@owlmeans/auth-common 0.1.18-rc.7 → 0.1.18-rc.9

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.7",
-  "generatedAt": "2026-08-24T21:14:00.112Z",
+  "version": "0.1.18-rc.8",
+  "generatedAt": "2026-08-27T16:32:18.484Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.7"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.8"` in `dependencies`
 
 ## Key Exports
 

package/build/consts.d.ts

@@ -3,10 +3,29 @@ export declare const RELY_TOKEN_PREFIX = "rely-token:";
 export declare const RELY_CALL_TIMEOUT = 120;
 export declare const RELY_ACTION_TIMEOUT = 600;
 export declare const DISPATCHER_PATH = "/dispatcher";
+/**
+ * Where the surrogate login window runs.
+ *
+ * Reserved exactly like {@link DISPATCHER_PATH}: an application must not declare a route of its
+ * own here, and a code generator must not produce one. It is user-visible — it is what the popup's
+ * address bar shows.
+ */
+export declare const SURROGATE_PATH = "/surrogate";
 export declare const DEF_AUTH_SRV = "auth";
 export declare const DEFAULT_GUARD = "auth";
 export declare const TOKEN_UPDATE = "auth-token-refresh";
 export declare const WEB_API = "web-auth-api";
+/** Service alias of the organization-entity resolver, when an implementation registers one. */
+export declare const ENTITY_RESOLVER = "entity-resolver";
+/**
+ * What an organization slug may look like: a DNS label, lowercase.
+ *
+ * The constraint is not cosmetic. The same slug is used to compose hostnames, Kubernetes object
+ * names and OIDC client ids, so anything that would need sanitising before it could address one of
+ * those is rejected at the point it is chosen instead — a slug that survives this pattern passes
+ * through every downstream name unchanged.
+ */
+export declare const ENTITY_SLUG_PATTERN: RegExp;
 export declare const authApi: {
     profile: {
         base: string;

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,OAAO,iBAAiB,CAAA;AAErC,eAAO,MAAM,OAAO;IAClB,OAAO;QACL,IAAI;QACJ,UAAU;;IAEZ,MAAM;QACJ,IAAI;QACJ,GAAG;QACH,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,IAAI;;;IAGR,IAAI;QACF,IAAI;QACJ,QAAQ;;CAEX,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAAe,CAAA;AAE1C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,OAAO,iBAAiB,CAAA;AAErC,+FAA+F;AAC/F,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,QAA2C,CAAA;AAE3E,eAAO,MAAM,OAAO;IAClB,OAAO;QACL,IAAI;QACJ,UAAU;;IAEZ,MAAM;QACJ,IAAI;QACJ,GAAG;QACH,OAAO;YACL,IAAI;YACJ,IAAI;YACJ,IAAI;;;IAGR,IAAI;QACF,IAAI;QACJ,QAAQ;;CAEX,CAAA"}

package/build/consts.js

@@ -3,10 +3,29 @@ export const RELY_TOKEN_PREFIX = 'rely-token:';
 export const RELY_CALL_TIMEOUT = 120;
 export const RELY_ACTION_TIMEOUT = 600;
 export const DISPATCHER_PATH = '/dispatcher';
+/**
+ * Where the surrogate login window runs.
+ *
+ * Reserved exactly like {@link DISPATCHER_PATH}: an application must not declare a route of its
+ * own here, and a code generator must not produce one. It is user-visible — it is what the popup's
+ * address bar shows.
+ */
+export const SURROGATE_PATH = '/surrogate';
 export const DEF_AUTH_SRV = 'auth';
 export const DEFAULT_GUARD = DEF_AUTH_SRV;
 export const TOKEN_UPDATE = 'auth-token-refresh';
 export const WEB_API = 'web-auth-api';
+/** Service alias of the organization-entity resolver, when an implementation registers one. */
+export const ENTITY_RESOLVER = 'entity-resolver';
+/**
+ * What an organization slug may look like: a DNS label, lowercase.
+ *
+ * The constraint is not cosmetic. The same slug is used to compose hostnames, Kubernetes object
+ * names and OIDC client ids, so anything that would need sanitising before it could address one of
+ * those is rejected at the point it is chosen instead — a slug that survives this pattern passes
+ * through every downstream name unchanged.
+ */
+export const ENTITY_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/;
 export const authApi = {
     profile: {
         base: 'api:profile',

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,0BAA0B;KACvC;IACD,MAAM,EAAE;QACN,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,yBAAyB;SAChC;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,mBAAmB;KAC9B;CACF,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAA;AAErC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAA;AAE3E,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,0BAA0B;KACvC;IACD,MAAM,EAAE;QACN,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,yBAAyB;SAChC;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,mBAAmB;KAC9B;CACF,CAAA"}

package/build/entity.d.ts

@@ -0,0 +1,43 @@
+import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint';
+import type { BasicContext } from '@owlmeans/context';
+/**
+ * The value a handler should store and query organization-scoped records by.
+ *
+ * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
+ * survive a rename untouched. Falls back to the slug on the token for deployments that register no
+ * resolver — there the slug IS the only identifier the system has, and refusing to serve them
+ * would break every installation backed by an external IAM.
+ *
+ * Never use this to compose a user-facing name (a hostname, a display label). Those want the
+ * current slug, `req.entity?.slug`, precisely because it can change.
+ */
+export declare const entityKeyOf: (req: AbstractRequest) => string | undefined;
+/**
+ * `entityKeyOf` for handlers that cannot proceed without an organization.
+ *
+ * @throws {AuthorizationError} when the request carries no organization at all.
+ */
+export declare const requireEntityKey: (req: AbstractRequest) => string;
+/**
+ * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
+ *
+ * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
+ */
+export declare const requireEntity: (req: AbstractRequest) => ResolvedEntity;
+/**
+ * Resolve the organization a just-authenticated request acts for, and attach it.
+ *
+ * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
+ * authenticates on its own once the connection is already open. Both need it for the same reason:
+ * the token names the organization by a slug that can move, while everything downstream keys on
+ * the record. A path that authenticates without calling this leaves `request.entity` empty, and
+ * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
+ * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
+ *
+ * A no-op when no resolver is registered: such a deployment has no organization store, and the
+ * slug is the only identifier it has.
+ *
+ * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
+ */
+export declare const attachEntity: (context: BasicContext<any>, request: AbstractRequest) => Promise<ResolvedEntity | undefined>;
+//# sourceMappingURL=entity.d.ts.map

package/build/entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QAAS,eAAe,KAAG,MAAM,GAAG,SAClB,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,eAAe,KAAG,MAOvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAS,eAAe,KAAG,cAMpD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,YACd,YAAY,CAAC,GAAG,CAAC,WAAW,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAiBpC,CAAA"}

package/build/entity.js

@@ -0,0 +1,68 @@
+import { AuthenFailed, AuthorizationError, entitySlugOf } from '@owlmeans/auth';
+import { ENTITY_RESOLVER } from './consts.js';
+/**
+ * The value a handler should store and query organization-scoped records by.
+ *
+ * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
+ * survive a rename untouched. Falls back to the slug on the token for deployments that register no
+ * resolver — there the slug IS the only identifier the system has, and refusing to serve them
+ * would break every installation backed by an external IAM.
+ *
+ * Never use this to compose a user-facing name (a hostname, a display label). Those want the
+ * current slug, `req.entity?.slug`, precisely because it can change.
+ */
+export const entityKeyOf = (req) => req.entity?.id ?? entitySlugOf(req.auth);
+/**
+ * `entityKeyOf` for handlers that cannot proceed without an organization.
+ *
+ * @throws {AuthorizationError} when the request carries no organization at all.
+ */
+export const requireEntityKey = (req) => {
+    const key = entityKeyOf(req);
+    if (key == null || key === '') {
+        throw new AuthorizationError();
+    }
+    return key;
+};
+/**
+ * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
+ *
+ * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
+ */
+export const requireEntity = (req) => {
+    if (req.entity == null) {
+        throw new AuthorizationError();
+    }
+    return req.entity;
+};
+/**
+ * Resolve the organization a just-authenticated request acts for, and attach it.
+ *
+ * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
+ * authenticates on its own once the connection is already open. Both need it for the same reason:
+ * the token names the organization by a slug that can move, while everything downstream keys on
+ * the record. A path that authenticates without calling this leaves `request.entity` empty, and
+ * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
+ * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
+ *
+ * A no-op when no resolver is registered: such a deployment has no organization store, and the
+ * slug is the only identifier it has.
+ *
+ * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
+ */
+export const attachEntity = async (context, request) => {
+    const slug = entitySlugOf(request.auth);
+    if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
+        return undefined;
+    }
+    const entity = await context.service(ENTITY_RESOLVER).resolve(slug);
+    if (entity == null) {
+        throw new AuthenFailed('entity');
+    }
+    // Canonicalize: a request that arrived under a retired slug continues under the current one, so
+    // nothing echoing the value back can re-publish a name the organization has dropped.
+    request.auth.entitySlug = entity.slug;
+    request.entity = entity;
+    return entity;
+};
+//# sourceMappingURL=entity.js.map

package/build/entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity.js","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAsB,EAAE,CACtE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAU,EAAE;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAkB,EAAE;IACpE,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAA0B,EAAE,OAAwB,EACf,EAAE;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAED,gGAAgG;IAChG,qFAAqF;IACrF,OAAO,CAAC,IAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IACtC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IAEvB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/guards/basic-ed25519/service.js

@@ -89,7 +89,7 @@ export const makeBasicEd25519Guard = (resource, opts) => {
                 token: authorization,
                 userId: trusted.user.id,
                 profileId: trusted.user.id,
-                entityId: trusted.user.entityId,
+                entitySlug: trusted.user.entitySlug,
                 scopes: trusted.user.name != null ? [trusted.user.name] : [],
                 type: AuthroizationType.Ed25519BasicSignature,
                 source: context.cfg.service,

package/build/guards/basic-ed25519/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAE5G,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA2B,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAClF,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;aAChF,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAEhD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC5B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAC/B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAE5G,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA2B,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAClF,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;aAChF,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAEhD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC5B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/helper.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":""}

package/build/helper.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":""}

package/build/index.d.ts

@@ -1,6 +1,8 @@
 export type * from './types.js';
+export * from './schemas.js';
 export * from './modules.js';
 export * from './consts.js';
+export * from './entity.js';
 export * from './middleware.js';
 export * from './guards/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/index.js

@@ -1,5 +1,7 @@
+export * from './schemas.js';
 export * from './modules.js';
 export * from './consts.js';
+export * from './entity.js';
 export * from './middleware.js';
 export * from './guards/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,mDAuBnB,CAAA;AAED,eAAO,MAAM,cAAc,mDAW1B,CAAA"}
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,OAAO,mDAkCnB,CAAA;AAED,eAAO,MAAM,cAAc,mDAW1B,CAAA"}

package/build/modules.js

@@ -1,8 +1,9 @@
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
+import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, DISPATCHER_SURROGATE, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
 // import { AppType } from '@owlmeans/context'
 import { body, filter, entrypoint, query } from '@owlmeans/entrypoint';
 import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route';
-import { DISPATCHER_PATH, WEB_API, authApi } from './consts.js';
+import { DISPATCHER_PATH, SURROGATE_PATH, WEB_API, authApi } from './consts.js';
+import { SurrogateQuerySchema } from './schemas.js';
 export const modules = [
     entrypoint(route(AUTHEN, '/authentication', backend())),
     entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
@@ -21,6 +22,14 @@ export const modules = [
     // It's required here cause every web app needs dispatcher route to authorize
     // rediected users.
     filter(query(AuthTokenSchema), { sticky: true })),
+    // The login window an embedded application opens one level up.
+    //
+    // Top level and with no parent, so it renders outside every application layout — a popup must
+    // never show the application, with its navigation, inside itself. Sticky for the same reason the
+    // dispatcher is: it must attach to the client router regardless of service selection. It carries
+    // no `service`, unlike the dispatcher, because nothing server-side ever addresses it — the
+    // provider's callback goes to the dispatcher. And no guard: it is where a signed-out user lands.
+    entrypoint(route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()), filter(query(SurrogateQuerySchema), { sticky: true })),
     // This is a helper route that representes a API endpoint of service provider that wants to authenticate
     // a user with OwlMeans server-auth library.
     entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),

package/build/modules.js.map

@@ -1 +1 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,uBAAuB,EAAE,kBAAkB,EAC/D,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAE/D,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChH,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzH,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/F,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,UAAU,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3E,8GAA8G;IAC9G,UAAU,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,gHAAgH;IAChH,2FAA2F;IAC3F,UAAU,CACR,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,UAAU,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CACtH,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC7C,CAAC;CACH,CAAA;AAED,mCAAmC;AACnC,oDAAoD;AACpD,iGAAiG;AACjG,gCAAgC"}
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,kBAAkB,EACrF,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAEnD,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChH,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzH,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/F,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,UAAU,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3E,8GAA8G;IAC9G,UAAU,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,gHAAgH;IAChH,2FAA2F;IAC3F,UAAU,CACR,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,+DAA+D;IAC/D,EAAE;IACF,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,UAAU,CACR,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EACvD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACtD;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,UAAU,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CACtH,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC7C,CAAC;CACH,CAAA;AAED,mCAAmC;AACnC,oDAAoD;AACpD,iGAAiG;AACjG,gCAAgC"}

package/build/schemas.d.ts

@@ -0,0 +1,16 @@
+import type { JSONSchemaType } from 'ajv';
+/**
+ * What the surrogate login window is told about why it was opened.
+ *
+ * Every field is optional: the window must render something sensible when opened by hand, or by an
+ * older build that knew none of these parameters. `next` carries the address to run once the
+ * window is one level up, so the flow parameters the opener's URL held are forwarded rather than
+ * silently dropped.
+ */
+export interface SurrogateQuery {
+    intent?: string;
+    next?: string;
+    method?: string;
+}
+export declare const SurrogateQuerySchema: JSONSchemaType<SurrogateQuery>;
+//# sourceMappingURL=schemas.d.ts.map

package/build/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAQ/D,CAAA"}

package/build/schemas.js

@@ -0,0 +1,10 @@
+export const SurrogateQuerySchema = {
+    type: 'object',
+    properties: {
+        intent: { type: 'string', maxLength: 32, nullable: true },
+        next: { type: 'string', maxLength: 2048, nullable: true },
+        method: { type: 'string', maxLength: 128, nullable: true },
+    },
+    additionalProperties: true,
+};
+//# sourceMappingURL=schemas.js.map

package/build/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3D;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAA"}

package/build/types.d.ts

@@ -29,6 +29,57 @@ export interface ProfileToEntityIdRequest {
     profileId: string;
 }
 export interface ProfileToEntityIdResponse {
-    entityId: string;
+    entitySlug: string;
+}
+/**
+ * An organization entity: one immutable id, one renameable slug, and the trail of slugs it used to
+ * answer to.
+ *
+ * `formerSlugs` is what makes a rename survivable rather than merely possible. Tokens minted before
+ * the rename keep arriving until they expire, and third-party systems keep quoting the old value
+ * indefinitely; resolving a former slug to the same entity is how both keep working without anyone
+ * reissuing anything.
+ */
+export interface OrgEntityRef {
+    id: string;
+    slug: string;
+    formerSlugs?: string[];
+    /** Frozen identifier for systems whose names cannot be rewritten. See `ResolvedEntity.iamKey`. */
+    iamKey: string;
+}
+/**
+ * Resolves the renameable slug on a token to the stable entity it names.
+ *
+ * Registered only by implementations that actually store organizations. Basic auth deliberately
+ * does not define what an entity id is — a deployment backed by an external IAM has no such record
+ * and registers nothing, and every consumer must therefore treat an unresolved entity as ordinary
+ * rather than exceptional.
+ */
+export interface EntityResolverService extends InitializedService {
+    /**
+     * Find an entity by any name it has ever answered to: its id, its current slug, a former slug,
+     * or its frozen `iamKey`. Ids win over slugs, so a slug that collides with some other entity's
+     * id can never shadow it.
+     */
+    resolve: (value: string) => Promise<OrgEntityRef | null>;
+    byId: (id: string) => Promise<OrgEntityRef | null>;
+    /** Mint an unused slug. Uniqueness is settled against the store, not by entropy. */
+    mintSlug: () => Promise<string>;
+    /**
+     * Point the entity at a new slug, retiring the old one into `formerSlugs`.
+     *
+     * This is the whole cost of a rename: nothing else in any store is touched, because nothing else
+     * keys on the slug.
+     */
+    rename: (id: string, slug: string) => Promise<OrgEntityRef>;
+    /**
+     * Read — or, on first ask, mint and persist — a name this entity is known by in a system that
+     * cannot be renamed later (a namespace, a bucket prefix, a realm).
+     *
+     * Minting through the entity record rather than deriving the name on demand is what lets the
+     * slug move afterwards: the derivation happens once, the result is what everything addresses,
+     * and a later rename leaves the live resource alone.
+     */
+    mintName: (id: string, key: string, mint: (entity: OrgEntityRef) => string) => Promise<string>;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACxD,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAClD,oFAAoF;IACpF,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC3D;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.7",
+  "version": "0.1.18-rc.9",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,20 +29,20 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/auth-common": "^0.1.18-rc.7",
-    "@owlmeans/basic-ids": "^0.1.18-rc.6",
-    "@owlmeans/basic-keys": "^0.1.18-rc.7",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.7",
+    "@owlmeans/auth": "^0.1.18-rc.7",
+    "@owlmeans/auth-common": "^0.1.18-rc.9",
+    "@owlmeans/basic-ids": "^0.1.18-rc.7",
+    "@owlmeans/basic-keys": "^0.1.18-rc.9",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.9",
     "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/entrypoint": "^0.1.18-rc.7",
+    "@owlmeans/entrypoint": "^0.1.18-rc.8",
     "@owlmeans/resource": "^0.1.18-rc.7",
     "@owlmeans/route": "^0.1.18-rc.6"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.7",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.9",
+    "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/consts.ts

@@ -8,6 +8,15 @@ export const RELY_ACTION_TIMEOUT = 600
 
 export const DISPATCHER_PATH = '/dispatcher'
 
+/**
+ * Where the surrogate login window runs.
+ *
+ * Reserved exactly like {@link DISPATCHER_PATH}: an application must not declare a route of its
+ * own here, and a code generator must not produce one. It is user-visible — it is what the popup's
+ * address bar shows.
+ */
+export const SURROGATE_PATH = '/surrogate'
+
 export const DEF_AUTH_SRV = 'auth'
 
 export const DEFAULT_GUARD = DEF_AUTH_SRV
@@ -16,6 +25,19 @@ export const TOKEN_UPDATE = 'auth-token-refresh'
 
 export const WEB_API = 'web-auth-api'
 
+/** Service alias of the organization-entity resolver, when an implementation registers one. */
+export const ENTITY_RESOLVER = 'entity-resolver'
+
+/**
+ * What an organization slug may look like: a DNS label, lowercase.
+ *
+ * The constraint is not cosmetic. The same slug is used to compose hostnames, Kubernetes object
+ * names and OIDC client ids, so anything that would need sanitising before it could address one of
+ * those is rejected at the point it is chosen instead — a slug that survives this pattern passes
+ * through every downstream name unchanged.
+ */
+export const ENTITY_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/
+
 export const authApi = {
   profile: {
     base: 'api:profile',

package/src/entity.ts

@@ -0,0 +1,82 @@
+import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint'
+import type { BasicContext } from '@owlmeans/context'
+import { AuthenFailed, AuthorizationError, entitySlugOf } from '@owlmeans/auth'
+import type { EntityResolverService } from './types.js'
+import { ENTITY_RESOLVER } from './consts.js'
+
+/**
+ * The value a handler should store and query organization-scoped records by.
+ *
+ * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
+ * survive a rename untouched. Falls back to the slug on the token for deployments that register no
+ * resolver — there the slug IS the only identifier the system has, and refusing to serve them
+ * would break every installation backed by an external IAM.
+ *
+ * Never use this to compose a user-facing name (a hostname, a display label). Those want the
+ * current slug, `req.entity?.slug`, precisely because it can change.
+ */
+export const entityKeyOf = (req: AbstractRequest): string | undefined =>
+  req.entity?.id ?? entitySlugOf(req.auth)
+
+/**
+ * `entityKeyOf` for handlers that cannot proceed without an organization.
+ *
+ * @throws {AuthorizationError} when the request carries no organization at all.
+ */
+export const requireEntityKey = (req: AbstractRequest): string => {
+  const key = entityKeyOf(req)
+  if (key == null || key === '') {
+    throw new AuthorizationError()
+  }
+
+  return key
+}
+
+/**
+ * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
+ *
+ * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
+ */
+export const requireEntity = (req: AbstractRequest): ResolvedEntity => {
+  if (req.entity == null) {
+    throw new AuthorizationError()
+  }
+
+  return req.entity
+}
+
+/**
+ * Resolve the organization a just-authenticated request acts for, and attach it.
+ *
+ * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
+ * authenticates on its own once the connection is already open. Both need it for the same reason:
+ * the token names the organization by a slug that can move, while everything downstream keys on
+ * the record. A path that authenticates without calling this leaves `request.entity` empty, and
+ * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
+ * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
+ *
+ * A no-op when no resolver is registered: such a deployment has no organization store, and the
+ * slug is the only identifier it has.
+ *
+ * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
+ */
+export const attachEntity = async (
+  context: BasicContext<any>, request: AbstractRequest
+): Promise<ResolvedEntity | undefined> => {
+  const slug = entitySlugOf(request.auth)
+  if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
+    return undefined
+  }
+
+  const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(slug)
+  if (entity == null) {
+    throw new AuthenFailed('entity')
+  }
+
+  // Canonicalize: a request that arrived under a retired slug continues under the current one, so
+  // nothing echoing the value back can re-publish a name the organization has dropped.
+  request.auth!.entitySlug = entity.slug
+  request.entity = entity
+
+  return entity
+}

package/src/guards/basic-ed25519/service.ts

@@ -120,7 +120,7 @@ export const makeBasicEd25519Guard = (resource: string, opts?: BasicEd25519Guard
         token: authorization,
         userId: trusted.user.id,
         profileId: trusted.user.id,
-        entityId: trusted.user.entityId,
+        entitySlug: trusted.user.entitySlug,
         scopes: trusted.user.name != null ? [trusted.user.name] : [],
         type: AuthroizationType.Ed25519BasicSignature,
         source: context.cfg.service,

package/src/index.ts

@@ -1,6 +1,8 @@
 export type * from './types.js'
 
+export * from './schemas.js'
 export * from './modules.js'
 export * from './consts.js'
+export * from './entity.js'
 export * from './middleware.js'
 export * from './guards/index.js'

package/src/modules.ts

@@ -2,12 +2,13 @@
 import {
   AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema,
   AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER,
-  DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
+  DISPATCHER_AUTHEN, DISPATCHER_SURROGATE, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
 } from '@owlmeans/auth'
 // import { AppType } from '@owlmeans/context'
 import { body, filter, entrypoint, query } from '@owlmeans/entrypoint'
 import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route'
-import { DISPATCHER_PATH, WEB_API, authApi } from './consts.js'
+import { DISPATCHER_PATH, SURROGATE_PATH, WEB_API, authApi } from './consts.js'
+import { SurrogateQuerySchema } from './schemas.js'
 
 export const modules = [
   entrypoint(route(AUTHEN, '/authentication', backend())),
@@ -29,6 +30,17 @@ export const modules = [
     // rediected users.
     filter(query(AuthTokenSchema), { sticky: true })
   ),
+  // The login window an embedded application opens one level up.
+  //
+  // Top level and with no parent, so it renders outside every application layout — a popup must
+  // never show the application, with its navigation, inside itself. Sticky for the same reason the
+  // dispatcher is: it must attach to the client router regardless of service selection. It carries
+  // no `service`, unlike the dispatcher, because nothing server-side ever addresses it — the
+  // provider's callback goes to the dispatcher. And no guard: it is where a signed-out user lands.
+  entrypoint(
+    route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()),
+    filter(query(SurrogateQuerySchema), { sticky: true })
+  ),
   // This is a helper route that representes a API endpoint of service provider that wants to authenticate
   // a user with OwlMeans server-auth library.
   entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),

package/src/schemas.ts

@@ -0,0 +1,25 @@
+import type { JSONSchemaType } from 'ajv'
+
+/**
+ * What the surrogate login window is told about why it was opened.
+ *
+ * Every field is optional: the window must render something sensible when opened by hand, or by an
+ * older build that knew none of these parameters. `next` carries the address to run once the
+ * window is one level up, so the flow parameters the opener's URL held are forwarded rather than
+ * silently dropped.
+ */
+export interface SurrogateQuery {
+  intent?: string
+  next?: string
+  method?: string
+}
+
+export const SurrogateQuerySchema: JSONSchemaType<SurrogateQuery> = {
+  type: 'object',
+  properties: {
+    intent: { type: 'string', maxLength: 32, nullable: true },
+    next: { type: 'string', maxLength: 2048, nullable: true },
+    method: { type: 'string', maxLength: 128, nullable: true },
+  },
+  additionalProperties: true,
+}

package/src/types.ts

@@ -42,5 +42,58 @@ export interface ProfileToEntityIdRequest {
 }
 
 export interface ProfileToEntityIdResponse {
-  entityId: string
+  entitySlug: string
+}
+
+/**
+ * An organization entity: one immutable id, one renameable slug, and the trail of slugs it used to
+ * answer to.
+ *
+ * `formerSlugs` is what makes a rename survivable rather than merely possible. Tokens minted before
+ * the rename keep arriving until they expire, and third-party systems keep quoting the old value
+ * indefinitely; resolving a former slug to the same entity is how both keep working without anyone
+ * reissuing anything.
+ */
+export interface OrgEntityRef {
+  id: string
+  slug: string
+  formerSlugs?: string[]
+  /** Frozen identifier for systems whose names cannot be rewritten. See `ResolvedEntity.iamKey`. */
+  iamKey: string
+}
+
+/**
+ * Resolves the renameable slug on a token to the stable entity it names.
+ *
+ * Registered only by implementations that actually store organizations. Basic auth deliberately
+ * does not define what an entity id is — a deployment backed by an external IAM has no such record
+ * and registers nothing, and every consumer must therefore treat an unresolved entity as ordinary
+ * rather than exceptional.
+ */
+export interface EntityResolverService extends InitializedService {
+  /**
+   * Find an entity by any name it has ever answered to: its id, its current slug, a former slug,
+   * or its frozen `iamKey`. Ids win over slugs, so a slug that collides with some other entity's
+   * id can never shadow it.
+   */
+  resolve: (value: string) => Promise<OrgEntityRef | null>
+  byId: (id: string) => Promise<OrgEntityRef | null>
+  /** Mint an unused slug. Uniqueness is settled against the store, not by entropy. */
+  mintSlug: () => Promise<string>
+  /**
+   * Point the entity at a new slug, retiring the old one into `formerSlugs`.
+   *
+   * This is the whole cost of a rename: nothing else in any store is touched, because nothing else
+   * keys on the slug.
+   */
+  rename: (id: string, slug: string) => Promise<OrgEntityRef>
+  /**
+   * Read — or, on first ask, mint and persist — a name this entity is known by in a system that
+   * cannot be renamed later (a namespace, a bucket prefix, a realm).
+   *
+   * Minting through the entity record rather than deriving the name on demand is what lets the
+   * slug move afterwards: the derivation happens once, the result is what everything addresses,
+   * and a later rename leaves the live resource alone.
+   */
+  mintName: (id: string, key: string, mint: (entity: OrgEntityRef) => string) => Promise<string>
 }