@owlmeans/auth-common 0.1.18-rc.12 → 0.1.18-rc.13

package/README.md

@@ -12,7 +12,7 @@ Predefined authentication entrypoints, guards, and constants shared between serv
 ## Installation
 
 ```bash
-bun add @owlmeans/auth-common
+bun add @owlmeans/auth-common@^0.1.18-rc.12
 ```
 
 ## Usage
@@ -84,7 +84,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.12
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.12",
-  "generatedAt": "2026-09-01T17:39:40.761Z",
+  "version": "0.1.18-rc.13",
+  "generatedAt": "2026-09-04T22:43:25.439Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: auth-common
-description: How to use @owlmeans/auth-common — shared authentication guard aliases (DEFAULT_GUARD, GUARD_ED25519) and middleware shared between server and client. Auto-invoked when importing guard constants or shared auth modules.
+description: How to use @owlmeans/auth-common — the auth vocabulary both sides of the wire share, covering guard aliases (DEFAULT_GUARD, GUARD_ED25519), the shared auth entrypoint list, the Ed25519 signature guard, the TRUSTED-record trust() helper, and the organization-entity resolver contract (ENTITY_RESOLVER, entityKeyOf, attachEntity). Auto-invoked when importing guard constants, the shared auth entrypoints, or entity-resolution helpers.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,46 +8,135 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.12"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.13"` in `dependencies`
+
+Everything a server and a browser must agree on to talk authentication: aliases, the shared
+entrypoint declarations, the signature guard, and the contract for resolving the organization
+entity a token names.
 
 ## Key Exports
 
+### Aliases and constants
+
+| Export | Value / description |
+|--------|---------------------|
+| `DEF_AUTH_SRV` / `DEFAULT_GUARD` | `'auth'` — the canonical auth guard alias, the same string on both sides |
+| `GUARD_ED25519` | `'guard:ed25519-basic-signature'` — the Ed25519 request-signature guard |
+| `TOKEN_UPDATE` | `'auth-token-refresh'` |
+| `WEB_API` | `'web-auth-api'` — service alias of the auth manager's web API |
+| `DISPATCHER_PATH` / `SURROGATE_PATH` | `'/dispatcher'` / `'/surrogate'` — both reserved; an application must never declare its own route at either |
+| `ENTITY_RESOLVER` | `'entity-resolver'` — the organization-entity resolver's service alias |
+| `ENTITY_SLUG_PATTERN` | A lowercase DNS label. Slugs compose hostnames, cluster object names and OIDC client ids, so anything needing sanitising is rejected where it is chosen |
+| `RELY_PIN_PERFIX`, `RELY_TOKEN_PREFIX`, `RELY_CALL_TIMEOUT`, `RELY_ACTION_TIMEOUT` | Rely-handshake constants |
+| `BED255_TIME_HEADER`, `BED255_NONCE_HEADER`, `BED255_SIG_TTL`, `BED255_CASHE_RESOURCE` | Ed25519 signature-guard headers, replay window and nonce-cache alias |
+| `authApi` | Alias tree for the manager API entrypoints (`profile`, `entity`, `auth`) |
+
+### Entrypoints, guard and middleware
+
+| Export | Description |
+|--------|-------------|
+| `entrypoints` | The shared auth entrypoint list — `AUTHEN*`, `CAUTHEN*`, `DISPATCHER`, `DISPATCHER_SURROGATE`, `DISPATCHER_AUTHEN`. Server and client packages elevate the entries they serve |
+| `managerEntrypoints` | The auth-manager web API entrypoints (profile → entity slug, auth delegation) |
+| `makeBasicEd25519Guard(resource, opts?)` | The `GUARD_ED25519` guard service: signs outgoing requests as a client, verifies time/nonce/signature as a server |
+| `authMiddleware` | Loading-stage context middleware that attaches the guard's token to every guarded backend entrypoint's `invoke`/`call` |
+| `SurrogateQuery`, `SurrogateQuerySchema` | The surrogate window's `intent` / `next` / `method` query |
+
+### Types
+
+| Type | Description |
+|------|-------------|
+| `AuthService` | `GuardService` + `authenticate(token)`, `update(token)`, `user()`, `store<T>()` — the client-side auth manager contract |
+| `AuthorizationService` | `isAllowed(permissions, token?, thr?)`, `update(token?, thr?)` |
+| `TrustedRecord` | A `ConfigRecord` carrying a known signing identity's `name`, `credential` (public key) and optional `secret` |
+| `AuthRequest` | An `AbstractRequest` whose `query` is an `AuthToken` |
+| `AuthUIParams` | `{ type? }` — the typed login route's params |
+| `OrgEntityRef` | `{ id, slug, formerSlugs?, iamKey }` |
+| `EntityResolverService` | `resolve`, `byId`, `mintSlug`, `rename`, `mintName` — see below |
+| `ProfileToEntityIdRequest` / `ProfileToEntityIdResponse` | The manager API body/response that maps a `profileId` to an `entitySlug` |
+
+### Subpath `./utils`
+
 | Export | Description |
 |--------|-------------|
-| `DEFAULT_GUARD` | Alias for the default authentication guard |
-| `GUARD_ED25519` | Alias for the Ed25519 signature guard |
-| `AUTH_API` | Alias of the auth service module group |
-| Auth modules | Shared module declarations registered in both server and client |
-| Middleware | Cross-side auth middleware helpers |
+| `trust(context, resource, userName, field = 'name')` | Load a `TrustedRecord` from a config resource and return `{ user, key }`, where `key` is a signing `KeyPairModel` when the record has a `secret` and a verify-only one otherwise |
+| `extractAuthToken(req, type?, onlyValue?)` | Pull the `authorization` header, optionally requiring an `AuthroizationType` prefix |
+| `Config`, `Context` | The minimal context shape `trust` needs |
 
-## Subpath Exports
+## The organization entity
 
-- `./utils` — shared auth utility functions
+The customer organization is an **organization entity**. Two values name it and they are not
+interchangeable:
+
+- **`entitySlug`** — renameable, human-readable, and the only organization value on the wire. It is
+  what a token, a URL, a query param and a form carry.
+- **`entityId`** — the stable record id. It never travels; it is what database rows, permission
+  grants and third-party records key on, and it is why a rename costs one write.
+
+`EntityResolverService` is the contract between the two. It is registered **only** by an
+implementation that actually stores organizations (`@owlmeans/server-auth-identity` registers one);
+a deployment backed by an external IAM registers none, and every consumer must treat an unresolved
+entity as ordinary rather than exceptional.
+
+```typescript
+import { attachEntity, entityKeyOf, requireEntityKey, requireEntity } from '@owlmeans/auth-common'
+```
+
+| Helper | What it answers |
+|--------|-----------------|
+| `attachEntity(context, request)` | Resolve the slug on `request.auth` and set `request.entity`, canonicalizing a retired slug to the current one. A no-op when no resolver is registered; throws `AuthenFailed('entity')` when the token names an organization that will not resolve |
+| `entityKeyOf(req)` | The value to store and query organization-scoped records by — `req.entity?.id`, falling back to the token's slug where no resolver exists |
+| `requireEntityKey(req)` | Same, throwing `AuthorizationError` when the request carries no organization |
+| `requireEntity(req)` | The full `ResolvedEntity` (`id`, `slug`, `iamKey`), throwing `AuthorizationError` when nothing resolved |
+
+`attachEntity` must be called wherever authentication is **established** — the HTTP boundary, and
+any socket that authenticates after its connection is already open. A path that authenticates
+without it leaves `request.entity` empty and its handlers silently compare a slug against stored
+ids.
+
+Never build a user-facing name (a hostname, a display label) from `entityKeyOf`. Those want the
+current slug, `req.entity?.slug`.
 
 ## Usage
 
-Use guard aliases when declaring modules so both client and server agree on the guard name:
+Declare an entrypoint with a guard so both sides agree on the alias, and compose authorization as a
+gate inside the same options object:
 
 ```typescript
 import { entrypoint, guard, gate } from '@owlmeans/entrypoint'
-import { route } from '@owlmeans/route'
+import { route, backend } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
-import { OIDC_GATE } from '@owlmeans/oidc'
 
+// PRODUCT_GATE is the consuming app's own gate alias, registered as a GateService on its context.
 entrypoint(
-  route(manager.back.account.base, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
+  route('api:account', '/account', backend()),
+  guard(DEFAULT_GUARD, gate(PRODUCT_GATE, ['my-service-account-{entity}']))
 )
 ```
 
-## Product-Viable Usage Notes
+`{entity}` is a placeholder each **gate service** substitutes for itself — `@owlmeans/auth-common`
+declares neither the token nor the substitution — so what it stands for depends on the gate the
+alias resolves to. `@owlmeans/server-iam` substitutes `req.entity?.id`, falling back to the token's
+slug, because its grants are stored against the organization entity's stable id wherever one is
+resolvable. `@owlmeans/server-oidc-rp`'s gate model substitutes the token's slug only. Both write
+`'-'` when neither is available. Read the gate you are wiring before writing a parameter that
+depends on the value.
+
+## Rules
 
-- Manager API modules use `DEFAULT_GUARD` for bearer-token authentication and compose product authorization with `gate(VIABLE_AUTH_GATE, [...])` inside the same `guard(...)` options object.
-- Internal service-to-service routes still use `GUARD_ED25519`, including publisher/project command paths and auth service helper modules.
-- `DEFAULT_GUARD` is the guard alias shared across server and web; `@owlmeans/client-auth` exports the matching client alias.
-- OIDC gates are not required when OIDC is only the login/bootstrap provider. In product-viable, OIDC/Google login issues local bearer auth, and a product-specific gate checks local identity scopes.
+- `DEFAULT_GUARD` is the bearer-token guard shared by server and web; `@owlmeans/client-auth` exports
+  the matching client-side alias as `DEFAULT_ALIAS`.
+- `GUARD_ED25519` is for service-to-service calls, where the caller signs the request rather than
+  presenting a bearer token. Give it a Redis-backed nonce cache (`BED255_CASHE_RESOURCE`) in any
+  deployment that runs more than one replica, or replay protection is per-process only.
+- An OIDC gate is not required when OIDC is only the login/bootstrap provider. Where the provider
+  issues a local bearer token, authorize with a product-specific gate against local identity scopes.
+- The trust resource (`TRUSTED`, from `@owlmeans/config`) is the system's source of truth for known
+  signing identities — the auth service, peer services, wallet providers, supervisors.
 
 ## Depends On
 
-- `@owlmeans/auth` — types and errors
-- `@owlmeans/entrypoint` — entrypoint/guard/gate helpers
+- `@owlmeans/auth` — types, errors, entrypoint aliases
+- `@owlmeans/entrypoint` — `entrypoint` / `guard` / `gate`, `GuardService`, `ResolvedEntity`
+- `@owlmeans/route` — route builders for the shared entrypoint list
+- `@owlmeans/basic-keys` — key pairs behind `trust()` and the Ed25519 guard
+- `@owlmeans/basic-ids`, `@owlmeans/context`, `@owlmeans/resource`, `@owlmeans/client-entrypoint`

package/build/consts.d.ts

@@ -45,4 +45,13 @@ export declare const authApi: {
         delegate: string;
     };
 };
+/**
+ * The request header an authenticated call carries, re-exported for the packages that only depend
+ * on this half of the vocabulary.
+ *
+ * One spelling, one home: it is declared by `@owlmeans/auth` and named here so a client-side
+ * package does not have to take a dependency on the whole auth package to recognise its own
+ * bearer on a request it is about to send.
+ */
+export { AUTH_HEADER } from '@owlmeans/auth';
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAAe,CAAA;AAE1C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,OAAO,iBAAiB,CAAA;AAErC,+FAA+F;AAC/F,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,QAA2C,CAAA;AAE3E,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;CAkBnB,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAAe,CAAA;AAE1C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,OAAO,iBAAiB,CAAA;AAErC,+FAA+F;AAC/F,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,QAA2C,CAAA;AAE3E,eAAO,MAAM,OAAO;IAClB,OAAO;QACL,IAAI;QACJ,UAAU;;IAEZ,MAAM;QACJ,IAAI;QACJ,GAAG;QACH,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,IAAI;;;IAGR,IAAI;QACF,IAAI;QACJ,QAAQ;;CAEX,CAAA;AAGD;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA"}

package/build/consts.js

@@ -45,4 +45,13 @@ export const authApi = {
         delegate: 'api:auth:delegate',
     },
 };
+/**
+ * The request header an authenticated call carries, re-exported for the packages that only depend
+ * on this half of the vocabulary.
+ *
+ * One spelling, one home: it is declared by `@owlmeans/auth` and named here so a client-side
+ * package does not have to take a dependency on the whole auth package to recognise its own
+ * bearer on a request it is about to send.
+ */
+export { AUTH_HEADER } from '@owlmeans/auth';
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAA;AAErC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAA;AAE3E,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,0BAA0B;KACvC;IACD,MAAM,EAAE;QACN,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,yBAAyB;SAChC;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,mBAAmB;KAC9B;CACF,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAA;AAErC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAA;AAE3E,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,0BAA0B;KACvC;IACD,MAAM,EAAE;QACN,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,yBAAyB;SAChC;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,mBAAmB;KAC9B;CACF,CAAA;AAGD;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA"}

package/build/entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,eAAe,KAAG,MAAM,GAAG,SAClB,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,eAAe,KAAG,MAOvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,eAAe,KAAG,cAMpD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAiBpC,CAAA"}
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QAAS,eAAe,KAAG,MAAM,GAAG,SAClB,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,eAAe,KAAG,MAOvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAS,eAAe,KAAG,cAMpD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,YACd,YAAY,CAAC,GAAG,CAAC,WAAW,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAiBpC,CAAA"}

package/build/guards/basic-ed25519/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,EAAE,OAAO,wBAAwB,KAAG,iBAqHzF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBAqHzF,CAAA"}

package/build/utils/header.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D,eAAO,MAAM,gBAAgB,GAC3B,KAAK,OAAO,CAAC,eAAe,CAAC,EAC7B,OAAM,MAAM,GAAG,IAA0C,EACzD,YAAW,OAAc,KACxB,MAAM,GAAG,IAgBX,CAAA"}
+{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D,eAAO,MAAM,gBAAgB,QACtB,OAAO,CAAC,eAAe,CAAC,SACvB,MAAM,GAAG,IAAI,cACR,OAAO,KACjB,MAAM,GAAG,IAgBX,CAAA"}

package/build/utils/header.js.map

@@ -1 +1 @@
-{"version":3,"file":"header.js","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAG/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAA6B,EAC7B,OAAsB,iBAAiB,CAAC,iBAAiB,EACzD,YAAqB,IAAI,EACV,EAAE;IACjB,IAAI,aAAa,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IAC9C,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IAE/E,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IACnD,CAAC;IAED,OAAO,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;QAC1C,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA"}
+{"version":3,"file":"header.js","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAG/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAA6B,EAC7B,IAAI,GAAkB,iBAAiB,CAAC,iBAAiB,EACzD,SAAS,GAAY,IAAI,EACV,EAAE;IACjB,IAAI,aAAa,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IAC9C,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IAE/E,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IACnD,CAAC;IAED,OAAO,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;QAC1C,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA"}

package/build/utils/trusted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,UAAU,MAAM,EAAE,UAAU,MAAM,EAAE,QAAO,MAAe;;;EAWzI,CAAA"}
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,YAAY,MAAM,UAAS,MAAM;;;EAWhI,CAAA"}

package/build/utils/trusted.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,QAAgB,MAAM,EAAE,EAAE;IAC5I,MAAM,KAAK,GAA4B,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEvH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAK,GAAW,MAAM,EAAE,EAAE;IAC5I,MAAM,KAAK,GAA4B,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEvH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.12",
+  "version": "0.1.18-rc.13",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,19 +29,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.8",
-    "@owlmeans/auth-common": "^0.1.18-rc.12",
-    "@owlmeans/basic-ids": "^0.1.18-rc.8",
-    "@owlmeans/basic-keys": "^0.1.18-rc.11",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.12",
-    "@owlmeans/context": "^0.1.18-rc.7",
-    "@owlmeans/entrypoint": "^0.1.18-rc.10",
-    "@owlmeans/resource": "^0.1.18-rc.8",
-    "@owlmeans/route": "^0.1.18-rc.8"
+    "@owlmeans/auth": "^0.1.18-rc.9",
+    "@owlmeans/auth-common": "^0.1.18-rc.13",
+    "@owlmeans/basic-ids": "^0.1.18-rc.9",
+    "@owlmeans/basic-keys": "^0.1.18-rc.12",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.13",
+    "@owlmeans/context": "^0.1.18-rc.8",
+    "@owlmeans/entrypoint": "^0.1.18-rc.11",
+    "@owlmeans/resource": "^0.1.18-rc.9",
+    "@owlmeans/route": "^0.1.18-rc.9"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.12",
+    "@owlmeans/test-auth": "^0.1.18-rc.13",
     "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/consts.ts

@@ -58,3 +58,13 @@ export const authApi = {
   },
 }
 
+
+/**
+ * The request header an authenticated call carries, re-exported for the packages that only depend
+ * on this half of the vocabulary.
+ *
+ * One spelling, one home: it is declared by `@owlmeans/auth` and named here so a client-side
+ * package does not have to take a dependency on the whole auth package to recognise its own
+ * bearer on a request it is about to send.
+ */
+export { AUTH_HEADER } from '@owlmeans/auth'