8FAA8F;IAC9F,IAAI,SAAS,GAAkB,IAAI,CAAA;IAEnC,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE;QAC9C,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,GAAW,EAAiB,EAAE;QACzE,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,IAA6B,EAAE,GAAW,EAAE,KAAoB,EAAW,EAAE;QAC1F,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC;YACH,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC1B,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,GAAW,EAAE;QAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAA;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;QAC/C,IAAI,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,CAAC;YAChD,SAAS,GAAG,OAAO,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,KAAc,EAAiB,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAA;QAChD,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,MAAM,GAAqC,IAAI,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;eACzD,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;YACvE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACpE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAA;IACtB,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,KAAc,EAAQ,EAAE;QACzD,MAAM,MAAM,GAAqB;YAC/B,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,uBAAuB,GAAG,IAAI;SAC/F,CAAA;QACD,KAAK,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,KAAK,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAA;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AAClD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,102 @@
+import type { ComponentType } from 'react';
+import type { LazyService } from '@owlmeans/context';
+import type { ClientConfig, ClientContext } from '@owlmeans/client-context';
+import type { AuthMethodMeta } from '@owlmeans/client-auth/manager/plugins';
+import type { LoginScreenProps } from '@owlmeans/client-auth/login';
+import type { EmailAuthEntrypoints, EmailAuthOptionsView, EmailChallengeView, EmailPasswordPinRequest, EmailPasswordRemoveRequest, EmailPasswordSetRequest, EmailPasswordStatusView, EmailPinRequest, EmailSignInRequest, EmailSignInView } from '@owlmeans/auth-email';
+/**
+ * `(key, defaultValue) => string` — this package's own translator, or an application's.
+ *
+ * Keys are this package's (`login.title`, `error.code`, …, resource `auth-email`); the default is
+ * the English text. Placeholders such as `{{email}}` are filled by the component, so a translator
+ * returns the sentence as it is.
+ */
+export interface Translate {
+    (key: string, defaultValue: string): string;
+}
+/**
+ * How an application dresses the e-mail sign-in card — the same props the chooser card
+ * (`@owlmeans/web-panel`'s `LoginScreen`) takes for the same purpose.
+ */
+export interface EmailLoginScreenSetup extends Pick<LoginScreenProps, 'Logo' | 'title' | 'subtitle' | 'footer' | 'className' | 'containerClassName' | 'style' | 'locale' | 'translate'> {
+}
+export interface EmailLoginScreenProps extends EmailLoginScreenSetup {
+}
+export type EmailLoginScreenComponent = ComponentType<EmailLoginScreenProps>;
+export interface EmailLoginAppendOptions {
+    /**
+     * From `makeEmailAuthProtocols(...)` — the tree the application also binds with `bindAll` (the
+     * API routes) and `emailAuthEntrypoints` (the offer screen).
+     */
+    protocols: EmailAuthEntrypoints;
+    /** Logo, copy and classes of the e-mail card; merged under the props a host passes itself. */
+    screen?: EmailLoginScreenSetup;
+    /**
+     * How the method presents itself on the chooser, merged over `EMAIL_LOGIN_METHOD_META`.
+     * `available` is always this package's own (the client service is registered).
+     */
+    method?: Partial<AuthMethodMeta>;
+    /** Register the post-sign-in "set a password" step. Default `true`. */
+    offer?: boolean;
+}
+export type EmailLoginClientContext = ClientContext<ClientConfig>;
+/**
+ * The browser side of e-mail sign-in, registered as `EMAIL_LOGIN_SERVICE` by `appendEmailLogin`.
+ *
+ * A thin transport over the protocol tree: every call rejects with the error its route answered,
+ * and the caller phrases it (`emailRefusalHelper`). Nothing here swallows a failure.
+ */
+export interface EmailLoginClientService extends LazyService {
+    /** The protocol tree the service calls. */
+    protocols: () => EmailAuthEntrypoints;
+    /** `GET options`, cached after the first success; `fresh` asks again. */
+    options: (opts?: {
+        fresh?: boolean;
+    }) => Promise<EmailAuthOptionsView>;
+    /** `POST pin` — mail a sign-in PIN. */
+    sendPin: (request: EmailPinRequest) => Promise<EmailChallengeView>;
+    /** `POST sign-in` — PIN mode or password mode. */
+    signIn: (request: EmailSignInRequest) => Promise<EmailSignInView>;
+    /**
+     * Finish a signed-in answer the way every self-contained plugin does: adopt the token through the
+     * client auth service, keep the offer ticket (when one came) for the offer step, then land with
+     * `loginLandingOf(ctx).landAfterLogin()` — a pending step, a parked target, else home; inside a
+     * surrogate window the dispatcher, which hands the session to the opener.
+     *
+     * @throws when the answer carries no token, or the token is refused.
+     */
+    complete: (view: EmailSignInView) => Promise<void>;
+    /** `GET password` — the signed-in account's password state. */
+    passwordStatus: () => Promise<EmailPasswordStatusView>;
+    /** `POST password/pin` — mail a confirmation PIN to the account's own address. */
+    passwordPin: (request: EmailPasswordPinRequest) => Promise<EmailChallengeView>;
+    /** `POST password/set`. */
+    setPassword: (request: EmailPasswordSetRequest) => Promise<EmailPasswordStatusView>;
+    /** `POST password/remove`. */
+    removePassword: (request: EmailPasswordRemoveRequest) => Promise<EmailPasswordStatusView>;
+    /** `POST password/decline` — "Not now" on the offer. */
+    declinePassword: () => Promise<EmailPasswordStatusView>;
+    /** The screen the e-mail route renders; null = the package's own. */
+    screen: () => EmailLoginScreenComponent | null;
+    /** Replace the screen the e-mail route renders (`registerEmailLoginScreen`). */
+    registerScreen: (screen: EmailLoginScreenComponent) => void;
+}
+export interface MakeEmailLoginClientOptions {
+    alias?: string;
+    /** The screen the e-mail route renders until another is registered. */
+    screen?: EmailLoginScreenComponent;
+}
+/**
+ * The entrypoint aliases `usePassword` addresses.
+ *
+ * By default those of the tree given to `appendEmailLogin`, else the `EMAIL_AUTH_PASSWORD_*` aliases
+ * `makeEmailAuthProtocols` declares — an application that mounted the password routes under its own
+ * aliases (a facade in front of them, say) passes its own here.
+ */
+export interface EmailPasswordAliases {
+    status: string;
+    pin: string;
+    set: string;
+    remove: string;
+}
+//# sourceMappingURL=types.d.ts.map