@owlmeans/auth-common 0.1.18-rc.8 → 0.1.18

package/build/entrypoints.js

@@ -0,0 +1,46 @@
+import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, DISPATCHER_SURROGATE, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
+// import { AppType } from '@owlmeans/context'
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
+import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route';
+import { DISPATCHER_PATH, SURROGATE_PATH, WEB_API, authApi } from './consts.js';
+import { SurrogateQuerySchema } from './schemas.js';
+/** Shared authentication protocols, bound independently by server and browser packages. */
+export const authProtocols = {
+    authen: openProtocol(route(AUTHEN, '/authentication', backend())),
+    init: protocol(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), contract.request({ body: typed(AllowanceRequestSchema) }, typed())),
+    authenticate: protocol(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), contract.request({ body: typed(AuthCredentialsSchema) }, typed())),
+    rely: protocol(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), contract.request({ query: typed(OptionalAuthTokenSchema) }, typed())),
+    client: openProtocol(route(CAUTHEN, '/authentication', frontend())),
+    login: openProtocol(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+    loginDefault: openProtocol(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+    loginTyped: openProtocol(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+    flowEnter: openProtocol(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+    dispatcher: protocol(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), contract.request({ query: typed(AuthTokenSchema) }, typed()), { sticky: true }),
+    // The login window an embedded application opens one level up.
+    //
+    // Top level and with no parent, so it renders outside every application layout — a popup must
+    // never show the application, with its navigation, inside itself. Sticky for the same reason the
+    // dispatcher is: it must attach to the client router regardless of service selection. It carries
+    // no `service`, unlike the dispatcher, because nothing server-side ever addresses it — the
+    // provider's callback goes to the dispatcher. And no guard: it is where a signed-out user lands.
+    surrogate: protocol(route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()), contract.request({ query: typed(SurrogateQuerySchema) }, typed()), { sticky: true }),
+    // This is a helper route that representes a API endpoint of service provider that wants to authenticate
+    // a user with OwlMeans server-auth library.
+    dispatcherAuthenticate: protocol(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), contract.request({ body: typed(AuthTokenSchema) }, typed())),
+};
+/** Shared manager authentication protocols. */
+export const managerProtocols = {
+    profile: {
+        base: openProtocol(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
+        toEntityId: openProtocol(route(authApi.profile.toEntityId, '/to-entity-id', backend(authApi.profile.base, RouteMethod.POST))),
+    },
+    auth: {
+        base: openProtocol(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
+        delegate: openProtocol(route(authApi.auth.delegate, '/delegate', backend(authApi.auth.base, RouteMethod.POST))),
+    },
+};
+// const skipEntrypoints = [DISPATCHER]
+// export const authBackendEntrypoints = entrypoints.filter(
+//   module => !skipEntrypoints.includes(module.alias) && module.route.route.type === AppType.Backend
+// ).map(module => module.alias)
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,kBAAkB,EAAuF,MAAM,gBAAgB,CAAA;AAC9Y,8CAA8C;AAC9C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAGnD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAmB,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAqB,CAAC,CAAC;IAC1G,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAkB,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,CAAC;IAChG,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAqB,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,CAAC;IACtG,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACzF,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,UAAU,EAAE,QAAQ,CAClB,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAY,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EACvE,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;IACD,+DAA+D;IAC/D,EAAE;IACF,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,2FAA2F;IAC3F,iGAAiG;IACjG,SAAS,EAAE,QAAQ,CACjB,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAiB,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EACjF,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAY,eAAe,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,CAAC;CACrF,CAAA;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE;QACP,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1F,UAAU,EAAE,YAAY,CAAC,KAAK,CAC9B,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC9C,CAAC;KACH;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACpF,QAAQ,EAAE,YAAY,CAAC,KAAK,CAC5B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC3C,CAAC;KACH;CACF,CAAA;AAED,uCAAuC;AACvC,4DAA4D;AAC5D,qGAAqG;AACrG,gCAAgC"}

package/build/guards/basic-ed25519/consts.local.d.ts

@@ -0,0 +1,3 @@
+export declare const timeKey: string;
+export declare const nonceKey: string;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/guards/basic-ed25519/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/consts.local.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,QAAyC,CAAA;AAC7D,eAAO,MAAM,QAAQ,QAA0C,CAAA"}

package/build/guards/basic-ed25519/consts.local.js

@@ -0,0 +1,4 @@
+import { BED255_NONCE_HEADER, BED255_TIME_HEADER } from './consts.js';
+export const timeKey = BED255_TIME_HEADER.toLocaleLowerCase();
+export const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase();
+//# sourceMappingURL=consts.local.js.map

package/build/guards/basic-ed25519/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErE,MAAM,CAAC,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA"}

package/build/guards/basic-ed25519/index.d.ts

@@ -1,4 +1,5 @@
 export type * from './types.js';
 export * from './consts.js';
+export * from './replay.js';
 export * from './service.js';
 //# sourceMappingURL=index.d.ts.map

package/build/guards/basic-ed25519/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/guards/basic-ed25519/index.js

@@ -1,3 +1,4 @@
 export * from './consts.js';
+export * from './replay.js';
 export * from './service.js';
 //# sourceMappingURL=index.js.map

package/build/guards/basic-ed25519/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/guards/basic-ed25519/replay.d.ts

@@ -0,0 +1,14 @@
+import type { SignedRequestReplayResource, SignedRequestReplayStore } from './types.js';
+/**
+ * Process-local replay protection used when a deployment has not supplied a shared resource.
+ * A timer removes each claim at its signed expiry, keeping the fallback bounded by the live
+ * replay window rather than by process lifetime.
+ */
+export declare const makeMemorySignedRequestReplayStore: () => SignedRequestReplayStore;
+/**
+ * Adapt a create-once Resource to signed-request replay protection. Redis resources honour the
+ * absolute expiry and make the claim atomic across replicas (`SET NX`); other resource failures
+ * remain failures rather than being mistaken for successful claims.
+ */
+export declare const makeResourceSignedRequestReplayStore: (resource: SignedRequestReplayResource) => SignedRequestReplayStore;
+//# sourceMappingURL=replay.d.ts.map

package/build/guards/basic-ed25519/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/replay.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEvF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAO,wBAwBrD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,aACrC,2BAA2B,KACpC,wBAaD,CAAA"}

package/build/guards/basic-ed25519/replay.js

@@ -0,0 +1,49 @@
+import { RecordExists } from '@owlmeans/resource';
+/**
+ * Process-local replay protection used when a deployment has not supplied a shared resource.
+ * A timer removes each claim at its signed expiry, keeping the fallback bounded by the live
+ * replay window rather than by process lifetime.
+ */
+export const makeMemorySignedRequestReplayStore = () => {
+    const claims = new Map();
+    return {
+        claim: async (id, expiresAt) => {
+            const now = Date.now();
+            const current = claims.get(id);
+            if (current != null && current > now) {
+                return false;
+            }
+            const expiry = expiresAt.getTime();
+            claims.set(id, expiry);
+            const timer = setTimeout(() => {
+                if (claims.get(id) === expiry) {
+                    claims.delete(id);
+                }
+            }, Math.max(0, expiry - now));
+            const unref = timer.unref;
+            unref?.call(timer);
+            return true;
+        }
+    };
+};
+/**
+ * Adapt a create-once Resource to signed-request replay protection. Redis resources honour the
+ * absolute expiry and make the claim atomic across replicas (`SET NX`); other resource failures
+ * remain failures rather than being mistaken for successful claims.
+ */
+export const makeResourceSignedRequestReplayStore = (resource) => ({
+    claim: async (id, expiresAt) => {
+        try {
+            await resource.create({ id }, { ttl: expiresAt });
+            return true;
+        }
+        catch (error) {
+            if (error instanceof RecordExists
+                || error?.type === RecordExists.typeName) {
+                return false;
+            }
+            throw error;
+        }
+    }
+});
+//# sourceMappingURL=replay.js.map

package/build/guards/basic-ed25519/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/replay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAA6B,EAAE;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExC,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC9B,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAA;YACd,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;YAClC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC9B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACnB,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAA;YAC7B,MAAM,KAAK,GAAI,KAA2C,CAAC,KAAK,CAAA;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAElB,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,QAAqC,EACX,EAAE,CAAC,CAAC;IAC9B,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;YACjD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY;mBAC3B,KAAmC,EAAE,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/build/guards/basic-ed25519/service.d.ts

@@ -1,8 +1,3 @@
 import type { BasicEd25519Guard, BasicEd25519GuardOptions } from './types.js';
-/**
- * Proper configuration:
- * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
- * avoid requests duplication.
- */
 export declare const makeBasicEd25519Guard: (resource: string, opts?: BasicEd25519GuardOptions) => BasicEd25519Guard;
 //# sourceMappingURL=service.d.ts.map

package/build/guards/basic-ed25519/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBAqHzF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBA+IzF,CAAA"}

package/build/guards/basic-ed25519/service.js

@@ -1,21 +1,24 @@
 import { createService } from '@owlmeans/context';
 import { assertContext } from '@owlmeans/context';
-import { BED255_NONCE_HEADER, BED255_TIME_HEADER, BED255_CASHE_RESOURCE, GUARD_ED25519, BED255_SIG_TTL } from './consts.js';
+import { BED255_CASHE_RESOURCE, GUARD_ED25519, BED255_SIG_TTL } from './consts.js';
+import { nonceKey, timeKey } from './consts.local.js';
 import { trust } from '../../utils/trusted.js';
 import { AuthenPayloadError, AuthroizationType, AuthRole } from '@owlmeans/auth';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 import { extractAuthToken } from '@owlmeans/auth-common/utils';
-const timeKey = BED255_TIME_HEADER.toLocaleLowerCase();
-const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase();
-/**
- * Proper configuration:
- * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
- * avoid requests duplication.
- */
+import { makeMemorySignedRequestReplayStore, makeResourceSignedRequestReplayStore } from './replay.js';
 export const makeBasicEd25519Guard = (resource, opts) => {
-    const cache = (context) => context.hasResource(opts?.cache ?? BED255_CASHE_RESOURCE)
-        ? context.resource(opts?.cache ?? BED255_CASHE_RESOURCE)
-        : null;
+    const memoryReplay = makeMemorySignedRequestReplayStore();
+    const replay = (context) => {
+        if (opts?.replay != null) {
+            return opts.replay;
+        }
+        const alias = opts?.cache ?? BED255_CASHE_RESOURCE;
+        if (context.hasResource(alias)) {
+            return makeResourceSignedRequestReplayStore(context.resource(alias));
+        }
+        return memoryReplay;
+    };
     const guard = createService(GUARD_ED25519, {
         authenticated: async (req) => {
             const context = assertContext(guard.ctx);
@@ -54,32 +57,43 @@ export const makeBasicEd25519Guard = (resource, opts) => {
                 const [key, value] = pair.split('=', 2);
                 return { ...result, [key.toLowerCase()]: value };
             }, {});
+            if (typeof signature.credential !== 'string' || signature.credential.length === 0
+                || typeof signature.signature !== 'string' || signature.signature.length === 0) {
+                throw new AuthenPayloadError('signature');
+            }
             const trusted = await trust(context, resource, signature.credential, "id");
             if (trusted.user.credential == null) {
                 return false;
             }
+            const timestamp = req.headers?.[timeKey];
+            const nonce = req.headers?.[nonceKey];
             const payload = {
                 body: req.body ?? {},
-                headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+                headers: { [timeKey]: timestamp, [nonceKey]: nonce }
             };
             if (!await trusted.key.verify(payload, signature.signature)) {
                 return false;
             }
-            if (typeof req.headers[timeKey] !== 'string') {
+            if (typeof timestamp !== 'string') {
+                throw new AuthenPayloadError('timestamp');
+            }
+            const createdAt = new Date(timestamp);
+            const signedAt = createdAt.getTime();
+            if (!Number.isFinite(signedAt) || createdAt.toISOString() !== timestamp) {
                 throw new AuthenPayloadError('timestamp');
             }
-            const createdAt = new Date(req.headers[timeKey]);
-            if (createdAt.getTime() + BED255_SIG_TTL < Date.now()) {
+            if (Math.abs(Date.now() - signedAt) > BED255_SIG_TTL) {
                 throw new AuthenPayloadError('expired');
             }
-            const nonce = req.headers[nonceKey];
-            if (typeof nonce !== 'string') {
+            if (typeof nonce !== 'string' || nonce.length === 0) {
                 throw new AuthenPayloadError('nonce');
             }
             try {
-                const tried = cache(context);
-                if (tried != null) {
-                    await tried.create({ id: nonce }, { ttl: BED255_SIG_TTL / 1000 });
+                // The replay identity is the signing credential plus its nonce. A nonce used by one
+                // trusted service does not block another, while a captured request can be admitted once.
+                const claimed = await replay(context).claim(`${signature.credential.length}:${signature.credential}${nonce}`, new Date(signedAt + BED255_SIG_TTL));
+                if (!claimed) {
+                    throw new AuthenPayloadError('nonce');
                 }
             }
             catch {
@@ -89,7 +103,7 @@ export const makeBasicEd25519Guard = (resource, opts) => {
                 token: authorization,
                 userId: trusted.user.id,
                 profileId: trusted.user.id,
-                entityId: trusted.user.entityId,
+                entitySlug: trusted.user.entitySlug,
                 scopes: trusted.user.name != null ? [trusted.user.name] : [],
                 type: AuthroizationType.Ed25519BasicSignature,
                 source: context.cfg.service,

package/build/guards/basic-ed25519/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAE5G,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA2B,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAClF,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;aAChF,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAEhD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC5B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAC/B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EACL,kCAAkC,EAAE,oCAAoC,EACzE,MAAM,aAAa,CAAA;AAGpB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAC5G,MAAM,YAAY,GAAG,kCAAkC,EAAE,CAAA;IAEzD,MAAM,MAAM,GAAG,CAAC,OAAgB,EAA4B,EAAE;QAC5D,IAAI,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAA;QAClD,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,oCAAoC,CACzC,OAAO,CAAC,QAAQ,CAA8B,KAAK,CAAC,CACrD,CAAA;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;mBAC5E,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAA;YAErC,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;aACrD,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;gBACrD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,oFAAoF;gBACpF,yFAAyF;gBACzF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CACzC,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,GAAG,KAAK,EAAE,EAChE,IAAI,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,CACpC,CAAA;gBACD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACnC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/guards/basic-ed25519/types.d.ts

@@ -1,7 +1,23 @@
 import type { GuardService } from '@owlmeans/entrypoint';
+import type { ResourceRecord, WriteOptions } from '@owlmeans/resource';
+import type { BasicResource } from '@owlmeans/context';
 export interface BasicEd25519Guard extends GuardService {
 }
 export interface BasicEd25519GuardOptions {
+    /**
+     * Legacy resource alias. A Redis resource registered under this alias gives replay protection
+     * shared by every replica; when it is absent the guard falls back to its process-local store.
+     */
     cache?: string;
+    /** Explicit replay store, for consumers that do not register a Resource on the context. */
+    replay?: SignedRequestReplayStore;
+}
+/** A create-once claim over one signed request identity. */
+export interface SignedRequestReplayStore {
+    claim: (id: string, expiresAt: Date) => Promise<boolean>;
+}
+/** The small Resource surface needed by the Redis-compatible replay adapter. */
+export interface SignedRequestReplayResource extends BasicResource {
+    create: (record: Partial<ResourceRecord>, opts?: WriteOptions) => Promise<ResourceRecord>;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/guards/basic-ed25519/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2FAA2F;IAC3F,MAAM,CAAC,EAAE,wBAAwB,CAAA;CAClC;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACzD;AAED,gFAAgF;AAChF,MAAM,WAAW,2BAA4B,SAAQ,aAAa;IAChE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CAC1F"}

package/build/helper.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":""}

package/build/helper.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":""}

package/build/index.d.ts

@@ -1,6 +1,9 @@
 export type * from './types.js';
-export * from './modules.js';
+export type * from './entity/types.js';
+export * from './schemas.js';
+export * from './entrypoints.js';
 export * from './consts.js';
+export * from './entity.js';
 export * from './middleware.js';
 export * from './guards/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,mBAAmB,CAAA;AAEtC,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/index.js

@@ -1,5 +1,7 @@
-export * from './modules.js';
+export * from './schemas.js';
+export * from './entrypoints.js';
 export * from './consts.js';
+export * from './entity.js';
 export * from './middleware.js';
 export * from './guards/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/middleware.d.ts

@@ -1,3 +1,3 @@
-import type { Middleware } from '@owlmeans/context';
+import { type Middleware } from '@owlmeans/context';
 export declare const authMiddleware: Middleware;
 //# sourceMappingURL=middleware.d.ts.map

package/build/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,cAAc,EAAE,UAsC5B,CAAA"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAA4C,MAAM,mBAAmB,CAAA;AAM7F,eAAO,MAAM,cAAc,EAAE,UAuC5B,CAAA"}

package/build/middleware.js

@@ -1,27 +1,28 @@
 import { MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context';
-import { provideRequest } from '@owlmeans/client-entrypoint';
 import { AUTH_HEADER } from '@owlmeans/auth';
+import { clientRequestHelper } from '@owlmeans/client-entrypoint';
 export const authMiddleware = {
     type: MiddlewareType.Context,
     stage: MiddlewareStage.Loading,
     apply: async (context) => {
         context.entrypoints().forEach(module => {
-            if (module.route.route.type === AppType.Backend && module.call != null) {
-                const guards = module.getGuards();
-                if (guards.length > 0) {
+            if (module.route.route.type === AppType.Backend && module.invoke != null) {
+                if (module.getGuards().length > 0) {
                     if (module._auth_common_middleware_applied === true) {
                         return;
                     }
                     module._auth_common_middleware_applied = true;
-                    // const auth = context.service<GuardService>(service)
-                    const call = module.call;
-                    module.call = async (req, res) => {
+                    // Wrapping `invoke` covers `call` too: `call` reads `invoke` off the entrypoint at the
+                    // moment it runs, so both verbs carry the authentication header.
+                    const invoke = module.invoke;
+                    module.invoke = (async (req) => {
                         // @TODO Actually we may use multiple authentication headers with the same name
                         // As I learnt its not always the case
-                        const [token] = (await Promise.all(guards.map(guard => context.service(guard).authenticated(req)))).filter(token => token != null).reverse();
+                        // Asked per call, not captured: an ancestor may have gained a guard since the
+                        // middleware wrapped this entrypoint.
+                        const [token] = (await Promise.all(module.getGuards().map(guard => context.service(guard).authenticated(req)))).filter(token => token != null).reverse();
                         if (token != null) {
-                            await module.resolve();
-                            const _req = req ?? provideRequest(module.getAlias(), module.getPath());
+                            const _req = req ?? clientRequestHelper.provideRequest(module.alias, module.path());
                             const headers = (_req.headers ?? {});
                             if (headers[AUTH_HEADER] == null) {
                                 headers[AUTH_HEADER] = token;
@@ -29,8 +30,8 @@ export const authMiddleware = {
                                 req = _req;
                             }
                         }
-                        return call(req, res);
-                    };
+                        return invoke(req);
+                    });
                 }
             }
         });

package/build/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,sDAAsD;oBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;oBACxB,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBAC/B,+EAA+E;wBAC/E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;4BACtB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;4BACjG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACvB,CAAC,CAAA;gBAEH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACzE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,uFAAuF;oBACvF,iEAAiE;oBACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;oBAC5B,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;wBAC3B,+EAA+E;wBAC/E,sCAAsC;wBACtC,8EAA8E;wBAC9E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CACvD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,IAAI,GAA6B,GAAG,IAAI,mBAAmB,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;4BAC7G,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;oBACpB,CAAC,CAAyB,CAAA;gBAE5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/build/schemas.d.ts

@@ -0,0 +1,4 @@
+import type { JSONSchemaType } from 'ajv';
+import type { SurrogateQuery } from './types.js';
+export declare const SurrogateQuerySchema: JSONSchemaType<SurrogateQuery>;
+//# sourceMappingURL=schemas.d.ts.map

package/build/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAQ/D,CAAA"}

package/build/schemas.js

@@ -0,0 +1,10 @@
+export const SurrogateQuerySchema = {
+    type: 'object',
+    properties: {
+        intent: { type: 'string', maxLength: 32, nullable: true },
+        next: { type: 'string', maxLength: 2048, nullable: true },
+        method: { type: 'string', maxLength: 128, nullable: true },
+    },
+    additionalProperties: true,
+};
+//# sourceMappingURL=schemas.js.map

package/build/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3D;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAA"}

package/build/types.d.ts

@@ -29,6 +29,70 @@ export interface ProfileToEntityIdRequest {
     profileId: string;
 }
 export interface ProfileToEntityIdResponse {
-    entityId: string;
+    entitySlug: string;
+}
+/**
+ * An organization entity: one immutable id, one renameable slug, and the trail of slugs it used to
+ * answer to.
+ *
+ * `formerSlugs` is what makes a rename survivable rather than merely possible. Tokens minted before
+ * the rename keep arriving until they expire, and third-party systems keep quoting the old value
+ * indefinitely; resolving a former slug to the same entity is how both keep working without anyone
+ * reissuing anything.
+ */
+export interface OrgEntityRef {
+    id: string;
+    slug: string;
+    formerSlugs?: string[];
+    /** Frozen identifier for systems whose names cannot be rewritten. See `ResolvedEntity.iamKey`. */
+    iamKey: string;
+}
+/**
+ * Resolves the renameable slug on a token to the stable entity it names.
+ *
+ * Registered only by implementations that actually store organizations. Basic auth deliberately
+ * does not define what an entity id is — a deployment backed by an external IAM has no such record
+ * and registers nothing, and every consumer must therefore treat an unresolved entity as ordinary
+ * rather than exceptional.
+ */
+export interface EntityResolverService extends InitializedService {
+    /**
+     * Find an entity by any name it has ever answered to: its id, its current slug, a former slug,
+     * or its frozen `iamKey`. Ids win over slugs, so a slug that collides with some other entity's
+     * id can never shadow it.
+     */
+    resolve: (value: string) => Promise<OrgEntityRef | null>;
+    byId: (id: string) => Promise<OrgEntityRef | null>;
+    /** Mint an unused slug. Uniqueness is settled against the store, not by entropy. */
+    mintSlug: () => Promise<string>;
+    /**
+     * Point the entity at a new slug, retiring the old one into `formerSlugs`.
+     *
+     * This is the whole cost of a rename: nothing else in any store is touched, because nothing else
+     * keys on the slug.
+     */
+    rename: (id: string, slug: string) => Promise<OrgEntityRef>;
+    /**
+     * Read — or, on first ask, mint and persist — a name this entity is known by in a system that
+     * cannot be renamed later (a namespace, a bucket prefix, a realm).
+     *
+     * Minting through the entity record rather than deriving the name on demand is what lets the
+     * slug move afterwards: the derivation happens once, the result is what everything addresses,
+     * and a later rename leaves the live resource alone.
+     */
+    mintName: (id: string, key: string, mint: (entity: OrgEntityRef) => string) => Promise<string>;
+}
+/**
+ * What the surrogate login window is told about why it was opened.
+ *
+ * Every field is optional: the window must render something sensible when opened by hand, or by an
+ * older build that knew none of these parameters. `next` carries the address to run once the
+ * window is one level up, so the flow parameters the opener's URL held are forwarded rather than
+ * silently dropped.
+ */
+export interface SurrogateQuery {
+    intent?: string;
+    next?: string;
+    method?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACxD,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAClD,oFAAoF;IACpF,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC3D;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB"}

package/build/types.local.d.ts

@@ -0,0 +1,5 @@
+import type { ClientEntrypoint } from '@owlmeans/client-entrypoint';
+export interface Perked extends ClientEntrypoint<unknown> {
+    _auth_common_middleware_applied?: boolean;
+}
+//# sourceMappingURL=types.local.d.ts.map

package/build/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAEnE,MAAM,WAAW,MAAO,SAAQ,gBAAgB,CAAC,OAAO,CAAC;IACvD,+BAA+B,CAAC,EAAE,OAAO,CAAA;CAC1C"}

package/build/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":""}

package/build/utils/trusted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,YAAY,MAAM,UAAS,MAAM;;;EAUhI,CAAA"}
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,YAAY,MAAM,UAAS,MAAM;;;EAWhI,CAAA"}