@owlmeans/web-client 0.1.18-rc.50 → 0.1.18-rc.52

package/README.md

@@ -11,7 +11,7 @@ is the legacy MUI layer — start nothing new there. React Native apps use the `
 ## Installation
 
 ```bash
-bun add @owlmeans/web-client@^0.1.18-rc.50
+bun add @owlmeans/web-client@^0.1.18-rc.52
 ```
 
 ## Concepts
@@ -289,7 +289,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.38
+npx @owlmeans/agent-skills@^0.1.18-rc.39
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-client",
-  "version": "0.1.18-rc.50",
-  "generatedAt": "2026-09-23T19:57:40.685Z",
+  "version": "0.1.18-rc.52",
+  "generatedAt": "2026-09-25T12:22:06.199Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-client/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: web-client
-description: Bind OwlMeans shared entrypoint protocols in a browser application. Use when registering client routes, attaching React screens, calling API protocols, or configuring the browser context.
+description: Bind OwlMeans shared entrypoint protocols in a browser application. Use when registering client routes, attaching React screens (including lazily-loaded ones), calling API protocols, or configuring the browser context.
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # Browser protocol entrypoints
 
-**Install:** `bun add @owlmeans/web-client@^0.1.18-rc.50`
+**Install:** `bun add @owlmeans/web-client@^0.1.18-rc.52`
 
 Shared protocol declarations are immutable. Bind a complete protocol tree for callable API routes,
 then bind frontend declarations to screens.
@@ -31,11 +31,53 @@ const project = await context.entrypoint(projectProtocols.get).call({
 })
 ```
 
+## Lazily-loaded screens
+
+`lazyHandler` and `lazyComponent` (from `@owlmeans/client`) are re-exported here and by
+`@owlmeans/web-panel`, next to `handler`; so are, here only, the chunk-failure tools
+`retryImport`, `isChunkLoadError`, `reloadOnce` and `recoverFromChunkError` (types
+`LazyErrorRenderer`, `RetryImportOptions`). A `lazyHandler(...)` result binds exactly like
+`handler(Component)`; declare it at module scope, where the bindings live — never inside a render.
+
+```tsx
+import { bindScreen, lazyHandler } from '@owlmeans/web-client'
+
+const reportsScreen = lazyHandler(() => import('./screens/reports.js'), 'ReportsScreen', {
+  fallback: <Spinner />,
+})
+
+export const clientBindings = [
+  bindScreen(webProtocols.reports, reportsScreen),
+]
+// reportsScreen.preload() on hover/focus of a link renders the screen without its fallback.
+```
+
+The fallback renders inside the screen's own `Suspense` boundary, so the layout around it stays
+mounted while the chunk loads, and the screen's own error boundary keeps a failed chunk from
+unmounting it: a fetch failure is retried, then `error` renders — or, without one, the guarded
+reload starts. Rules and options: the `client` skill, Code-splitting and Chunk failures.
+
+## Rendering after an async boot
+
+If your app awaits something (e.g. `prepareI18n`) before calling `render()`, this is handled
+correctly — the render helper checks `document.readyState` rather than unconditionally waiting for
+an event that may already have fired. It waits for `DOMContentLoaded` only while the document is
+still `loading` and mounts at once otherwise; `renderApp` and `@owlmeans/web-panel`'s `render` both
+go through it.
+
+```ts
+import { prepareI18n } from '@owlmeans/client-i18n'
+
+await prepareI18n(context.cfg)
+renderApp(context)            // or @owlmeans/web-panel's render(context)
+```
+
 ## Rules
 
 - Declare paths, guards, gates and contracts once in the shared protocol tree.
 - Bind every API declaration the browser calls, including route parents.
-- Use `bindScreen(protocol, handler(Component))` only for frontend route declarations.
+- Use `bindScreen(protocol, handler(Component))` — or `lazyHandler(...)` — only for frontend route
+  declarations.
 - Do not replace request/response typing at a call site; update the shared contract instead.
 - Keep framework entrypoints and application entrypoints in one registered array, without mutating a
   shared declaration collection.

package/build/exports.d.ts

@@ -1,4 +1,5 @@
-export { handler } from '@owlmeans/client';
+export { handler, lazyHandler, lazyComponent, retryImport, isChunkLoadError, reloadOnce, recoverFromChunkError, chunkUrlOf, cacheBustedUrl, } from '@owlmeans/client';
+export type { LazyComponent, LazyComponentOptions, LazyErrorRenderer, LazyHandler, RetryImportOptions } from '@owlmeans/client';
 export { config } from '@owlmeans/client-context';
 export { service } from '@owlmeans/config';
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context';

package/build/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EACrG,UAAU,EAAE,cAAc,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EACxF,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,wBAAwB,CAAA"}

package/build/exports.js

@@ -1,4 +1,4 @@
-export { handler } from '@owlmeans/client';
+export { handler, lazyHandler, lazyComponent, retryImport, isChunkLoadError, reloadOnce, recoverFromChunkError, chunkUrlOf, cacheBustedUrl, } from '@owlmeans/client';
 export { config } from '@owlmeans/client-context';
 export { service } from '@owlmeans/config';
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context';

package/build/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EACrG,UAAU,EAAE,cAAc,GAC3B,MAAM,kBAAkB,CAAA;AAIzB,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA"}

package/build/login/screen.d.ts

@@ -7,9 +7,33 @@ import type { FC } from 'react';
  * application, with its navigation, inside itself. This screen has no continuation at all — it
  * either hands something back and closes, or it says what it is waiting for.
  *
- * It also never runs the authorization machine. When there is already a session here, that is the
- * answer, and it goes back to the opener immediately — no provider round trip, no PKCE exchange.
- * When there is not, it forwards to the dispatcher (`next`), which owns that flow.
+ * It also never runs the authorization machine itself: it forwards to the dispatcher (`next`),
+ * which owns that flow, and hands back what the dispatcher issued — see {@link surrogateLoginStep}
+ * for why a session already stored in this window is not simply handed back.
  */
+/** What a surrogate window opened to SIGN IN does with the session it may already hold. */
+export declare enum SurrogateLoginStep {
+    /** Drop the stored session and authenticate afresh through the dispatcher. */
+    Forget = "forget",
+    /** Hand the stored session to the opener — there is no dispatcher to authenticate through. */
+    Resume = "resume",
+    /** Nothing stored: authenticate through the dispatcher. */
+    Authenticate = "authenticate"
+}
+/**
+ * A sign-in request never reuses the session this window happens to hold.
+ *
+ * The opener asks for a sign-in only when it has no session its server accepts — and the window it
+ * opens does not share its storage: an embedded application's storage is partitioned by the top
+ * level site, the popup's is first-party. So the popup can hold a session the server has already
+ * REFUSED (its record gone after a restart, revoked, fenced). Handing that back closes the popup
+ * at once — a blink — and the opener fails its next request exactly as before, forever, because
+ * nothing in the opener can reach the popup's storage to clear it. A fresh round trip costs only
+ * redirects while the provider still has a session, and always yields a session the server holds.
+ *
+ * Only without a dispatcher address is the stored session handed back as it is: there is nothing
+ * to authenticate through, and the opener's own 401 handling drops it if it is refused.
+ */
+export declare const surrogateLoginStep: (token: string | null | undefined, next: string | null) => SurrogateLoginStep;
 export declare const SurrogateScreen: FC;
 //# sourceMappingURL=screen.d.ts.map

package/build/login/screen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAU/B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,EAAE,EA+F7B,CAAA"}
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAW/B;;;;;;;;;;;GAWG;AACH,2FAA2F;AAC3F,oBAAY,kBAAkB;IAC5B,8EAA8E;IAC9E,MAAM,WAAW;IACjB,8FAA8F;IAC9F,MAAM,WAAW;IACjB,2DAA2D;IAC3D,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,GAAG,IAAI,GAAG,SAAS,QAAQ,MAAM,GAAG,IAAI,KAAG,kBAO1F,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,EAyG7B,CAAA"}

package/build/login/screen.js

@@ -3,6 +3,7 @@ import { useCallback, useEffect, useState } from 'react';
 import { useContext } from '@owlmeans/client';
 import { useI18nLib } from '@owlmeans/client-i18n';
 import { LoginIntent, LoginOutcome, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY, } from '@owlmeans/client-auth/login';
+import { USER_ID } from '@owlmeans/client-auth';
 import { LoginSurrogateView, SurrogateStage } from './view.js';
 /**
  * The login window an embedded application opens one level up.
@@ -12,10 +13,41 @@ import { LoginSurrogateView, SurrogateStage } from './view.js';
  * application, with its navigation, inside itself. This screen has no continuation at all — it
  * either hands something back and closes, or it says what it is waiting for.
  *
- * It also never runs the authorization machine. When there is already a session here, that is the
- * answer, and it goes back to the opener immediately — no provider round trip, no PKCE exchange.
- * When there is not, it forwards to the dispatcher (`next`), which owns that flow.
+ * It also never runs the authorization machine itself: it forwards to the dispatcher (`next`),
+ * which owns that flow, and hands back what the dispatcher issued — see {@link surrogateLoginStep}
+ * for why a session already stored in this window is not simply handed back.
  */
+/** What a surrogate window opened to SIGN IN does with the session it may already hold. */
+export var SurrogateLoginStep;
+(function (SurrogateLoginStep) {
+    /** Drop the stored session and authenticate afresh through the dispatcher. */
+    SurrogateLoginStep["Forget"] = "forget";
+    /** Hand the stored session to the opener — there is no dispatcher to authenticate through. */
+    SurrogateLoginStep["Resume"] = "resume";
+    /** Nothing stored: authenticate through the dispatcher. */
+    SurrogateLoginStep["Authenticate"] = "authenticate";
+})(SurrogateLoginStep || (SurrogateLoginStep = {}));
+/**
+ * A sign-in request never reuses the session this window happens to hold.
+ *
+ * The opener asks for a sign-in only when it has no session its server accepts — and the window it
+ * opens does not share its storage: an embedded application's storage is partitioned by the top
+ * level site, the popup's is first-party. So the popup can hold a session the server has already
+ * REFUSED (its record gone after a restart, revoked, fenced). Handing that back closes the popup
+ * at once — a blink — and the opener fails its next request exactly as before, forever, because
+ * nothing in the opener can reach the popup's storage to clear it. A fresh round trip costs only
+ * redirects while the provider still has a session, and always yields a session the server holds.
+ *
+ * Only without a dispatcher address is the stored session handed back as it is: there is nothing
+ * to authenticate through, and the opener's own 401 handling drops it if it is refused.
+ */
+export const surrogateLoginStep = (token, next) => {
+    const stored = token != null && token !== '';
+    if (!stored) {
+        return SurrogateLoginStep.Authenticate;
+    }
+    return next != null && next !== '' ? SurrogateLoginStep.Forget : SurrogateLoginStep.Resume;
+};
 export const SurrogateScreen = () => {
     const context = useContext();
     const [query] = context.router().useSearchParams();
@@ -63,19 +95,27 @@ export const SurrogateScreen = () => {
                         : SurrogateStage.Failed);
                 return;
             }
-            if (token != null && token !== '') {
-                // Already signed in here. The framed application is the one that asked, so the session
-                // goes to it rather than being displayed to this window.
+            const next = query.get(LOGIN_NEXT_QUERY);
+            const step = surrogateLoginStep(token, next);
+            if (step === SurrogateLoginStep.Forget) {
+                // Dropped from this window's storage only — the web auth service's own clearing path
+                // navigates to the dispatcher, and `next` below is exactly where this window goes anyway.
+                const auth = context.auth();
+                await auth.store().delete(USER_ID);
+                auth.token = undefined;
+                auth.auth = undefined;
+            }
+            if (step === SurrogateLoginStep.Resume && token != null) {
+                // Signed in here and nowhere to authenticate afresh: hand what there is to the opener.
                 const outcome = await login.resume(token);
                 setStage(outcome === LoginOutcome.Handled ? SurrogateStage.Handing
                     : outcome === LoginOutcome.Orphaned ? SurrogateStage.Orphaned
                         : SurrogateStage.Failed);
                 return;
             }
-            // Nothing here yet — the dispatcher owns the authorization round trip, and the provider's
-            // callback lands there rather than on this route. The method the user already chose travels
-            // with it, so the dispatcher does not ask a second time in a window with no one to ask.
-            const next = query.get(LOGIN_NEXT_QUERY);
+            // The dispatcher owns the authorization round trip, and the provider's callback lands there
+            // rather than on this route. The method the user already chose travels with it, so the
+            // dispatcher does not ask a second time in a window with no one to ask.
             if (next == null || next === '') {
                 setStage(SurrogateStage.Gesture);
                 return;

package/build/login/screen.js.map

@@ -1 +1 @@
-{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EACL,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,GACpF,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE9D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAO,GAAG,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,EAA2B,CAAA;IACrD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,WAAW,CAAC,MAAM;QACjE,CAAC,CAAC,WAAW,CAAC,MAAM;QACpB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAA;IAErB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,cAAc,CAAC,OAAO,CAAC,CAAA;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,EAAsB,CAAA;IAExD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,IAAI,KAAK,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,OAAM;QACR,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAE3B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,eAAe,CAAC,CAAA;QAC5D,yFAAyF;QACzF,yFAAyF;QACzF,iCAAiC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAA;QAEb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,0FAA0F;YAC1F,sCAAsC;YACtC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;YAElD,IAAI,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAClC,sFAAsF;gBACtF,yFAAyF;gBACzF,UAAU;gBACV,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;gBACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;gBAC5C,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,uFAAuF;gBACvF,yDAAyD;gBACzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzC,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,0FAA0F;YAC1F,4FAA4F;YAC5F,wFAAwF;YACxF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;gBAChC,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE;gBAC5C,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBAC/F,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAA;QAC/B,CAAC,CAAA;QAED,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAChB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAErB,OAAO,KAAC,kBAAkB,IACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAC9D,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC1D,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EACL,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,GACpF,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE9D;;;;;;;;;;;GAWG;AACH,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,8EAA8E;IAC9E,uCAAiB,CAAA;IACjB,8FAA8F;IAC9F,uCAAiB,CAAA;IACjB,2DAA2D;IAC3D,mDAA6B,CAAA;AAC/B,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAgC,EAAE,IAAmB,EAAsB,EAAE;IAC9G,MAAM,MAAM,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAA;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,kBAAkB,CAAC,YAAY,CAAA;IACxC,CAAC;IAED,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAA;AAC5F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAO,GAAG,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,EAA2B,CAAA;IACrD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,WAAW,CAAC,MAAM;QACjE,CAAC,CAAC,WAAW,CAAC,MAAM;QACpB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAA;IAErB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,cAAc,CAAC,OAAO,CAAC,CAAA;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,EAAsB,CAAA;IAExD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,IAAI,KAAK,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,OAAM;QACR,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAE3B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,eAAe,CAAC,CAAA;QAC5D,yFAAyF;QACzF,yFAAyF;QACzF,iCAAiC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAA;QAEb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,0FAA0F;YAC1F,sCAAsC;YACtC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;YAElD,IAAI,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAClC,sFAAsF;gBACtF,yFAAyF;gBACzF,UAAU;gBACV,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;gBACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;gBAC5C,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YAE5C,IAAI,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;gBACvC,qFAAqF;gBACrF,0FAA0F;gBAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;gBAC3B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAClC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;gBACtB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;YACvB,CAAC;YAED,IAAI,IAAI,KAAK,kBAAkB,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACxD,uFAAuF;gBACvF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzC,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,4FAA4F;YAC5F,uFAAuF;YACvF,wEAAwE;YACxE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;gBAChC,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE;gBAC5C,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBAC/F,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAA;QAC/B,CAAC,CAAA;QAED,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAChB,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAErB,OAAO,KAAC,kBAAkB,IACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAC9D,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC1D,CAAA;AACJ,CAAC,CAAA"}

package/build/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGtC,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAGtE,eAAO,MAAM,MAAM,SAAU,SAAS,SAAS,aAAa,SAkB3D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,aAAa,aAAa,SAAS,SACQ,CAAA"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAGtC,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAGtE,eAAO,MAAM,MAAM,SAAU,SAAS,SAAS,aAAa,SAyB3D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,aAAa,aAAa,SAAS,SACQ,CAAA"}

package/build/main.js

@@ -19,7 +19,15 @@ export const render = (node, opts) => {
             createRoot(root).render(node);
         }
     };
-    opts?.onReady ?? true ? window.addEventListener('DOMContentLoaded', _callback) : _callback();
+    // Wait for the DOM only while it is still loading: a caller that awaits something first
+    // (`await prepareI18n(cfg); render(...)`) can run after `DOMContentLoaded` has already fired,
+    // and a listener added then never runs — the app would never mount.
+    if ((opts?.onReady ?? true) && document.readyState === 'loading') {
+        window.addEventListener('DOMContentLoaded', _callback, { once: true });
+    }
+    else {
+        _callback();
+    }
 };
 /**
  * Mount the application.

package/build/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAe,EAAE,IAAoB,EAAE,EAAE;IAC9D,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,IAAI,YAAY,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AAC9F,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAU,EAAE,IAAoB,EAAE,QAAoB,EACtD,EAAE,CAAC,MAAM,CAAC,KAAC,MAAM,IAAC,OAAO,EAAE,OAAO,YAAG,QAAQ,GAAU,EAAE,IAAI,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAe,EAAE,IAAoB,EAAE,EAAE;IAC9D,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,IAAI,YAAY,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,wFAAwF;IACxF,8FAA8F;IAC9F,oEAAoE;IACpE,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjE,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;SAAM,CAAC;QACN,SAAS,EAAE,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAU,EAAE,IAAoB,EAAE,QAAoB,EACtD,EAAE,CAAC,MAAM,CAAC,KAAC,MAAM,IAAC,OAAO,EAAE,OAAO,YAAG,QAAQ,GAAU,EAAE,IAAI,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-client",
-  "version": "0.1.18-rc.50",
+  "version": "0.1.18-rc.52",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,22 +21,22 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.35",
-    "@owlmeans/auth-common": "^0.1.18-rc.37",
-    "@owlmeans/client": "^0.1.18-rc.40",
-    "@owlmeans/client-auth": "^0.1.18-rc.47",
-    "@owlmeans/client-context": "^0.1.18-rc.38",
-    "@owlmeans/client-i18n": "^0.1.18-rc.39",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.37",
-    "@owlmeans/client-resource": "^0.1.18-rc.37",
-    "@owlmeans/client-route": "^0.1.18-rc.38",
-    "@owlmeans/config": "^0.1.18-rc.37",
+    "@owlmeans/auth": "^0.1.18-rc.36",
+    "@owlmeans/auth-common": "^0.1.18-rc.38",
+    "@owlmeans/client": "^0.1.18-rc.42",
+    "@owlmeans/client-auth": "^0.1.18-rc.49",
+    "@owlmeans/client-context": "^0.1.18-rc.39",
+    "@owlmeans/client-i18n": "^0.1.18-rc.41",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.38",
+    "@owlmeans/client-resource": "^0.1.18-rc.38",
+    "@owlmeans/client-route": "^0.1.18-rc.39",
+    "@owlmeans/config": "^0.1.18-rc.38",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/error": "^0.1.18-rc.35",
-    "@owlmeans/i18n": "^0.1.18-rc.36",
+    "@owlmeans/error": "^0.1.18-rc.36",
+    "@owlmeans/i18n": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/web-db": "^0.1.18-rc.38",
-    "@owlmeans/web-router": "^0.1.18-rc.38",
+    "@owlmeans/web-db": "^0.1.18-rc.39",
+    "@owlmeans/web-router": "^0.1.18-rc.40",
     "react-dropzone": "^14.3.5"
   },
   "peerDependencies": {

package/src/exports.ts

@@ -1,5 +1,11 @@
 
-export { handler } from '@owlmeans/client'
+export {
+  handler, lazyHandler, lazyComponent, retryImport, isChunkLoadError, reloadOnce, recoverFromChunkError,
+  chunkUrlOf, cacheBustedUrl,
+} from '@owlmeans/client'
+export type {
+  LazyComponent, LazyComponentOptions, LazyErrorRenderer, LazyHandler, RetryImportOptions
+} from '@owlmeans/client'
 export { config } from '@owlmeans/client-context'
 export { service } from '@owlmeans/config'
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context'

package/src/login/screen.tsx

@@ -6,6 +6,7 @@ import {
   LoginIntent, LoginOutcome, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY,
 } from '@owlmeans/client-auth/login'
 import type { LoginService } from '@owlmeans/client-auth/login'
+import { USER_ID } from '@owlmeans/client-auth'
 import type { AppContext } from '../types.js'
 import { LoginSurrogateView, SurrogateStage } from './view.js'
 
@@ -17,10 +18,43 @@ import { LoginSurrogateView, SurrogateStage } from './view.js'
  * application, with its navigation, inside itself. This screen has no continuation at all — it
  * either hands something back and closes, or it says what it is waiting for.
  *
- * It also never runs the authorization machine. When there is already a session here, that is the
- * answer, and it goes back to the opener immediately — no provider round trip, no PKCE exchange.
- * When there is not, it forwards to the dispatcher (`next`), which owns that flow.
+ * It also never runs the authorization machine itself: it forwards to the dispatcher (`next`),
+ * which owns that flow, and hands back what the dispatcher issued — see {@link surrogateLoginStep}
+ * for why a session already stored in this window is not simply handed back.
  */
+/** What a surrogate window opened to SIGN IN does with the session it may already hold. */
+export enum SurrogateLoginStep {
+  /** Drop the stored session and authenticate afresh through the dispatcher. */
+  Forget = 'forget',
+  /** Hand the stored session to the opener — there is no dispatcher to authenticate through. */
+  Resume = 'resume',
+  /** Nothing stored: authenticate through the dispatcher. */
+  Authenticate = 'authenticate',
+}
+
+/**
+ * A sign-in request never reuses the session this window happens to hold.
+ *
+ * The opener asks for a sign-in only when it has no session its server accepts — and the window it
+ * opens does not share its storage: an embedded application's storage is partitioned by the top
+ * level site, the popup's is first-party. So the popup can hold a session the server has already
+ * REFUSED (its record gone after a restart, revoked, fenced). Handing that back closes the popup
+ * at once — a blink — and the opener fails its next request exactly as before, forever, because
+ * nothing in the opener can reach the popup's storage to clear it. A fresh round trip costs only
+ * redirects while the provider still has a session, and always yields a session the server holds.
+ *
+ * Only without a dispatcher address is the stored session handed back as it is: there is nothing
+ * to authenticate through, and the opener's own 401 handling drops it if it is refused.
+ */
+export const surrogateLoginStep = (token: string | null | undefined, next: string | null): SurrogateLoginStep => {
+  const stored = token != null && token !== ''
+  if (!stored) {
+    return SurrogateLoginStep.Authenticate
+  }
+
+  return next != null && next !== '' ? SurrogateLoginStep.Forget : SurrogateLoginStep.Resume
+}
+
 export const SurrogateScreen: FC = () => {
   const context = useContext() as unknown as AppContext
   const [query] = context.router().useSearchParams()
@@ -78,9 +112,20 @@ export const SurrogateScreen: FC = () => {
         return
       }
 
-      if (token != null && token !== '') {
-        // Already signed in here. The framed application is the one that asked, so the session
-        // goes to it rather than being displayed to this window.
+      const next = query.get(LOGIN_NEXT_QUERY)
+      const step = surrogateLoginStep(token, next)
+
+      if (step === SurrogateLoginStep.Forget) {
+        // Dropped from this window's storage only — the web auth service's own clearing path
+        // navigates to the dispatcher, and `next` below is exactly where this window goes anyway.
+        const auth = context.auth()
+        await auth.store().delete(USER_ID)
+        auth.token = undefined
+        auth.auth = undefined
+      }
+
+      if (step === SurrogateLoginStep.Resume && token != null) {
+        // Signed in here and nowhere to authenticate afresh: hand what there is to the opener.
         const outcome = await login.resume(token)
         setStage(
           outcome === LoginOutcome.Handled ? SurrogateStage.Handing
@@ -90,10 +135,9 @@ export const SurrogateScreen: FC = () => {
         return
       }
 
-      // Nothing here yet — the dispatcher owns the authorization round trip, and the provider's
-      // callback lands there rather than on this route. The method the user already chose travels
-      // with it, so the dispatcher does not ask a second time in a window with no one to ask.
-      const next = query.get(LOGIN_NEXT_QUERY)
+      // The dispatcher owns the authorization round trip, and the provider's callback lands there
+      // rather than on this route. The method the user already chose travels with it, so the
+      // dispatcher does not ask a second time in a window with no one to ask.
       if (next == null || next === '') {
         setStage(SurrogateStage.Gesture)
         return

package/src/main.tsx

@@ -22,7 +22,14 @@ export const render = (node: ReactNode, opts?: RenderOptions) => {
     }
   }
 
-  opts?.onReady ?? true ? window.addEventListener('DOMContentLoaded', _callback) : _callback()
+  // Wait for the DOM only while it is still loading: a caller that awaits something first
+  // (`await prepareI18n(cfg); render(...)`) can run after `DOMContentLoaded` has already fired,
+  // and a listener added then never runs — the app would never mount.
+  if ((opts?.onReady ?? true) && document.readyState === 'loading') {
+    window.addEventListener('DOMContentLoaded', _callback, { once: true })
+  } else {
+    _callback()
+  }
 }
 
 /**

package/tests/surrogate.spec.ts

@@ -50,3 +50,22 @@ describe('centeredPopupFeatures', () => {
     expect(centeredPopupFeatures(520, 760)).toBe('popup=yes,width=520,height=760,left=0,top=0')
   })
 })
+
+describe('surrogateLoginStep', () => {
+  test('a stored session is forgotten when there is a dispatcher to authenticate through', async () => {
+    const { surrogateLoginStep, SurrogateLoginStep } = await import('../src/login/screen.js')
+    expect(surrogateLoginStep('OIDC-WRAPPED-TOKEN abc', '/dispatcher?x=1')).toBe(SurrogateLoginStep.Forget)
+  })
+
+  test('a stored session is handed back only when there is no dispatcher address', async () => {
+    const { surrogateLoginStep, SurrogateLoginStep } = await import('../src/login/screen.js')
+    expect(surrogateLoginStep('OIDC-WRAPPED-TOKEN abc', null)).toBe(SurrogateLoginStep.Resume)
+    expect(surrogateLoginStep('OIDC-WRAPPED-TOKEN abc', '')).toBe(SurrogateLoginStep.Resume)
+  })
+
+  test('nothing stored authenticates, with or without a dispatcher address', async () => {
+    const { surrogateLoginStep, SurrogateLoginStep } = await import('../src/login/screen.js')
+    expect(surrogateLoginStep(null, '/dispatcher')).toBe(SurrogateLoginStep.Authenticate)
+    expect(surrogateLoginStep('', null)).toBe(SurrogateLoginStep.Authenticate)
+  })
+})