@owlmeans/web-panel 0.1.18-rc.71 → 0.1.18-rc.73

package/README.md

@@ -11,7 +11,7 @@ but never started.
 ## Installation
 
 ```sh
-bun add @owlmeans/web-panel@^0.1.18-rc.71
+bun add @owlmeans/web-panel@^0.1.18-rc.73
 ```
 
 Peer requirements (the consuming app provides these): `react`, `react-dom`,
@@ -413,7 +413,9 @@ consumer's CSS puts dark tokens under `.dark` AND under
 
 | Symbol | Kind | Purpose |
 |---|---|---|
-| `PanelCookieConsent`, `PanelCookiePolicy` | component | `@owlmeans/web-consent` components bound to the app's language and translations |
+| `PanelCookieConsent`, `PanelCookiePolicy` | component | `@owlmeans/web-consent` components bound to the app's language, translations and `cfg.cookieConsent` (`{ mode?, geo? }` — a prop wins) |
+| `appendConsentGeoPlugin(ctx, plugin)` | function | Register the app's own country locator (`ConsentGeoPlugin`) while the context is configured; turns the geo gate on |
+| `PanelCookieConsentConfig`, `ConsentGeoPluginAppend` | type | `cfg.cookieConsent`; the `context.consentGeo()` accessor |
 | `PanelConsentMenuWidget` | component | The cookie-preferences control for a host menu or footer ("Cookie settings" — pass `label` and `className`) |
 | `appendConsentWidgetService(ctx, alias?)`, `createConsentWidgetService` | function | Ref-counted presence service over a state resource |
 | `useConsentMenuPresence()`, `useConsentWidgetPresent()` | hook | Declare that a menu shows the row; read whether one does (hides the floating button) |
@@ -496,7 +498,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.49
+npx @owlmeans/agent-skills@^0.1.18-rc.52
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-panel",
-  "version": "0.1.18-rc.71",
-  "generatedAt": "2026-10-05T21:03:06.415Z",
+  "version": "0.1.18-rc.73",
+  "generatedAt": "2026-10-08T21:27:54.321Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-panel/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/web-panel
 
 **Layer:** Web (React)
-**Install:** `"@owlmeans/web-panel": "^0.1.18-rc.71"` in `dependencies`
+**Install:** `"@owlmeans/web-panel": "^0.1.18-rc.73"` in `dependencies`
 
 ## Key Exports
 
@@ -21,6 +21,7 @@ user-invocable: false
 | `ThemeToggle` / `useColorScheme` | The light/dark switcher (`ThemeToggleProps`, `ThemeToggleLabels`) and the hook behind it (`ColorSchemeModel`) — see *Light and dark* below |
 | `SocketReloadDialog` | The global "connection lost — try again / reload" prompt (opt in via `cfg.socket.reloadDialog`) `PanelApp` mounts automatically — see below. The hooks it reads, `useSocketStatus` and `useSocketRetry`, are imported from `@owlmeans/client-socket`, not from this package |
 | `Link` | An `<a>` addressing an entrypoint alias (or a literal `src`), with the label taken from i18n |
+| `LoginProviderNote` | The provider disclosure (`LoginProviderNoteProps`) — see *The provider disclosure* below |
 | `LoginScreen` / `LocalizedLoginScreen` / `appendLoginScreen` | The identity-provider choice screen — see `login-methods`. `LoginScreen` is pure w.r.t. `locale` too, exactly like `translate`: it is a prop, defaulting to nothing, never an implicit `useLanguage()` read, because a component that reaches for i18n context directly crashes an app mounted without one. `LocalizedLoginScreen` supplies `useLanguage()`'s value when the caller does not pass its own |
 | `render(context, opts?)` | Mounts the tree inside `PanelApp`, with the browser language detector installed on the i18n instance. `opts` is `RenderOptions` plus `rootClassName` |
 | `PanelApp` | That wrapper on its own — the themed root `div` plus the i18n provider — for a host that mounts the tree itself |
@@ -449,11 +450,60 @@ prop, never read from context directly — for `Intl.ListFormat` and a custom do
 ordinary one, with no special case. Pinned by `tests/login.spec.ts` → the "with billing, product and
 custom documents configured" and "the Terms confirmation deferred to a step" blocks.
 
+### The provider disclosure — `LoginProviderNote`
+
+`LoginScreen` renders `useLoginMethods().provider` (`@owlmeans/client-panel/auth`, resolution rules
+there) through `components/login/provider.tsx`:
+`<div role="note" data-login-provider data-placement="top|inline">` — a `ShieldCheck` icon, the
+sentence, and, when `info` resolved, `<a data-login-provider-info target="_blank"
+rel="noopener noreferrer">More information</a>`. Never a `header`/`nav`: it is a disclosure, not a
+landmark.
+
+- **No provider → the DOM is exactly the pre-provider screen** (no note, no stage, title
+  `login.title`).
+- **`top`** (the platform's own hosts) — the strip is the FIRST child of `[data-login-screen]`,
+  full width, at the screen's top edge; the card sits in `<div data-login-stage>`, which takes the
+  remaining height and centres it. The screen's column layout, its zero padding, the stage's flex
+  centring/padding and the strip's width are INLINE styles (same reason as the screen height —
+  `login-methods` → Layout); classes there are cosmetic only.
+- **`inline`** (an owner's own domain) — the note is one line inside `CardContent`, directly under
+  the methods and above the terms; the screen keeps its ordinary shape.
+- The card title becomes `login.provider.title` ("Sign in to {{product}}") whenever a provider
+  resolves; `props.title` still wins.
+- Copy: `login.provider.{title,top,inline,more}` in all eight languages
+  (`components/login/i18n/*.json`), registered by `components/login/i18n.ts` into the SAME `auth`
+  library resource as `client-auth`'s login copy (deep-merged; this package owns only the
+  `login.provider` subtree). Names are filled after translation by `loginProviderHelper.fill`.
+- Still exactly one `[data-login-terms]` in either placement. Pinned by `tests/login.spec.ts` →
+  "the provider disclosure" (`?provider=top|inline` in the harness) and
+  `tests/login-provider.spec.ts` (resolver, `fill`, eight-language key/placeholder parity).
+
 ## Subpath: `./consent`
 
 `PanelCookieConsent` and `PanelCookiePolicy` — `@owlmeans/web-consent`'s components bound to this
-app's language and translations, falling through to the package's own seven-language bundle for
-every key the app has not overridden. See the `consent` skill.
+app's language and translations, falling through to the package's own eight-language bundle for
+every key the app has not overridden — and to the app's cookie-consent configuration. See the
+`consent` and `web-consent` skills.
+
+**The configuration lives in `cfg.cookieConsent`** (`PanelCookieConsentConfig`, on `AppConfig`),
+set where the rest of the app's configuration is, before anything renders:
+
+```typescript
+cfg.cookieConsent = { geo: { cloudflare: true } }   // ask only in consent countries; mode: 'bar' default
+```
+
+- `mode` (`'bar'` | `'window'`) and `geo` (`ConsentGeoOptions`) feed both components; a prop of the
+  same name always wins. Not `cfg.consent` — "consent" also names the marketing-consent and sign-in
+  terms options.
+- A file restored into apps of every age (a generated target's `config.ts`) writes it as
+  `Object.assign(cfg, { cookieConsent: … })`, so a tree whose framework predates the key still
+  type-checks; an older package ignores it.
+- **A locator of the app's own** is code, not configuration: `appendConsentGeoPlugin(context,
+  plugin)` in `context.ts` registers a `ConsentGeoPlugin` (`{ alias, locate }` — resolve the country
+  or throw) ahead of Cloudflare's and installs `context.consentGeo()`. Appending one IS asking for
+  the gate: `PanelCookieConsent` turns it on (`geo: {}`) even where `cfg.cookieConsent.geo` says
+  nothing. `PanelCookiePolicy` reads the same, so the policy states the regional rule exactly when
+  the dialog applies it.
 
 A re-export does not move Tailwind class strings, so a consumer adds a second `@source` for
 `@owlmeans/web-consent` alongside this package's — pointing at **`src`**, for the reason spelled out
@@ -503,7 +553,8 @@ menu has already mounted) and because React 18 StrictMode double-invokes mount/c
 
 | Job | Import from `@owlmeans/web-panel/consent` | Where it goes |
 |---|---|---|
-| The consent dialog (and its floating re-open button) | `PanelCookieConsent` | Beside the router — a `PanelApp` child — once |
+| The consent UI — bar, window, spinner (and its floating re-open button) | `PanelCookieConsent` | Beside the router — a `PanelApp` child — once |
+| Asking only in consent countries | `cfg.cookieConsent.geo`, or `appendConsentGeoPlugin(context, plugin)` | The app's `config.ts` / `context.ts` |
 | The "Cookie settings" control in a footer or menu | `PanelConsentMenuWidget` (`label`, `className`, `onSelect?` — defaults to `consentStore.open('reopen')`) | Inside the host's own footer/menu |
 | Hiding the floating button while that control is reachable | `useConsentMenuPresence()` | Called by the always-mounted component that renders the control — mounted ONLY while the control can actually be reached: a component that is merely hidden by CSS (`xl:hidden`) is still mounted and still claims presence, so the floating button vanishes with nothing else to open the dialog; render it conditionally instead (viable's header mounts its hamburger menu only below the full-row breakpoint) |
 | Registering the presence service | `appendConsentWidgetService(context)` | The app's `context.ts` |
@@ -528,7 +579,8 @@ bound dialog with its floating button; `useConsentMenuPresence()` then has nothi
 does nothing. The presence read itself (`useConsentWidgetPresent`) still needs the service — its
 state resource is registered by it — so any other caller checks first. A dialog that read an
 unregistered state resource threw inside render ("Resource consent-widget-presence not found") and
-blanked the whole application. Pinned by `tests/consent.spec.ts` (`?consent=bare` / `?consent=menu`).
+blanked the whole application. Pinned by `tests/consent.spec.ts` (`?consent=bare` / `?consent=menu`;
+the configuration by `?consentCfg=window|bar`, `?modeProp=` and `?consentGeo=<CC>|fail`).
 
 ## Consumer setup — package boundary and Tailwind
 

package/build/components/login/i18n/be.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Уваход у {{product}}",
+            "top": "Гэтую праграму размяшчае {{operator}} ад імя {{product}}. Для ўваходу выкарыстоўваецца {{provider}}.",
+            "inline": "Уваход забяспечвае {{provider}} ад імя {{product}}.",
+            "more": "Падрабязней"
+        }
+    }
+}

package/build/components/login/i18n/de.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Bei {{product}} anmelden",
+            "top": "Diese App wird von {{operator}} im Auftrag von {{product}} gehostet. Sie melden sich mit {{provider}} an.",
+            "inline": "Die Anmeldung stellt {{provider}} im Auftrag von {{product}} bereit.",
+            "more": "Weitere Informationen"
+        }
+    }
+}

package/build/components/login/i18n/en.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Sign in to {{product}}",
+            "top": "This app is hosted by {{operator}} on behalf of {{product}}. You sign in with {{provider}}.",
+            "inline": "Sign-in is provided by {{provider}} on behalf of {{product}}.",
+            "more": "More information"
+        }
+    }
+}

package/build/components/login/i18n/es.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Iniciar sesión en {{product}}",
+            "top": "Esta aplicación está alojada por {{operator}} en nombre de {{product}}. Inicias sesión con {{provider}}.",
+            "inline": "El inicio de sesión lo proporciona {{provider}} en nombre de {{product}}.",
+            "more": "Más información"
+        }
+    }
+}

package/build/components/login/i18n/fr.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Connexion à {{product}}",
+            "top": "Cette application est hébergée par {{operator}} pour le compte de {{product}}. Vous vous connectez avec {{provider}}.",
+            "inline": "La connexion est assurée par {{provider}} pour le compte de {{product}}.",
+            "more": "En savoir plus"
+        }
+    }
+}

package/build/components/login/i18n/pl.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Zaloguj się do {{product}}",
+            "top": "Ta aplikacja jest hostowana przez {{operator}} w imieniu {{product}}. Logujesz się przez {{provider}}.",
+            "inline": "Logowanie zapewnia {{provider}} w imieniu {{product}}.",
+            "more": "Więcej informacji"
+        }
+    }
+}

package/build/components/login/i18n/ru.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Вход в {{product}}",
+            "top": "Это приложение размещает {{operator}} от имени {{product}}. Для входа используется {{provider}}.",
+            "inline": "Вход обеспечивает {{provider}} от имени {{product}}.",
+            "more": "Подробнее"
+        }
+    }
+}

package/build/components/login/i18n/uk.json

@@ -0,0 +1,10 @@
+{
+    "login": {
+        "provider": {
+            "title": "Вхід до {{product}}",
+            "top": "Цей застосунок розміщує {{operator}} від імені {{product}}. Для входу використовується {{provider}}.",
+            "inline": "Вхід забезпечує {{provider}} від імені {{product}}.",
+            "more": "Докладніше"
+        }
+    }
+}

package/build/components/login/i18n.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=i18n.d.ts.map

package/build/components/login/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../../../src/components/login/i18n.ts"],"names":[],"mappings":""}

package/build/components/login/i18n.js

@@ -0,0 +1,28 @@
+import { i18nHelper } from '@owlmeans/i18n';
+import en from './i18n/en.json' with { type: 'json' };
+import pl from './i18n/pl.json' with { type: 'json' };
+import ru from './i18n/ru.json' with { type: 'json' };
+import be from './i18n/be.json' with { type: 'json' };
+import uk from './i18n/uk.json' with { type: 'json' };
+import es from './i18n/es.json' with { type: 'json' };
+import de from './i18n/de.json' with { type: 'json' };
+import fr from './i18n/fr.json' with { type: 'json' };
+import { AUTH_RESOURCE } from './consts.local.js';
+/**
+ * The provider disclosure's copy (`login.provider.*`), registered into the SAME `auth` library
+ * resource `@owlmeans/client-auth/login` fills with the rest of the sign-in screen.
+ *
+ * `_addI18n` pushes and the bundles are merged deeply by tier and priority, so this chunk lands
+ * beside `login.title`/`login.terms.*` rather than replacing the `login` subtree. It lives here, not
+ * in `client-auth`, because only this package renders the disclosure — and `client-auth` is pinned
+ * exactly by applications that must not be pulled into a release for it.
+ */
+i18nHelper.addI18nLib('en', AUTH_RESOURCE, en);
+i18nHelper.addI18nLib('pl', AUTH_RESOURCE, pl);
+i18nHelper.addI18nLib('ru', AUTH_RESOURCE, ru);
+i18nHelper.addI18nLib('be', AUTH_RESOURCE, be);
+i18nHelper.addI18nLib('uk', AUTH_RESOURCE, uk);
+i18nHelper.addI18nLib('es', AUTH_RESOURCE, es);
+i18nHelper.addI18nLib('de', AUTH_RESOURCE, de);
+i18nHelper.addI18nLib('fr', AUTH_RESOURCE, fr);
+//# sourceMappingURL=i18n.js.map

package/build/components/login/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../../src/components/login/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;GAQG;AACH,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;AAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA"}

package/build/components/login/index.d.ts

@@ -1,7 +1,9 @@
+import './i18n.js';
 export * from './screen.js';
 export * from './terms.js';
 export type * from './types.js';
 export * from './credit.js';
+export * from './provider.js';
 export * from './consts.js';
 export * from './icons.js';
 export * from './append.js';

package/build/components/login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/build/components/login/index.js

@@ -1,6 +1,8 @@
+import './i18n.js';
 export * from './screen.js';
 export * from './terms.js';
 export * from './credit.js';
+export * from './provider.js';
 export * from './consts.js';
 export * from './icons.js';
 export * from './append.js';

package/build/components/login/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAE1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/components/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAE1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/build/components/login/provider.d.ts

@@ -0,0 +1,20 @@
+import type { FC } from 'react';
+import type { LoginProviderNoteProps } from './types.js';
+/**
+ * Who signs the person in, and on whose behalf.
+ *
+ * A sign-in page that a third party runs for an application has to say so wherever the
+ * application's own name appears: the relationship in a sentence, and a "More information" link.
+ * Without it the page is a stranger's form wearing someone else's name — which is precisely what a
+ * browser's impersonation heuristics look for.
+ *
+ * `top` is a full-width strip the screen renders as its FIRST child, above the card (the platform's
+ * own hosts); `inline` is one line inside the card, under the methods (an owner's own domain).
+ * A `role="note"` block, never `header`/`nav`: it is a disclosure, not page chrome, and a screen
+ * that grew a landmark here would be read as a second banner.
+ *
+ * The names are put in after translation (`loginProviderHelper.fill`), so word order stays the
+ * translator's and nothing but plain text ever reaches the markup.
+ */
+export declare const LoginProviderNote: FC<LoginProviderNoteProps>;
+//# sourceMappingURL=provider.d.ts.map

package/build/components/login/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/components/login/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAI/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,EAAE,EAAE,CAAC,sBAAsB,CAkCxD,CAAA"}

package/build/components/login/provider.js

@@ -0,0 +1,31 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { ShieldCheck } from 'lucide-react';
+import { cn } from '../../@/lib/utils.js';
+import { loginProviderHelper } from '@owlmeans/client-panel/auth';
+/**
+ * Who signs the person in, and on whose behalf.
+ *
+ * A sign-in page that a third party runs for an application has to say so wherever the
+ * application's own name appears: the relationship in a sentence, and a "More information" link.
+ * Without it the page is a stranger's form wearing someone else's name — which is precisely what a
+ * browser's impersonation heuristics look for.
+ *
+ * `top` is a full-width strip the screen renders as its FIRST child, above the card (the platform's
+ * own hosts); `inline` is one line inside the card, under the methods (an owner's own domain).
+ * A `role="note"` block, never `header`/`nav`: it is a disclosure, not page chrome, and a screen
+ * that grew a landmark here would be read as a second banner.
+ *
+ * The names are put in after translation (`loginProviderHelper.fill`), so word order stays the
+ * translator's and nothing but plain text ever reaches the markup.
+ */
+export const LoginProviderNote = ({ model, translate, className }) => {
+    const top = model.placement === 'top';
+    const sentence = top
+        ? translate('login.provider.top', 'This app is hosted by {{operator}} on behalf of {{product}}. You sign in with {{provider}}.')
+        : translate('login.provider.inline', 'Sign-in is provided by {{provider}} on behalf of {{product}}.');
+    return _jsxs("div", { role: "note", "data-login-provider": true, "data-placement": model.placement, 
+        // The strip's full width is inline for the same reason the screen's height is: it is the part
+        // of the layout a stale `@source` scan must never be able to drop.
+        style: top ? { width: '100%', boxSizing: 'border-box' } : undefined, className: cn('flex items-start justify-center gap-2 text-center text-xs text-muted-foreground', top && 'border-b bg-muted px-4 py-2', className), children: [_jsx(ShieldCheck, { "aria-hidden": "true", className: "size-4 shrink-0" }), _jsxs("span", { children: [loginProviderHelper.fill(sentence, model), model.info != null && _jsxs(_Fragment, { children: [' ', _jsx("a", { "data-login-provider-info": true, href: model.info, target: "_blank", rel: "noopener noreferrer", className: "underline underline-offset-2 hover:text-foreground", children: translate('login.provider.more', 'More information') })] })] })] });
+};
+//# sourceMappingURL=provider.js.map

package/build/components/login/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/components/login/provider.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAGjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA+B,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;IAC/F,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAA;IACrC,MAAM,QAAQ,GAAG,GAAG;QAClB,CAAC,CAAC,SAAS,CAAC,oBAAoB,EAAE,6FAA6F,CAAC;QAChI,CAAC,CAAC,SAAS,CAAC,uBAAuB,EAAE,+DAA+D,CAAC,CAAA;IAEvG,OAAO,eACL,IAAI,EAAC,MAAM,iDAEK,KAAK,CAAC,SAAS;QAC/B,8FAA8F;QAC9F,mEAAmE;QACnE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,EACnE,SAAS,EAAE,EAAE,CACX,iFAAiF,EACjF,GAAG,IAAI,6BAA6B,EACpC,SAAS,CACV,aAED,KAAC,WAAW,mBAAa,MAAM,EAAC,SAAS,EAAC,iBAAiB,GAAG,EAC9D,2BACG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EACzC,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,8BACpB,GAAG,EACJ,8CAEE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAC,QAAQ,EAAC,GAAG,EAAC,qBAAqB,EAC3D,SAAS,EAAC,oDAAoD,YAE7D,SAAS,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,GACnD,IACH,IACE,IACH,CAAA;AACR,CAAC,CAAA"}

package/build/components/login/screen.d.ts

@@ -1,5 +1,6 @@
 import { type FC } from 'react';
 import { type LoginScreenProps } from '@owlmeans/client-auth/login';
+import './i18n.js';
 /**
  * The sign-in screen: which identity provider, confirmed against which documents.
  *

package/build/components/login/screen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../../src/components/login/screen.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,EAAE,EAAE,MAAM,OAAO,CAAA;AAO/C,OAAO,EAAoB,KAAK,gBAAgB,EAAqB,MAAM,6BAA6B,CAAA;AAMxG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAgG5C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,EAAE,CAAC,gBAAgB,CASrD,CAAA"}
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../../src/components/login/screen.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,EAAE,EAAE,MAAM,OAAO,CAAA;AAO/C,OAAO,EAAoB,KAAK,gBAAgB,EAAqB,MAAM,6BAA6B,CAAA;AAMxG,OAAO,WAAW,CAAA;AAElB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAqI5C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,EAAE,CAAC,gBAAgB,CASrD,CAAA"}

package/build/components/login/screen.js

@@ -5,12 +5,14 @@ import { Button } from '../../@/components/ui/button.js';
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '../../@/components/ui/card.js';
 import { cn } from '../../@/lib/utils.js';
 import { useI18nLib, useLanguage } from '@owlmeans/client-i18n';
-import { useLoginMethods } from '@owlmeans/client-panel/auth';
+import { loginProviderHelper, useLoginMethods } from '@owlmeans/client-panel/auth';
 import { loginResumeHelper } from '@owlmeans/client-auth/login';
 import { LoginMethodIcon } from './icons.js';
 import { LoginPrivacyNotice, LoginTerms } from './terms.js';
 import { LoginCredit } from './credit.js';
+import { LoginProviderNote } from './provider.js';
 import { VARIANT } from './consts.local.js';
+import './i18n.js';
 /**
  * The sign-in screen: which identity provider, confirmed against which documents.
  *
@@ -31,6 +33,23 @@ export const LoginScreen = props => {
     });
     const Logo = props.Logo;
     const attemptError = model.busy == null ? loginResumeHelper.loginAttemptError(model.outcome) : null;
+    const provider = model.provider;
+    const title = props.title ?? (provider != null
+        ? loginProviderHelper.fill(t('login.provider.title', 'Sign in to {{product}}'), provider)
+        : t('login.title', 'Sign in'));
+    const card = _jsxs(Card, { className: cn('w-full max-w-sm', props.containerClassName), children: [_jsxs(CardHeader, { className: "items-center gap-2 text-center", children: [Logo != null && _jsx("div", { className: "flex justify-center pb-2", children: isValidElement(Logo) ? Logo : typeof Logo === 'function'
+                            ? _jsx(Logo, { className: "h-10 w-auto" }) : Logo }), _jsx(CardTitle, { className: "text-xl", children: title }), _jsx(CardDescription, { children: props.subtitle ?? t('login.subtitle', 'Choose how you would like to continue.') })] }), _jsxs(CardContent, { className: "flex flex-col gap-4", children: [model.methods.length < 1
+                        ? _jsx("p", { role: "status", className: "text-sm text-muted-foreground text-center", children: t('login.empty', 'No sign-in method is configured for this application.') })
+                        : _jsx("div", { className: "flex flex-col gap-2", children: model.methods.map((method) => _jsxs(Button, { type: "button", "data-login-method": method.id, variant: VARIANT[method.emphasis ?? 'secondary'] ?? 'outline', "aria-disabled": model.blocked || undefined, "data-blocked": model.blocked ? 'true' : undefined, 
+                                // `cursor-pointer` explicitly: the package's private shadcn button stays compatible
+                                // with the older primitive style too. Stating it here keeps the sign-in control
+                                // visibly actionable independently of a consumer's shadcn setup.
+                                className: cn('w-full justify-center gap-2 cursor-pointer', model.blocked && 'opacity-60'), autoFocus: method.id === model.primary?.id, onClick: () => model.select(method), children: [model.busy === method.id
+                                        ? _jsx(Loader2, { className: "size-4 animate-spin" })
+                                        : _jsx(LoginMethodIcon, { name: method.icon, className: "size-4" }), method.label ?? t(`login.method.${method.i18nKey ?? method.id}`, method.id)] }, method.id)) }), provider?.placement === 'inline' && _jsx(LoginProviderNote, { model: provider, translate: t }), model.terms.required && (model.terms.deferred
+                        ? _jsx(LoginPrivacyNotice, { model: model.terms, translate: t, locale: props.locale })
+                        : _jsx(LoginTerms, { model: model.terms, translate: t, locale: props.locale })), (model.error ?? attemptError) != null
+                        && _jsx("p", { role: "alert", "data-login-error": true, className: "text-sm text-destructive text-center", children: model.error ?? t(attemptError, 'Sign-in did not complete. Please try again.') })] }), _jsx("div", { className: "px-6", children: props.footer ?? _jsx(LoginCredit, { model: model.credit, translate: t }) })] });
     // The viewport height is set INLINE, and deliberately.
     //
     // A percentage minimum (`min-h-full`) resolves against a parent that has a height, and this
@@ -43,19 +62,20 @@ export const LoginScreen = props => {
     // rule, by contrast, is invisible — the screen looks nearly right and is silently uncentred.
     //
     // `props.style` still wins, because a class-based override no longer can.
-    return _jsx("div", { "data-login-screen": true, style: { minHeight: '100dvh', ...props.style }, className: cn('flex w-full items-center justify-center p-4', props.className), children: _jsxs(Card, { className: cn('w-full max-w-sm', props.containerClassName), children: [_jsxs(CardHeader, { className: "items-center gap-2 text-center", children: [Logo != null && _jsx("div", { className: "flex justify-center pb-2", children: isValidElement(Logo) ? Logo : typeof Logo === 'function'
-                                ? _jsx(Logo, { className: "h-10 w-auto" }) : Logo }), _jsx(CardTitle, { className: "text-xl", children: props.title ?? t('login.title', 'Sign in') }), _jsx(CardDescription, { children: props.subtitle ?? t('login.subtitle', 'Choose how you would like to continue.') })] }), _jsxs(CardContent, { className: "flex flex-col gap-4", children: [model.methods.length < 1
-                            ? _jsx("p", { role: "status", className: "text-sm text-muted-foreground text-center", children: t('login.empty', 'No sign-in method is configured for this application.') })
-                            : _jsx("div", { className: "flex flex-col gap-2", children: model.methods.map((method) => _jsxs(Button, { type: "button", "data-login-method": method.id, variant: VARIANT[method.emphasis ?? 'secondary'] ?? 'outline', "aria-disabled": model.blocked || undefined, "data-blocked": model.blocked ? 'true' : undefined, 
-                                    // `cursor-pointer` explicitly: the package's private shadcn button stays compatible
-                                    // with the older primitive style too. Stating it here keeps the sign-in control
-                                    // visibly actionable independently of a consumer's shadcn setup.
-                                    className: cn('w-full justify-center gap-2 cursor-pointer', model.blocked && 'opacity-60'), autoFocus: method.id === model.primary?.id, onClick: () => model.select(method), children: [model.busy === method.id
-                                            ? _jsx(Loader2, { className: "size-4 animate-spin" })
-                                            : _jsx(LoginMethodIcon, { name: method.icon, className: "size-4" }), method.label ?? t(`login.method.${method.i18nKey ?? method.id}`, method.id)] }, method.id)) }), model.terms.required && (model.terms.deferred
-                            ? _jsx(LoginPrivacyNotice, { model: model.terms, translate: t, locale: props.locale })
-                            : _jsx(LoginTerms, { model: model.terms, translate: t, locale: props.locale })), (model.error ?? attemptError) != null
-                            && _jsx("p", { role: "alert", "data-login-error": true, className: "text-sm text-destructive text-center", children: model.error ?? t(attemptError, 'Sign-in did not complete. Please try again.') })] }), _jsx("div", { className: "px-6", children: props.footer ?? _jsx(LoginCredit, { model: model.credit, translate: t }) })] }) });
+    //
+    // The platform's own hosts put the provider disclosure in a strip across the top of the page —
+    // the FIRST child of the screen — and centre the card in a stage that takes the rest of the
+    // height. Every layout-bearing property of that variant is inline too, for the same reason.
+    if (provider?.placement === 'top') {
+        return _jsxs("div", { "data-login-screen": true, style: {
+                minHeight: '100dvh', display: 'flex', flexDirection: 'column', alignItems: 'stretch',
+                justifyContent: 'flex-start', padding: 0, ...props.style,
+            }, className: cn('w-full', props.className), children: [_jsx(LoginProviderNote, { model: provider, translate: t }), _jsx("div", { "data-login-stage": true, style: {
+                        display: 'flex', flex: '1 1 auto', alignItems: 'center', justifyContent: 'center',
+                        width: '100%', padding: '1rem', boxSizing: 'border-box',
+                    }, children: card })] });
+    }
+    return _jsx("div", { "data-login-screen": true, style: { minHeight: '100dvh', ...props.style }, className: cn('flex w-full items-center justify-center p-4', props.className), children: card });
 };
 /**
  * {@link LoginScreen} bound to the application's own translations.

package/build/components/login/screen.js.map

@@ -1 +1 @@
-{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../../src/components/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,cAAc,EAAW,MAAM,OAAO,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACzG,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAA2C,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAyB,KAAK,CAAC,EAAE;IACvD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,YAAoB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEnG,uDAAuD;IACvD,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,6FAA6F;IAC7F,EAAE;IACF,0EAA0E;IAC1E,OAAO,yCAEL,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,EAC9C,SAAS,EAAE,EAAE,CAAC,6CAA6C,EAAE,KAAK,CAAC,SAAS,CAAC,YAE7E,MAAC,IAAI,IAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,kBAAkB,CAAC,aAC9D,MAAC,UAAU,IAAC,SAAS,EAAC,gCAAgC,aACnD,IAAI,IAAI,IAAI,IAAI,cAAK,SAAS,EAAC,0BAA0B,YACvD,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,UAAU;gCACvD,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,aAAa,GAAG,CAAC,CAAC,CAAC,IAAI,GACvC,EACN,KAAC,SAAS,IAAC,SAAS,EAAC,SAAS,YAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,GAAa,EACvF,KAAC,eAAe,cACb,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,GAChE,IACP,EAEb,MAAC,WAAW,IAAC,SAAS,EAAC,qBAAqB,aACzC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;4BACvB,CAAC,CAAC,YAAG,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,2CAA2C,YACrE,CAAC,CAAC,aAAa,EAAE,uDAAuD,CAAC,GACxE;4BACJ,CAAC,CAAC,cAAK,SAAS,EAAC,qBAAqB,YACnC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAmB,EAAE,EAAE,CAAC,MAAC,MAAM,IAEjD,IAAI,EAAC,QAAQ,uBACM,MAAM,CAAC,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,WAAW,CAAC,IAAI,SAAS,mBAK9C,KAAK,CAAC,OAAO,IAAI,SAAS,kBAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;oCAChD,oFAAoF;oCACpF,gFAAgF;oCAChF,iEAAiE;oCACjE,SAAS,EAAE,EAAE,CACX,4CAA4C,EAC5C,KAAK,CAAC,OAAO,IAAI,YAAY,CAC9B,EACD,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,EAC1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAElC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE;4CACvB,CAAC,CAAC,KAAC,OAAO,IAAC,SAAS,EAAC,qBAAqB,GAAG;4CAC7C,CAAC,CAAC,KAAC,eAAe,IAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAC,QAAQ,GAAG,EAC5D,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,KAvBvE,MAAM,CAAC,EAAE,CAwBP,CAAC,GACN,EAIP,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;4BAC5C,CAAC,CAAC,KAAC,kBAAkB,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAI;4BAChF,CAAC,CAAC,KAAC,UAAU,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAI,CAAC,EAO1E,CAAC,KAAK,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,IAAI;+BACjC,YAAG,IAAI,EAAC,OAAO,4BAAkB,SAAS,EAAC,sCAAsC,YACjF,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,YAAsB,EAAE,6CAA6C,CAAC,GACtF,IACM,EAEd,cAAK,SAAS,EAAC,MAAM,YAClB,KAAK,CAAC,MAAM,IAAI,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,GAAI,GAC/D,IACD,GACH,CAAA;AACR,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyB,KAAK,CAAC,EAAE;IAChE,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,EAAE,CAAA;IAE3B,OAAO,KAAC,WAAW,OACb,KAAK,EACT,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAC/E,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,GAC3B,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../../src/components/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,cAAc,EAAW,MAAM,OAAO,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACzG,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAClF,OAAO,EAA2C,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3C,OAAO,WAAW,CAAA;AAElB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAyB,KAAK,CAAC,EAAE;IACvD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,YAAoB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACvB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEnG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC5C,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,EAAE,QAAQ,CAAC;QACzF,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;IAEhC,MAAM,IAAI,GAAG,MAAC,IAAI,IAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,kBAAkB,CAAC,aAC3E,MAAC,UAAU,IAAC,SAAS,EAAC,gCAAgC,aACnD,IAAI,IAAI,IAAI,IAAI,cAAK,SAAS,EAAC,0BAA0B,YACvD,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,UAAU;4BACvD,CAAC,CAAC,KAAC,IAAI,IAAC,SAAS,EAAC,aAAa,GAAG,CAAC,CAAC,CAAC,IAAI,GACvC,EACN,KAAC,SAAS,IAAC,SAAS,EAAC,SAAS,YAAE,KAAK,GAAa,EAClD,KAAC,eAAe,cACb,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,GAChE,IACP,EAEb,MAAC,WAAW,IAAC,SAAS,EAAC,qBAAqB,aACzC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;wBACvB,CAAC,CAAC,YAAG,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,2CAA2C,YACrE,CAAC,CAAC,aAAa,EAAE,uDAAuD,CAAC,GACxE;wBACJ,CAAC,CAAC,cAAK,SAAS,EAAC,qBAAqB,YACnC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAmB,EAAE,EAAE,CAAC,MAAC,MAAM,IAEjD,IAAI,EAAC,QAAQ,uBACM,MAAM,CAAC,EAAE,EAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,WAAW,CAAC,IAAI,SAAS,mBAK9C,KAAK,CAAC,OAAO,IAAI,SAAS,kBAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gCAChD,oFAAoF;gCACpF,gFAAgF;gCAChF,iEAAiE;gCACjE,SAAS,EAAE,EAAE,CACX,4CAA4C,EAC5C,KAAK,CAAC,OAAO,IAAI,YAAY,CAC9B,EACD,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,EAC1C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAElC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE;wCACvB,CAAC,CAAC,KAAC,OAAO,IAAC,SAAS,EAAC,qBAAqB,GAAG;wCAC7C,CAAC,CAAC,KAAC,eAAe,IAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAC,QAAQ,GAAG,EAC5D,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,KAvBvE,MAAM,CAAC,EAAE,CAwBP,CAAC,GACN,EAIP,QAAQ,EAAE,SAAS,KAAK,QAAQ,IAAI,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAI,EAIxF,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;wBAC5C,CAAC,CAAC,KAAC,kBAAkB,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAI;wBAChF,CAAC,CAAC,KAAC,UAAU,IAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAI,CAAC,EAO1E,CAAC,KAAK,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,IAAI;2BACjC,YAAG,IAAI,EAAC,OAAO,4BAAkB,SAAS,EAAC,sCAAsC,YACjF,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,YAAsB,EAAE,6CAA6C,CAAC,GACtF,IACM,EAEd,cAAK,SAAS,EAAC,MAAM,YAClB,KAAK,CAAC,MAAM,IAAI,KAAC,WAAW,IAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,GAAI,GAC/D,IACD,CAAA;IAEP,uDAAuD;IACvD,EAAE;IACF,4FAA4F;IAC5F,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,6FAA6F;IAC7F,EAAE;IACF,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,4FAA4F;IAC5F,IAAI,QAAQ,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,0CAEL,KAAK,EAAE;gBACL,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS;gBACpF,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK;aACzD,EACD,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,aAExC,KAAC,iBAAiB,IAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAI,EACpD,wCAEE,KAAK,EAAE;wBACL,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ;wBACjF,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY;qBACxD,YAEA,IAAI,GACD,IACF,CAAA;IACR,CAAC;IAED,OAAO,yCAEL,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,EAC9C,SAAS,EAAE,EAAE,CAAC,6CAA6C,EAAE,KAAK,CAAC,SAAS,CAAC,YAE5E,IAAI,GACD,CAAA;AACR,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyB,KAAK,CAAC,EAAE;IAChE,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,EAAE,CAAA;IAE3B,OAAO,KAAC,WAAW,OACb,KAAK,EACT,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAC/E,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,GAC3B,CAAA;AACJ,CAAC,CAAA"}

package/build/components/login/types.d.ts

@@ -1,6 +1,6 @@
 import type { LoginScreenProps } from '@owlmeans/client-auth/login';
 import type { ComponentType, ReactNode } from 'react';
-import type { LoginCreditModel, LoginTermsModel } from '@owlmeans/client-panel/auth';
+import type { LoginCreditModel, LoginProviderModel, LoginTermsModel } from '@owlmeans/client-panel/auth';
 export interface LoginScreenSetup extends Omit<LoginScreenProps, 'translate'> {
     /** The one thing an application is expected to supply. */
     Logo?: ComponentType<{
@@ -15,9 +15,14 @@ export interface LoginCreditProps {
 export interface LoginTermsProps {
     model: LoginTermsModel;
     translate: (key: string, defaultValue: string) => string;
-    /** The current language, for `Intl.ListFormat` and a document's own locale-keyed label. */
+    /** The current language, for `Intl.ListFormat`, document labels and explicit translated hrefs. */
     locale?: string;
     className?: string;
 }
 export type LoginPrivacyNoticeProps = LoginTermsProps;
+export interface LoginProviderNoteProps {
+    model: LoginProviderModel;
+    translate: (key: string, defaultValue: string) => string;
+    className?: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/components/login/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/components/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAEpF,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;IAC3E,0DAA0D;IAC1D,IAAI,CAAC,EAAE,aAAa,CAAC;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAA;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,gBAAgB,CAAA;IACvB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAA;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,uBAAuB,GAAG,eAAe,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/components/login/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAExG,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;IAC3E,0DAA0D;IAC1D,IAAI,CAAC,EAAE,aAAa,CAAC;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAA;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,gBAAgB,CAAA;IACvB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAA;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,uBAAuB,GAAG,eAAe,CAAA;AAErD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,kBAAkB,CAAA;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB"}

package/build/consent/component.d.ts

@@ -19,5 +19,9 @@ import { type CookieConsentProps, type CookiePolicyProps } from '@owlmeans/web-c
  * while the context is built, before anything renders.
  */
 export declare const PanelCookieConsent: FC<CookieConsentProps>;
+/**
+ * The cookie-policy page, bound like the dialog — and told about the geo gate the same way, so it
+ * states the regional rule exactly when the dialog applies it.
+ */
 export declare const PanelCookiePolicy: FC<CookiePolicyProps>;
 //# sourceMappingURL=component.d.ts.map

package/build/consent/component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../src/consent/component.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,EAA+B,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AA0BpH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAMrD,CAAA;AAED,eAAO,MAAM,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAMnD,CAAA"}
+{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../src/consent/component.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAA;AAC/B,OAAO,EACgD,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EACrG,MAAM,uBAAuB,CAAA;AAqC9B;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAWrD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAQnD,CAAA"}

package/build/consent/component.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { CookieConsent, CookiePolicy } from '@owlmeans/web-consent';
+import { CookieConsent, CookiePolicy, } from '@owlmeans/web-consent';
 import { useLanguage } from '@owlmeans/client-i18n';
 import { useContext } from '../context.js';
 import { useConsentTranslate } from './translate.js';
@@ -12,6 +12,12 @@ const BoundCookieConsent = ({ menuPresent, ...props }) => {
     return _jsx(CookieConsent, { ...props, locale: locale, translate: translate, noReopenButton: props.noReopenButton ?? menuPresent });
 };
 const MenuAwareCookieConsent = props => _jsx(BoundCookieConsent, { ...props, menuPresent: useConsentWidgetPresent() });
+/**
+ * The geo gate in force: the prop, else `cfg.cookieConsent.geo`, else — when the application
+ * appended a locator of its own — the gate with nothing but that locator.
+ */
+const geoOf = (prop, context) => prop ?? context.cfg.cookieConsent?.geo ?? (typeof context.consentGeo === 'function' ? {} : undefined);
+void _localeParity;
 /**
  * The consent dialog, bound to this application's language and translations.
  *
@@ -32,15 +38,23 @@ const MenuAwareCookieConsent = props => _jsx(BoundCookieConsent, { ...props, men
  */
 export const PanelCookieConsent = props => {
     const context = useContext();
+    const mode = props.mode ?? context.cfg.cookieConsent?.mode;
+    const geo = geoOf(props.geo, context);
+    const bound = { ...props, ...(mode != null ? { mode } : {}), ...(geo != null ? { geo } : {}) };
     return typeof context.consentWidget === 'function'
-        ? _jsx(MenuAwareCookieConsent, { ...props })
-        : _jsx(BoundCookieConsent, { ...props });
+        ? _jsx(MenuAwareCookieConsent, { ...bound })
+        : _jsx(BoundCookieConsent, { ...bound });
 };
+/**
+ * The cookie-policy page, bound like the dialog — and told about the geo gate the same way, so it
+ * states the regional rule exactly when the dialog applies it.
+ */
 export const PanelCookiePolicy = props => {
+    const context = useContext();
     const [lng] = useLanguage();
     const locale = props.locale ?? lng;
     const translate = useConsentTranslate(locale, props.translate);
-    return _jsx(CookiePolicy, { ...props, locale: locale, translate: translate });
+    const geo = geoOf(props.geo, context);
+    return _jsx(CookiePolicy, { ...props, ...(geo != null ? { geo } : {}), locale: locale, translate: translate });
 };
-void _localeParity;
 //# sourceMappingURL=component.js.map