@owlmeans/web-client 0.1.18-rc.6 → 0.1.18-rc.9

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-client",
-  "version": "0.1.18-rc.6",
-  "generatedAt": "2026-08-18T14:48:00.525Z",
+  "version": "0.1.18-rc.9",
+  "generatedAt": "2026-08-24T21:14:00.125Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-client/SKILL.md

@@ -8,19 +8,21 @@ user-invocable: false
 # @owlmeans/web-client
 
 **Layer:** Web (React)
-**Install:** `"@owlmeans/web-client": "^0.1.18-rc.6"` in `dependencies`
+**Install:** `"@owlmeans/web-client": "^0.1.18-rc.9"` in `dependencies`
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
 | `renderApp<C, T>(context)` | Mount the React app (routing via the active router plugin — OwlMeans by default) |
-| `elevate(modules, alias, handler)` | Attach a React component (or `handler(Component)`) to an entrypoint |
+| `elevate(entrypoints, alias, handler)` | Attach a React component (or `handler(Component)`) to an entrypoint |
 | `handler(Component)` | Wrap a React component as an entrypoint handler |
-| `context.registerEntrypoints(modules)` | Register the full entrypoint list on the context |
+| `context.registerEntrypoints(entrypoints)` | Register the full entrypoint list on the context |
 | `context.serviceRoute(alias, isDefault?)` | Mark a service's routing root |
+| `makeContext(cfg)` | Build the browser context — auth, web db, client resource, router and login are all appended here |
+| `appendWebLogin(context)` | Register the login host plus the redirect and surrogate-window plugins |
 | `router`, `components`, `service`, `i18n`, `helpers`, `errors` | Web-specific helpers |
-| Constants | Default aliases (BASE, HOME) |
+| Constants | Default aliases (BASE, HOME), `REDIRECT_LOGIN`, `SURROGATE_LOGIN` |
 
 ## Usage
 
@@ -29,31 +31,64 @@ user-invocable: false
 // index.tsx
 import { renderApp } from '@owlmeans/web-client'
 import { makeContext } from './context.js'
-import { appModules } from './modules.js'
+import { appEntrypoints } from './entrypoints.js'
 import { MANAGER, MANAGER_API } from 'my-common'
 import config from './config.js'
 
 const context = makeContext(config)
-context.registerEntrypoints(appModules)
+context.registerEntrypoints(appEntrypoints)
 context.serviceRoute(MANAGER, true)
 context.serviceRoute(MANAGER_API, true)
 renderApp<Config, Context>(context)
 ```
 
-### Module elevation with React components
+### Entrypoint elevation with React components
 ```typescript
-import { elevate, route, frontend, handler, entrypoint, guard } from '@owlmeans/web-client'
+import { elevate, route, frontend, handler, entrypoint } from '@owlmeans/web-client'
 import { HomeScreen, ProjectDashboardScreen } from './screens/index.js'
 
-elevate(modules, manager.front.project.dashboard, handler(ProjectDashboardScreen))
+elevate(entrypoints, manager.front.project.dashboard, handler(ProjectDashboardScreen))
 
-modules.push(
+entrypoints.push(
   entrypoint(route(HOME, '/', frontend({ default: true, parent: BASE })), handler(HomeScreen))
 )
 ```
 
+A **backend** alias the client calls needs a bare `elevate(entrypoints, alias)` — no handler. That
+makes `context.entrypoint<ClientEntrypoint<T>>(alias).call({ params, body, query })` work; the auth
+header is attached automatically for guarded entrypoints.
+
+### Login comes with the context
+
+`makeContext` calls `appendWebLogin`, which registers the login host (`@owlmeans/client-auth/login`)
+and both browser plugins on it — redirect (`REDIRECT_LOGIN`, priority 0, applies always) and
+surrogate window (`SURROGATE_LOGIN`, priority 100, applies in a frame or in the surrogate itself).
+So every web app — and everything built on `web-panel` or `mui-panel` — has working sign-in,
+including from an embedded app, with nothing registered by hand:
+
+```typescript
+import { useLogin, useLogout } from '@owlmeans/client-auth/login'
+
+const [, onLogIn] = useLogin()   // one control, one handler, no environment checks
+```
+
+An app that needs a different mechanic registers its own plugin at a higher priority after building
+the base context (`context.login().registerPlugin(...)`); it never replaces these. The contract, the
+cascade and the invariants are the `login-plugins` skill.
+
+### Navigation
+```typescript
+import { useNavigate } from '@owlmeans/client'   // not re-exported by web-client
+import { useStoreList, useStoreModel } from '@owlmeans/client'   // client state — also not re-exported
+
+const nav = useNavigate()
+<Button onClick={nav.press(manager.front.project.dashboard, { params: { projectId } })}>Open</Button>
+await nav.go(alias, { params })   // programmatic; nav.back() to go back
+```
+
 ## Depends On
 
 - `@owlmeans/client`, `@owlmeans/web-router` (default OwlMeans browser routing), `@owlmeans/web-panel` (typically), `@owlmeans/client-i18n`
+- `@owlmeans/client-auth` — `AUTH_RESOURCE` and the `./login` host the browser plugins register on
 - `@owlmeans/entrypoint`, `@owlmeans/route`
 - `react`, `react-dom` (peer). No longer depends on `react-router` — opt into it with `@owlmeans/web-router-react-router` (`appendReactRouter`). The former `provide` export is a deprecated `undefined`.

package/build/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AASlD,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,OAC7F,CAAC,KACL,CAYF,CAAA;AAED,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,SAAS,GAAG,SAAS,EAAC,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QACnF,CAAA"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAUlD,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,OAC7F,CAAC,KACL,CAaF,CAAA;AAED,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,SAAS,GAAG,SAAS,EAAC,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QACnF,CAAA"}

package/build/context.js

@@ -6,6 +6,7 @@ import { useContext as useCtx } from '@owlmeans/client';
 import { extractPrimaryHost } from './helper.js';
 import { appendWebAuthService } from './service.js';
 import { appendWebRouter } from '@owlmeans/web-router';
+import { appendWebLogin } from './login/service.js';
 export const makeContext = (cfg) => {
     const context = makeClientContext(cfg);
     extractPrimaryHost(context);
@@ -13,6 +14,7 @@ export const makeContext = (cfg) => {
     appendWebDbService(context);
     appendClientResource(context, AUTH_RESOURCE);
     appendWebRouter(context);
+    appendWebLogin(context);
     context.makeContext = makeContext;
     return context;
 };

package/build/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,UAAU,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAM,EACH,EAAE;IACL,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAC3C,kBAAkB,CAAO,OAAO,CAAC,CAAA;IAEjC,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,kBAAkB,CAAO,OAAO,CAAC,CAAA;IACjC,oBAAoB,CAAO,OAAO,EAAE,aAAa,CAAC,CAAA;IAClD,eAAe,CAAO,OAAO,CAAC,CAAA;IAE9B,OAAO,CAAC,WAAW,GAAG,WAAyC,CAAA;IAE/D,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,GAA4E,EAAE,CACtG,MAAM,EAAO,CAAA"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,UAAU,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAM,EACH,EAAE;IACL,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAC3C,kBAAkB,CAAO,OAAO,CAAC,CAAA;IAEjC,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,kBAAkB,CAAO,OAAO,CAAC,CAAA;IACjC,oBAAoB,CAAO,OAAO,EAAE,aAAa,CAAC,CAAA;IAClD,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,cAAc,CAAO,OAAO,CAAC,CAAA;IAE7B,OAAO,CAAC,WAAW,GAAG,WAAyC,CAAA;IAE/D,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,GAA4E,EAAE,CACtG,MAAM,EAAO,CAAA"}

package/build/exports.d.ts

@@ -4,6 +4,7 @@ export { service } from '@owlmeans/config';
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context';
 export { entrypoint, elevate, provideRequest, stab } from '@owlmeans/client-entrypoint';
 export { route, frontend } from '@owlmeans/route';
+export type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
 export type { ClientEntrypoint as Module } from '@owlmeans/client-entrypoint';
 export type { ClientRoute as Route } from '@owlmeans/client-route';
 //# sourceMappingURL=exports.d.ts.map

package/build/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../src/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,YAAY,EAAE,gBAAgB,IAAI,MAAM,EAAE,MAAM,6BAA6B,CAAA;AAC7E,YAAY,EAAE,WAAW,IAAI,KAAK,EAAE,MAAM,wBAAwB,CAAA"}

package/build/index.d.ts

@@ -10,4 +10,5 @@ export * from './helper.js';
 export * from './i18n.js';
 export * from './service.js';
 export * from './errors.js';
+export * from './login/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA"}

package/build/index.js

@@ -10,4 +10,5 @@ export * from './helper.js';
 export * from './i18n.js';
 export * from './service.js';
 export * from './errors.js';
+export * from './login/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA"}

package/build/login/consts.d.ts

@@ -0,0 +1,11 @@
+/** The ordinary flow: leave for the provider and come back. */
+export declare const REDIRECT_LOGIN = "owlmeans-redirect-login";
+/** The flow that runs one window up, for a document that cannot redirect where it is. */
+export declare const SURROGATE_LOGIN = "owlmeans-surrogate-login";
+/**
+ * Registered above the default so it wins the cascade wherever it applies. It applies narrowly —
+ * only in a frame, or in the surrogate window itself — so the default still serves every
+ * ordinary tab.
+ */
+export declare const SURROGATE_LOGIN_PRIORITY = 100;
+//# sourceMappingURL=consts.d.ts.map

package/build/login/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,4BAA4B,CAAA;AAEvD,yFAAyF;AACzF,eAAO,MAAM,eAAe,6BAA6B,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA"}

package/build/login/consts.js

@@ -0,0 +1,11 @@
+/** The ordinary flow: leave for the provider and come back. */
+export const REDIRECT_LOGIN = 'owlmeans-redirect-login';
+/** The flow that runs one window up, for a document that cannot redirect where it is. */
+export const SURROGATE_LOGIN = 'owlmeans-surrogate-login';
+/**
+ * Registered above the default so it wins the cascade wherever it applies. It applies narrowly —
+ * only in a frame, or in the surrogate window itself — so the default still serves every
+ * ordinary tab.
+ */
+export const SURROGATE_LOGIN_PRIORITY = 100;
+//# sourceMappingURL=consts.js.map

package/build/login/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/login/consts.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAyB,CAAA;AAEvD,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA"}

package/build/login/index.d.ts

@@ -0,0 +1,5 @@
+export * from './consts.js';
+export * from './redirect.js';
+export * from './surrogate.js';
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/build/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA"}

package/build/login/index.js

@@ -0,0 +1,5 @@
+export * from './consts.js';
+export * from './redirect.js';
+export * from './surrogate.js';
+export * from './service.js';
+//# sourceMappingURL=index.js.map

package/build/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA"}

package/build/login/redirect.d.ts

@@ -0,0 +1,9 @@
+import type { LoginPlugin } from '@owlmeans/client-auth/login';
+/**
+ * The ordinary login flow: this document leaves for the identity provider and comes back.
+ *
+ * The default plugin, matching everything, so any environment that does not need special handling
+ * behaves exactly as it always did.
+ */
+export declare const makeRedirectLoginPlugin: () => LoginPlugin;
+//# sourceMappingURL=redirect.d.ts.map

package/build/login/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/login/redirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAG9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAO,WA2BzC,CAAA"}

package/build/login/redirect.js

@@ -0,0 +1,31 @@
+import { LoginOutcome } from '@owlmeans/client-auth/login';
+import { REDIRECT_LOGIN } from './consts.js';
+/**
+ * The ordinary login flow: this document leaves for the identity provider and comes back.
+ *
+ * The default plugin, matching everything, so any environment that does not need special handling
+ * behaves exactly as it always did.
+ */
+export const makeRedirectLoginPlugin = () => ({
+    alias: REDIRECT_LOGIN,
+    priority: 0,
+    mode: 'redirect',
+    match: () => true,
+    begin: async (_ctx, request) => {
+        // Prefer the in-app continuation the caller handed over: a client-side navigation to the
+        // dispatcher keeps the app mounted, where a full page load would tear it down and rebuild it.
+        if (request.navigate != null) {
+            await request.navigate();
+            return LoginOutcome.Handled;
+        }
+        window.location.href = request.url;
+        return LoginOutcome.Redirected;
+    },
+    authorize: async (_ctx, url) => {
+        window.location.href = url;
+        return LoginOutcome.Redirected;
+    },
+    // Nothing to hand anywhere — the token was issued in the document that will use it.
+    complete: async () => LoginOutcome.Passed,
+});
+//# sourceMappingURL=redirect.js.map

package/build/login/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/login/redirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAgB,EAAE,CAAC,CAAC;IACzD,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;IAEjB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7B,yFAAyF;QACzF,8FAA8F;QAC9F,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;YAExB,OAAO,YAAY,CAAC,OAAO,CAAA;QAC7B,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAA;QAElC,OAAO,YAAY,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;QAE1B,OAAO,YAAY,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,oFAAoF;IACpF,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM;CAC1C,CAAC,CAAA"}

package/build/login/service.d.ts

@@ -0,0 +1,10 @@
+import type { BasicConfig, BasicContext } from '@owlmeans/context';
+/**
+ * Register the login host and the two browser flows on a context.
+ *
+ * Called by `makeContext`, so every web app has working login — including a framed one — without
+ * registering anything. An app that needs a different mechanic registers its own plugin at a
+ * higher priority; it does not replace this.
+ */
+export declare const appendWebLogin: <C extends BasicConfig, T extends BasicContext<C>>(ctx: T) => T;
+//# sourceMappingURL=service.d.ts.map

package/build/login/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIlE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAG,CAMzF,CAAA"}

package/build/login/service.js

@@ -0,0 +1,17 @@
+import { appendLogin } from '@owlmeans/client-auth/login';
+import { makeRedirectLoginPlugin } from './redirect.js';
+import { makeSurrogateLoginPlugin } from './surrogate.js';
+/**
+ * Register the login host and the two browser flows on a context.
+ *
+ * Called by `makeContext`, so every web app has working login — including a framed one — without
+ * registering anything. An app that needs a different mechanic registers its own plugin at a
+ * higher priority; it does not replace this.
+ */
+export const appendWebLogin = (ctx) => {
+    const service = appendLogin(ctx).login();
+    service.registerPlugin(makeRedirectLoginPlugin());
+    service.registerPlugin(makeSurrogateLoginPlugin());
+    return ctx;
+};
+//# sourceMappingURL=service.js.map

package/build/login/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAmD,GAAM,EAAK,EAAE;IAC5F,MAAM,OAAO,GAAG,WAAW,CAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAA;IAC9C,OAAO,CAAC,cAAc,CAAC,uBAAuB,EAAE,CAAC,CAAA;IACjD,OAAO,CAAC,cAAc,CAAC,wBAAwB,EAAE,CAAC,CAAA;IAElD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/build/login/surrogate.d.ts

@@ -0,0 +1,21 @@
+import type { LoginPlugin } from '@owlmeans/client-auth/login';
+/**
+ * Login for a document that cannot complete the flow where it is.
+ *
+ * An app embedded in a frame cannot redirect to an identity provider: the provider refuses to be
+ * embedded (`frame-ancestors`), and its session cookies are third-party there. So the flow runs
+ * one window up, in a surrogate window that is top-level and first-party on this application's own
+ * origin — where the very same flow completes normally — and the token is passed back to the
+ * document that asked for it.
+ *
+ * This plugin is deliberately not OIDC-specific. The mechanic is "run the login route one window
+ * up and hand the token back", and the adoption is the plain auth service, so any relying party
+ * that renders a login route gets it by registering nothing.
+ *
+ * `match` covers BOTH halves of the lifecycle — the framed opener and the surrogate itself, where
+ * `embedded` is false. Inside the surrogate the redirect plugin must not win: that window IS
+ * top-level, so it authorizes by an ordinary redirect and differs only in what it does with the
+ * token at the end.
+ */
+export declare const makeSurrogateLoginPlugin: () => LoginPlugin;
+//# sourceMappingURL=surrogate.d.ts.map

package/build/login/surrogate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surrogate.d.ts","sourceRoot":"","sources":["../../src/login/surrogate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAG5E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,QAAO,WAiG1C,CAAA"}

package/build/login/surrogate.js

@@ -0,0 +1,105 @@
+import { adoptToken, clearSurrogate, markSurrogate, LoginOutcome, LOGIN_SURROGATE_FEATURES, LOGIN_SURROGATE_NAME, LOGIN_TOKEN_MESSAGE, LOGIN_WATCH_INTERVAL, } from '@owlmeans/client-auth/login';
+import { SURROGATE_LOGIN, SURROGATE_LOGIN_PRIORITY } from './consts.js';
+/**
+ * Login for a document that cannot complete the flow where it is.
+ *
+ * An app embedded in a frame cannot redirect to an identity provider: the provider refuses to be
+ * embedded (`frame-ancestors`), and its session cookies are third-party there. So the flow runs
+ * one window up, in a surrogate window that is top-level and first-party on this application's own
+ * origin — where the very same flow completes normally — and the token is passed back to the
+ * document that asked for it.
+ *
+ * This plugin is deliberately not OIDC-specific. The mechanic is "run the login route one window
+ * up and hand the token back", and the adoption is the plain auth service, so any relying party
+ * that renders a login route gets it by registering nothing.
+ *
+ * `match` covers BOTH halves of the lifecycle — the framed opener and the surrogate itself, where
+ * `embedded` is false. Inside the surrogate the redirect plugin must not win: that window IS
+ * top-level, so it authorizes by an ordinary redirect and differs only in what it does with the
+ * token at the end.
+ */
+export const makeSurrogateLoginPlugin = () => ({
+    alias: SURROGATE_LOGIN,
+    priority: SURROGATE_LOGIN_PRIORITY,
+    mode: 'surrogate',
+    match: env => env.hasWindow && (env.embedded || env.surrogate),
+    enter: () => { markSurrogate(); },
+    begin: (ctx, request, env) => {
+        // Already one window up — nothing to open, just run the flow.
+        if (env.surrogate) {
+            window.location.href = request.url;
+            return Promise.resolve(LoginOutcome.Redirected);
+        }
+        // Opened FIRST and synchronously: `window.open` escapes the popup blocker only while the user
+        // gesture is still being handled, so nothing may be awaited before this line. That is why this
+        // function is not `async`.
+        const surrogate = window.open(request.url, LOGIN_SURROGATE_NAME, LOGIN_SURROGATE_FEATURES);
+        if (surrogate == null) {
+            return Promise.resolve(LoginOutcome.Failed);
+        }
+        return new Promise(resolve => {
+            let settled = false;
+            let watch;
+            const finish = (result) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                window.removeEventListener('message', onMessage);
+                if (watch != null) {
+                    clearInterval(watch);
+                }
+                resolve(result);
+            };
+            function onMessage(event) {
+                if (event.origin !== window.location.origin) {
+                    return;
+                }
+                const data = event.data;
+                if (data?.type !== LOGIN_TOKEN_MESSAGE || data.token == null || data.token === '') {
+                    return;
+                }
+                void adoptToken(ctx, data.token)
+                    .then(() => finish(LoginOutcome.Handled))
+                    .catch(() => finish(LoginOutcome.Failed));
+            }
+            window.addEventListener('message', onMessage);
+            // A window the user simply closes announces nothing, so the only way to stop waiting on it
+            // is to watch for it going away.
+            watch = setInterval(() => {
+                if (surrogate.closed) {
+                    finish(LoginOutcome.Failed);
+                }
+            }, LOGIN_WATCH_INTERVAL);
+        });
+    },
+    authorize: async (_ctx, url, env) => {
+        // The surrogate is top-level, so it redirects like any ordinary tab.
+        if (env.surrogate) {
+            window.location.href = url;
+            return LoginOutcome.Redirected;
+        }
+        // Framed, and not yet one window up. A redirect from here would land in the frame and be
+        // refused, and the window that would fix it cannot be opened without a user gesture — so the
+        // caller is told to render a control rather than to navigate.
+        return LoginOutcome.Gesture;
+    },
+    complete: async (_ctx, token, env) => {
+        if (!env.surrogate) {
+            // This document started the flow and finished it in place — it already has what it needs.
+            return LoginOutcome.Passed;
+        }
+        if (!env.hasOpener) {
+            // Authenticated with nowhere to send it. `Cross-Origin-Opener-Policy: same-origin` from the
+            // provider severs `window.opener` permanently, so this is not a timing problem to retry.
+            return LoginOutcome.Orphaned;
+        }
+        clearSurrogate();
+        // Both windows are the same origin (the surrogate is this application's own login route), so
+        // the origin is pinned rather than passed as `*` — the message carries a bearer token.
+        window.opener.postMessage({ type: LOGIN_TOKEN_MESSAGE, token }, window.location.origin);
+        window.close();
+        return LoginOutcome.Handled;
+    },
+});
+//# sourceMappingURL=surrogate.js.map

package/build/login/surrogate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surrogate.js","sourceRoot":"","sources":["../../src/login/surrogate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EACvD,wBAAwB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,GAC1F,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAEvE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAgB,EAAE,CAAC,CAAC;IAC1D,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,wBAAwB;IAClC,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC;IAE9D,KAAK,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAA,CAAC,CAAC;IAEhC,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC3B,8DAA8D;QAC9D,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAA;YAElC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACjD,CAAC;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,2BAA2B;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,wBAAwB,CAAC,CAAA;QAC1F,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,IAAI,OAAO,CAAe,OAAO,CAAC,EAAE;YACzC,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,KAAiD,CAAA;YAErD,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAQ,EAAE;gBAC5C,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAM;gBACR,CAAC;gBACD,OAAO,GAAG,IAAI,CAAA;gBACd,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBAChD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,aAAa,CAAC,KAAK,CAAC,CAAA;gBACtB,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAA;YACjB,CAAC,CAAA;YAED,SAAS,SAAS,CAAC,KAAmB;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAgD,CAAA;gBACnE,IAAI,IAAI,EAAE,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBAClF,OAAM;gBACR,CAAC;gBACD,KAAK,UAAU,CAAC,GAAmB,EAAE,IAAI,CAAC,KAAK,CAAC;qBAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;qBACxC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7C,CAAC;YAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YAC7C,2FAA2F;YAC3F,iCAAiC;YACjC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,qEAAqE;QACrE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;YAE1B,OAAO,YAAY,CAAC,UAAU,CAAA;QAChC,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,8DAA8D;QAC9D,OAAO,YAAY,CAAC,OAAO,CAAA;IAC7B,CAAC;IAED,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,0FAA0F;YAC1F,OAAO,YAAY,CAAC,MAAM,CAAA;QAC5B,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,4FAA4F;YAC5F,yFAAyF;YACzF,OAAO,YAAY,CAAC,QAAQ,CAAA;QAC9B,CAAC;QAED,cAAc,EAAE,CAAA;QAChB,6FAA6F;QAC7F,uFAAuF;QACvF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACvF,MAAM,CAAC,KAAK,EAAE,CAAA;QAEd,OAAO,YAAY,CAAC,OAAO,CAAA;IAC7B,CAAC;CACF,CAAC,CAAA"}

package/build/types.d.ts

@@ -1,4 +1,5 @@
 import type { AuthServiceAppend } from '@owlmeans/client-auth';
+import type { LoginServiceAppend } from '@owlmeans/client-auth/login';
 import type { ClientConfig } from '@owlmeans/client-context';
 import type { ClientContext } from '@owlmeans/client';
 export interface RenderOptions {
@@ -9,6 +10,6 @@ export interface RenderOptions {
 }
 export interface AppConfig extends ClientConfig {
 }
-export interface AppContext<C extends AppConfig = AppConfig> extends ClientContext<C>, AuthServiceAppend {
+export interface AppContext<C extends AppConfig = AppConfig> extends ClientContext<C>, AuthServiceAppend, LoginServiceAppend {
 }
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACnF,iBAAiB;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACnF,iBAAiB,EAAE,kBAAkB;CACtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-client",
-  "version": "0.1.18-rc.6",
+  "version": "0.1.18-rc.9",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,21 +22,21 @@
   },
   "dependencies": {
     "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/auth-common": "^0.1.18-rc.6",
-    "@owlmeans/client": "^0.1.18-rc.6",
-    "@owlmeans/client-auth": "^0.1.18-rc.6",
-    "@owlmeans/client-context": "^0.1.18-rc.6",
-    "@owlmeans/client-i18n": "^0.1.18-rc.6",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.6",
-    "@owlmeans/client-resource": "^0.1.18-rc.6",
-    "@owlmeans/client-route": "^0.1.18-rc.6",
-    "@owlmeans/config": "^0.1.18-rc.6",
+    "@owlmeans/auth-common": "^0.1.18-rc.7",
+    "@owlmeans/client": "^0.1.18-rc.8",
+    "@owlmeans/client-auth": "^0.1.18-rc.9",
+    "@owlmeans/client-context": "^0.1.18-rc.7",
+    "@owlmeans/client-i18n": "^0.1.18-rc.7",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.7",
+    "@owlmeans/client-resource": "^0.1.18-rc.7",
+    "@owlmeans/client-route": "^0.1.18-rc.7",
+    "@owlmeans/config": "^0.1.18-rc.7",
     "@owlmeans/context": "^0.1.18-rc.6",
     "@owlmeans/error": "^0.1.18-rc.6",
     "@owlmeans/i18n": "^0.1.18-rc.6",
     "@owlmeans/route": "^0.1.18-rc.6",
-    "@owlmeans/web-db": "^0.1.18-rc.6",
-    "@owlmeans/web-router": "^0.1.18-rc.6",
+    "@owlmeans/web-db": "^0.1.18-rc.7",
+    "@owlmeans/web-router": "^0.1.18-rc.7",
     "react-dropzone": "^14.3.5"
   },
   "peerDependencies": {

package/src/context.ts

@@ -8,6 +8,7 @@ import { useContext as useCtx } from '@owlmeans/client'
 import { extractPrimaryHost } from './helper.js'
 import { appendWebAuthService } from './service.js'
 import { appendWebRouter } from '@owlmeans/web-router'
+import { appendWebLogin } from './login/service.js'
 
 export const makeContext = <C extends AppConfig = AppConfig, T extends AppContext<C> = AppContext<C>>(
   cfg: C
@@ -19,6 +20,7 @@ export const makeContext = <C extends AppConfig = AppConfig, T extends AppContex
   appendWebDbService<C, T>(context)
   appendClientResource<C, T>(context, AUTH_RESOURCE)
   appendWebRouter<C, T>(context)
+  appendWebLogin<C, T>(context)
 
   context.makeContext = makeContext as typeof context.makeContext
 

package/src/exports.ts

@@ -5,5 +5,6 @@ export { service } from '@owlmeans/config'
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context'
 export { entrypoint, elevate, provideRequest, stab } from '@owlmeans/client-entrypoint'
 export { route, frontend } from '@owlmeans/route'
+export type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 export type { ClientEntrypoint as Module } from '@owlmeans/client-entrypoint'
 export type { ClientRoute as Route } from '@owlmeans/client-route'

package/src/index.ts

@@ -11,3 +11,4 @@ export * from './helper.js'
 export * from './i18n.js'
 export * from './service.js'
 export * from './errors.js'
+export * from './login/index.js'

package/src/login/consts.ts

@@ -0,0 +1,12 @@
+/** The ordinary flow: leave for the provider and come back. */
+export const REDIRECT_LOGIN = 'owlmeans-redirect-login'
+
+/** The flow that runs one window up, for a document that cannot redirect where it is. */
+export const SURROGATE_LOGIN = 'owlmeans-surrogate-login'
+
+/**
+ * Registered above the default so it wins the cascade wherever it applies. It applies narrowly —
+ * only in a frame, or in the surrogate window itself — so the default still serves every
+ * ordinary tab.
+ */
+export const SURROGATE_LOGIN_PRIORITY = 100

package/src/login/index.ts

@@ -0,0 +1,4 @@
+export * from './consts.js'
+export * from './redirect.js'
+export * from './surrogate.js'
+export * from './service.js'

package/src/login/redirect.ts

@@ -0,0 +1,38 @@
+import { LoginOutcome } from '@owlmeans/client-auth/login'
+import type { LoginPlugin } from '@owlmeans/client-auth/login'
+import { REDIRECT_LOGIN } from './consts.js'
+
+/**
+ * The ordinary login flow: this document leaves for the identity provider and comes back.
+ *
+ * The default plugin, matching everything, so any environment that does not need special handling
+ * behaves exactly as it always did.
+ */
+export const makeRedirectLoginPlugin = (): LoginPlugin => ({
+  alias: REDIRECT_LOGIN,
+  priority: 0,
+  mode: 'redirect',
+  match: () => true,
+
+  begin: async (_ctx, request) => {
+    // Prefer the in-app continuation the caller handed over: a client-side navigation to the
+    // dispatcher keeps the app mounted, where a full page load would tear it down and rebuild it.
+    if (request.navigate != null) {
+      await request.navigate()
+
+      return LoginOutcome.Handled
+    }
+    window.location.href = request.url
+
+    return LoginOutcome.Redirected
+  },
+
+  authorize: async (_ctx, url) => {
+    window.location.href = url
+
+    return LoginOutcome.Redirected
+  },
+
+  // Nothing to hand anywhere — the token was issued in the document that will use it.
+  complete: async () => LoginOutcome.Passed,
+})

package/src/login/service.ts

@@ -0,0 +1,19 @@
+import { appendLogin } from '@owlmeans/client-auth/login'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { makeRedirectLoginPlugin } from './redirect.js'
+import { makeSurrogateLoginPlugin } from './surrogate.js'
+
+/**
+ * Register the login host and the two browser flows on a context.
+ *
+ * Called by `makeContext`, so every web app has working login — including a framed one — without
+ * registering anything. An app that needs a different mechanic registers its own plugin at a
+ * higher priority; it does not replace this.
+ */
+export const appendWebLogin = <C extends BasicConfig, T extends BasicContext<C>>(ctx: T): T => {
+  const service = appendLogin<C, T>(ctx).login()
+  service.registerPlugin(makeRedirectLoginPlugin())
+  service.registerPlugin(makeSurrogateLoginPlugin())
+
+  return ctx
+}

package/src/login/surrogate.ts

@@ -0,0 +1,123 @@
+import {
+  adoptToken, clearSurrogate, markSurrogate, LoginOutcome,
+  LOGIN_SURROGATE_FEATURES, LOGIN_SURROGATE_NAME, LOGIN_TOKEN_MESSAGE, LOGIN_WATCH_INTERVAL,
+} from '@owlmeans/client-auth/login'
+import type { LoginContext, LoginPlugin } from '@owlmeans/client-auth/login'
+import { SURROGATE_LOGIN, SURROGATE_LOGIN_PRIORITY } from './consts.js'
+
+/**
+ * Login for a document that cannot complete the flow where it is.
+ *
+ * An app embedded in a frame cannot redirect to an identity provider: the provider refuses to be
+ * embedded (`frame-ancestors`), and its session cookies are third-party there. So the flow runs
+ * one window up, in a surrogate window that is top-level and first-party on this application's own
+ * origin — where the very same flow completes normally — and the token is passed back to the
+ * document that asked for it.
+ *
+ * This plugin is deliberately not OIDC-specific. The mechanic is "run the login route one window
+ * up and hand the token back", and the adoption is the plain auth service, so any relying party
+ * that renders a login route gets it by registering nothing.
+ *
+ * `match` covers BOTH halves of the lifecycle — the framed opener and the surrogate itself, where
+ * `embedded` is false. Inside the surrogate the redirect plugin must not win: that window IS
+ * top-level, so it authorizes by an ordinary redirect and differs only in what it does with the
+ * token at the end.
+ */
+export const makeSurrogateLoginPlugin = (): LoginPlugin => ({
+  alias: SURROGATE_LOGIN,
+  priority: SURROGATE_LOGIN_PRIORITY,
+  mode: 'surrogate',
+  match: env => env.hasWindow && (env.embedded || env.surrogate),
+
+  enter: () => { markSurrogate() },
+
+  begin: (ctx, request, env) => {
+    // Already one window up — nothing to open, just run the flow.
+    if (env.surrogate) {
+      window.location.href = request.url
+
+      return Promise.resolve(LoginOutcome.Redirected)
+    }
+
+    // Opened FIRST and synchronously: `window.open` escapes the popup blocker only while the user
+    // gesture is still being handled, so nothing may be awaited before this line. That is why this
+    // function is not `async`.
+    const surrogate = window.open(request.url, LOGIN_SURROGATE_NAME, LOGIN_SURROGATE_FEATURES)
+    if (surrogate == null) {
+      return Promise.resolve(LoginOutcome.Failed)
+    }
+
+    return new Promise<LoginOutcome>(resolve => {
+      let settled = false
+      let watch: ReturnType<typeof setInterval> | undefined
+
+      const finish = (result: LoginOutcome): void => {
+        if (settled) {
+          return
+        }
+        settled = true
+        window.removeEventListener('message', onMessage)
+        if (watch != null) {
+          clearInterval(watch)
+        }
+        resolve(result)
+      }
+
+      function onMessage(event: MessageEvent): void {
+        if (event.origin !== window.location.origin) {
+          return
+        }
+        const data = event.data as { type?: string, token?: string } | null
+        if (data?.type !== LOGIN_TOKEN_MESSAGE || data.token == null || data.token === '') {
+          return
+        }
+        void adoptToken(ctx as LoginContext, data.token)
+          .then(() => finish(LoginOutcome.Handled))
+          .catch(() => finish(LoginOutcome.Failed))
+      }
+
+      window.addEventListener('message', onMessage)
+      // A window the user simply closes announces nothing, so the only way to stop waiting on it
+      // is to watch for it going away.
+      watch = setInterval(() => {
+        if (surrogate.closed) {
+          finish(LoginOutcome.Failed)
+        }
+      }, LOGIN_WATCH_INTERVAL)
+    })
+  },
+
+  authorize: async (_ctx, url, env) => {
+    // The surrogate is top-level, so it redirects like any ordinary tab.
+    if (env.surrogate) {
+      window.location.href = url
+
+      return LoginOutcome.Redirected
+    }
+
+    // Framed, and not yet one window up. A redirect from here would land in the frame and be
+    // refused, and the window that would fix it cannot be opened without a user gesture — so the
+    // caller is told to render a control rather than to navigate.
+    return LoginOutcome.Gesture
+  },
+
+  complete: async (_ctx, token, env) => {
+    if (!env.surrogate) {
+      // This document started the flow and finished it in place — it already has what it needs.
+      return LoginOutcome.Passed
+    }
+    if (!env.hasOpener) {
+      // Authenticated with nowhere to send it. `Cross-Origin-Opener-Policy: same-origin` from the
+      // provider severs `window.opener` permanently, so this is not a timing problem to retry.
+      return LoginOutcome.Orphaned
+    }
+
+    clearSurrogate()
+    // Both windows are the same origin (the surrogate is this application's own login route), so
+    // the origin is pinned rather than passed as `*` — the message carries a bearer token.
+    window.opener.postMessage({ type: LOGIN_TOKEN_MESSAGE, token }, window.location.origin)
+    window.close()
+
+    return LoginOutcome.Handled
+  },
+})

package/src/types.ts

@@ -1,4 +1,5 @@
 import type { AuthServiceAppend } from '@owlmeans/client-auth'
+import type { LoginServiceAppend } from '@owlmeans/client-auth/login'
 import type { ClientConfig } from '@owlmeans/client-context'
 import type { ClientContext } from '@owlmeans/client'
 
@@ -13,5 +14,5 @@ export interface AppConfig extends ClientConfig {
 }
 
 export interface AppContext<C extends AppConfig = AppConfig> extends ClientContext<C>,
-  AuthServiceAppend {
+  AuthServiceAppend, LoginServiceAppend {
 }