@owlmeans/auth-common 0.1.18-rc.46 → 0.1.18-rc.48

package/README.md

@@ -12,7 +12,7 @@ Predefined authentication protocols, guards, and constants shared between server
 ## Installation
 
 ```bash
-bun add @owlmeans/auth-common@^0.1.18-rc.46
+bun add @owlmeans/auth-common@^0.1.18-rc.48
 ```
 
 ## Usage
@@ -98,7 +98,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.46",
-  "generatedAt": "2026-10-05T08:32:19.101Z",
+  "version": "0.1.18-rc.48",
+  "generatedAt": "2026-10-06T11:45:57.659Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: auth-common
-description: How to use @owlmeans/auth-common — the auth vocabulary both sides of the wire share, covering guard aliases (DEFAULT_GUARD, GUARD_ED25519), the shared auth protocol trees, the Ed25519 signature guard, the TRUSTED-record trust() helper, and the organization-entity resolver contract (ENTITY_RESOLVER, entityKeyOf, attachEntity). Auto-invoked when importing guard constants, shared auth protocols, or entity-resolution helpers.
+description: How to use @owlmeans/auth-common — the auth vocabulary both sides of the wire share, covering guard aliases (DEFAULT_GUARD, GUARD_ED25519), the shared auth protocol trees, the Ed25519 signature guard, the TRUSTED-record trust() helper, and the organization-entity resolver contract (ENTITY_RESOLVER, makeEntityScope). Auto-invoked when importing guard constants, shared auth protocols, or entity-resolution helpers.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.46"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.48"` in `dependencies`
 
 Everything a server and a browser must agree on to talk authentication: aliases, the shared
 protocol declarations, the signature guard, and the contract for resolving the organization
@@ -78,32 +78,35 @@ a deployment backed by an external IAM registers none, and every consumer must t
 entity as ordinary rather than exceptional.
 
 ```typescript
-import { attachEntity, entityKeyOf, requireEntityKey, requireEntity } from '@owlmeans/auth-common'
+import { makeEntityScope } from '@owlmeans/auth-common'
+
+const scope = makeEntityScope(request)   // once at the top of a handler, never stored
 ```
 
 | Helper | What it answers |
 |--------|-----------------|
-| `attachEntity(context, request)` | Resolve the slug on `request.auth` and set `request.entity`, canonicalizing a retired slug to the current one. Keeps an entity the guard already attached when its `slug` equals the token's exactly, and drops one that does not. Otherwise a no-op when no resolver is registered; throws `AuthenFailed('entity')` when the token names an organization that will not resolve |
-| `entityKeyOf(req)` | The value to store and query organization-scoped records by — `req.entity?.id`, falling back to the token's slug where no resolver exists |
-| `requireEntityKey(req)` | Same, throwing `AuthorizationError` when the request carries no organization |
-| `requireEntity(req)` | The full `ResolvedEntity` (`id`, `slug`, `iamKey`), throwing `AuthorizationError` when nothing resolved |
-
-`attachEntity` must be called wherever authentication is **established** — the HTTP boundary, and
-any socket that authenticates after its connection is already open. A path that authenticates
-without it leaves `request.entity` empty and its handlers silently compare a slug against stored
-ids.
-
-A guard may attach the entity itself when its authority names the organization — the OIDC guard
-does for a session of a tenanted client (`@owlmeans/oidc`), whose relying party has no registry to
-resolve from. `attachEntity` trusts that attachment only while its `slug` is the token's
-`entitySlugOf(request.auth)`; on any mismatch it removes it and resolves as if nothing had been
-attached, so a stale or foreign entity can never reach a handler. That attached entity is keyed by
-the organization's frozen IAM key (`{ id: entityKey, slug, iamKey: entityKey }`) — the registry's
-record id never leaves the provider — so on such a relying party `requireEntityKey(req)` answers the
-`entityKey`, which survives a rename exactly as a record id would.
-
-Never build a user-facing name (a hostname, a display label) from `entityKeyOf`. Those want the
-current slug, `req.entity?.slug`.
+| `scope.attachEntity(context)` | Resolve the slug on `request.auth` and set `request.entity`, canonicalizing a retired slug to the current one. Keeps an entity the guard already attached when its `slug` equals the token's exactly, and drops one that does not. Otherwise a no-op when no resolver is registered; throws `AuthenFailed('entity')` when the token names an organization that will not resolve |
+| `scope.entityKeyOf()` | The value to store and query organization-scoped records by — `req.entity?.id`, falling back to the token's slug where no resolver exists |
+| `scope.requireEntityKey()` | Same, throwing `AuthorizationError` when the request carries no organization |
+| `scope.requireEntity()` | The full `ResolvedEntity` (`id`, `slug`, `iamKey`), throwing `AuthorizationError` when nothing resolved |
+
+`scope.attachEntity(context)` must be called wherever authentication is **established** — the HTTP
+boundary, and any socket that authenticates after its connection is already open. A path that
+authenticates without it leaves `request.entity` empty and its handlers silently compare a slug
+against stored ids.
+
+A guard may attach the entity itself when its authority names the organization — the OIDC guard does
+for a session of a tenanted client (`@owlmeans/oidc`), whose relying party has no registry to
+resolve from. `scope.attachEntity` trusts that attachment only while its `slug` is the token's
+`authHelper.entitySlugOf(request.auth)`; on any mismatch it removes it and resolves as if nothing
+had been attached, so a stale or foreign entity can never reach a handler. That attached entity is
+keyed by the organization's frozen IAM key (`{ id: entityKey, slug, iamKey: entityKey }`) — the
+registry's record id never leaves the provider — so on such a relying party
+`scope.requireEntityKey()` answers the `entityKey`, which survives a rename exactly as a record id
+would.
+
+Never build a user-facing name (a hostname, a display label) from `scope.entityKeyOf()`. Those want
+the current slug, `req.entity?.slug`.
 
 ## Usage
 

package/build/entity/types.d.ts

@@ -0,0 +1,52 @@
+import type { BasicContext } from '@owlmeans/context';
+import type { ResolvedEntity } from '@owlmeans/entrypoint';
+/** The organization entity one request acts for — built once at the top of a handler, never stored. */
+export interface EntityScope {
+    /**
+     * The value a handler should store and query organization-scoped records by.
+     *
+     * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
+     * survive a rename untouched. Falls back to the slug on the token for deployments that register no
+     * resolver — there the slug IS the only identifier the system has, and refusing to serve them
+     * would break every installation backed by an external IAM.
+     *
+     * Never use this to compose a user-facing name (a hostname, a display label). Those want the
+     * current slug, `req.entity?.slug`, precisely because it can change.
+     */
+    entityKeyOf: () => string | undefined;
+    /**
+     * `entityKeyOf` for handlers that cannot proceed without an organization.
+     *
+     * @throws {AuthorizationError} when the request carries no organization at all.
+     */
+    requireEntityKey: () => string;
+    /**
+     * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
+     *
+     * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
+     */
+    requireEntity: () => ResolvedEntity;
+    /**
+     * Resolve the organization a just-authenticated request acts for, and attach it.
+     *
+     * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
+     * authenticates on its own once the connection is already open. Both need it for the same reason:
+     * the token names the organization by a slug that can move, while everything downstream keys on
+     * the record. A path that authenticates without calling this leaves `request.entity` empty, and
+     * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
+     * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
+     *
+     * An entity the guard already attached is kept while its slug is exactly the token's: a guard
+     * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
+     * source such a deployment has, because the registry that owns the organization is not its own.
+     * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
+     * not been there.
+     *
+     * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
+     * and the slug is the only identifier it has.
+     *
+     * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
+     */
+    attachEntity: (context: BasicContext<any>) => Promise<ResolvedEntity | undefined>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/entity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/entity/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,uGAAuG;AACvG,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;OAUG;IACH,WAAW,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IACrC;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,MAAM,CAAA;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,cAAc,CAAA;IACnC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;CAClF"}

package/build/entity/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/entity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/entity/types.ts"],"names":[],"mappings":""}

package/build/entity.d.ts

@@ -1,49 +1,11 @@
 import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint';
 import type { BasicContext } from '@owlmeans/context';
-/**
- * The value a handler should store and query organization-scoped records by.
- *
- * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
- * survive a rename untouched. Falls back to the slug on the token for deployments that register no
- * resolver — there the slug IS the only identifier the system has, and refusing to serve them
- * would break every installation backed by an external IAM.
- *
- * Never use this to compose a user-facing name (a hostname, a display label). Those want the
- * current slug, `req.entity?.slug`, precisely because it can change.
- */
+import type { EntityScope } from './entity/types.js';
+export declare const makeEntityScope: (req: AbstractRequest) => EntityScope;
+/** @deprecated compat:factory-refactor — use `makeEntityScope(req).entityKeyOf()` */
 export declare const entityKeyOf: (req: AbstractRequest) => string | undefined;
-/**
- * `entityKeyOf` for handlers that cannot proceed without an organization.
- *
- * @throws {AuthorizationError} when the request carries no organization at all.
- */
+/** @deprecated compat:factory-refactor — use `makeEntityScope(req).requireEntityKey()` */
 export declare const requireEntityKey: (req: AbstractRequest) => string;
-/**
- * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
- *
- * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
- */
-export declare const requireEntity: (req: AbstractRequest) => ResolvedEntity;
-/**
- * Resolve the organization a just-authenticated request acts for, and attach it.
- *
- * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
- * authenticates on its own once the connection is already open. Both need it for the same reason:
- * the token names the organization by a slug that can move, while everything downstream keys on
- * the record. A path that authenticates without calling this leaves `request.entity` empty, and
- * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
- * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
- *
- * An entity the guard already attached is kept while its slug is exactly the token's: a guard
- * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
- * source such a deployment has, because the registry that owns the organization is not its own.
- * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
- * not been there.
- *
- * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
- * and the slug is the only identifier it has.
- *
- * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
- */
+/** @deprecated compat:factory-refactor — use `makeEntityScope(request).attachEntity(context)` */
 export declare const attachEntity: (context: BasicContext<any>, request: AbstractRequest) => Promise<ResolvedEntity | undefined>;
 //# sourceMappingURL=entity.d.ts.map

package/build/entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QAAS,eAAe,KAAG,MAAM,GAAG,SAClB,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,eAAe,KAAG,MAOvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAS,eAAe,KAAG,cAMpD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,YAAY,YACd,YAAY,CAAC,GAAG,CAAC,WAAW,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAwBpC,CAAA"}
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,eAAO,MAAM,eAAe,QAAS,eAAe,KAAG,WAgDtD,CAAA;AAED,qFAAqF;AACrF,eAAO,MAAM,WAAW,QAAS,eAAe,KAAG,MAAM,GAAG,SAA+C,CAAA;AAE3G,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,QAAS,eAAe,KAAG,MAAiD,CAAA;AAEzG,iGAAiG;AACjG,eAAO,MAAM,YAAY,YACd,YAAY,CAAC,GAAG,CAAC,WAAW,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAAyD,CAAA"}

package/build/entity.js

@@ -1,80 +1,47 @@
-import { AuthenFailed, AuthorizationError, entitySlugOf } from '@owlmeans/auth';
+import { AuthenFailed, AuthorizationError, authHelper } from '@owlmeans/auth';
 import { ENTITY_RESOLVER } from './consts.js';
-/**
- * The value a handler should store and query organization-scoped records by.
- *
- * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
- * survive a rename untouched. Falls back to the slug on the token for deployments that register no
- * resolver — there the slug IS the only identifier the system has, and refusing to serve them
- * would break every installation backed by an external IAM.
- *
- * Never use this to compose a user-facing name (a hostname, a display label). Those want the
- * current slug, `req.entity?.slug`, precisely because it can change.
- */
-export const entityKeyOf = (req) => req.entity?.id ?? entitySlugOf(req.auth);
-/**
- * `entityKeyOf` for handlers that cannot proceed without an organization.
- *
- * @throws {AuthorizationError} when the request carries no organization at all.
- */
-export const requireEntityKey = (req) => {
-    const key = entityKeyOf(req);
-    if (key == null || key === '') {
-        throw new AuthorizationError();
-    }
-    return key;
-};
-/**
- * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
- *
- * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
- */
-export const requireEntity = (req) => {
-    if (req.entity == null) {
-        throw new AuthorizationError();
-    }
-    return req.entity;
-};
-/**
- * Resolve the organization a just-authenticated request acts for, and attach it.
- *
- * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
- * authenticates on its own once the connection is already open. Both need it for the same reason:
- * the token names the organization by a slug that can move, while everything downstream keys on
- * the record. A path that authenticates without calling this leaves `request.entity` empty, and
- * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
- * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
- *
- * An entity the guard already attached is kept while its slug is exactly the token's: a guard
- * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
- * source such a deployment has, because the registry that owns the organization is not its own.
- * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
- * not been there.
- *
- * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
- * and the slug is the only identifier it has.
- *
- * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
- */
-export const attachEntity = async (context, request) => {
-    const slug = entitySlugOf(request.auth);
-    if (request.entity != null) {
-        if (slug != null && request.entity.slug === slug) {
-            return request.entity;
+export const makeEntityScope = (req) => {
+    const entityKeyOf = () => req.entity?.id ?? authHelper.entitySlugOf(req.auth);
+    const requireEntityKey = () => {
+        const key = entityKeyOf();
+        if (key == null || key === '') {
+            throw new AuthorizationError();
+        }
+        return key;
+    };
+    const requireEntity = () => {
+        if (req.entity == null) {
+            throw new AuthorizationError();
+        }
+        return req.entity;
+    };
+    const attachEntity = async (context) => {
+        const slug = authHelper.entitySlugOf(req.auth);
+        if (req.entity != null) {
+            if (slug != null && req.entity.slug === slug) {
+                return req.entity;
+            }
+            req.entity = undefined;
+        }
+        if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
+            return undefined;
+        }
+        const entity = await context.service(ENTITY_RESOLVER).resolve(slug);
+        if (entity == null) {
+            throw new AuthenFailed('entity');
         }
-        request.entity = undefined;
-    }
-    if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
-        return undefined;
-    }
-    const entity = await context.service(ENTITY_RESOLVER).resolve(slug);
-    if (entity == null) {
-        throw new AuthenFailed('entity');
-    }
-    // Canonicalize: a request that arrived under a retired slug continues under the current one, so
-    // nothing echoing the value back can re-publish a name the organization has dropped.
-    request.auth.entitySlug = entity.slug;
-    request.entity = entity;
-    return entity;
+        // Canonicalize: a request that arrived under a retired slug continues under the current one, so
+        // nothing echoing the value back can re-publish a name the organization has dropped.
+        req.auth.entitySlug = entity.slug;
+        req.entity = entity;
+        return entity;
+    };
+    return { entityKeyOf, requireEntityKey, requireEntity, attachEntity };
 };
+/** @deprecated compat:factory-refactor — use `makeEntityScope(req).entityKeyOf()` */
+export const entityKeyOf = (req) => makeEntityScope(req).entityKeyOf();
+/** @deprecated compat:factory-refactor — use `makeEntityScope(req).requireEntityKey()` */
+export const requireEntityKey = (req) => makeEntityScope(req).requireEntityKey();
+/** @deprecated compat:factory-refactor — use `makeEntityScope(request).attachEntity(context)` */
+export const attachEntity = async (context, request) => await makeEntityScope(request).attachEntity(context);
 //# sourceMappingURL=entity.js.map

package/build/entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity.js","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAsB,EAAE,CACtE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAU,EAAE;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAkB,EAAE;IACpE,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAA0B,EAAE,OAAwB,EACf,EAAE;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,MAAM,CAAA;QACvB,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAED,gGAAgG;IAChG,qFAAqF;IACrF,OAAO,CAAC,IAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IACtC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IAEvB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"entity.js","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAG7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAe,EAAE;IACnE,MAAM,WAAW,GAAG,GAAuB,EAAE,CAC3C,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAErD,MAAM,gBAAgB,GAAG,GAAW,EAAE;QACpC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,EAAE,CAAA;QAChC,CAAC;QAED,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,GAAmB,EAAE;QACzC,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,EAAE,CAAA;QAChC,CAAC;QAED,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAE,OAA0B,EAAuC,EAAE;QAC7F,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,MAAM,CAAA;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAA;QACxB,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC1F,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QAED,gGAAgG;QAChG,qFAAqF;QACrF,GAAG,CAAC,IAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;QAClC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;QAEnB,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AACvE,CAAC,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAsB,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;AAE3G,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAU,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAA;AAEzG,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAA0B,EAAE,OAAwB,EACf,EAAE,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -19,10 +19,10 @@ export declare const authProtocols: {
     flowEnter: import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>;
     dispatcher: import("@owlmeans/entrypoint").EntrypointProtocol<{
         query: AuthToken;
-    }, undefined>;
+    }, unknown>;
     surrogate: import("@owlmeans/entrypoint").EntrypointProtocol<{
         query: SurrogateQuery;
-    }, undefined>;
+    }, unknown>;
     dispatcherAuthenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
         body: AuthToken;
     }, AuthToken>;

package/build/guards/basic-ed25519/consts.local.d.ts

@@ -0,0 +1,3 @@
+export declare const timeKey: string;
+export declare const nonceKey: string;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/guards/basic-ed25519/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/consts.local.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,QAAyC,CAAA;AAC7D,eAAO,MAAM,QAAQ,QAA0C,CAAA"}

package/build/guards/basic-ed25519/consts.local.js

@@ -0,0 +1,4 @@
+import { BED255_NONCE_HEADER, BED255_TIME_HEADER } from './consts.js';
+export const timeKey = BED255_TIME_HEADER.toLocaleLowerCase();
+export const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase();
+//# sourceMappingURL=consts.local.js.map

package/build/guards/basic-ed25519/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErE,MAAM,CAAC,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA"}

package/build/guards/basic-ed25519/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAa7E,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBA+IzF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBA+IzF,CAAA"}

package/build/guards/basic-ed25519/service.js

@@ -1,13 +1,12 @@
 import { createService } from '@owlmeans/context';
 import { assertContext } from '@owlmeans/context';
-import { BED255_NONCE_HEADER, BED255_TIME_HEADER, BED255_CASHE_RESOURCE, GUARD_ED25519, BED255_SIG_TTL } from './consts.js';
+import { BED255_CASHE_RESOURCE, GUARD_ED25519, BED255_SIG_TTL } from './consts.js';
+import { nonceKey, timeKey } from './consts.local.js';
 import { trust } from '../../utils/trusted.js';
 import { AuthenPayloadError, AuthroizationType, AuthRole } from '@owlmeans/auth';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 import { extractAuthToken } from '@owlmeans/auth-common/utils';
 import { makeMemorySignedRequestReplayStore, makeResourceSignedRequestReplayStore } from './replay.js';
-const timeKey = BED255_TIME_HEADER.toLocaleLowerCase();
-const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase();
 export const makeBasicEd25519Guard = (resource, opts) => {
     const memoryReplay = makeMemorySignedRequestReplayStore();
     const replay = (context) => {

package/build/guards/basic-ed25519/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EACL,kCAAkC,EAAE,oCAAoC,EACzE,MAAM,aAAa,CAAA;AAGpB,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAC5G,MAAM,YAAY,GAAG,kCAAkC,EAAE,CAAA;IAEzD,MAAM,MAAM,GAAG,CAAC,OAAgB,EAA4B,EAAE;QAC5D,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAA;QAClD,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,oCAAoC,CACzC,OAAO,CAAC,QAAQ,CAA8B,KAAK,CAAC,CACrD,CAAA;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;mBAC5E,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAA;YAErC,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;aACrD,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;gBACrD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,oFAAoF;gBACpF,yFAAyF;gBACzF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CACzC,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,GAAG,KAAK,EAAE,EAChE,IAAI,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,CACpC,CAAA;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EACL,kCAAkC,EAAE,oCAAoC,EACzE,MAAM,aAAa,CAAA;AAGpB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAC5G,MAAM,YAAY,GAAG,kCAAkC,EAAE,CAAA;IAEzD,MAAM,MAAM,GAAG,CAAC,OAAgB,EAA4B,EAAE;QAC5D,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAA;QAClD,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,oCAAoC,CACzC,OAAO,CAAC,QAAQ,CAA8B,KAAK,CAAC,CACrD,CAAA;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;mBAC5E,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAA;YAErC,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;aACrD,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;gBACrD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,oFAAoF;gBACpF,yFAAyF;gBACzF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CACzC,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,GAAG,KAAK,EAAE,EAChE,IAAI,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,CACpC,CAAA;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,4 +1,5 @@
 export type * from './types.js';
+export type * from './entity/types.js';
 export * from './schemas.js';
 export * from './entrypoints.js';
 export * from './consts.js';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,mBAAmB,CAAA;AAEtC,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/middleware.js

@@ -1,6 +1,6 @@
 import { MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context';
-import { provideRequest } from '@owlmeans/client-entrypoint';
 import { AUTH_HEADER } from '@owlmeans/auth';
+import { clientRequestHelper } from '@owlmeans/client-entrypoint';
 export const authMiddleware = {
     type: MiddlewareType.Context,
     stage: MiddlewareStage.Loading,
@@ -22,7 +22,7 @@ export const authMiddleware = {
                         // middleware wrapped this entrypoint.
                         const [token] = (await Promise.all(module.getGuards().map(guard => context.service(guard).authenticated(req)))).filter(token => token != null).reverse();
                         if (token != null) {
-                            const _req = req ?? provideRequest(module.alias, module.path());
+                            const _req = req ?? clientRequestHelper.provideRequest(module.alias, module.path());
                             const headers = (_req.headers ?? {});
                             if (headers[AUTH_HEADER] == null) {
                                 headers[AUTH_HEADER] = token;

package/build/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACzE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,uFAAuF;oBACvF,iEAAiE;oBACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;oBAC5B,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;wBAC3B,+EAA+E;wBAC/E,sCAAsC;wBACtC,8EAA8E;wBAC9E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CACvD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;4BACzF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;oBACpB,CAAC,CAAyB,CAAA;gBAE5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACzE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,uFAAuF;oBACvF,iEAAiE;oBACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;oBAC5B,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;wBAC3B,+EAA+E;wBAC/E,sCAAsC;wBACtC,8EAA8E;wBAC9E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CACvD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,IAAI,GAA6B,GAAG,IAAI,mBAAmB,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;4BAC7G,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;oBACpB,CAAC,CAAyB,CAAA;gBAE5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/build/utils/trusted.js

@@ -1,4 +1,4 @@
-import { fromPubKey, makeKeyPairModel } from '@owlmeans/basic-keys';
+import { keyHelper, makeKeyPairModel } from '@owlmeans/basic-keys';
 export const trust = async (context, resource, userName, field = 'name') => {
     const where = { [field]: userName };
     const trustedUser = await context.resource(resource).load(where);
@@ -6,7 +6,7 @@ export const trust = async (context, resource, userName, field = 'name') => {
         throw new SyntaxError(`Auth service trusted entity is not provided: ${userName}`);
     }
     // @TODO credential can really be undefined - we need to process it properly
-    const keyPair = trustedUser.secret != null ? makeKeyPairModel(trustedUser.secret) : fromPubKey(trustedUser.credential);
+    const keyPair = trustedUser.secret != null ? makeKeyPairModel(trustedUser.secret) : keyHelper.fromPubKey(trustedUser.credential);
     return { user: trustedUser, key: keyPair };
 };
 //# sourceMappingURL=trusted.js.map

package/build/utils/trusted.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAK,GAAW,MAAM,EAAE,EAAE;IAC5I,MAAM,KAAK,GAA4B,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEvH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAElE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAK,GAAW,MAAM,EAAE,EAAE;IAC5I,MAAM,KAAK,GAA4B,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEjI,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.46",
+  "version": "0.1.18-rc.48",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,19 +29,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.39",
-    "@owlmeans/auth-common": "^0.1.18-rc.46",
-    "@owlmeans/basic-ids": "^0.1.18-rc.36",
-    "@owlmeans/basic-keys": "^0.1.18-rc.47",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.46",
-    "@owlmeans/context": "^0.1.18-rc.33",
-    "@owlmeans/entrypoint": "^0.1.18-rc.40",
-    "@owlmeans/resource": "^0.1.18-rc.39",
-    "@owlmeans/route": "^0.1.18-rc.34"
+    "@owlmeans/auth": "^0.1.18-rc.40",
+    "@owlmeans/auth-common": "^0.1.18-rc.48",
+    "@owlmeans/basic-ids": "^0.1.18-rc.38",
+    "@owlmeans/basic-keys": "^0.1.18-rc.49",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.48",
+    "@owlmeans/context": "^0.1.18-rc.34",
+    "@owlmeans/entrypoint": "^0.1.18-rc.41",
+    "@owlmeans/resource": "^0.1.18-rc.40",
+    "@owlmeans/route": "^0.1.18-rc.35"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.45",
+    "@owlmeans/test-auth": "^0.1.18-rc.47",
     "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/entity/types.ts

@@ -0,0 +1,52 @@
+import type { BasicContext } from '@owlmeans/context'
+import type { ResolvedEntity } from '@owlmeans/entrypoint'
+
+/** The organization entity one request acts for — built once at the top of a handler, never stored. */
+export interface EntityScope {
+  /**
+   * The value a handler should store and query organization-scoped records by.
+   *
+   * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
+   * survive a rename untouched. Falls back to the slug on the token for deployments that register no
+   * resolver — there the slug IS the only identifier the system has, and refusing to serve them
+   * would break every installation backed by an external IAM.
+   *
+   * Never use this to compose a user-facing name (a hostname, a display label). Those want the
+   * current slug, `req.entity?.slug`, precisely because it can change.
+   */
+  entityKeyOf: () => string | undefined
+  /**
+   * `entityKeyOf` for handlers that cannot proceed without an organization.
+   *
+   * @throws {AuthorizationError} when the request carries no organization at all.
+   */
+  requireEntityKey: () => string
+  /**
+   * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
+   *
+   * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
+   */
+  requireEntity: () => ResolvedEntity
+  /**
+   * Resolve the organization a just-authenticated request acts for, and attach it.
+   *
+   * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
+   * authenticates on its own once the connection is already open. Both need it for the same reason:
+   * the token names the organization by a slug that can move, while everything downstream keys on
+   * the record. A path that authenticates without calling this leaves `request.entity` empty, and
+   * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
+   * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
+   *
+   * An entity the guard already attached is kept while its slug is exactly the token's: a guard
+   * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
+   * source such a deployment has, because the registry that owns the organization is not its own.
+   * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
+   * not been there.
+   *
+   * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
+   * and the slug is the only identifier it has.
+   *
+   * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
+   */
+  attachEntity: (context: BasicContext<any>) => Promise<ResolvedEntity | undefined>
+}

package/src/entity.ts

@@ -1,95 +1,67 @@
 import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint'
 import type { BasicContext } from '@owlmeans/context'
-import { AuthenFailed, AuthorizationError, entitySlugOf } from '@owlmeans/auth'
+import { AuthenFailed, AuthorizationError, authHelper } from '@owlmeans/auth'
 import type { EntityResolverService } from './types.js'
 import { ENTITY_RESOLVER } from './consts.js'
+import type { EntityScope } from './entity/types.js'
 
-/**
- * The value a handler should store and query organization-scoped records by.
- *
- * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
- * survive a rename untouched. Falls back to the slug on the token for deployments that register no
- * resolver — there the slug IS the only identifier the system has, and refusing to serve them
- * would break every installation backed by an external IAM.
- *
- * Never use this to compose a user-facing name (a hostname, a display label). Those want the
- * current slug, `req.entity?.slug`, precisely because it can change.
- */
-export const entityKeyOf = (req: AbstractRequest): string | undefined =>
-  req.entity?.id ?? entitySlugOf(req.auth)
+export const makeEntityScope = (req: AbstractRequest): EntityScope => {
+  const entityKeyOf = (): string | undefined =>
+    req.entity?.id ?? authHelper.entitySlugOf(req.auth)
 
-/**
- * `entityKeyOf` for handlers that cannot proceed without an organization.
- *
- * @throws {AuthorizationError} when the request carries no organization at all.
- */
-export const requireEntityKey = (req: AbstractRequest): string => {
-  const key = entityKeyOf(req)
-  if (key == null || key === '') {
-    throw new AuthorizationError()
+  const requireEntityKey = (): string => {
+    const key = entityKeyOf()
+    if (key == null || key === '') {
+      throw new AuthorizationError()
+    }
+
+    return key
   }
 
-  return key
-}
+  const requireEntity = (): ResolvedEntity => {
+    if (req.entity == null) {
+      throw new AuthorizationError()
+    }
 
-/**
- * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
- *
- * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
- */
-export const requireEntity = (req: AbstractRequest): ResolvedEntity => {
-  if (req.entity == null) {
-    throw new AuthorizationError()
+    return req.entity
   }
 
-  return req.entity
-}
+  const attachEntity = async (context: BasicContext<any>): Promise<ResolvedEntity | undefined> => {
+    const slug = authHelper.entitySlugOf(req.auth)
+    if (req.entity != null) {
+      if (slug != null && req.entity.slug === slug) {
+        return req.entity
+      }
+      req.entity = undefined
+    }
 
-/**
- * Resolve the organization a just-authenticated request acts for, and attach it.
- *
- * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
- * authenticates on its own once the connection is already open. Both need it for the same reason:
- * the token names the organization by a slug that can move, while everything downstream keys on
- * the record. A path that authenticates without calling this leaves `request.entity` empty, and
- * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
- * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
- *
- * An entity the guard already attached is kept while its slug is exactly the token's: a guard
- * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
- * source such a deployment has, because the registry that owns the organization is not its own.
- * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
- * not been there.
- *
- * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
- * and the slug is the only identifier it has.
- *
- * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
- */
-export const attachEntity = async (
-  context: BasicContext<any>, request: AbstractRequest
-): Promise<ResolvedEntity | undefined> => {
-  const slug = entitySlugOf(request.auth)
-  if (request.entity != null) {
-    if (slug != null && request.entity.slug === slug) {
-      return request.entity
+    if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
+      return undefined
     }
-    request.entity = undefined
-  }
 
-  if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
-    return undefined
-  }
+    const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(slug)
+    if (entity == null) {
+      throw new AuthenFailed('entity')
+    }
 
-  const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(slug)
-  if (entity == null) {
-    throw new AuthenFailed('entity')
-  }
+    // Canonicalize: a request that arrived under a retired slug continues under the current one, so
+    // nothing echoing the value back can re-publish a name the organization has dropped.
+    req.auth!.entitySlug = entity.slug
+    req.entity = entity
 
-  // Canonicalize: a request that arrived under a retired slug continues under the current one, so
-  // nothing echoing the value back can re-publish a name the organization has dropped.
-  request.auth!.entitySlug = entity.slug
-  request.entity = entity
+    return entity
+  }
 
-  return entity
+  return { entityKeyOf, requireEntityKey, requireEntity, attachEntity }
 }
+
+/** @deprecated compat:factory-refactor — use `makeEntityScope(req).entityKeyOf()` */
+export const entityKeyOf = (req: AbstractRequest): string | undefined => makeEntityScope(req).entityKeyOf()
+
+/** @deprecated compat:factory-refactor — use `makeEntityScope(req).requireEntityKey()` */
+export const requireEntityKey = (req: AbstractRequest): string => makeEntityScope(req).requireEntityKey()
+
+/** @deprecated compat:factory-refactor — use `makeEntityScope(request).attachEntity(context)` */
+export const attachEntity = async (
+  context: BasicContext<any>, request: AbstractRequest
+): Promise<ResolvedEntity | undefined> => await makeEntityScope(request).attachEntity(context)

package/src/guards/basic-ed25519/consts.local.ts

@@ -0,0 +1,4 @@
+import { BED255_NONCE_HEADER, BED255_TIME_HEADER } from './consts.js'
+
+export const timeKey = BED255_TIME_HEADER.toLocaleLowerCase()
+export const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase()

package/src/guards/basic-ed25519/service.ts

@@ -1,10 +1,8 @@
 import { createService } from '@owlmeans/context'
 import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import { assertContext } from '@owlmeans/context'
-import {
-  BED255_NONCE_HEADER, BED255_TIME_HEADER, BED255_CASHE_RESOURCE, GUARD_ED25519,
-  BED255_SIG_TTL
-} from './consts.js'
+import { BED255_CASHE_RESOURCE, GUARD_ED25519, BED255_SIG_TTL } from './consts.js'
+import { nonceKey, timeKey } from './consts.local.js'
 import { trust } from '../../utils/trusted.js'
 import type { Config, Context } from '../../utils/types.js'
 import type { BasicEd25519Guard, BasicEd25519GuardOptions } from './types.js'
@@ -17,9 +15,6 @@ import {
 } from './replay.js'
 import type { SignedRequestReplayResource, SignedRequestReplayStore } from './types.js'
 
-const timeKey = BED255_TIME_HEADER.toLocaleLowerCase()
-const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase()
-
 export const makeBasicEd25519Guard = (resource: string, opts?: BasicEd25519GuardOptions): BasicEd25519Guard => {
   const memoryReplay = makeMemorySignedRequestReplayStore()
 

package/src/index.ts

@@ -1,4 +1,5 @@
 export type * from './types.js'
+export type * from './entity/types.js'
 
 export * from './schemas.js'
 export * from './entrypoints.js'

package/src/middleware.ts

@@ -1,8 +1,8 @@
 import { type Middleware, MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context'
-import { provideRequest } from '@owlmeans/client-entrypoint'
 import { AUTH_HEADER } from '@owlmeans/auth'
 import type { AbstractRequest, GuardService } from '@owlmeans/entrypoint'
 import type { Perked } from './types.local.js'
+import { clientRequestHelper } from '@owlmeans/client-entrypoint'
 
 export const authMiddleware: Middleware = {
   type: MiddlewareType.Context,
@@ -27,7 +27,7 @@ export const authMiddleware: Middleware = {
               guard => context.service<GuardService>(guard).authenticated(req)
             ))).filter(token => token != null).reverse()
             if (token != null) {
-              const _req: Partial<AbstractRequest> = req ?? provideRequest(module.alias, module.path())
+              const _req: Partial<AbstractRequest> = req ?? clientRequestHelper.provideRequest(module.alias, module.path())
               const headers = (_req.headers ?? {}) as Record<string, string | undefined>
               if (headers[AUTH_HEADER] == null) {
                 headers[AUTH_HEADER] = token

package/src/utils/trusted.ts

@@ -2,7 +2,7 @@
 import type { Context, Config } from './types.js'
 import type { TrustedRecord } from '../types.js'
 import type { Criteria, Resource } from '@owlmeans/resource'
-import { fromPubKey, makeKeyPairModel } from '@owlmeans/basic-keys'
+import { keyHelper, makeKeyPairModel } from '@owlmeans/basic-keys'
 
 export const trust = async <C extends Config, T extends Context<C>>(context: T, resource: string, userName: string, field: string = 'name') => {
   const where: Criteria<TrustedRecord> = { [field]: userName }
@@ -12,7 +12,7 @@ export const trust = async <C extends Config, T extends Context<C>>(context: T,
   }
 
   // @TODO credential can really be undefined - we need to process it properly
-  const keyPair = trustedUser.secret != null ? makeKeyPairModel(trustedUser.secret) : fromPubKey(trustedUser.credential!)
+  const keyPair = trustedUser.secret != null ? makeKeyPairModel(trustedUser.secret) : keyHelper.fromPubKey(trustedUser.credential!)
 
   return { user: trustedUser, key: keyPair }
 }

package/tests/basic-ed25519.spec.ts

@@ -4,7 +4,7 @@ import {
   BED255_NONCE_HEADER, BED255_SIG_TTL, BED255_TIME_HEADER, makeBasicEd25519Guard,
   makeResourceSignedRequestReplayStore
 } from '@owlmeans/auth-common'
-import type { SignedRequestReplayResource } from '@owlmeans/auth-common'
+import type { BasicEd25519Guard, SignedRequestReplayResource } from '@owlmeans/auth-common'
 import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import type { Auth } from '@owlmeans/auth'
 import { RecordExists } from '@owlmeans/resource'
@@ -35,7 +35,7 @@ const request = async (timestamp: string, nonce: string) => {
 }
 
 const handle = async (
-  guard: ReturnType<typeof makeBasicEd25519Guard>, req: AbstractRequest
+  guard: BasicEd25519Guard, req: AbstractRequest
 ): Promise<Auth | undefined> => {
   let value: Auth | undefined
   const response: AbstractResponse<Auth> = {

package/tests/entity.spec.ts

@@ -4,7 +4,7 @@ import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import { AuthenFailed, AuthRole } from '@owlmeans/auth'
 import type { Auth } from '@owlmeans/auth'
 import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint'
-import { attachEntity } from '../src/entity.js'
+import { makeEntityScope } from '../src/entity.js'
 import { ENTITY_RESOLVER } from '../src/consts.js'
 import type { EntityResolverService, OrgEntityRef } from '../src/types.js'
 
@@ -47,7 +47,7 @@ describe('attachEntity — an entity the guard attached', () => {
     const { ctx } = await contextWith()
     const request = requestFor('tenant', attached)
 
-    expect(await attachEntity(ctx, request)).toEqual(attached)
+    expect(await makeEntityScope(request).attachEntity(ctx)).toEqual(attached)
     expect(request.entity).toEqual(attached)
   })
 
@@ -55,7 +55,7 @@ describe('attachEntity — an entity the guard attached', () => {
     const { ctx, calls } = await contextWith([ACME])
     const request = requestFor('tenant', attached)
 
-    expect(await attachEntity(ctx, request)).toEqual(attached)
+    expect(await makeEntityScope(request).attachEntity(ctx)).toEqual(attached)
     expect(calls).toEqual([])
   })
 
@@ -63,7 +63,7 @@ describe('attachEntity — an entity the guard attached', () => {
     const { ctx, calls } = await contextWith([ACME])
     const request = requestFor('acme', attached)
 
-    expect(await attachEntity(ctx, request)).toEqual(ACME)
+    expect(await makeEntityScope(request).attachEntity(ctx)).toEqual(ACME)
     expect(request.entity).toEqual(ACME)
     expect(calls).toEqual(['acme'])
   })
@@ -72,7 +72,7 @@ describe('attachEntity — an entity the guard attached', () => {
     const { ctx } = await contextWith()
     const request = requestFor('acme', attached)
 
-    expect(await attachEntity(ctx, request)).toBeUndefined()
+    expect(await makeEntityScope(request).attachEntity(ctx)).toBeUndefined()
     expect(request.entity).toBeUndefined()
   })
 
@@ -80,7 +80,7 @@ describe('attachEntity — an entity the guard attached', () => {
     const { ctx } = await contextWith()
     const request = requestFor(undefined, attached)
 
-    expect(await attachEntity(ctx, request)).toBeUndefined()
+    expect(await makeEntityScope(request).attachEntity(ctx)).toBeUndefined()
     expect(request.entity).toBeUndefined()
   })
 })
@@ -90,7 +90,7 @@ describe('attachEntity — the resolver path', () => {
     const { ctx } = await contextWith([ACME])
     const request = requestFor('acme-old')
 
-    expect(await attachEntity(ctx, request)).toEqual(ACME)
+    expect(await makeEntityScope(request).attachEntity(ctx)).toEqual(ACME)
     expect(request.entity).toEqual(ACME)
     expect(request.auth?.entitySlug).toBe('acme')
   })
@@ -98,14 +98,14 @@ describe('attachEntity — the resolver path', () => {
   test('refuses a token naming an organization the registry does not know', async () => {
     const { ctx } = await contextWith([ACME])
 
-    await expect(attachEntity(ctx, requestFor('nobody'))).rejects.toBeInstanceOf(AuthenFailed)
+    await expect(makeEntityScope(requestFor('nobody')).attachEntity(ctx)).rejects.toBeInstanceOf(AuthenFailed)
   })
 
   test('is a no-op with no resolver and nothing attached', async () => {
     const { ctx } = await contextWith()
     const request = requestFor('acme')
 
-    expect(await attachEntity(ctx, request)).toBeUndefined()
+    expect(await makeEntityScope(request).attachEntity(ctx)).toBeUndefined()
     expect(request.entity).toBeUndefined()
     expect(request.auth?.entitySlug).toBe('acme')
   })