@owlmeans/auth-common 0.1.18-rc.43 → 0.1.18-rc.45

package/README.md

@@ -12,7 +12,7 @@ Predefined authentication protocols, guards, and constants shared between server
 ## Installation
 
 ```bash
-bun add @owlmeans/auth-common@^0.1.18-rc.43
+bun add @owlmeans/auth-common@^0.1.18-rc.45
 ```
 
 ## Usage
@@ -98,7 +98,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.45
+npx @owlmeans/agent-skills@^0.1.18-rc.47
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.43",
-  "generatedAt": "2026-10-01T23:27:48.728Z",
+  "version": "0.1.18-rc.45",
+  "generatedAt": "2026-10-03T20:05:07.589Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.43"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.45"` in `dependencies`
 
 Everything a server and a browser must agree on to talk authentication: aliases, the shared
 protocol declarations, the signature guard, and the contract for resolving the organization
@@ -97,7 +97,10 @@ A guard may attach the entity itself when its authority names the organization
 does for a session of a tenanted client (`@owlmeans/oidc`), whose relying party has no registry to
 resolve from. `attachEntity` trusts that attachment only while its `slug` is the token's
 `entitySlugOf(request.auth)`; on any mismatch it removes it and resolves as if nothing had been
-attached, so a stale or foreign entity can never reach a handler.
+attached, so a stale or foreign entity can never reach a handler. That attached entity is keyed by
+the organization's frozen IAM key (`{ id: entityKey, slug, iamKey: entityKey }`) — the registry's
+record id never leaves the provider — so on such a relying party `requireEntityKey(req)` answers the
+`entityKey`, which survives a rename exactly as a record id would.
 
 Never build a user-facing name (a hostname, a display label) from `entityKeyOf`. Those want the
 current slug, `req.entity?.slug`.
@@ -120,13 +123,10 @@ protocol(
 )
 ```
 
-`{entity}` is a placeholder each **gate service** substitutes for itself — `@owlmeans/auth-common`
-declares neither the token nor the substitution — so what it stands for depends on the gate the
-alias resolves to. `@owlmeans/server-iam` substitutes `req.entity?.id`, falling back to the token's
-slug, because its grants are stored against the organization entity's stable id wherever one is
-resolvable. `@owlmeans/server-oidc-rp`'s gate model substitutes the token's slug only. Both write
-`'-'` when neither is available. Read the gate you are wiring before writing a parameter that
-depends on the value.
+`{entity}` is a placeholder each **gate service** substitutes for itself — this package declares
+neither the token nor the substitution. `@owlmeans/server-iam` substitutes the resolved id
+(`server-iam` → "`{entity}` in a permission name"); `@owlmeans/server-oidc-rp`'s gate model the
+token's slug only; both write `'-'` when neither is available. Read the gate you are wiring first.
 
 ## Rules
 
@@ -138,8 +138,7 @@ depends on the value.
   accepts only canonical timestamps inside its symmetric 60-second window and claims the
   credential-and-nonce pair until that timestamp's absolute expiry; a replay-store error refuses
   authentication rather than disabling deduplication.
-- An OIDC gate is not required when OIDC is only the login/bootstrap provider. Where the provider
-  issues a local bearer token, authorize with a product-specific gate against local identity scopes.
+- OIDC used only to sign in authorizes with a product gate, not `OIDC_GATE` (`server-oidc-rp` → Rules).
 - The trust resource (`TRUSTED`, from `@owlmeans/config`) is the system's source of truth for known
   signing identities — the auth service, peer services, wallet providers, supervisors.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.43",
+  "version": "0.1.18-rc.45",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,19 +29,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.37",
-    "@owlmeans/auth-common": "^0.1.18-rc.43",
-    "@owlmeans/basic-ids": "^0.1.18-rc.34",
-    "@owlmeans/basic-keys": "^0.1.18-rc.44",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.43",
+    "@owlmeans/auth": "^0.1.18-rc.38",
+    "@owlmeans/auth-common": "^0.1.18-rc.45",
+    "@owlmeans/basic-ids": "^0.1.18-rc.35",
+    "@owlmeans/basic-keys": "^0.1.18-rc.46",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.45",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.38",
-    "@owlmeans/resource": "^0.1.18-rc.37",
+    "@owlmeans/entrypoint": "^0.1.18-rc.39",
+    "@owlmeans/resource": "^0.1.18-rc.38",
     "@owlmeans/route": "^0.1.18-rc.33"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.42",
+    "@owlmeans/test-auth": "^0.1.18-rc.44",
     "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"