@owlmeans/web-client 0.1.18-rc.26 → 0.1.18-rc.27

package/README.md

@@ -6,11 +6,11 @@ React web application bootstrap — context factory, entrypoint/routing utilitie
 
 - `makeContext(cfg)` — creates the web application context (includes auth, router, and DB services)
 - `renderApp(context)` — mounts the React app to the DOM
-- Re-exports entrypoint/routing helpers: `entrypoint`, `route`, `frontend`, `handler`, `elevate`
+- Re-exports entrypoint/routing helpers: `bind`, `bindAll`, `bindScreen`, `route`, `frontend`, `handler`
 - Re-exports route constants: `BASE`, `HOME`, `ROOT`, `GUEST`
 - `entrypoints` — the base client entrypoints (dispatcher, login surrogate) every web app spreads
-- `ClientEntrypoint<T>` (also exported as `Module<T>`) — the typed entrypoint interface behind
-  `call()` / `invoke()` / `url()`
+- `ClientProtocolEntrypoint<Protocol>` — the context-bound entrypoint interface inferred from a
+  shared protocol declaration; it exposes `call()` / `invoke()` / `url()`
 
 ## Installation
 
@@ -34,20 +34,20 @@ renderApp<Config, Context>(context)
 Define entrypoints:
 
 ```typescript
-import { BASE, HOME, elevate, entrypoint, frontend, handler, route } from '@owlmeans/web-client'
+import { bindScreen, bindAll } from '@owlmeans/client-entrypoint'
+import { handler } from '@owlmeans/client'
+import { appEntrypoints as protocols } from 'my-app-common'
 
-appEntrypoints.push(entrypoint(route(BASE, '/', frontend()), handler(PublicLayout)))
-appEntrypoints.push(entrypoint(route(HOME, '/', frontend({ default: true, parent: BASE })), handler(HomeScreen)))
-elevate(appEntrypoints, manager.back.account.base)
+appEntrypoints.push(bindScreen(protocols.web.base, handler(PublicLayout)))
+appEntrypoints.push(bindScreen(protocols.web.home, handler(HomeScreen)))
+appEntrypoints.push(...bindAll(protocols.api))
 ```
 
 A screen entrypoint carries a renderer, so it is addressed by `url()` and never called over the
 wire. Call an API entrypoint from a component:
 
 ```typescript
-import type { ClientEntrypoint } from '@owlmeans/web-client'
-
-const result = await context.entrypoint<ClientEntrypoint<MyType>>(alias)
+const result = await context.entrypoint(appEntrypoints.api.project)
   .call({ params: { id }, body: data })
 ```
 
@@ -78,7 +78,7 @@ Component that handles authentication routing (redirect to login, etc.).
 - [`@owlmeans/client-context`](../client-context) — `ClientContext` base extended by `makeContext`
 - [`@owlmeans/web-router`](../web-router) — default OwlMeans browser routing plugin registered by `makeContext`
 - [`@owlmeans/web-db`](../web-db) — IndexedDB service registered by `makeContext`
-- [`@owlmeans/client-entrypoint`](../client-entrypoint) — the `ClientEntrypoint<T>` implementation
+- [`@owlmeans/client-entrypoint`](../client-entrypoint) — protocol binding helpers
 
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
@@ -88,7 +88,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.14
+npx @owlmeans/agent-skills@^0.1.18-rc.15
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-client",
-  "version": "0.1.18-rc.26",
-  "generatedAt": "2026-09-10T23:12:07.511Z",
+  "version": "0.1.18-rc.27",
+  "generatedAt": "2026-09-12T08:39:52.726Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-client/SKILL.md

@@ -1,189 +1,39 @@
 ---
 name: web-client
-description: How to use @owlmeans/web-client — the browser entry point — makeContext(), renderApp(), elevate() to attach React components to entrypoint declarations, context.registerEntrypoints(), context.serviceRoute(), the dispatcher and surrogate login screens, and useAuthenticated(). Auto-invoked when working with a web app entry point, attaching React components to entrypoints, or wiring browser login.
-user-invocable: false
+description: Bind OwlMeans shared entrypoint protocols in a browser application. Use when registering client routes, attaching React screens, calling API protocols, or configuring the browser context.
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
-# @owlmeans/web-client
+# Browser protocol entrypoints
 
-**Layer:** Web (React)
-**Install:** `"@owlmeans/web-client": "^0.1.18-rc.26"` in `dependencies`
-
-The browser layer over `@owlmeans/client`. It builds the context, mounts the app, and brings
-working authentication with nothing registered by hand.
-
-**What is here and what is not.** `@owlmeans/client` owns the React primitives and does not
-re-export from here; this package owns the browser wiring and re-exports only the few authoring
-helpers below. In particular `useNavigate`, `useEntrypoint`, `useStoreModel`, `useStoreList`,
-`useValue` and `useToggle` are imported from `@owlmeans/client` even in a browser-only app.
-
-## Key Exports
-
-| Export | Description |
-|--------|-------------|
-| `makeContext(cfg)` | Build the browser context: the client context plus the primary host, the auth service, web db, the auth client resource, the router and login |
-| `AppConfig` / `AppContext` | The config and context types — `ClientContext` plus `auth()` and `login()` |
-| `renderApp(context, opts?, children?)` | Mount the app. `children` render inside the provider and before the router — the global overlay slot |
-| `render(node, opts?)` / `RenderOptions` | The bare mount: `{ domId, onReady, hydrate, debug }`, default root id `root` |
-| `WebApp` | The mounted tree — the i18n provider around `App` from `@owlmeans/client` |
-| `useContext()` | The context, typed as `AppContext` |
-| `useAuthenticated()` | Whether this browsing context holds a session — it reports, it does not guard |
-| `entrypoints` | The auth entrypoint list, with the dispatcher and the login-surrogate screens already elevated. Spread it into the app's own list |
-| `Dispatcher` / `parametriseDispatcher(defaults, Com?)` | The post-login landing screen, and a wrapper that pre-fills its props |
-| `Uploader` / `ImageUploader` / `UploaderProps` / `UploaderRootProps` | Dropzone-based file input; props are `react-dropzone`'s `DropzoneOptions` plus `Root`/`rootProps`. The image variant only DEFAULTS `maxSize` to 5 MB — pass `maxSize` to override it |
-| `UploaderError` / `FileUploadingError` | Upload failures, on top of `ComponentError` |
-| `appendWebLogin(ctx)` | Register the login host plus the redirect and surrogate-window plugins |
-| `makeRedirectLoginPlugin()` / `makeSurrogateLoginPlugin()` / `awaitSurrogate(win, type, onMessage)` | The two browser login plugins and the window pump they share |
-| `SurrogateScreen` / `LoginSurrogateView` / `SurrogateStage` / `SurrogateViewProps` | What the surrogate login window renders |
-| `makeAuthWebService(alias?)` / `appendWebAuthService(ctx, alias?)` | The auth service whose `update(undefined)` leaves for the dispatcher. The append form also registers `authMiddleware` and the logout middleware |
-| `extractPrimaryHost(ctx)` | Fill `cfg.primaryHost` / `primaryPort` from `window.location` |
-| `DEFAULT_ROOT` (`root`), `REDIRECT_LOGIN`, `SURROGATE_LOGIN`, `SURROGATE_LOGIN_PRIORITY` (100) | Constants |
-
-### Re-exported for authoring
-
-`handler` (from `@owlmeans/client`); `entrypoint`, `elevate`, `provideRequest`, `stab` and the
-`ClientEntrypoint` type (from `@owlmeans/client-entrypoint`); `route`, `frontend` (from
-`@owlmeans/route`); `config` (from `@owlmeans/client-context`); `service` (from `@owlmeans/config`);
-`AppType`, `HOME`, `ROOT`, `BASE`, `GUEST` (from `@owlmeans/context`). Import them from here so an
-app's entrypoint file needs one import.
-
-## Usage
-
-### Entry point
-```typescript
-// index.tsx
-import { renderApp } from '@owlmeans/web-client'
-import { makeContext } from './context.js'
-import { appEntrypoints } from './entrypoints.js'
-import { MANAGER, MANAGER_API } from 'my-common'
-import config from './config.js'
-
-const context = makeContext(config)
-context.registerEntrypoints(appEntrypoints)
-context.serviceRoute(MANAGER, true)
-context.serviceRoute(MANAGER_API, true)
-renderApp<Config, Context>(context)
-```
-
-`serviceRoute(alias, makeDefault?)` marks a service's routing root; an alias `cfg.services` does not
-carry throws a `SyntaxError` naming everything that is registered. Anything passed as `renderApp`'s
-third argument mounts once, above routing, and survives navigation — which is where a consent
-dialog or a toast surface belongs, since the same component inside a route is torn down and rebuilt
-on every navigation and a dialog would close itself.
-
-### Entrypoint elevation with React components
-```typescript
-import { elevate, route, frontend, handler, entrypoint } from '@owlmeans/web-client'
-import { HomeScreen, ProjectDashboardScreen } from './screens/index.js'
-
-elevate(entrypoints, manager.front.project.dashboard, handler(ProjectDashboardScreen))
-
-entrypoints.push(
-  entrypoint(route(HOME, '/', frontend({ default: true, parent: BASE })), handler(HomeScreen))
-)
-```
-
-`elevate` is idempotent — it replaces the declaration in the list, so re-elevating an alias (a
-screen swapped for a variant build, a guard added to an already-elevated one) is allowed, and
-guards named at elevation are unioned with the declared ones rather than replacing them. A backend
-alias takes no handler at all: giving one is a wiring error and throws.
-
-A **backend** alias the client calls needs a bare `elevate(entrypoints, alias)` — no handler. That
-opts the alias into client-side callability, so:
-
-```typescript
-const project = await context.entrypoint<ClientEntrypoint<Project>>(alias)
-  .call({ params, body, query })                       // the value; the reply's error is thrown
-const { value, outcome } = await context.entrypoint<ClientEntrypoint<Project>>(alias)
-  .invoke({ params })                                  // when the outcome decides what happens next
-const href = await context.entrypoint<ClientEntrypoint<Project>>(alias)
-  .url({ params }, { absolute: true })                 // the address, not the round trip
-```
-
-The auth header is attached automatically for guarded entrypoints. An entrypoint that renders a
-screen answers `url()` and throws from `call()`/`invoke()` — a screen is navigated to, not called.
-
-A guarded call whose session the server rejects logs the user out rather than surfacing the error
-raw. `appendWebAuthService` registers a logout middleware for this — internal to the package, not
-an import — which wraps `invoke` on every guarded backend entrypoint (that covers `call`, since
-`call` reads `invoke` at the moment it runs), and an `AuthUnknown` ending in `:invalid` clears the
-token, which through the web auth service leaves for the dispatcher.
-
-### Login comes with the context
-
-`makeContext` calls `appendWebLogin`, which registers the login host (`@owlmeans/client-auth/login`)
-and both browser plugins on it — redirect (`REDIRECT_LOGIN`, priority 0, applies always) and
-surrogate window (`SURROGATE_LOGIN`, priority 100, applies in a frame or in the surrogate itself).
-So every web app — and everything built on `web-panel` or `mui-panel` — has working sign-in,
-including from an embedded app, with nothing registered by hand:
-
-```typescript
-import { useLogin, useLogout } from '@owlmeans/client-auth/login'
-
-const [, onLogIn] = useLogin()   // one control, one handler, no environment checks
-```
-
-The dispatcher and the surrogate screen are elevated on the auth entrypoint list this package
-exports, so an app that spreads `entrypoints` into its own list gets both without an edit. The
-surrogate screen renders `LoginSurrogateView` with plain elements and inline styles on purpose: it
-runs in a popup opened by apps with entirely different stylesheets, none of which is loaded there.
-
-An app that needs a different mechanic registers its own plugin at a higher priority after building
-the base context (`context.login().registerPlugin(...)`); it never replaces these. The contract, the
-cascade and the invariants are the [[login-plugins]] skill.
-
-### Reading auth state
+Shared protocol declarations are immutable. Bind a complete protocol tree for callable API routes,
+then bind frontend declarations to screens.
 
 ```ts
-import { useAuthenticated } from '@owlmeans/web-client'
-
-const authenticated = useAuthenticated()   // false until the check settles
+import { bindAll, bindScreen, entrypoints as frameworkEntrypoints, handler } from '@owlmeans/web-panel'
+import { projectEntrypoints, webEntrypoints } from 'project-common'
+import { ProjectScreen } from './screens/project.js'
+
+export const appEntrypoints = [
+  ...frameworkEntrypoints,
+  ...bindAll(projectEntrypoints),
+  bindScreen(webEntrypoints.project, handler(ProjectScreen)),
+]
 ```
 
-`useAuthenticated()` asks `context.auth().authenticated()` — the one channel the dispatcher and the
-login screen already read, answering from the auth service's token or rehydrating it from the auth
-resource. It is what a header uses to choose between the "Log in" and "Log out" control; nothing
-about it navigates, and it does not re-check, because both ways out of its answer replace the
-document.
-
-**It reports; it does not guard.** The guard is `useSelfAuth` from `@owlmeans/client-auth`, which
-sends an anonymous visitor to the dispatcher and defaults to doing so — the wrong behaviour for a
-component that only wants to know which control to draw. An application declares neither hook
-itself.
-
-### Navigation
-```typescript
-import { useNavigate } from '@owlmeans/client'   // not re-exported by web-client
-import { useStoreList, useStoreModel } from '@owlmeans/client'   // client state — also not re-exported
+Call a protocol directly. Its request and response types come from its shared contract.
 
-const nav = useNavigate()
-<Button onClick={nav.press(manager.front.project.dashboard, { params: { projectId } })}>Open</Button>
-await nav.go(alias, { params })   // programmatic; nav.back() to go back
+```ts
+const project = await context.entrypoint(projectEntrypoints.get).call({
+  params: { id: projectId },
+})
 ```
 
-The navigator resolves its target through the entrypoint's own `url(request)`, so a screen names an
-alias and never assembles a path. Render a plain `<a href>` the same way — `await
-context.entrypoint(alias).url({ params })`, or the `Link` component from `@owlmeans/web-panel`,
-which does it for you.
-
-## Depends On
-
-- `@owlmeans/client`, `@owlmeans/web-router` (default OwlMeans browser routing), `@owlmeans/web-db`
-  (the IndexedDB store behind the client resources), `@owlmeans/client-i18n`
-- `@owlmeans/client-auth` — `AUTH_RESOURCE`, the dispatcher HOC, and the `./login` host the browser
-  plugins register on; `@owlmeans/auth`, `@owlmeans/auth-common`
-- `@owlmeans/client-context`, `@owlmeans/client-entrypoint`, `@owlmeans/client-resource`,
-  `@owlmeans/client-route`, `@owlmeans/route`, `@owlmeans/config`, `@owlmeans/context`,
-  `@owlmeans/error`, `@owlmeans/i18n`, `react-dropzone`
-- `@owlmeans/web-panel` and `@owlmeans/mui-panel` build **on** this package, not the other way
-  round: a UI-family app imports the panel package and gets this one with it
-- `react`, `react-dom` (peer). It does not depend on `react-router` — opt into it with
-  `@owlmeans/web-router-react-router` (`appendReactRouter`). Routing needs no explicit provider:
-  `PanelApp`/`App` compile through `context.router()`, so nothing passes a `provide` prop.
-
-## Related
+## Rules
 
-- [[client]] — the React primitives and the hooks this does not re-export
-- [[login-plugins]] — the plugin cascade the two browser plugins take part in
-- [[web-router]] — the routing this context registers
+- Declare paths, guards, gates and contracts once in the shared protocol tree.
+- Bind every API declaration the browser calls, including route parents.
+- Use `bindScreen(protocol, handler(Component))` only for frontend route declarations.
+- Do not replace request/response typing at a call site; update the shared contract instead.
+- Keep framework entrypoints and application entrypoints in one registered array, without mutating a
+  shared declaration collection.

package/build/components/dispatcher/component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU,6FAsGrB,CAAA"}
+{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU,6FA+FrB,CAAA"}

package/build/components/dispatcher/component.js

@@ -3,7 +3,7 @@ import { DispatcherHOC } from '@owlmeans/client-auth';
 import { useEffect, useState } from 'react';
 import { useI18nLib } from '@owlmeans/client-i18n';
 import { AUTH_QUERY } from '@owlmeans/auth';
-import { FallbackLoginScreen, LoginIntent, LoginOutcome, ResumeAction, resumeAction, LOGIN_FRESH_QUERY, } from '@owlmeans/client-auth/login';
+import { FallbackLoginScreen, LoginIntent, LoginOutcome, ResumeAction, resumeAction, } from '@owlmeans/client-auth/login';
 import { LoginSurrogateView, SurrogateStage } from '../../login/view.js';
 import { useContext } from '../../context.js';
 export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
@@ -33,13 +33,7 @@ export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
             provideToken({ token }, params);
             return;
         }
-        // `fresh` says this window was opened to PRODUCE a session, so one it merely finds on this
-        // origin is not the answer — see LOGIN_FRESH_QUERY. Kept identical to the relying party's own
-        // dispatcher: the last time these two held their own copy of a decision they drifted.
-        const found = query.has(LOGIN_FRESH_QUERY)
-            ? Promise.resolve(null)
-            : context.auth().authenticated();
-        void found.then(async (authzToken) => {
+        void context.auth().authenticated().then(async (authzToken) => {
             if (authzToken == null || authzToken === '') {
                 setChoose(true);
                 return;

package/build/components/dispatcher/component.js.map

@@ -1 +1 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EACL,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,GAC9F,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAElD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAEhC,8FAA8F;IAC9F,iGAAiG;IACjG,+FAA+F;IAC/F,sEAAsE;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;IACnD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,6FAA6F;IAC7F,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE3C,SAAS,CAAC,GAAG,EAAE;QACb,4FAA4F;QAC5F,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAA;QAEvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,MAAM,GAA2B,EAAE,CAAA;YACzC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3B,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;gBACrB,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;YAE/B,OAAM;QACR,CAAC;QAED,2FAA2F;QAC3F,8FAA8F;QAC9F,sFAAsF;QACtF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;QAElC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;YACjC,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC,CAAA;gBAEf,OAAM;YACR,CAAC;YACD,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACxD,QAAQ,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,KAAK,YAAY,CAAC,IAAI;oBACpB,OAAM;gBACR,KAAK,YAAY,CAAC,MAAM;oBACtB,UAAU,CAAC,OAAO,CAAC,CAAA;oBAEnB,OAAM;gBACR;oBACE,MAAM,QAAQ,EAAE,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,4FAA4F;IAC5F,8CAA8C;IAC9C,EAAE;IACF,4FAA4F;IAC5F,8FAA8F;IAC9F,0FAA0F;IAC1F,8FAA8F;IAC9F,iGAAiG;IACjG,0FAA0F;IAC1F,wDAAwD;IACxD,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,KAAC,kBAAkB,IACxB,MAAM,EAAE,WAAW,CAAC,KAAK,EACzB,KAAK,EACH,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;gBACzD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;wBACzD,CAAC,CAAC,cAAc,CAAC,OAAO,EAEhC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC9D,CAAA;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,mBAAmB,CAAA;QAE9D,OAAO,KAAC,MAAM,IAAC,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAAI,CAAA;IACnF,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAK,KAAK,EAAE;YACzC,KAAK,EAAE,MAAM,EAAE,sCAAsC;YACrD,OAAO,EAAE,MAAM,EAAE,yBAAyB;YAC1C,cAAc,EAAE,QAAQ,EAAE,+BAA+B;YACzD,UAAU,EAAE,QAAQ,EAAE,yCAAyC;YAC/D,SAAS,EAAE,QAAQ,EAAE,8BAA8B;YACnD,UAAU,EAAE,MAAM,EAAE,6BAA6B;YACjD,aAAa,EAAE,MAAM,EAAE,6BAA6B;SACrD,YAAG,CAAC,CAAC,SAAS,CAAC,GAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACrC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../src/components/dispatcher/component.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EACL,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,GAC3E,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAElD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAEhC,8FAA8F;IAC9F,iGAAiG;IACjG,+FAA+F;IAC/F,sEAAsE;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;IACnD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAA;IACjE,6FAA6F;IAC7F,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE3C,SAAS,CAAC,GAAG,EAAE;QACb,4FAA4F;QAC5F,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAA;QAEvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,MAAM,GAA2B,EAAE,CAAA;YACzC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3B,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;gBACrB,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;YAE/B,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;YAC1D,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC,CAAA;gBAEf,OAAM;YACR,CAAC;YACD,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACxD,QAAQ,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,KAAK,YAAY,CAAC,IAAI;oBACpB,OAAM;gBACR,KAAK,YAAY,CAAC,MAAM;oBACtB,UAAU,CAAC,OAAO,CAAC,CAAA;oBAEnB,OAAM;gBACR;oBACE,MAAM,QAAQ,EAAE,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,4FAA4F;IAC5F,8CAA8C;IAC9C,EAAE;IACF,4FAA4F;IAC5F,8FAA8F;IAC9F,0FAA0F;IAC1F,8FAA8F;IAC9F,iGAAiG;IACjG,0FAA0F;IAC1F,wDAAwD;IACxD,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,KAAC,kBAAkB,IACxB,MAAM,EAAE,WAAW,CAAC,KAAK,EACzB,KAAK,EACH,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;gBACzD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;wBACzD,CAAC,CAAC,cAAc,CAAC,OAAO,EAEhC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC9D,CAAA;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,mBAAmB,CAAA;QAE9D,OAAO,KAAC,MAAM,IAAC,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAAI,CAAA;IACnF,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAK,KAAK,EAAE;YACzC,KAAK,EAAE,MAAM,EAAE,sCAAsC;YACrD,OAAO,EAAE,MAAM,EAAE,yBAAyB;YAC1C,cAAc,EAAE,QAAQ,EAAE,+BAA+B;YACzD,UAAU,EAAE,QAAQ,EAAE,yCAAyC;YAC/D,SAAS,EAAE,QAAQ,EAAE,8BAA8B;YACnD,UAAU,EAAE,MAAM,EAAE,6BAA6B;YACjD,aAAa,EAAE,MAAM,EAAE,6BAA6B;SACrD,YAAG,CAAC,CAAC,SAAS,CAAC,GAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACrC,CAAC,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -1,2 +1,16 @@
-export declare const entrypoints: import("@owlmeans/client-entrypoint").ClientEntrypoint<{}, import("@owlmeans/client-entrypoint").ClientRequest<{}>>[];
+/**
+ * Bound here rather than in a relying-party package on purpose.
+ *
+ * The surrogate mechanic is not OIDC-specific — it is "run the login route one window up and hand
+ * the result back" — and every web application already spreads this list. Putting the screen here
+ * means `web-panel`, `mui-panel` and every generated target gain a working login window with no
+ * edit of their own, which is the only way an application that is already deployed can get it.
+ */
+export declare const entrypoints: (import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    query: import("@owlmeans/auth").AuthToken;
+}, undefined>> | import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    query: import("@owlmeans/auth-common").SurrogateQuery;
+}, undefined>> | import("@owlmeans/client-entrypoint").ClientProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AuthToken;
+}, import("@owlmeans/auth").AuthToken>>)[];
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,WAAW,uHAAO,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW;;;;;;0CAIvB,CAAA"}

package/build/entrypoints.js

@@ -1,18 +1,20 @@
-import { DISPATCHER, DISPATCHER_SURROGATE } from '@owlmeans/auth';
-import { entrypoints as list } from '@owlmeans/client-auth';
-import { elevate } from '@owlmeans/client-entrypoint';
+import { authProtocols } from '@owlmeans/auth-common';
+import { entrypoints as authBindings } from '@owlmeans/client-auth';
+import { bindScreen } from '@owlmeans/client-entrypoint';
 import { handler } from '@owlmeans/client';
 import { Dispatcher } from './components/dispatcher/component.js';
 import { SurrogateScreen } from './login/screen.js';
-elevate(list, DISPATCHER, handler(Dispatcher));
 /**
- * Elevated here rather than in a relying-party package on purpose.
+ * Bound here rather than in a relying-party package on purpose.
  *
  * The surrogate mechanic is not OIDC-specific — it is "run the login route one window up and hand
  * the result back" — and every web application already spreads this list. Putting the screen here
  * means `web-panel`, `mui-panel` and every generated target gain a working login window with no
  * edit of their own, which is the only way an application that is already deployed can get it.
  */
-elevate(list, DISPATCHER_SURROGATE, handler(SurrogateScreen));
-export const entrypoints = list;
+export const entrypoints = [
+    ...authBindings,
+    bindScreen(authProtocols.dispatcher, handler(Dispatcher)),
+    bindScreen(authProtocols.surrogate, handler(SurrogateScreen)),
+];
 //# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;AAE9C;;;;;;;GAOG;AACH,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,YAAY;IACf,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACzD,UAAU,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CAC9D,CAAA"}

package/build/exports.d.ts

@@ -2,7 +2,7 @@ export { handler } from '@owlmeans/client';
 export { config } from '@owlmeans/client-context';
 export { service } from '@owlmeans/config';
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context';
-export { entrypoint, elevate, provideRequest, stab } from '@owlmeans/client-entrypoint';
+export { bind, bindAll, bindScreen, provideRequest, stab } from '@owlmeans/client-entrypoint';
 export { route, frontend } from '@owlmeans/route';
 export type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
 export type { ClientEntrypoint as Module } from '@owlmeans/client-entrypoint';

package/build/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,wBAAwB,CAAA"}

package/build/exports.js

@@ -2,6 +2,6 @@ export { handler } from '@owlmeans/client';
 export { config } from '@owlmeans/client-context';
 export { service } from '@owlmeans/config';
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context';
-export { entrypoint, elevate, provideRequest, stab } from '@owlmeans/client-entrypoint';
+export { bind, bindAll, bindScreen, provideRequest, stab } from '@owlmeans/client-entrypoint';
 export { route, frontend } from '@owlmeans/route';
 //# sourceMappingURL=exports.js.map

package/build/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA"}

package/build/helper.d.ts

@@ -1,22 +1,3 @@
 import type { AppConfig, AppContext } from './types.js';
 export declare const extractPrimaryHost: <C extends AppConfig = AppConfig, T extends AppContext<C> = AppContext<C>>(context: T) => void;
-/**
- * Whether this browsing context currently holds a session — the flag a screen renders against
- * when it offers "Log in" or "Log out", a profile menu, or an authenticated-only panel.
- *
- * It reads the one channel the rest of the package reads, `context.auth().authenticated()`, which
- * answers from the auth service's token or, in a cold document, rehydrates it from the auth
- * resource. Nothing here touches storage or decodes a token: a second way to ask the same question
- * is a second thing to keep in step with logout.
- *
- * The answer is `false` until that promise settles and is not re-checked afterwards, because both
- * transitions out of the current answer replace the document — signing in navigates through the
- * dispatcher, and `auth().update(undefined)` assigns `document.location.href`. There is no in-page
- * change to subscribe to.
- *
- * This reports; it does not guard. `useSelfAuth` from `@owlmeans/client-auth` is the guard — it
- * sends an anonymous visitor to the dispatcher, which is the wrong behaviour for a component that
- * only wants to know which control to draw.
- */
-export declare const useAuthenticated: () => boolean;
 //# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvD,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,SAKtH,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAgBnC,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvD,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,SAKtH,CAAA"}

package/build/helper.js

@@ -1,41 +1,7 @@
-import { useEffect, useState } from 'react';
-import { useContext } from '@owlmeans/client';
 export const extractPrimaryHost = (context) => {
     if (typeof window !== 'undefined') {
         context.cfg.primaryHost = window.location.hostname;
         context.cfg.primaryPort = window.location.port != null && window.location.port != '' ? parseInt(window.location.port) : undefined;
     }
 };
-/**
- * Whether this browsing context currently holds a session — the flag a screen renders against
- * when it offers "Log in" or "Log out", a profile menu, or an authenticated-only panel.
- *
- * It reads the one channel the rest of the package reads, `context.auth().authenticated()`, which
- * answers from the auth service's token or, in a cold document, rehydrates it from the auth
- * resource. Nothing here touches storage or decodes a token: a second way to ask the same question
- * is a second thing to keep in step with logout.
- *
- * The answer is `false` until that promise settles and is not re-checked afterwards, because both
- * transitions out of the current answer replace the document — signing in navigates through the
- * dispatcher, and `auth().update(undefined)` assigns `document.location.href`. There is no in-page
- * change to subscribe to.
- *
- * This reports; it does not guard. `useSelfAuth` from `@owlmeans/client-auth` is the guard — it
- * sends an anonymous visitor to the dispatcher, which is the wrong behaviour for a component that
- * only wants to know which control to draw.
- */
-export const useAuthenticated = () => {
-    const context = useContext();
-    const [authenticated, setAuthenticated] = useState(false);
-    useEffect(() => {
-        let mounted = true;
-        void context.auth().authenticated().then(token => {
-            if (mounted) {
-                setAuthenticated(token != null && token !== '');
-            }
-        });
-        return () => { mounted = false; };
-    }, []);
-    return authenticated;
-};
 //# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAA2E,OAAU,EAAE,EAAE;IACzH,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA;QAClD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACnI,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAY,EAAE;IAC5C,MAAM,OAAO,GAAG,UAAU,EAAyB,CAAA;IACnD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,GAAG,IAAI,CAAA;QAClB,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,gBAAgB,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAA;YACjD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAA,CAAC,CAAC,CAAA;IAClC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAA2E,OAAU,EAAE,EAAE;IACzH,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA;QAClD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACnI,CAAC;AACH,CAAC,CAAA"}

package/build/login/screen.d.ts

@@ -7,22 +7,9 @@ import type { FC } from 'react';
  * application, with its navigation, inside itself. This screen has no continuation at all — it
  * either hands something back and closes, or it says what it is waiting for.
  *
- * It does not run the authorization machine itself either: it forwards to the dispatcher (`next`),
- * which owns that flow.
- *
- * It used to short-circuit that when a session was already present on this origin — hand it back,
- * no provider round trip. That is wrong, and it was the whole of a reported defect. This window is
- * first-party on the application's origin, so what it finds there is whatever the person's own
- * tabs left behind, and a token being present says nothing about the record behind it still
- * existing: `authenticated()` reads storage and decodes an envelope, and no client asks the server.
- * A session that had been revoked, replaced or expired was therefore handed back to a window that
- * had asked for a LOGIN, adopted, and used to fail every call — and the next press of the same
- * button found the same dead token and did it again. Nothing recovered but clearing site data.
- *
- * So an explicit login PRODUCES a session. `fresh` says so to the dispatcher, which skips its own
- * resume for the same reason. The cost is one provider round trip that the provider's own session
- * normally answers without asking the person anything; the gain is that what comes back has just
- * been vouched for, and that signing in as somebody else is possible at all.
+ * It also never runs the authorization machine. When there is already a session here, that is the
+ * answer, and it goes back to the opener immediately — no provider round trip, no PKCE exchange.
+ * When there is not, it forwards to the dispatcher (`next`), which owns that flow.
  */
 export declare const SurrogateScreen: FC;
 //# sourceMappingURL=screen.d.ts.map

package/build/login/screen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAW/B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,eAAe,EAAE,EAoF7B,CAAA"}
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAU/B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,EAAE,EA+F7B,CAAA"}

package/build/login/screen.js

@@ -2,7 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useCallback, useEffect, useState } from 'react';
 import { useContext } from '@owlmeans/client';
 import { useI18nLib } from '@owlmeans/client-i18n';
-import { LoginIntent, LoginOutcome, LOGIN_FRESH_QUERY, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY, } from '@owlmeans/client-auth/login';
+import { LoginIntent, LoginOutcome, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY, } from '@owlmeans/client-auth/login';
 import { LoginSurrogateView, SurrogateStage } from './view.js';
 /**
  * The login window an embedded application opens one level up.
@@ -12,22 +12,9 @@ import { LoginSurrogateView, SurrogateStage } from './view.js';
  * application, with its navigation, inside itself. This screen has no continuation at all — it
  * either hands something back and closes, or it says what it is waiting for.
  *
- * It does not run the authorization machine itself either: it forwards to the dispatcher (`next`),
- * which owns that flow.
- *
- * It used to short-circuit that when a session was already present on this origin — hand it back,
- * no provider round trip. That is wrong, and it was the whole of a reported defect. This window is
- * first-party on the application's origin, so what it finds there is whatever the person's own
- * tabs left behind, and a token being present says nothing about the record behind it still
- * existing: `authenticated()` reads storage and decodes an envelope, and no client asks the server.
- * A session that had been revoked, replaced or expired was therefore handed back to a window that
- * had asked for a LOGIN, adopted, and used to fail every call — and the next press of the same
- * button found the same dead token and did it again. Nothing recovered but clearing site data.
- *
- * So an explicit login PRODUCES a session. `fresh` says so to the dispatcher, which skips its own
- * resume for the same reason. The cost is one provider round trip that the provider's own session
- * normally answers without asking the person anything; the gain is that what comes back has just
- * been vouched for, and that signing in as somebody else is possible at all.
+ * It also never runs the authorization machine. When there is already a session here, that is the
+ * answer, and it goes back to the opener immediately — no provider round trip, no PKCE exchange.
+ * When there is not, it forwards to the dispatcher (`next`), which owns that flow.
  */
 export const SurrogateScreen = () => {
     const context = useContext();
@@ -64,6 +51,7 @@ export const SurrogateScreen = () => {
             return;
         }
         const run = async () => {
+            const token = await context.auth().authenticated();
             if (intent === LoginIntent.Logout) {
                 // Revoked FIRST, before anything can be awaited on a channel that may never answer: a
                 // window the user closes half a second later must still have ended the session it opened
@@ -75,22 +63,28 @@ export const SurrogateScreen = () => {
                         : SurrogateStage.Failed);
                 return;
             }
-            // The dispatcher owns the authorization round trip, and the provider's callback lands there
-            // rather than on this route. Two things travel with it: the method the user already chose,
-            // so the dispatcher does not ask a second time in a window with no one to ask, and `fresh`,
-            // which tells it that a session it happens to find here is not the answer to this request.
+            if (token != null && token !== '') {
+                // Already signed in here. The framed application is the one that asked, so the session
+                // goes to it rather than being displayed to this window.
+                const outcome = await login.resume(token);
+                setStage(outcome === LoginOutcome.Handled ? SurrogateStage.Handing
+                    : outcome === LoginOutcome.Orphaned ? SurrogateStage.Orphaned
+                        : SurrogateStage.Failed);
+                return;
+            }
+            // Nothing here yet — the dispatcher owns the authorization round trip, and the provider's
+            // callback lands there rather than on this route. The method the user already chose travels
+            // with it, so the dispatcher does not ask a second time in a window with no one to ask.
             const next = query.get(LOGIN_NEXT_QUERY);
             if (next == null || next === '') {
                 setStage(SurrogateStage.Gesture);
                 return;
             }
             const method = query.get(LOGIN_METHOD_QUERY);
-            const params = new URLSearchParams();
-            if (method != null && method !== '') {
-                params.set(LOGIN_METHOD_QUERY, method);
-            }
-            params.set(LOGIN_FRESH_QUERY, '1');
-            window.location.href = `${next}${next.includes('?') ? '&' : '?'}${params.toString()}`;
+            const target = method != null && method !== ''
+                ? `${next}${next.includes('?') ? '&' : '?'}${LOGIN_METHOD_QUERY}=${encodeURIComponent(method)}`
+                : next;
+            window.location.href = target;
         };
         void run().catch((e) => {
             console.error(e);

package/build/login/screen.js.map

@@ -1 +1 @@
-{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EACL,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EACpF,gBAAgB,GACjB,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAO,GAAG,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,EAA2B,CAAA;IACrD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,WAAW,CAAC,MAAM;QACjE,CAAC,CAAC,WAAW,CAAC,MAAM;QACpB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAA;IAErB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,cAAc,CAAC,OAAO,CAAC,CAAA;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,EAAsB,CAAA;IAExD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,IAAI,KAAK,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,OAAM;QACR,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAE3B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,eAAe,CAAC,CAAA;QAC5D,yFAAyF;QACzF,yFAAyF;QACzF,iCAAiC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAA;QAEb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,0FAA0F;YAC1F,sCAAsC;YACtC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,IAAI,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAClC,sFAAsF;gBACtF,yFAAyF;gBACzF,UAAU;gBACV,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;gBACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;gBAC5C,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,2FAA2F;YAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;gBAChC,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;YACpC,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;QACvF,CAAC,CAAA;QAED,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAChB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAErB,OAAO,KAAC,kBAAkB,IACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAC9D,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC1D,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EACL,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,GACpF,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE9D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAO,GAAG,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,EAA2B,CAAA;IACrD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,WAAW,CAAC,MAAM;QACjE,CAAC,CAAC,WAAW,CAAC,MAAM;QACpB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAA;IAErB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,cAAc,CAAC,OAAO,CAAC,CAAA;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,EAAsB,CAAA;IAExD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,IAAI,KAAK,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,OAAM;QACR,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAE3B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,eAAe,CAAC,CAAA;QAC5D,yFAAyF;QACzF,yFAAyF;QACzF,iCAAiC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAA;QAEb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,0FAA0F;YAC1F,sCAAsC;YACtC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;YAElD,IAAI,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAClC,sFAAsF;gBACtF,yFAAyF;gBACzF,UAAU;gBACV,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;gBACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;gBAC5C,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,uFAAuF;gBACvF,yDAAyD;gBACzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzC,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,0FAA0F;YAC1F,4FAA4F;YAC5F,wFAAwF;YACxF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;gBAChC,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE;gBAC5C,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBAC/F,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAA;QAC/B,CAAC,CAAA;QAED,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAChB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAErB,OAAO,KAAC,kBAAkB,IACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAC9D,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC1D,CAAA;AACJ,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-client",
-  "version": "0.1.18-rc.26",
+  "version": "0.1.18-rc.27",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,22 +21,22 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.11",
-    "@owlmeans/auth-common": "^0.1.18-rc.15",
-    "@owlmeans/client": "^0.1.18-rc.18",
-    "@owlmeans/client-auth": "^0.1.18-rc.22",
-    "@owlmeans/client-context": "^0.1.18-rc.15",
-    "@owlmeans/client-i18n": "^0.1.18-rc.17",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.15",
-    "@owlmeans/client-resource": "^0.1.18-rc.15",
-    "@owlmeans/client-route": "^0.1.18-rc.15",
-    "@owlmeans/config": "^0.1.18-rc.14",
-    "@owlmeans/context": "^0.1.18-rc.10",
-    "@owlmeans/error": "^0.1.18-rc.10",
-    "@owlmeans/i18n": "^0.1.18-rc.10",
-    "@owlmeans/route": "^0.1.18-rc.11",
-    "@owlmeans/web-db": "^0.1.18-rc.16",
-    "@owlmeans/web-router": "^0.1.18-rc.16",
+    "@owlmeans/auth": "^0.1.18-rc.12",
+    "@owlmeans/auth-common": "^0.1.18-rc.16",
+    "@owlmeans/client": "^0.1.18-rc.19",
+    "@owlmeans/client-auth": "^0.1.18-rc.23",
+    "@owlmeans/client-context": "^0.1.18-rc.16",
+    "@owlmeans/client-i18n": "^0.1.18-rc.18",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.16",
+    "@owlmeans/client-resource": "^0.1.18-rc.16",
+    "@owlmeans/client-route": "^0.1.18-rc.16",
+    "@owlmeans/config": "^0.1.18-rc.15",
+    "@owlmeans/context": "^0.1.18-rc.11",
+    "@owlmeans/error": "^0.1.18-rc.11",
+    "@owlmeans/i18n": "^0.1.18-rc.11",
+    "@owlmeans/route": "^0.1.18-rc.12",
+    "@owlmeans/web-db": "^0.1.18-rc.17",
+    "@owlmeans/web-router": "^0.1.18-rc.17",
     "react-dropzone": "^14.3.5"
   },
   "peerDependencies": {

package/src/components/dispatcher/component.tsx

@@ -3,7 +3,7 @@ import { useEffect, useState } from 'react'
 import { useI18nLib } from '@owlmeans/client-i18n'
 import { AUTH_QUERY } from '@owlmeans/auth'
 import {
-  FallbackLoginScreen, LoginIntent, LoginOutcome, ResumeAction, resumeAction, LOGIN_FRESH_QUERY,
+  FallbackLoginScreen, LoginIntent, LoginOutcome, ResumeAction, resumeAction,
 } from '@owlmeans/client-auth/login'
 import { LoginSurrogateView, SurrogateStage } from '../../login/view.js'
 import { useContext } from '../../context.js'
@@ -42,14 +42,7 @@ export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
       return
     }
 
-    // `fresh` says this window was opened to PRODUCE a session, so one it merely finds on this
-    // origin is not the answer — see LOGIN_FRESH_QUERY. Kept identical to the relying party's own
-    // dispatcher: the last time these two held their own copy of a decision they drifted.
-    const found = query.has(LOGIN_FRESH_QUERY)
-      ? Promise.resolve(null)
-      : context.auth().authenticated()
-
-    void found.then(async authzToken => {
+    void context.auth().authenticated().then(async authzToken => {
       if (authzToken == null || authzToken === '') {
         setChoose(true)
 

package/src/entrypoints.ts

@@ -1,20 +1,20 @@
-import { DISPATCHER, DISPATCHER_SURROGATE } from '@owlmeans/auth'
-import { entrypoints as list } from '@owlmeans/client-auth'
-import { elevate } from '@owlmeans/client-entrypoint'
+import { authProtocols } from '@owlmeans/auth-common'
+import { entrypoints as authBindings } from '@owlmeans/client-auth'
+import { bindScreen } from '@owlmeans/client-entrypoint'
 import { handler } from '@owlmeans/client'
 import { Dispatcher } from './components/dispatcher/component.js'
 import { SurrogateScreen } from './login/screen.js'
 
-elevate(list, DISPATCHER, handler(Dispatcher))
-
 /**
- * Elevated here rather than in a relying-party package on purpose.
+ * Bound here rather than in a relying-party package on purpose.
  *
  * The surrogate mechanic is not OIDC-specific — it is "run the login route one window up and hand
  * the result back" — and every web application already spreads this list. Putting the screen here
  * means `web-panel`, `mui-panel` and every generated target gain a working login window with no
  * edit of their own, which is the only way an application that is already deployed can get it.
  */
-elevate(list, DISPATCHER_SURROGATE, handler(SurrogateScreen))
-
-export const entrypoints = list
+export const entrypoints = [
+  ...authBindings,
+  bindScreen(authProtocols.dispatcher, handler(Dispatcher)),
+  bindScreen(authProtocols.surrogate, handler(SurrogateScreen)),
+]

package/src/exports.ts

@@ -3,7 +3,7 @@ export { handler } from '@owlmeans/client'
 export { config } from '@owlmeans/client-context'
 export { service } from '@owlmeans/config'
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context'
-export { entrypoint, elevate, provideRequest, stab } from '@owlmeans/client-entrypoint'
+export { bind, bindAll, bindScreen, provideRequest, stab } from '@owlmeans/client-entrypoint'
 export { route, frontend } from '@owlmeans/route'
 export type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 export type { ClientEntrypoint as Module } from '@owlmeans/client-entrypoint'

package/src/helper.ts

@@ -1,5 +1,3 @@
-import { useEffect, useState } from 'react'
-import { useContext } from '@owlmeans/client'
 import type { AppConfig, AppContext } from './types.js'
 
 export const extractPrimaryHost = <C extends AppConfig = AppConfig, T extends AppContext<C> = AppContext<C>>(context: T) => {
@@ -8,39 +6,3 @@ export const extractPrimaryHost = <C extends AppConfig = AppConfig, T extends Ap
     context.cfg.primaryPort = window.location.port != null && window.location.port != '' ? parseInt(window.location.port) : undefined
   }
 }
-
-/**
- * Whether this browsing context currently holds a session — the flag a screen renders against
- * when it offers "Log in" or "Log out", a profile menu, or an authenticated-only panel.
- *
- * It reads the one channel the rest of the package reads, `context.auth().authenticated()`, which
- * answers from the auth service's token or, in a cold document, rehydrates it from the auth
- * resource. Nothing here touches storage or decodes a token: a second way to ask the same question
- * is a second thing to keep in step with logout.
- *
- * The answer is `false` until that promise settles and is not re-checked afterwards, because both
- * transitions out of the current answer replace the document — signing in navigates through the
- * dispatcher, and `auth().update(undefined)` assigns `document.location.href`. There is no in-page
- * change to subscribe to.
- *
- * This reports; it does not guard. `useSelfAuth` from `@owlmeans/client-auth` is the guard — it
- * sends an anonymous visitor to the dispatcher, which is the wrong behaviour for a component that
- * only wants to know which control to draw.
- */
-export const useAuthenticated = (): boolean => {
-  const context = useContext<AppConfig, AppContext>()
-  const [authenticated, setAuthenticated] = useState(false)
-
-  useEffect(() => {
-    let mounted = true
-    void context.auth().authenticated().then(token => {
-      if (mounted) {
-        setAuthenticated(token != null && token !== '')
-      }
-    })
-
-    return () => { mounted = false }
-  }, [])
-
-  return authenticated
-}

package/src/login/screen.tsx

@@ -3,8 +3,7 @@ import type { FC } from 'react'
 import { useContext } from '@owlmeans/client'
 import { useI18nLib } from '@owlmeans/client-i18n'
 import {
-  LoginIntent, LoginOutcome, LOGIN_FRESH_QUERY, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY,
-  LOGIN_NEXT_QUERY,
+  LoginIntent, LoginOutcome, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY,
 } from '@owlmeans/client-auth/login'
 import type { LoginService } from '@owlmeans/client-auth/login'
 import type { AppContext } from '../types.js'
@@ -18,22 +17,9 @@ import { LoginSurrogateView, SurrogateStage } from './view.js'
  * application, with its navigation, inside itself. This screen has no continuation at all — it
  * either hands something back and closes, or it says what it is waiting for.
  *
- * It does not run the authorization machine itself either: it forwards to the dispatcher (`next`),
- * which owns that flow.
- *
- * It used to short-circuit that when a session was already present on this origin — hand it back,
- * no provider round trip. That is wrong, and it was the whole of a reported defect. This window is
- * first-party on the application's origin, so what it finds there is whatever the person's own
- * tabs left behind, and a token being present says nothing about the record behind it still
- * existing: `authenticated()` reads storage and decodes an envelope, and no client asks the server.
- * A session that had been revoked, replaced or expired was therefore handed back to a window that
- * had asked for a LOGIN, adopted, and used to fail every call — and the next press of the same
- * button found the same dead token and did it again. Nothing recovered but clearing site data.
- *
- * So an explicit login PRODUCES a session. `fresh` says so to the dispatcher, which skips its own
- * resume for the same reason. The cost is one provider round trip that the provider's own session
- * normally answers without asking the person anything; the gain is that what comes back has just
- * been vouched for, and that signing in as somebody else is possible at all.
+ * It also never runs the authorization machine. When there is already a session here, that is the
+ * answer, and it goes back to the opener immediately — no provider round trip, no PKCE exchange.
+ * When there is not, it forwards to the dispatcher (`next`), which owns that flow.
  */
 export const SurrogateScreen: FC = () => {
   const context = useContext() as unknown as AppContext
@@ -76,6 +62,8 @@ export const SurrogateScreen: FC = () => {
     }
 
     const run = async (): Promise<void> => {
+      const token = await context.auth().authenticated()
+
       if (intent === LoginIntent.Logout) {
         // Revoked FIRST, before anything can be awaited on a channel that may never answer: a
         // window the user closes half a second later must still have ended the session it opened
@@ -90,22 +78,31 @@ export const SurrogateScreen: FC = () => {
         return
       }
 
-      // The dispatcher owns the authorization round trip, and the provider's callback lands there
-      // rather than on this route. Two things travel with it: the method the user already chose,
-      // so the dispatcher does not ask a second time in a window with no one to ask, and `fresh`,
-      // which tells it that a session it happens to find here is not the answer to this request.
+      if (token != null && token !== '') {
+        // Already signed in here. The framed application is the one that asked, so the session
+        // goes to it rather than being displayed to this window.
+        const outcome = await login.resume(token)
+        setStage(
+          outcome === LoginOutcome.Handled ? SurrogateStage.Handing
+            : outcome === LoginOutcome.Orphaned ? SurrogateStage.Orphaned
+              : SurrogateStage.Failed
+        )
+        return
+      }
+
+      // Nothing here yet — the dispatcher owns the authorization round trip, and the provider's
+      // callback lands there rather than on this route. The method the user already chose travels
+      // with it, so the dispatcher does not ask a second time in a window with no one to ask.
       const next = query.get(LOGIN_NEXT_QUERY)
       if (next == null || next === '') {
         setStage(SurrogateStage.Gesture)
         return
       }
       const method = query.get(LOGIN_METHOD_QUERY)
-      const params = new URLSearchParams()
-      if (method != null && method !== '') {
-        params.set(LOGIN_METHOD_QUERY, method)
-      }
-      params.set(LOGIN_FRESH_QUERY, '1')
-      window.location.href = `${next}${next.includes('?') ? '&' : '?'}${params.toString()}`
+      const target = method != null && method !== ''
+        ? `${next}${next.includes('?') ? '&' : '?'}${LOGIN_METHOD_QUERY}=${encodeURIComponent(method)}`
+        : next
+      window.location.href = target
     }
 
     void run().catch((e: Error) => {