@owlmeans/web-auth 0.1.18-rc.9 → 0.1.18

package/README.md

@@ -1,3 +1,163 @@
+# @owlmeans/web-auth
+
+Web-side authentication plugins that register into the shared `@owlmeans/client-auth/manager`
+plugin registry. Today it ships one plugin: the development-only **PK supervisor** login form, where
+a holder of one of the project's trusted private keys signs a server challenge to sign in as any
+user id or email. A web client uses it to give end-to-end tests and operators a deterministic way in
+on development and staging deployments. It is not a general sign-in package: regular login methods
+come from `@owlmeans/client-auth` and its plugin packages (`@owlmeans/web-oidc-rp` for OIDC), and
+the server half of the supervisor login — signature verification and user resolution — lives in
+`@owlmeans/server-auth/manager`. The whole feature is described by the `supervisor-auth` skill; this
+package by the `web-auth` skill.
+
+## Installation
+
+```bash
+bun add @owlmeans/web-auth@^0.1.18
+```
+
+`react` is a peer dependency.
+
+## Concepts
+
+- **Supervisor login** — `AuthenticationType.Supervisor` (`'pk-supervisor'`) from `@owlmeans/auth`.
+  The browser signs `buildSupervisorPayload(challenge, userId, salt)` with an entered private key;
+  the server checks the signature against its trusted public keys and issues a regular token.
+- **Client auth plugin** — an `AuthenticationPlugin` placed into the `plugins` registry of
+  `@owlmeans/client-auth/manager`, keyed by authentication type. The standard typed authentication
+  route renders whichever plugin is registered for the type in its URL.
+- **Restricted method** — `supervisorClientPlugin.method.restricted` is `true`, so registering the
+  plugin does not put it on the sign-in screen. It is offered only where
+  `cfg.security.auth.login.overrides` names it.
+- **Deployment gate** — `appendSupervisorAuth` turns itself on only when `cfg.debug.supervisor ===
+  true`. It deliberately ignores `cfg.debug.all`, which many applications set for unrelated reasons.
+
+## Usage
+
+### 1. Wire the gated append into the web context
+
+Call it once in the web client's context factory, after the layer context is built.
+
+```typescript
+import { appendSupervisorAuth } from '@owlmeans/web-auth'
+import { makeContext as makePanelContext } from '@owlmeans/web-panel'
+import type { AppConfig, AppContext } from '@owlmeans/web-panel'
+
+export const makeContext = <C extends AppConfig, T extends AppContext<C>>(cfg: C): T => {
+  const context = makePanelContext<C, T>(cfg)
+  appendSupervisorAuth(context)
+
+  return context
+}
+```
+
+With `cfg.debug.supervisor` unset the call returns the context untouched. With it set, the call
+registers the plugin and fills the sign-in configuration that makes it offerable — only where a
+value is missing:
+
+| Path | Value written |
+|---|---|
+| `cfg.security.auth.login.secretKey` | `true` |
+| `cfg.security.auth.login.overrides['pk-supervisor']` | `{ enabled: true }` |
+
+### 2. Force it on or register it unadvertised
+
+```typescript
+import { appendSupervisorAuth, SUPERVISOR_LOGIN_PATH } from '@owlmeans/web-auth'
+
+// ignore the debug flags — e.g. a dedicated e2e build
+appendSupervisorAuth(context, { enabled: true })
+
+// reachable only by URL, never listed on the sign-in screen
+appendSupervisorAuth(context, { enabled: true, offer: false })
+
+console.log(SUPERVISOR_LOGIN_PATH) // '/authentication/login/pk-supervisor'
+```
+
+### 3. Always-on side-effect import
+
+The `./auth/plugins` subpath registers the plugin at import time with no gate and no sign-in
+override. Prefer the gated append; use this only where the bundle itself is development-only.
+
+```typescript
+import '@owlmeans/web-auth/auth/plugins'
+```
+
+### 4. Drive the form from a test
+
+The form lives at `SUPERVISOR_LOGIN_PATH` and exposes stable test ids. `@owlmeans/test-ui` wraps
+them (`makePageHelper(page).loginViaSupervisorForm(...)`), but a raw Playwright test can fill them
+directly:
+
+```typescript
+import { SUPERVISOR_LOGIN_PATH } from '@owlmeans/web-auth'
+
+await page.goto(`${baseUrl}${SUPERVISOR_LOGIN_PATH}`, { waitUntil: 'domcontentloaded' })
+await page.getByTestId('supervisor-user-id').fill('person@example.com')
+await page.getByTestId('supervisor-pk').fill(process.env.SUPERVISOR_PK!)
+await page.getByTestId('supervisor-submit').click()
+```
+
+On submit the form requests a fresh allowance, signs the challenge, user id and a fresh 16-character
+salt, sends `JSON.stringify({ salt, signature })` as the credential (never the key), stores the
+issued token through the client `AuthService`, and navigates via `landAfterLogin()` /
+`landingUrl()` from `@owlmeans/client-auth/login`.
+
+## API
+
+### Main entry `@owlmeans/web-auth`
+
+| Symbol | Kind | Purpose |
+|---|---|---|
+| `appendSupervisorAuth(context, opts?)` | function | Register `supervisorClientPlugin` and, unless `offer: false`, write the sign-in overrides; returns the same context. No-op unless enabled |
+| `WebSupervisorAuthOptions` | type | `{ enabled?: boolean, offer?: boolean }` — `enabled` defaults to `cfg.debug.supervisor === true`, `offer` to `true` |
+| `SUPERVISOR_LOGIN_PATH` | const | `/authentication/login/${AuthenticationType.Supervisor}` — the typed authentication route for the form |
+| `supervisorClientPlugin` | `AuthenticationPlugin` | The self-contained form plugin |
+
+`appendSupervisorAuth` accepts any context whose `cfg` carries optional `debug` and `security`
+fields, so it works on every web client context.
+
+### `supervisorClientPlugin`
+
+| Member | Value |
+|---|---|
+| `type` | `AuthenticationType.Supervisor` |
+| `method` | `{ order: 900, icon: 'key', emphasis: 'link', restricted: true }` — last, rendered as a link |
+| `Implementation` | React form with test ids `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`, `supervisor-submit`, `supervisor-error` |
+| `authenticate(credentials)` | Signs the payload with `credentials.credential` as the private key, replaces it with the packed `{ salt, signature }`, returns `{ token: '' }`; the real token comes from the backend through the auth control |
+
+### Subpath `@owlmeans/web-auth/auth/plugins`
+
+| Symbol | Purpose |
+|---|---|
+| (side effect) | `plugins[AuthenticationType.Supervisor] = supervisorClientPlugin` on import |
+| `plugins` | the shared `@owlmeans/client-auth/manager` registry, re-exported |
+| `supervisorClientPlugin` | same object as the main entry |
+
+## Common pitfalls
+
+- Setting only `cfg.debug.all` does not enable the web form; set `cfg.debug.supervisor` (the server
+  half honours either flag, so `debug.supervisor` is the one both halves agree on).
+- The web plugin alone signs nothing useful: the server must call `appendSupervisorAuth` from
+  `@owlmeans/server-auth/manager` with `supervisors` naming trusted records whose private keys you
+  hold.
+- Registering the plugin by hand (or through the side-effect import) does not offer it — the method
+  is `restricted` until `cfg.security.auth.login.overrides` enables it.
+- Overrides already present in the config win: `appendSupervisorAuth` only fills missing values, so
+  an explicit `{ enabled: false }` keeps the method off the screen.
+- Never ship a supervisor-enabled build to real production — anyone holding a supervisor private key
+  can sign in as, and register, any user.
+- No extra route is needed; the form renders through the standard `CAUTHEN_AUTHEN_TYPED` route.
+
+## Related packages
+
+- [`@owlmeans/client-auth`](../client-auth) — the plugin registry, auth control and post-login landing
+- [`@owlmeans/server-auth`](../server-auth) — the server `appendSupervisorAuth` that verifies the signature
+- [`@owlmeans/auth`](../auth) — `AuthenticationType.Supervisor` and `buildSupervisorPayload`
+- [`@owlmeans/basic-keys`](../basic-keys) — the key model used to sign
+- [`@owlmeans/web-oidc-rp`](../web-oidc-rp) — another web auth plugin registering into the same registry
+- [`@owlmeans/test-ui`](../test-ui) — supervisor login helpers for API and Playwright tests
+
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
 
@@ -6,7 +166,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "package": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.9",
-  "generatedAt": "2026-08-24T21:14:00.120Z",
+  "version": "0.1.18",
+  "generatedAt": "2026-10-28T00:31:34.730Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: web-auth
-description: How to use @owlmeans/web-auth — web client auth plugins that register into @owlmeans/client-auth/manager. Currently ships the development-only PK-based supervisor login form (appendSupervisorAuth). Auto-invoked when importing @owlmeans/web-auth.
+description: How to use @owlmeans/web-auth — web-side authentication-plugin package that registers into the shared @owlmeans/client-auth/manager registry. It ships the development-only PK supervisor login form (appendSupervisorAuth, supervisorClientPlugin, SUPERVISOR_LOGIN_PATH). Auto-invoked when importing @owlmeans/web-auth or wiring the supervisor login into a web client.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,35 +8,64 @@ user-invocable: false
 # @owlmeans/web-auth
 
 **Layer:** Web
-**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.9"` in `dependencies`
+**Install:** `"@owlmeans/web-auth": "^0.1.18"` in `dependencies`
 
-Web-side auth UI plugins that register into the shared `@owlmeans/client-auth/manager` plugin registry
-(mirrors `@owlmeans/web-oidc-rp`). Currently ships the **PK-based supervisor** login form.
+Web-side auth UI plugins registering into the shared `@owlmeans/client-auth/manager` plugin registry
+(mirroring `@owlmeans/web-oidc-rp`). It ships the **PK supervisor** login form.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `appendSupervisorAuth(context, opts?)` | Dev-only: register the supervisor login form plugin |
-| `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` (the typed-route path) |
-| `supervisorClientPlugin` | The client `AuthenticationPlugin` (self-contained form) |
+| `appendSupervisorAuth(context, opts?)` | Register the supervisor login plugin and, unless told otherwise, offer it on the sign-in screen |
+| `WebSupervisorAuthOptions` | `{ enabled?, offer? }` |
+| `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` — the typed-route path |
+| `supervisorClientPlugin` | The client `AuthenticationPlugin`: a self-contained form that signs the server challenge and hands the packed credential to the standard auth control |
 
 ## Subpath Exports
-- `./auth/plugins` — side-effect import that always-registers the supervisor plugin
-  (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the dev-gated `appendSupervisorAuth`.
+
+- `./auth/plugins` — a side-effect import that always registers the supervisor plugin
+  (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the gated `appendSupervisorAuth`.
 
 ## Usage
+
 ```ts
 import { appendSupervisorAuth } from '@owlmeans/web-auth'
-// in your web client makeContext():
-appendSupervisorAuth(context) // enabled in development only (cfg.debug)
+
+// in the web client's makeContext():
+appendSupervisorAuth(context)
 ```
-The form renders at `SUPERVISOR_LOGIN_PATH` via the standard `CAUTHEN_AUTHEN_TYPED` route — no extra
-route registration needed. Test ids: `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`,
-`supervisor-submit`, `supervisor-error`.
 
-See the **supervisor-auth** skill for the full feature (server append, options, security, test helpers).
+**It reads `cfg.debug.supervisor`, and deliberately NOT `cfg.debug.all`.** Whole families of
+OwlMeans applications set `debug.all` for reasons that have nothing to do with authentication — a
+Viable-generated target sets it for itself — so gating on it would put an operator login on every
+one of them, in production, reachable by anyone who typed the URL. Pass `{ enabled: true }` to force
+it on regardless of the debug flags.
+
+Registering the plugin is not enough to make it OFFERED: `supervisorClientPlugin` carries
+`restricted: true`, so the sign-in screen shows it only where the configuration names it. That is
+what `appendSupervisorAuth` writes into `cfg.security.auth.login.overrides` (and
+`login.secretKey`) when it enables the plugin — pass `{ offer: false }` to register it without
+advertising it.
+
+The form renders at `SUPERVISOR_LOGIN_PATH` through the standard `CAUTHEN_AUTHEN_TYPED` route, so
+no extra route registration is needed. It orders itself last (`order: 900`) and renders as a link,
+because it is a tool rather than a way in. Test ids: `supervisor-auth-form`, `supervisor-user-id`,
+`supervisor-pk`, `supervisor-submit`, `supervisor-error`.
+
+On submit the form requests a fresh allowance, signs `buildSupervisorPayload(challenge, userId,
+salt)` with the entered private key, packs `{ salt, signature }` as the credential, exchanges the
+resulting token through the client `AuthService`, and navigates via `landAfterLogin` +
+`landingUrl` (`@owlmeans/client-auth/login`) — a pending post-login step, then a screen suspended
+in `@owlmeans/client-flow` (an OAuth consent screen reached signed out, say), else `HOME`. It no
+longer imports `@owlmeans/client-flow` or `@owlmeans/web-client` directly; `landAfterLogin` is the
+whole decision.
+
+See the **supervisor-auth** skill for the whole feature — the server append, its options, the
+security boundary and the `@owlmeans/test-ui` helpers.
 
 ## Depends On
-- `@owlmeans/client-auth`, `@owlmeans/web-client`, `@owlmeans/client`
-- `@owlmeans/auth` (type + `buildSupervisorPayload`), `@owlmeans/basic-keys`, `@owlmeans/basic-ids`
+- `@owlmeans/client-auth` (the manager plugin registry), `@owlmeans/web-client`, `@owlmeans/client`
+- `@owlmeans/auth` — `AuthenticationType.Supervisor`, `buildSupervisorPayload`
+- `@owlmeans/auth-common` — the client `AuthService` type
+- `@owlmeans/basic-keys` (signing), `@owlmeans/basic-ids` (the salt), `@owlmeans/config`

package/build/append.d.ts

@@ -1,19 +1,10 @@
-export interface WebSupervisorAuthOptions {
-    /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
-    enabled?: boolean;
-}
+import type { DebugCarrier } from './types.local.js';
+import type { WebSupervisorAuthOptions } from './types.js';
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
  */
-export declare const appendSupervisorAuth: <T extends {
-    cfg: {
-        debug?: {
-            all?: boolean;
-            supervisor?: boolean;
-        };
-    };
-}>(context: T, opts?: WebSupervisorAuthOptions) => T;
+export declare const appendSupervisorAuth: <T extends DebugCarrier>(context: T, opts?: WebSupervisorAuthOptions) => T;
 //# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,wBAAwB;IACvC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAKD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS;IAAE,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,WAChG,CAAC,SAAS,wBAAwB,KAC1C,CASF,CAAA"}
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAc1D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,WAChD,CAAC,SAAS,wBAAwB,KAC1C,CAoBF,CAAA"}

package/build/append.js

@@ -1,19 +1,38 @@
 import { AuthenticationType } from '@owlmeans/auth';
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager';
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js';
-const isDevelopment = (context) => context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true;
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Whether this deployment wants the PK supervisor login.
+ *
+ * Reads `debug.supervisor` and deliberately NOT `debug.all`. `debug.all` is set by whole families
+ * of applications for reasons that have nothing to do with authentication — a generated target
+ * application sets it for itself — so gating on it hands an operator login to every one of them,
+ * in production, reachable by anyone who types the URL. `debug.supervisor` is a deployment saying
+ * this specific thing on purpose.
+ */
+const isSupervised = (context) => context.cfg.debug?.supervisor === true;
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
  */
 export const appendSupervisorAuth = (context, opts) => {
-    const enabled = opts?.enabled ?? isDevelopment(context);
+    const enabled = opts?.enabled ?? isSupervised(context);
     if (!enabled) {
         return context;
     }
     authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin;
+    if (opts?.offer ?? true) {
+        const cfg = context.cfg;
+        cfg.security ??= {};
+        cfg.security.auth ??= {};
+        cfg.security.auth.login ??= {};
+        const login = cfg.security.auth.login;
+        login.secretKey ??= true;
+        login.overrides ??= {};
+        login.overrides[AuthenticationType.Supervisor] ??= { enabled: true };
+    }
     return context;
 };
 //# sourceMappingURL=append.js.map

package/build/append.js.map

@@ -1 +1 @@
-{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAOrE,MAAM,aAAa,GAAG,CAAC,OAAqE,EAAW,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAIrE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAW,EAAE,CACtD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAmB,CAAA;QACvC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;QACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAA;QACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAA;QACrC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAA;QACxB,KAAK,CAAC,SAAS,KAAK,EAAE,CAAA;QACtB,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/auth/plugins/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAWjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAsEpC,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA+EpC,CAAA"}

package/build/auth/plugins/supervisor.js

@@ -3,7 +3,7 @@ import { useState } from 'react';
 import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
 import { useContext } from '@owlmeans/client';
-import { HOME } from '@owlmeans/web-client';
+import { loginLandingOf } from '@owlmeans/client-auth/login';
 import { makeKeyPairModel } from '@owlmeans/basic-keys';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 /**
@@ -20,6 +20,10 @@ import { createIdOfLength } from '@owlmeans/basic-ids';
  */
 export const supervisorClientPlugin = {
     type: AuthenticationType.Supervisor,
+    // `restricted`, so registering the plugin is not enough to put an operator login on the sign-in
+    // screen of a production application — the configuration has to name it. Last in the order and
+    // rendered as a link, because it is a tool, not a way in.
+    method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
     Implementation: () => ({ type, control }) => {
         const context = useContext();
         const [userId, setUserId] = useState('');
@@ -39,8 +43,12 @@ export const supervisorClientPlugin = {
                     const authService = context.service(AUTH_SERVICE);
                     await authService.authenticate(token);
                 }
-                const [homeUrl] = await context.module(HOME).call({ full: true }) ?? [];
-                window.location.href = homeUrl ?? window.location.origin;
+                // A registered step (marketing consent, say) or a device/authorization-code consent
+                // screen that suspended itself here before sending the browser to sign in both take
+                // priority over the app's own home — `landAfterLogin` is the whole decision.
+                const landings = loginLandingOf(context);
+                const landing = await landings.landAfterLogin();
+                window.location.href = await landings.landingUrl(landing);
             }
             catch (e) {
                 setError(e instanceof Error ? e.message : String(e));

package/build/auth/plugins/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;gBACvF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/build/index.d.ts

@@ -1,4 +1,5 @@
 export * from './consts.js';
 export * from './append.js';
+export type * from './types.js';
 export { supervisorClientPlugin } from './auth/plugins/supervisor.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,10 @@
+export interface WebSupervisorAuthOptions {
+    /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
+    enabled?: boolean;
+    /**
+     * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+     * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+     */
+    offer?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/build/types.local.d.ts

@@ -0,0 +1,11 @@
+import type { CommonConfig } from '@owlmeans/config';
+export interface DebugCarrier {
+    cfg: {
+        debug?: {
+            all?: boolean;
+            supervisor?: boolean;
+        };
+        security?: CommonConfig['security'];
+    };
+}
+//# sourceMappingURL=types.local.d.ts.map

package/build/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF"}

package/build/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.9",
+  "version": "0.1.18",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,22 +29,24 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/auth-common": "^0.1.18-rc.7",
-    "@owlmeans/basic-ids": "^0.1.18-rc.6",
-    "@owlmeans/basic-keys": "^0.1.18-rc.7",
-    "@owlmeans/client": "^0.1.18-rc.8",
-    "@owlmeans/client-auth": "^0.1.18-rc.9",
-    "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/web-client": "^0.1.18-rc.9"
+    "@owlmeans/auth": "^0.1.18",
+    "@owlmeans/auth-common": "^0.1.18",
+    "@owlmeans/basic-ids": "^0.1.18",
+    "@owlmeans/basic-keys": "^0.1.18",
+    "@owlmeans/client": "^0.1.18",
+    "@owlmeans/client-auth": "^0.1.18",
+    "@owlmeans/client-flow": "^0.1.18",
+    "@owlmeans/config": "^0.1.18",
+    "@owlmeans/context": "^0.1.18",
+    "@owlmeans/web-client": "^0.1.18"
   },
   "peerDependencies": {
     "react": "*"
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
-    "@types/react": "^19.2.17",
+    "@owlmeans/dep-config": "^0.1.18",
+    "@types/bun": "^1.4.2",
+    "@types/react": "^19.3.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/append.ts

@@ -1,30 +1,48 @@
 import { AuthenticationType } from '@owlmeans/auth'
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import type { CommonConfig } from '@owlmeans/config'
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js'
+import type { DebugCarrier } from './types.local.js'
+import type { WebSupervisorAuthOptions } from './types.js'
 
-export interface WebSupervisorAuthOptions {
-  /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
-  enabled?: boolean
-}
-
-const isDevelopment = (context: { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }): boolean =>
-  context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true
+/**
+ * Whether this deployment wants the PK supervisor login.
+ *
+ * Reads `debug.supervisor` and deliberately NOT `debug.all`. `debug.all` is set by whole families
+ * of applications for reasons that have nothing to do with authentication — a generated target
+ * application sets it for itself — so gating on it hands an operator login to every one of them,
+ * in production, reachable by anyone who types the URL. `debug.supervisor` is a deployment saying
+ * this specific thing on purpose.
+ */
+const isSupervised = (context: DebugCarrier): boolean =>
+  context.cfg.debug?.supervisor === true
 
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
  */
-export const appendSupervisorAuth = <T extends { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }>(
+export const appendSupervisorAuth = <T extends DebugCarrier>(
   context: T, opts?: WebSupervisorAuthOptions
 ): T => {
-  const enabled = opts?.enabled ?? isDevelopment(context)
+  const enabled = opts?.enabled ?? isSupervised(context)
   if (!enabled) {
     return context
   }
 
   authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin
 
+  if (opts?.offer ?? true) {
+    const cfg = context.cfg as CommonConfig
+    cfg.security ??= {}
+    cfg.security.auth ??= {}
+    cfg.security.auth.login ??= {}
+    const login = cfg.security.auth.login
+    login.secretKey ??= true
+    login.overrides ??= {}
+    login.overrides[AuthenticationType.Supervisor] ??= { enabled: true }
+  }
+
   return context
 }

package/src/auth/plugins/supervisor.tsx

@@ -6,8 +6,7 @@ import type { AuthToken } from '@owlmeans/auth'
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
 import type { AuthService } from '@owlmeans/auth-common'
 import { useContext } from '@owlmeans/client'
-import { HOME } from '@owlmeans/web-client'
-import type { Module } from '@owlmeans/web-client'
+import { loginLandingOf } from '@owlmeans/client-auth/login'
 import { makeKeyPairModel } from '@owlmeans/basic-keys'
 import { createIdOfLength } from '@owlmeans/basic-ids'
 
@@ -26,6 +25,11 @@ import { createIdOfLength } from '@owlmeans/basic-ids'
 export const supervisorClientPlugin: AuthenticationPlugin = {
   type: AuthenticationType.Supervisor,
 
+  // `restricted`, so registering the plugin is not enough to put an operator login on the sign-in
+  // screen of a production application — the configuration has to name it. Last in the order and
+  // rendered as a link, because it is a tool, not a way in.
+  method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
+
   Implementation: () => ({ type, control }) => {
     const context = useContext()
     const [userId, setUserId] = useState('')
@@ -49,8 +53,12 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
           await authService.authenticate(token)
         }
 
-        const [homeUrl] = await context.module<Module<string>>(HOME).call({ full: true }) ?? []
-        window.location.href = homeUrl ?? window.location.origin
+        // A registered step (marketing consent, say) or a device/authorization-code consent
+        // screen that suspended itself here before sending the browser to sign in both take
+        // priority over the app's own home — `landAfterLogin` is the whole decision.
+        const landings = loginLandingOf(context)
+        const landing = await landings.landAfterLogin()
+        window.location.href = await landings.landingUrl(landing)
       } catch (e) {
         setError(e instanceof Error ? e.message : String(e))
         setBusy(false)

package/src/index.ts

@@ -1,3 +1,4 @@
 export * from './consts.js'
 export * from './append.js'
+export type * from './types.js'
 export { supervisorClientPlugin } from './auth/plugins/supervisor.js'

package/src/types.local.ts

@@ -0,0 +1,8 @@
+import type { CommonConfig } from '@owlmeans/config'
+
+export interface DebugCarrier {
+  cfg: {
+    debug?: { all?: boolean, supervisor?: boolean }
+    security?: CommonConfig['security']
+  }
+}

package/src/types.ts

@@ -0,0 +1,9 @@
+export interface WebSupervisorAuthOptions {
+  /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
+  enabled?: boolean
+  /**
+   * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+   * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+   */
+  offer?: boolean
+}

package/tests/supervisor.spec.ts

@@ -0,0 +1,89 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { makeKeyPairModel, keyHelper } from '@owlmeans/basic-keys'
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import type { CommonConfig } from '@owlmeans/config'
+import { appendSupervisorAuth, SUPERVISOR_LOGIN_PATH, supervisorClientPlugin } from '../src/index.js'
+
+type Cfg = { debug?: { all?: boolean, supervisor?: boolean }, security?: CommonConfig['security'] }
+const carrier = (cfg: Cfg = {}) => ({ cfg })
+
+afterEach(() => { delete authPlugins[AuthenticationType.Supervisor] })
+
+describe('appendSupervisorAuth — who gets an operator login', () => {
+  test('nothing is registered unless the deployment asks for the supervisor on purpose', () => {
+    const context = carrier({ debug: { all: true } })
+    appendSupervisorAuth(context)
+
+    expect(authPlugins[AuthenticationType.Supervisor]).toBeUndefined()
+    expect(context.cfg.security).toBeUndefined()
+  })
+
+  test('`debug.supervisor` registers the plugin and offers it on the sign-in screen', () => {
+    const context = carrier({ debug: { supervisor: true } })
+    appendSupervisorAuth(context)
+
+    expect(authPlugins[AuthenticationType.Supervisor]).toBe(supervisorClientPlugin)
+    expect(context.cfg.security?.auth?.login?.secretKey).toBe(true)
+    expect(context.cfg.security?.auth?.login?.overrides?.[AuthenticationType.Supervisor]).toEqual({ enabled: true })
+  })
+
+  test('`offer: false` registers the route without putting it on the screen', () => {
+    const context = carrier()
+    appendSupervisorAuth(context, { enabled: true, offer: false })
+
+    expect(authPlugins[AuthenticationType.Supervisor]).toBe(supervisorClientPlugin)
+    expect(context.cfg.security).toBeUndefined()
+  })
+
+  test('an override the configuration already states is kept', () => {
+    const context = carrier({
+      debug: { supervisor: true },
+      security: { auth: { login: { secretKey: false, overrides: { [AuthenticationType.Supervisor]: { enabled: false } } } } },
+    } as Cfg)
+    appendSupervisorAuth(context)
+
+    expect(context.cfg.security?.auth?.login?.secretKey).toBe(false)
+    expect(context.cfg.security?.auth?.login?.overrides?.[AuthenticationType.Supervisor]).toEqual({ enabled: false })
+  })
+
+  test('the form lives on the standard typed authentication route', () => {
+    expect(SUPERVISOR_LOGIN_PATH).toBe(`/authentication/login/${AuthenticationType.Supervisor}`)
+  })
+})
+
+describe('supervisorClientPlugin — what it sends', () => {
+  test('is a restricted method, shown last as a link', () => {
+    expect(supervisorClientPlugin.type).toBe(AuthenticationType.Supervisor)
+    expect(supervisorClientPlugin.method).toMatchObject({ restricted: true, emphasis: 'link', order: 900 })
+  })
+
+  test('signs the challenge, the user and a fresh salt with the entered key and sends no key', async () => {
+    const key = makeKeyPairModel()
+    const credentials = { userId: 'person@example.com', credential: key.export(), challenge: 'one-time' } as AuthCredentials
+
+    const token = await supervisorClientPlugin.authenticate!(credentials)
+
+    expect(token).toEqual({ token: '' })
+    const packed = JSON.parse(credentials.credential) as { salt: string, signature: string }
+    expect(Object.keys(packed).sort()).toEqual(['salt', 'signature'])
+    expect(packed.salt).toHaveLength(16)
+    expect(credentials.credential).not.toContain(key.export())
+    // Verified the way the server's supervisor plugin verifies it.
+    const verifier = keyHelper.fromPubKey(key.exportPublic())
+    expect(await verifier.verify(buildSupervisorPayload('one-time', 'person@example.com', packed.salt), packed.signature)).toBe(true)
+    expect(await verifier.verify(buildSupervisorPayload('replayed', 'person@example.com', packed.salt), packed.signature)).toBe(false)
+  })
+
+  test('two sign-ins never share a salt', async () => {
+    const key = makeKeyPairModel().export()
+    const salts = await Promise.all([1, 2].map(async () => {
+      const credentials = { userId: 'u', credential: key, challenge: 'c' } as AuthCredentials
+      await supervisorClientPlugin.authenticate!(credentials)
+      return (JSON.parse(credentials.credential) as { salt: string }).salt
+    }))
+
+    expect(salts[0]).not.toBe(salts[1])
+  })
+})