- Shipped
- November 15, 2026 at 4:01 AM UTC
- Author
- Kamo
- Commit
- eb5a984
- Identifier first: the member says who they are, signin/identify routes by DOMAIN only (never reveals an account), then the ways in for this host + audience as shared-layout method pills: Password, Email Code, KamoMobile (number matching, waiting ring), Passkey; QR sign-in from the first step; passkey conditional mediation in the identifier field; "Skip passwords next time" enrol offer after a password sign-in (auto-continues within the one-time key's life); Trust This Device (kamo_td, forwarded as X-Kamo-Trusted-Device). Every one shows only when signin/methods says it is on and its relay answers; a 404 hides it silently (app/api/signin/[op] via @kamo/auth 0.6.0). - One card that breathes: direction-aware (RTL-mirrored) step slides, springing height, card widens for the workspace picker. The Sign In button stretches into kamo-internal /validate's horizon line + aurora before the cross-origin hop (HorizonHandoff). - Workspace picker: org cards with logo, brand-colour glow + corner ribbon, role and last visit when sent, hover/focus cross-fades the backdrop to that org's photographs, favourites (localStorage, try/catch), type-to-filter, keys 1–9, arrow keys. - Light / Dark / Auto set before first paint (org config.json colorScheme as the default), scoped to the redesigned surfaces so OAuth consent/logout/link keep their look. - next-intl from the dictionary project kamo-login (CI clones it; prebuild key guard), language picker in the pane footer, Accept-Language, RTL; copy.ts retired. - Password-manager friendly fields (stable names, username / current-password / one-time-code), keyboard-reachable reveal, Caps Lock warning; plain-language refusals for every securityservice reason (lockout ring + strike meter kept, inactive team member, unknown host, location block, WRONG_SECURITY_PROVIDER_ORG with its button); org front-door links + notice card from config.json (absent = hidden); Need Help? = the org's public chat widget if configured, else help centre. - Theme resolved server-side (colours, backgrounds with ?v=<themeRevision>, title) — no platform-brand flash; first background preloaded and never opacity:0; no slideshow library (Swiper removed). - Can't Sign In: /recover (email, SMS, security questions, recovery phrase) merged into /reset-password, in org colours (MUI blue gone); /recover deleted. - ID1.4b: a provider callbackUrl on another login.* origin restarts the flow there (once, never for LINK); no provider live = the "not available" card; linkSession passed to federation/start. - The password request (/api/login body) is unchanged.