Provide a short returning-user path and a dependable same-tab path. Google and the browser decide whether account selection or reauthentication is required. Do not promise silent login or call a flow fastest without measurements.
- Inspect login, signup, email verification, recovery, session, logout, account linking and authorization. Identify the selected action, locales, design system and registered Google callback.
- Read integration. For React 19.2+, adapt GoogleSignIn.tsx and its styles. Use the optional AuthPanel with panel styles for a Muvisafe-inspired shell. Other frameworks should implement the same contract using their own lifecycle primitives.
- For email/password flows, adapt EmailAuth.tsx and email styles. Read the email adapter section in the integration contract. Use email-design for messages sent by those flows.
- Keep the official Google button with FedCM auto-selection for a remembered account. Always offer a normal same-tab link. GIS sign-in does not provide the OAuth authorization client's
error_callback. Do not invent popup-failure detection, retry timers or user-agent rules. - Resolve return navigation in the auth owner. Both paths must use the same account/session policy, then resume the action once. Only the backend verifies identity and authorizes access.
- Run the applicable journeys through the project's existing QA harness. Keep fixture results, real Google evidence and deployed behavior distinct.
- Record the app commit, runtime versions and actual evidence in its existing tracked guidance. Change the shared recipe only when new evidence changes a shared rule.
The app owns script loading, public client configuration, remembering the successful Google account, sessions, error reporting and navigation. The component owns rendering, pending/error UI and cancelling its credential operation when the auth surface closes.
For architecture standardization, read backend standard. It is a proposed target, not an implemented Go dependency or completed migration.
For web/native/TV clients or another social provider, read platforms and providers. Use one identity store and revocation model per product across its clients. Keep browser cookies and native secure-storage transport distinct.
Curation
Read provenance before claiming production coverage. Distinguish a shipped reference, a tested extraction and a pending app integration. Add future components as focused skills with code, integration contracts and behavior tests when an actual app supplies the evidence. Do not add empty catalogs or treat a component PR as permission to deploy another app.