@owlmeans/auth-common 0.1.18-rc.14 → 0.1.18-rc.16

package/README.md

@@ -31,9 +31,14 @@ Protect a route with the ED25519 signature guard (re-exported via `@owlmeans/ser
 
 ```typescript
 import { GUARD_ED25519 } from '@owlmeans/auth-common'
-import { entrypoint, guard } from '@owlmeans/server-app'
-
-const adminEntrypoint = entrypoint(route('admin', '/api/admin'), guard(GUARD_ED25519))
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
+import { route } from '@owlmeans/route'
+
+const adminProtocol = protocol(
+  route('admin', '/api/admin'),
+  contract(typed<AdminResponse>()),
+  { guards: GUARD_ED25519 },
+)
 ```
 
 ## API
@@ -66,9 +71,9 @@ BED255_CASHE_RESOURCE // resource alias for nonce cache
 ## Product-Viable Integration Notes
 
 - `DEFAULT_GUARD` protects manager routes after bearer authentication is installed by `@owlmeans/server-auth`.
-- Product authorization composes a custom gate inside `guard(DEFAULT_GUARD, gate(VIABLE_AUTH_GATE, [...]))` rather than using `OIDC_GATE` for Google login flows.
+- Product authorization composes a custom gate in the protocol options rather than using `OIDC_GATE` for Google login flows.
 - `GUARD_ED25519` remains the service-to-service guard for internal/publisher/payment/auth-service calls.
-- The browser-side alias from `@owlmeans/client-auth` must match the default guard name so shared entrypoint declarations elevate consistently.
+- The browser-side binding from `@owlmeans/client-auth` uses the same protocol references as the shared declarations.
 
 ## Related Packages
 
@@ -84,7 +89,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.13
+npx @owlmeans/agent-skills@^0.1.18-rc.15
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.14",
-  "generatedAt": "2026-09-10T18:54:42.492Z",
+  "version": "0.1.18-rc.16",
+  "generatedAt": "2026-09-12T08:39:52.720Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.14"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.16"` in `dependencies`
 
 Everything a server and a browser must agree on to talk authentication: aliases, the shared
 entrypoint declarations, the signature guard, and the contract for resolving the organization
@@ -35,7 +35,7 @@ entity a token names.
 
 | Export | Description |
 |--------|-------------|
-| `entrypoints` | The shared auth entrypoint list — `AUTHEN*`, `CAUTHEN*`, `DISPATCHER`, `DISPATCHER_SURROGATE`, `DISPATCHER_AUTHEN`. Server and client packages elevate the entries they serve |
+| `authEntrypoints` | The shared auth protocol tree — `AUTHEN*`, `CAUTHEN*`, `DISPATCHER`, `DISPATCHER_SURROGATE`, `DISPATCHER_AUTHEN`. Server and client packages bind the entries they serve |
 | `managerEntrypoints` | The auth-manager web API entrypoints (profile → entity slug, auth delegation) |
 | `makeBasicEd25519Guard(resource, opts?)` | The `GUARD_ED25519` guard service: signs outgoing requests as a client, verifies time/nonce/signature as a server |
 | `authMiddleware` | Loading-stage context middleware that attaches the guard's token to every guarded backend entrypoint's `invoke`/`call` |
@@ -102,14 +102,15 @@ Declare an entrypoint with a guard so both sides agree on the alias, and compose
 gate inside the same options object:
 
 ```typescript
-import { entrypoint, guard, gate } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route, backend } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 
 // PRODUCT_GATE is the consuming app's own gate alias, registered as a GateService on its context.
-entrypoint(
+protocol(
   route('api:account', '/account', backend()),
-  guard(DEFAULT_GUARD, gate(PRODUCT_GATE, ['my-service-account-{entity}']))
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: PRODUCT_GATE, params: ['my-service-account-{entity}'] } },
 )
 ```
 

package/build/entrypoints.d.ts

@@ -1,3 +1,41 @@
-export declare const entrypoints: import("@owlmeans/entrypoint").CommonEntrypoint[];
-export declare const managerEntrypoints: import("@owlmeans/entrypoint").CommonEntrypoint[];
+import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth';
+import type { SurrogateQuery } from './schemas.js';
+/** Shared authentication protocols, bound independently by server and browser packages. */
+export declare const authProtocols: {
+    authen: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    init: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: AllowanceRequest;
+    }, AllowanceResponse>;
+    authenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: AuthCredentials;
+    }, AuthToken>;
+    rely: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        query: Partial<AuthToken>;
+    }, undefined>;
+    client: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    login: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    loginDefault: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    loginTyped: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    flowEnter: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    dispatcher: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        query: AuthToken;
+    }, undefined>;
+    surrogate: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        query: SurrogateQuery;
+    }, undefined>;
+    dispatcherAuthenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: AuthToken;
+    }, AuthToken>;
+};
+/** Shared manager authentication protocols. */
+export declare const managerProtocols: {
+    profile: {
+        base: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+        toEntityId: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    };
+    auth: {
+        base: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+        delegate: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
+    };
+};
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,WAAW,mDAkCvB,CAAA;AAED,eAAO,MAAM,kBAAkB,mDAW9B,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAMrG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,2FAA2F;AAC3F,eAAO,MAAM,aAAa;IACxB,MAAM;IACN,IAAI;;;IAEJ,YAAY;;;IAEZ,IAAI;;;IAEJ,MAAM;IACN,KAAK;IACL,YAAY;IACZ,UAAU;IACV,SAAS;IACT,UAAU;;;IAYV,SAAS;;;IAOT,sBAAsB;;;CAEvB,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB;IAC3B,OAAO;QACL,IAAI;QACJ,UAAU;;IAKZ,IAAI;QACF,IAAI;QACJ,QAAQ;;CAKX,CAAA"}

package/build/entrypoints.js

@@ -1,27 +1,21 @@
 import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, DISPATCHER_SURROGATE, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
 // import { AppType } from '@owlmeans/context'
-import { body, filter, entrypoint, query } from '@owlmeans/entrypoint';
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
 import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route';
 import { DISPATCHER_PATH, SURROGATE_PATH, WEB_API, authApi } from './consts.js';
 import { SurrogateQuerySchema } from './schemas.js';
-export const entrypoints = [
-    entrypoint(route(AUTHEN, '/authentication', backend())),
-    entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
-    entrypoint(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
-    entrypoint(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
-    entrypoint(route(CAUTHEN, '/authentication', frontend())),
-    entrypoint(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
-    entrypoint(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
-    entrypoint(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
-    // This is a helper route that is used by service providers to redirect to an external authentication service.
-    entrypoint(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
-    // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
-    // Also it can be default starting point to be redirected to an external identity provider.
-    entrypoint(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), 
-    // This entrypoint is sticky - it means it's always attach to client router.
-    // It's required here cause every web app needs dispatcher route to authorize
-    // rediected users.
-    filter(query(AuthTokenSchema), { sticky: true })),
+/** Shared authentication protocols, bound independently by server and browser packages. */
+export const authProtocols = {
+    authen: openProtocol(route(AUTHEN, '/authentication', backend())),
+    init: protocol(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), contract.request({ body: typed(AllowanceRequestSchema) }, typed())),
+    authenticate: protocol(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), contract.request({ body: typed(AuthCredentialsSchema) }, typed())),
+    rely: protocol(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), contract.request({ query: typed(OptionalAuthTokenSchema) }, typed())),
+    client: openProtocol(route(CAUTHEN, '/authentication', frontend())),
+    login: openProtocol(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+    loginDefault: openProtocol(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+    loginTyped: openProtocol(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+    flowEnter: openProtocol(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+    dispatcher: protocol(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), contract.request({ query: typed(AuthTokenSchema) }, typed()), { sticky: true }),
     // The login window an embedded application opens one level up.
     //
     // Top level and with no parent, so it renders outside every application layout — a popup must
@@ -29,17 +23,22 @@ export const entrypoints = [
     // dispatcher is: it must attach to the client router regardless of service selection. It carries
     // no `service`, unlike the dispatcher, because nothing server-side ever addresses it — the
     // provider's callback goes to the dispatcher. And no guard: it is where a signed-out user lands.
-    entrypoint(route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()), filter(query(SurrogateQuerySchema), { sticky: true })),
+    surrogate: protocol(route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()), contract.request({ query: typed(SurrogateQuerySchema) }, typed()), { sticky: true }),
     // This is a helper route that representes a API endpoint of service provider that wants to authenticate
     // a user with OwlMeans server-auth library.
-    entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
-];
-export const managerEntrypoints = [
-    entrypoint(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
-    entrypoint(route(authApi.profile.toEntityId, '/to-entity-id', backend(authApi.profile.base, RouteMethod.POST))),
-    entrypoint(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
-    entrypoint(route(authApi.auth.delegate, '/delegate', backend(authApi.auth.base, RouteMethod.POST))),
-];
+    dispatcherAuthenticate: protocol(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), contract.request({ body: typed(AuthTokenSchema) }, typed())),
+};
+/** Shared manager authentication protocols. */
+export const managerProtocols = {
+    profile: {
+        base: openProtocol(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
+        toEntityId: openProtocol(route(authApi.profile.toEntityId, '/to-entity-id', backend(authApi.profile.base, RouteMethod.POST))),
+    },
+    auth: {
+        base: openProtocol(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
+        delegate: openProtocol(route(authApi.auth.delegate, '/delegate', backend(authApi.auth.base, RouteMethod.POST))),
+    },
+};
 // const skipEntrypoints = [DISPATCHER]
 // export const authBackendEntrypoints = entrypoints.filter(
 //   module => !skipEntrypoints.includes(module.alias) && module.route.route.type === AppType.Backend

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,kBAAkB,EACrF,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChH,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzH,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/F,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,UAAU,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3E,8GAA8G;IAC9G,UAAU,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,gHAAgH;IAChH,2FAA2F;IAC3F,UAAU,CACR,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,4EAA4E;IAC5E,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,+DAA+D;IAC/D,EAAE;IACF,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,UAAU,CACR,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EACvD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACtD;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,UAAU,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CACtH,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC7C,CAAC;CACH,CAAA;AAED,uCAAuC;AACvC,4DAA4D;AAC5D,qGAAqG;AACrG,gCAAgC"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,kBAAkB,EACrF,MAAM,gBAAgB,CAAA;AAEvB,8CAA8C;AAC9C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGnD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAmB,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAqB,CAAC,CAAC;IAC1G,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAkB,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,CAAC;IAChG,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAqB,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACzF,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,UAAU,EAAE,QAAQ,CAClB,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAY,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EACvE,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;IACD,+DAA+D;IAC/D,EAAE;IACF,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,SAAS,EAAE,QAAQ,CACjB,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAiB,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EACjF,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAY,eAAe,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,CAAC;CACrF,CAAA;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE;QACP,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1F,UAAU,EAAE,YAAY,CAAC,KAAK,CAC9B,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC9C,CAAC;KACH;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACpF,QAAQ,EAAE,YAAY,CAAC,KAAK,CAC5B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC3C,CAAC;KACH;CACF,CAAA;AAED,uCAAuC;AACvC,4DAA4D;AAC5D,qGAAqG;AACrG,gCAAgC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.14",
+  "version": "0.1.18-rc.16",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,19 +29,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.10",
-    "@owlmeans/auth-common": "^0.1.18-rc.14",
-    "@owlmeans/basic-ids": "^0.1.18-rc.10",
-    "@owlmeans/basic-keys": "^0.1.18-rc.13",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.14",
-    "@owlmeans/context": "^0.1.18-rc.9",
-    "@owlmeans/entrypoint": "^0.1.18-rc.12",
-    "@owlmeans/resource": "^0.1.18-rc.10",
-    "@owlmeans/route": "^0.1.18-rc.10"
+    "@owlmeans/auth": "^0.1.18-rc.12",
+    "@owlmeans/auth-common": "^0.1.18-rc.16",
+    "@owlmeans/basic-ids": "^0.1.18-rc.12",
+    "@owlmeans/basic-keys": "^0.1.18-rc.15",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.16",
+    "@owlmeans/context": "^0.1.18-rc.11",
+    "@owlmeans/entrypoint": "^0.1.18-rc.14",
+    "@owlmeans/resource": "^0.1.18-rc.12",
+    "@owlmeans/route": "^0.1.18-rc.12"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.16",
     "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/entrypoints.ts

@@ -4,31 +4,32 @@ import {
   AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER,
   DISPATCHER_AUTHEN, DISPATCHER_SURROGATE, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
 } from '@owlmeans/auth'
+import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth'
 // import { AppType } from '@owlmeans/context'
-import { body, filter, entrypoint, query } from '@owlmeans/entrypoint'
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint'
 import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route'
 import { DISPATCHER_PATH, SURROGATE_PATH, WEB_API, authApi } from './consts.js'
 import { SurrogateQuerySchema } from './schemas.js'
+import type { SurrogateQuery } from './schemas.js'
 
-export const entrypoints = [
-  entrypoint(route(AUTHEN, '/authentication', backend())),
-  entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
-  entrypoint(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
-  entrypoint(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
-  entrypoint(route(CAUTHEN, '/authentication', frontend())),
-  entrypoint(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
-  entrypoint(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
-  entrypoint(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
-  // This is a helper route that is used by service providers to redirect to an external authentication service.
-  entrypoint(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
-  // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
-  // Also it can be default starting point to be redirected to an external identity provider.
-  entrypoint(
+/** Shared authentication protocols, bound independently by server and browser packages. */
+export const authProtocols = {
+  authen: openProtocol(route(AUTHEN, '/authentication', backend())),
+  init: protocol(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)),
+    contract.request({ body: typed<AllowanceRequest>(AllowanceRequestSchema) }, typed<AllowanceResponse>())),
+  authenticate: protocol(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)),
+    contract.request({ body: typed<AuthCredentials>(AuthCredentialsSchema) }, typed<AuthToken>())),
+  rely: protocol(route(AUTHEN_RELY, '/rely', socket(AUTHEN)),
+    contract.request({ query: typed<Partial<AuthToken>>(OptionalAuthTokenSchema) }, typed())),
+  client: openProtocol(route(CAUTHEN, '/authentication', frontend())),
+  login: openProtocol(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+  loginDefault: openProtocol(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+  loginTyped: openProtocol(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+  flowEnter: openProtocol(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+  dispatcher: protocol(
     route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })),
-    // This entrypoint is sticky - it means it's always attach to client router.
-    // It's required here cause every web app needs dispatcher route to authorize
-    // rediected users.
-    filter(query(AuthTokenSchema), { sticky: true })
+    contract.request({ query: typed<AuthToken>(AuthTokenSchema) }, typed()),
+    { sticky: true },
   ),
   // The login window an embedded application opens one level up.
   //
@@ -37,27 +38,34 @@ export const entrypoints = [
   // dispatcher is: it must attach to the client router regardless of service selection. It carries
   // no `service`, unlike the dispatcher, because nothing server-side ever addresses it — the
   // provider's callback goes to the dispatcher. And no guard: it is where a signed-out user lands.
-  entrypoint(
+  surrogate: protocol(
     route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()),
-    filter(query(SurrogateQuerySchema), { sticky: true })
+    contract.request({ query: typed<SurrogateQuery>(SurrogateQuerySchema) }, typed()),
+    { sticky: true },
   ),
   // This is a helper route that representes a API endpoint of service provider that wants to authenticate
   // a user with OwlMeans server-auth library.
-  entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
-]
+  dispatcherAuthenticate: protocol(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)),
+    contract.request({ body: typed<AuthToken>(AuthTokenSchema) }, typed<AuthToken>())),
+}
 
-export const managerEntrypoints = [
-  entrypoint(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
-  entrypoint(route(
+/** Shared manager authentication protocols. */
+export const managerProtocols = {
+  profile: {
+    base: openProtocol(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
+    toEntityId: openProtocol(route(
     authApi.profile.toEntityId, '/to-entity-id',
     backend(authApi.profile.base, RouteMethod.POST)
-  )),
-  entrypoint(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
-  entrypoint(route(
+    )),
+  },
+  auth: {
+    base: openProtocol(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
+    delegate: openProtocol(route(
     authApi.auth.delegate, '/delegate',
     backend(authApi.auth.base, RouteMethod.POST)
-  )),
-]
+    )),
+  },
+}
 
 // const skipEntrypoints = [DISPATCHER]
 // export const authBackendEntrypoints = entrypoints.filter(