@owlmeans/web-auth 0.1.18-rc.60 → 0.1.18-rc.62

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.47
+npx @owlmeans/agent-skills@^0.1.18-rc.49
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.60",
-  "generatedAt": "2026-10-03T20:05:07.592Z",
+  "version": "0.1.18-rc.62",
+  "generatedAt": "2026-10-05T21:03:06.390Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/web-auth
 
 **Layer:** Web
-**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.60"` in `dependencies`
+**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.62"` in `dependencies`
 
 Web-side auth UI plugins registering into the shared `@owlmeans/client-auth/manager` plugin registry
 (mirroring `@owlmeans/web-oidc-rp`). It ships the **PK supervisor** login form.

package/build/append.d.ts

@@ -1,22 +1,5 @@
-import type { CommonConfig } from '@owlmeans/config';
-export interface WebSupervisorAuthOptions {
-    /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
-    enabled?: boolean;
-    /**
-     * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
-     * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
-     */
-    offer?: boolean;
-}
-interface DebugCarrier {
-    cfg: {
-        debug?: {
-            all?: boolean;
-            supervisor?: boolean;
-        };
-        security?: CommonConfig['security'];
-    };
-}
+import type { DebugCarrier } from './types.local.js';
+import type { WebSupervisorAuthOptions } from './types.js';
 /**
  * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
  * context. It registers the supervisor client plugin so the form is rendered by the standard typed
@@ -24,5 +7,4 @@ interface DebugCarrier {
  * configuration — which is what turns a `restricted` method from registered into offerable.
  */
 export declare const appendSupervisorAuth: <T extends DebugCarrier>(context: T, opts?: WebSupervisorAuthOptions) => T;
-export {};
 //# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAGpD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF;AAcD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,WAChD,CAAC,SAAS,wBAAwB,KAC1C,CAoBF,CAAA"}
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAc1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,WAChD,CAAC,SAAS,wBAAwB,KAC1C,CAoBF,CAAA"}

package/build/append.js.map

@@ -1 +1 @@
-{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAmBrE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAW,EAAE,CACtD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAmB,CAAA;QACvC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;QACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAA;QACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAA;QACrC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAA;QACxB,KAAK,CAAC,SAAS,KAAK,EAAE,CAAA;QACtB,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAIrE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAW,EAAE,CACtD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAmB,CAAA;QACvC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;QACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAA;QACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAA;QACrC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAA;QACxB,KAAK,CAAC,SAAS,KAAK,EAAE,CAAA;QACtB,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/auth/plugins/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA8EpC,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA+EpC,CAAA"}

package/build/auth/plugins/supervisor.js

@@ -3,7 +3,7 @@ import { useState } from 'react';
 import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
 import { useContext } from '@owlmeans/client';
-import { landAfterLogin, landingUrl } from '@owlmeans/client-auth/login';
+import { loginLandingOf } from '@owlmeans/client-auth/login';
 import { makeKeyPairModel } from '@owlmeans/basic-keys';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 /**
@@ -46,8 +46,9 @@ export const supervisorClientPlugin = {
                 // A registered step (marketing consent, say) or a device/authorization-code consent
                 // screen that suspended itself here before sending the browser to sign in both take
                 // priority over the app's own home — `landAfterLogin` is the whole decision.
-                const landing = await landAfterLogin(context);
-                window.location.href = await landingUrl(context, landing);
+                const landings = loginLandingOf(context);
+                const landing = await landings.landAfterLogin();
+                window.location.href = await landings.landingUrl(landing);
             }
             catch (e) {
                 setError(e instanceof Error ? e.message : String(e));

package/build/auth/plugins/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;gBAC7C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/build/index.d.ts

@@ -1,4 +1,5 @@
 export * from './consts.js';
 export * from './append.js';
+export type * from './types.js';
 export { supervisorClientPlugin } from './auth/plugins/supervisor.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,10 @@
+export interface WebSupervisorAuthOptions {
+    /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
+    enabled?: boolean;
+    /**
+     * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+     * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+     */
+    offer?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/build/types.local.d.ts

@@ -0,0 +1,11 @@
+import type { CommonConfig } from '@owlmeans/config';
+export interface DebugCarrier {
+    cfg: {
+        debug?: {
+            all?: boolean;
+            supervisor?: boolean;
+        };
+        security?: CommonConfig['security'];
+    };
+}
+//# sourceMappingURL=types.local.d.ts.map

package/build/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF"}

package/build/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.60",
+  "version": "0.1.18-rc.62",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,24 +29,24 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.38",
-    "@owlmeans/auth-common": "^0.1.18-rc.45",
-    "@owlmeans/basic-ids": "^0.1.18-rc.35",
-    "@owlmeans/basic-keys": "^0.1.18-rc.46",
-    "@owlmeans/client": "^0.1.18-rc.49",
-    "@owlmeans/client-auth": "^0.1.18-rc.56",
-    "@owlmeans/client-flow": "^0.1.18-rc.52",
-    "@owlmeans/config": "^0.1.18-rc.42",
-    "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/web-client": "^0.1.18-rc.59"
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@owlmeans/auth-common": "^0.1.18-rc.47",
+    "@owlmeans/basic-ids": "^0.1.18-rc.37",
+    "@owlmeans/basic-keys": "^0.1.18-rc.48",
+    "@owlmeans/client": "^0.1.18-rc.51",
+    "@owlmeans/client-auth": "^0.1.18-rc.58",
+    "@owlmeans/client-flow": "^0.1.18-rc.54",
+    "@owlmeans/config": "^0.1.18-rc.44",
+    "@owlmeans/context": "^0.1.18-rc.34",
+    "@owlmeans/web-client": "^0.1.18-rc.61"
   },
   "peerDependencies": {
     "react": "*"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.4.0",
-    "@types/react": "^19.2.17",
+    "@types/bun": "^1.4.2",
+    "@types/react": "^19.3.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/append.ts

@@ -2,23 +2,8 @@ import { AuthenticationType } from '@owlmeans/auth'
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
 import type { CommonConfig } from '@owlmeans/config'
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js'
-
-export interface WebSupervisorAuthOptions {
-  /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
-  enabled?: boolean
-  /**
-   * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
-   * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
-   */
-  offer?: boolean
-}
-
-interface DebugCarrier {
-  cfg: {
-    debug?: { all?: boolean, supervisor?: boolean }
-    security?: CommonConfig['security']
-  }
-}
+import type { DebugCarrier } from './types.local.js'
+import type { WebSupervisorAuthOptions } from './types.js'
 
 /**
  * Whether this deployment wants the PK supervisor login.

package/src/auth/plugins/supervisor.tsx

@@ -6,7 +6,7 @@ import type { AuthToken } from '@owlmeans/auth'
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
 import type { AuthService } from '@owlmeans/auth-common'
 import { useContext } from '@owlmeans/client'
-import { landAfterLogin, landingUrl } from '@owlmeans/client-auth/login'
+import { loginLandingOf } from '@owlmeans/client-auth/login'
 import { makeKeyPairModel } from '@owlmeans/basic-keys'
 import { createIdOfLength } from '@owlmeans/basic-ids'
 
@@ -56,8 +56,9 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
         // A registered step (marketing consent, say) or a device/authorization-code consent
         // screen that suspended itself here before sending the browser to sign in both take
         // priority over the app's own home — `landAfterLogin` is the whole decision.
-        const landing = await landAfterLogin(context)
-        window.location.href = await landingUrl(context, landing)
+        const landings = loginLandingOf(context)
+        const landing = await landings.landAfterLogin()
+        window.location.href = await landings.landingUrl(landing)
       } catch (e) {
         setError(e instanceof Error ? e.message : String(e))
         setBusy(false)

package/src/index.ts

@@ -1,3 +1,4 @@
 export * from './consts.js'
 export * from './append.js'
+export type * from './types.js'
 export { supervisorClientPlugin } from './auth/plugins/supervisor.js'

package/src/types.local.ts

@@ -0,0 +1,8 @@
+import type { CommonConfig } from '@owlmeans/config'
+
+export interface DebugCarrier {
+  cfg: {
+    debug?: { all?: boolean, supervisor?: boolean }
+    security?: CommonConfig['security']
+  }
+}

package/src/types.ts

@@ -0,0 +1,9 @@
+export interface WebSupervisorAuthOptions {
+  /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
+  enabled?: boolean
+  /**
+   * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+   * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+   */
+  offer?: boolean
+}

package/tests/supervisor.spec.ts

@@ -0,0 +1,89 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { makeKeyPairModel, keyHelper } from '@owlmeans/basic-keys'
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import type { CommonConfig } from '@owlmeans/config'
+import { appendSupervisorAuth, SUPERVISOR_LOGIN_PATH, supervisorClientPlugin } from '../src/index.js'
+
+type Cfg = { debug?: { all?: boolean, supervisor?: boolean }, security?: CommonConfig['security'] }
+const carrier = (cfg: Cfg = {}) => ({ cfg })
+
+afterEach(() => { delete authPlugins[AuthenticationType.Supervisor] })
+
+describe('appendSupervisorAuth — who gets an operator login', () => {
+  test('nothing is registered unless the deployment asks for the supervisor on purpose', () => {
+    const context = carrier({ debug: { all: true } })
+    appendSupervisorAuth(context)
+
+    expect(authPlugins[AuthenticationType.Supervisor]).toBeUndefined()
+    expect(context.cfg.security).toBeUndefined()
+  })
+
+  test('`debug.supervisor` registers the plugin and offers it on the sign-in screen', () => {
+    const context = carrier({ debug: { supervisor: true } })
+    appendSupervisorAuth(context)
+
+    expect(authPlugins[AuthenticationType.Supervisor]).toBe(supervisorClientPlugin)
+    expect(context.cfg.security?.auth?.login?.secretKey).toBe(true)
+    expect(context.cfg.security?.auth?.login?.overrides?.[AuthenticationType.Supervisor]).toEqual({ enabled: true })
+  })
+
+  test('`offer: false` registers the route without putting it on the screen', () => {
+    const context = carrier()
+    appendSupervisorAuth(context, { enabled: true, offer: false })
+
+    expect(authPlugins[AuthenticationType.Supervisor]).toBe(supervisorClientPlugin)
+    expect(context.cfg.security).toBeUndefined()
+  })
+
+  test('an override the configuration already states is kept', () => {
+    const context = carrier({
+      debug: { supervisor: true },
+      security: { auth: { login: { secretKey: false, overrides: { [AuthenticationType.Supervisor]: { enabled: false } } } } },
+    } as Cfg)
+    appendSupervisorAuth(context)
+
+    expect(context.cfg.security?.auth?.login?.secretKey).toBe(false)
+    expect(context.cfg.security?.auth?.login?.overrides?.[AuthenticationType.Supervisor]).toEqual({ enabled: false })
+  })
+
+  test('the form lives on the standard typed authentication route', () => {
+    expect(SUPERVISOR_LOGIN_PATH).toBe(`/authentication/login/${AuthenticationType.Supervisor}`)
+  })
+})
+
+describe('supervisorClientPlugin — what it sends', () => {
+  test('is a restricted method, shown last as a link', () => {
+    expect(supervisorClientPlugin.type).toBe(AuthenticationType.Supervisor)
+    expect(supervisorClientPlugin.method).toMatchObject({ restricted: true, emphasis: 'link', order: 900 })
+  })
+
+  test('signs the challenge, the user and a fresh salt with the entered key and sends no key', async () => {
+    const key = makeKeyPairModel()
+    const credentials = { userId: 'person@example.com', credential: key.export(), challenge: 'one-time' } as AuthCredentials
+
+    const token = await supervisorClientPlugin.authenticate!(credentials)
+
+    expect(token).toEqual({ token: '' })
+    const packed = JSON.parse(credentials.credential) as { salt: string, signature: string }
+    expect(Object.keys(packed).sort()).toEqual(['salt', 'signature'])
+    expect(packed.salt).toHaveLength(16)
+    expect(credentials.credential).not.toContain(key.export())
+    // Verified the way the server's supervisor plugin verifies it.
+    const verifier = keyHelper.fromPubKey(key.exportPublic())
+    expect(await verifier.verify(buildSupervisorPayload('one-time', 'person@example.com', packed.salt), packed.signature)).toBe(true)
+    expect(await verifier.verify(buildSupervisorPayload('replayed', 'person@example.com', packed.salt), packed.signature)).toBe(false)
+  })
+
+  test('two sign-ins never share a salt', async () => {
+    const key = makeKeyPairModel().export()
+    const salts = await Promise.all([1, 2].map(async () => {
+      const credentials = { userId: 'u', credential: key, challenge: 'c' } as AuthCredentials
+      await supervisorClientPlugin.authenticate!(credentials)
+      return (JSON.parse(credentials.credential) as { salt: string }).salt
+    }))
+
+    expect(salts[0]).not.toBe(salts[1])
+  })
+})