@owlmeans/entrypoint 0.1.18-rc.1 → 0.1.18-rc.11

package/README.md

@@ -4,16 +4,21 @@ Entrypoint system — the URL unit abstraction shared between server and client
 
 ## Overview
 
-- An **entrypoint** is a URL unit: an alias + path + optional guards/gates/filters
+- An **entrypoint** is a URL unit: an alias + a route declaration + optional guards/gates/filters
 - On the server, entrypoints become API routes with attached handlers
 - On the client, entrypoints provide URL generation and navigation
 - All AJV validation schemas are defined at entrypoint level, keeping data contracts consistent fullstack
 - Most commonly used via re-exports in `@owlmeans/server-app` or `@owlmeans/client-entrypoint`
 
+The route declaration an entrypoint carries is immutable: its `path` always stays the segment this
+entrypoint contributes under its parent. Addresses are computed on demand against the context the
+entrypoint is registered in — `path()` walks the parent chain, `mount()` adds the service base,
+`address()` picks host, port and scheme — so one declaration answers correctly on both sides.
+
 ## Installation
 
 ```bash
-bun add @owlmeans/entrypoint
+bun add @owlmeans/entrypoint@^0.1.18-rc.10
 ```
 
 ## Usage
@@ -24,7 +29,7 @@ Define an entrypoint with body validation and a guard:
 import { entrypoint, guard, filter, body, params } from '@owlmeans/server-app'
 import { route } from '@owlmeans/route'
 
-const createStoryModule = entrypoint(
+const createStoryEntrypoint = entrypoint(
   route('story-create', '/stories', { method: 'POST', parent: 'api' }),
   filter(body({
     type: 'object',
@@ -67,14 +72,24 @@ Attaches validation schemas (AJV format) to the entrypoint.
 
 Build a `Filter` object with the given AJV schema applied to the corresponding request part.
 
-### `parent(entrypoint, parentAlias): CommonEntrypoint`
+### Parentship
 
-Sets a parent-child relationship so child entrypoints inherit guards/gates.
+A child names its parent in the route declaration (`route('story-create', '/stories', { parent: 'api' })`).
+`path()` prefixes the parent's segments, and `getGuards()` / `getGates()` collect the parent's on
+every call — so a guard added to a parent later still applies.
 
 ### `provideResponse<T>(): AbstractResponse<T>`
 
 Creates a response object for use in non-elevated handlers.
 
+### Transport
+
+A route's protocol picks the carrier. Register a service under `transportAlias(protocol)` —
+`transport:<protocol>` — implementing `EntrypointTransport { protocol, handle }`, and every call to
+an entrypoint on that protocol goes through it. A consumer writes `ep.call(...)` and never learns
+whether that became an HTTP request, a socket message or a queued job. Without a registered
+transport the call goes over HTTP.
+
 ### `EntrypointOutcome`
 
 ```typescript
@@ -85,7 +100,10 @@ enum EntrypointOutcome { Ok, Accepted, Created, Finished }
 
 - `AbstractRequest<T>` — request with `params`, `body`, `query`, `headers`, `auth`
 - `AbstractResponse<T>` — response with `resolve(value, outcome?)` and `reject(error)`
-- `CommonEntrypoint` — entrypoint with `getAlias()`, `getPath()`, `getGuards()`, `handle`
+- `CommonEntrypoint` — entrypoint with `alias`, `route`, `handle`, and the context-computed
+  `segment()`, `path()`, `mount()`, `service()`, `address()`, `isLocal()`, `parent()`,
+  `getGuards()`, `getGates()`
+- `EntrypointTransport` — `{ protocol, handle }`, the service that carries a call for one protocol
 
 ## Related Packages
 
@@ -102,7 +120,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.12
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/entrypoint",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.515Z",
+  "version": "0.1.18-rc.11",
+  "generatedAt": "2026-09-04T22:43:25.452Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/entrypoint/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: entrypoint
-description: How to use @owlmeans/entrypoint — declarative entrypoint/route definitions with entrypoint(), guard(), gate(), filter(), body(), params(), query() builders. Auto-invoked when importing from this package or defining a service entrypoint declaration. Also covers the deprecated @owlmeans/module reexport shim (module() → entrypoint()).
+description: How to use @owlmeans/entrypoint — declarative entrypoint definitions over immutable route declarations, with entrypoint(), guard(), gate(), filter(), body(), params(), query() builders, the address accessors, and the transport seam. Auto-invoked when importing from this package or defining a service entrypoint declaration.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,27 +8,142 @@ user-invocable: false
 # @owlmeans/entrypoint
 
 **Layer:** Core
-**Install:** `"@owlmeans/entrypoint": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/entrypoint": "^0.1.18-rc.11"` in `dependencies`
+
+An entrypoint is a **URL unit**: an immutable route declaration plus the guards, gates and schemas
+it answers under. It is the single concept an application declares once in a shared package and
+elevates on either side.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `entrypoint(...builders)` | Compose an entrypoint declaration from builders |
-| `guard(alias, ...gates)` | Attach a security guard |
-| `gate(alias, scopes[])` | Define an auth gate (used inside a guard) |
-| `filter(...validators)` | Attach request validators |
-| `body(Schema)` | AJV body validator |
-| `params(Schema)` | URL params validator |
-| `query(Schema)` | Query string validator |
-| `ClientEntrypoint<T>` types | Resolved entrypoint type used for `ctx.entrypoint<...>(alias).call(...)` |
+| `entrypoint(route, opts?)` | Declare an entrypoint on a route model |
+| `guard(alias, opts?)` | Require a guard; returns options, so it wraps rather than takes them |
+| `gate(alias, params, opts?)` | Require a gate; passed as the `opts` of `guard(...)` |
+| `filter(filter, opts?)` | Attach request validators |
+| `body(Schema)` / `params(Schema)` / `query(Schema)` / `headers(Schema)` / `response(Schema, code?)` | AJV validators composed into a `Filter` |
+| `CommonEntrypoint` | The entrypoint interface — declaration, guards/gates, address accessors |
+| `AbstractRequest` / `AbstractResponse` | The request and reply shapes every handler sees |
+| `ResolvedEntity` | `req.entity` — the organization entity's `{ id, slug, iamKey }` |
+| `provideResponse(original?)` | Build a reply object a handler resolves or rejects |
+| `EntrypointHandler` | What a handler implements: `(req, res) => value` |
+| `Filter` | The composed validator set: `{ body, params, query, headers, response }` |
+| `GuardService` / `GateService` | What a guard and a gate implement |
 | `EntrypointOutcome` | Enum: Ok, Accepted, Created, Finished |
-| Constants | Built-in entrypoint aliases |
+| `EntrypointTransport` | `{ protocol, handle }` — a carrier bound to a route protocol |
+| `transportAlias(protocol?)` | The service alias a transport registers under (`transport:<protocol>`) |
+
+`guard`, `gate` and `filter` are **options-object combinators, not variadic composers**. Each
+returns a `CommonEntrypointOptions` and takes the next one as its final argument, so they nest:
+
+```typescript
+entrypoint(
+  route(app.api.item.remove, '/:id', { parent: app.api.item, method: RouteMethod.DELETE }),
+  guard(DEFAULT_GUARD, gate(OIDC_GATE, ['item--delete@id']))
+)
+```
+
+Guards and gates are **inherited by child entrypoints** and enforced by the framework before a
+handler runs — a handler that re-checks them is duplicating an enforced rule, and is wrong even
+when it agrees.
+
+`sticky: true` in the options exempts a frontend entrypoint from the **service** filter the client
+router applies while building its entrypoint tree: without it, only entrypoints that name no service
+or name the context's own service are attached, so a route belonging to another service (an
+authentication dispatcher, say) needs it to reach the router at all. It changes nothing else — not
+the frontend-only restriction, not route matching — and defaults to `false`.
 
 ## Subpath Exports
 
 - `./utils` — entrypoint construction helpers (`isEntrypoint`, `CreateEntrypointSignature`)
 
+## Declaration and model
+
+The `RouteDeclaration` an entrypoint carries is plain, immutable data: its `path` is the **segment**
+this entrypoint contributes under its parent, and nothing rewrites it. `RouteModel` only wraps that
+declaration. Every address question is therefore a question about the declaration asked **against
+the context that asks it** — computed on demand, never stored — so the same declaration answers one
+way in a server and another in a client without being touched.
+
+| Accessor | Answers |
+|----------|---------|
+| `segment()` | The segment declared under the parent |
+| `path()` | Every ancestor's segment, then this one |
+| `mount()` | `base` + `path()` — what a server registers and a client requests |
+| `service()` | The resolved service route this entrypoint answers on |
+| `address()` | `{ host, port, base, secure, protocol }` — where it actually answers |
+| `isLocal()` | Does it belong to the service the asking context IS? |
+| `parent()` | The parent entrypoint, or `null` |
+| `getGuards()` | Own guards plus every ancestor's, deduped |
+| `getGates()` | Own gate plus every ancestor's, as `[gate, params]` |
+
+`getGuards()` and `getGates()` walk the chain afresh on every call and are never memoised: a guard
+attached to an ancestor after this entrypoint was first asked still has to count.
+
+## What a handler receives
+
+`AbstractRequest` carries `params`, `body`, `query`, `headers` and `path`, plus `auth` once a guard
+has run. `req.entity` is the organization entity resolved from `auth.entitySlug` **once**, at the
+server boundary: `entity.id` is the stable value to key records, grants and generated names by,
+`entity.slug` is the renameable name a person reads, and `entity.iamKey` is the frozen identifier
+external systems already know the organization under. It is absent when no resolver is registered,
+so read it defensively rather than assuming it.
+
+`timeout` and `signal` on a request are forwarded to the transport, so a caller can bound or abort a
+single round trip.
+
+## Calling an entrypoint
+
+Three explicit verbs, so the caller says which answer it wants:
+
+```typescript
+const project = await ep.call({ params: { id } })            // the VALUE; the reply error is thrown
+const { value, outcome } = await ep.invoke({ body })         // value AND outcome
+const href = await ep.url({ params: { id } }, { absolute: true })   // the URL string
+```
+
+Use `invoke` only where the outcome decides what happens next; `call` covers everything else. An
+entrypoint that **renders a screen** is addressed by URL and never over the wire — it throws from
+`call()`/`invoke()` telling the caller to use `url()`.
+
+The three verbs sit on the callable entrypoint that `@owlmeans/client-entrypoint` produces; the
+declaration built here is what they address.
+
+## Elevation
+
+`elevate` replaces the declaration in the entrypoint list with its elevated counterpart, so it is
+**idempotent**: elevating the same alias again simply replaces the element once more. Guards passed
+at elevation are **unioned** with the ones the entrypoint declared — elevating adds guards, it never
+swaps them. Server-side elevation lives in `@owlmeans/server-entrypoint`, client-side callability is
+an explicit opt-in through `@owlmeans/client-entrypoint`.
+
+## Transport seam
+
+A route names the protocol it answers on, and a protocol may be carried by something other than
+HTTP. A service registered under `transportAlias(protocol)` implementing `EntrypointTransport` takes
+the call, so a consumer writes `ep.call(...)` and never learns whether that became an HTTP request,
+a socket message or a queued job. Bind nothing and the call goes over HTTP.
+
+```typescript
+import { transportAlias } from '@owlmeans/entrypoint'
+import type { EntrypointTransport } from '@owlmeans/entrypoint'
+import { RouteProtocols } from '@owlmeans/route'
+import { createService } from '@owlmeans/context'
+
+const transport = createService<EntrypointTransport>(transportAlias(RouteProtocols.SOCKET), {
+  protocol: RouteProtocols.SOCKET,
+  handle: async (req, res) => { /* carry the call, resolve or reject res */ }
+}, service => async () => { service.initialized = true })
+
+context.registerService(transport)
+```
+
+`@owlmeans/queue` is the worked example: `appendQueueTransport(context)` binds
+`RouteProtocols.QUEUE`, and a declaration built with `job()` instead of `backend()` is then carried
+as a broker job. Nothing at the call site changes — which is the point of putting the protocol on
+the route rather than at the call.
+
 ## Usage
 
 Define entrypoints in a shared `common` package, then `elevate()` them with handlers in server/web packages:
@@ -40,7 +155,7 @@ import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 import { CreateProjectSchema } from './schemas.js'
 
-export const managerModules = [
+export const managerEntrypoints = [
   entrypoint(
     route(manager.back.account.base, '/account'),
     guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
@@ -57,6 +172,12 @@ export const managerModules = [
 
 ## Depends On
 
-- `@owlmeans/route` — `route()`, `RouteMethod`
-- `@owlmeans/auth-common` — guard aliases (`DEFAULT_GUARD`)
-- `@owlmeans/error`, `@owlmeans/i18n`
+- `@owlmeans/route` — `RouteModel`, `RouteAddress`, `RouteProtocols`, and the address helpers under `/utils`
+- `@owlmeans/context` — `appendContextual`, and the `BasicEntrypoint` / service shapes an entrypoint and its guards, gates and transports register as
+- `@owlmeans/auth` — `Auth`, the type behind `req.auth`
+- `ajv` — the JSON-schema types `body()` / `params()` / `query()` / `headers()` / `response()` are declared with
+
+Guard and gate **aliases** are not declared here: an entrypoint names a guard by string, and the
+package that implements the guard owns the constant (`DEFAULT_GUARD` comes from
+`@owlmeans/auth-common`, `OIDC_GATE` from `@owlmeans/oidc`). That is what keeps this package free of
+any dependency on the auth stack.

package/build/consts.d.ts

@@ -4,4 +4,9 @@ export declare enum EntrypointOutcome {
     Created = "created",
     Finished = "finished"
 }
+/**
+ * Service alias a transport registers under. The default protocol is the web one, so an application
+ * that binds nothing keeps talking HTTP.
+ */
+export declare const transportAlias: (protocol?: string) => string;
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,oBAAY,iBAAiB;IAC3B,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,oBAAY,iBAAiB;IAC3B,EAAE,OAAO;IACT,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,cAAc,MAAM,WAAqC,CAAA"}

package/build/consts.js

@@ -5,4 +5,9 @@ export var EntrypointOutcome;
     EntrypointOutcome["Created"] = "created";
     EntrypointOutcome["Finished"] = "finished";
 })(EntrypointOutcome || (EntrypointOutcome = {}));
+/**
+ * Service alias a transport registers under. The default protocol is the web one, so an application
+ * that binds nothing keeps talking HTTP.
+ */
+export const transportAlias = (protocol = 'http') => `transport:${protocol}`;
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,8BAAS,CAAA;IACT,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;IACnB,0CAAqB,CAAA;AACvB,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,8BAAS,CAAA;IACT,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;IACnB,0CAAqB,CAAA;AACvB,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,GAAW,MAAM,EAAE,EAAE,CAAC,aAAa,QAAQ,EAAE,CAAA"}

package/build/entrypoint.d.ts

@@ -1,5 +1,4 @@
 import type { CommonEntrypoint } from './types.js';
 import type { CreateEntrypointSignature } from './utils/types.js';
 export declare const entrypoint: CreateEntrypointSignature<CommonEntrypoint>;
-export declare const parent: <T extends CommonEntrypoint | CommonEntrypoint[]>(ep: T, aliasOrParent: string, _parent?: string) => T;
 //# sourceMappingURL=entrypoint.d.ts.map

package/build/entrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoint.d.ts","sourceRoot":"","sources":["../src/entrypoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAEjE,eAAO,MAAM,UAAU,EAAE,yBAAyB,CAAC,gBAAgB,CAqFlE,CAAA;AAED,eAAO,MAAM,MAAM,GAAI,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,MAAM,YAAY,MAAM,KAAG,CAcxH,CAAA"}
+{"version":3,"file":"entrypoint.d.ts","sourceRoot":"","sources":["../src/entrypoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAKlD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAEjE,eAAO,MAAM,UAAU,EAAE,yBAAyB,CAAC,gBAAgB,CAkElE,CAAA"}

package/build/entrypoint.js

@@ -1,61 +1,49 @@
 import { appendContextual } from '@owlmeans/context';
+import { isLocalRoute, resolveAddress, resolveMount, resolvePath, resolveService } from '@owlmeans/route/utils';
 export const entrypoint = (route, opts) => {
-    let guards = null;
-    let gates = null;
     const ep = appendContextual(route.route.alias, {
         _entrypoint: true,
-        _module: true,
         sticky: false,
         route,
-        getAlias: () => ep.route.route.alias,
-        getPath: () => ep.route.route.path,
-        getParentAlias: () => ep.route.route.parent ?? null,
-        hasParent: () => ep.getParentAlias() != null,
-        resolve: async () => {
-            if (ep.ctx == null) {
-                throw new SyntaxError(`Entrypoint has no context yet - ${ep.getAlias()}`);
-            }
-            await ep.route.resolve(ep.ctx);
-            return ep;
-        },
-        getParent: () => {
-            const parentAlias = ep.getParentAlias();
-            if (parentAlias == null) {
-                throw new SyntaxError(`Entrypoint has no parent - ${ep.getAlias()}`);
-            }
-            if (ep.ctx == null) {
-                throw new SyntaxError(`Entrypoint has no context yet - ${ep.getAlias()}`);
-            }
-            return ep.ctx.entrypoint(parentAlias);
-        },
-        setService: service => {
-            if (ep.route.route.resolved) {
-                throw new SyntaxError(`Cannot update a resolved entrypoint - ${ep.getAlias()}`);
-            }
-            ep.route.route.service = service;
-        },
+        segment: () => ep.route.route.path,
+        path: () => resolvePath(ep.assertCtx(), ep.route.route),
+        mount: () => resolveMount(ep.assertCtx(), ep.route.route),
+        service: () => resolveService(ep.assertCtx(), ep.route.route),
+        address: () => resolveAddress(ep.assertCtx(), ep.route.route),
+        isLocal: () => isLocalRoute(ep.assertCtx(), ep.route.route),
+        parent: () => ep.route.route.parent == null ? null
+            : ep.assertCtx().entrypoint(ep.route.route.parent),
+        // Walked afresh on every call: a guard attached to an ancestor after this entrypoint was first
+        // asked still has to count.
         getGuards: () => {
-            if (guards != null) {
-                return guards;
-            }
-            guards = ep.guards ?? [];
-            if (ep.hasParent()) {
-                guards.push(...ep.getParent().getGuards().filter(guard => !guards?.includes(guard)));
+            const guards = [...ep.guards ?? []];
+            const parent = ep.parent();
+            if (parent != null) {
+                guards.push(...parent.getGuards().filter(guard => !guards.includes(guard)));
             }
             return guards;
         },
+        /**
+         * The gates standing over this entrypoint: its own, then an ancestor's for each gate service
+         * this entrypoint has not already named.
+         *
+         * KNOWN HAZARD, deliberately left alone: the dedup is by gate SERVICE, and two gates under one
+         * service are two different questions because their parameters differ — so a child that
+         * declares its own gate silently drops its ancestor's, which is the opposite of what
+         * "inherited" means. Anything that needs a group rule AND a member rule must therefore not
+         * express the group half as a gate under the same service. Changing this would widen every
+         * backend and socket entrypoint that today relies on the replacement, so it is a migration
+         * rather than a fix.
+         */
         getGates: () => {
-            if (gates != null) {
-                return gates;
-            }
-            gates = ep.gate != null ? [[
+            const gates = ep.gate != null ? [[
                     ep.gate, ep.gateParams == null
                         ? [] : Array.isArray(ep.gateParams)
                         ? ep.gateParams : [ep.gateParams]
                 ]] : [];
-            if (ep.hasParent()) {
-                gates.push(...ep.getParent().getGates()
-                    .filter(([gate]) => !gates?.some(([g]) => g === gate)));
+            const parent = ep.parent();
+            if (parent != null) {
+                gates.push(...parent.getGates().filter(([gate]) => !gates.some(([g]) => g === gate)));
             }
             return gates;
         },
@@ -63,18 +51,4 @@ export const entrypoint = (route, opts) => {
     });
     return ep;
 };
-export const parent = (ep, aliasOrParent, _parent) => {
-    if (Array.isArray(ep)) {
-        if (_parent == null) {
-            throw SyntaxError('Elevating parent requires parent name to be specified');
-        }
-        ep = ep.find(e => e.route.route.alias === aliasOrParent);
-        if (ep == null) {
-            throw SyntaxError(`Entrypoint not found ${aliasOrParent}`);
-        }
-        return parent(ep, _parent);
-    }
-    ep.route.route.parent = aliasOrParent;
-    return ep;
-};
 //# sourceMappingURL=entrypoint.js.map

package/build/entrypoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoint.js","sourceRoot":"","sources":["../src/entrypoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,MAAM,CAAC,MAAM,UAAU,GAAgD,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrF,IAAI,MAAM,GAAoB,IAAI,CAAA;IAClC,IAAI,KAAK,GAAgC,IAAI,CAAA;IAC7C,MAAM,EAAE,GAAqB,gBAAgB,CAAmB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;QACjF,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QAEb,MAAM,EAAE,KAAK;QAEb,KAAK;QAEL,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK;QACpC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAClC,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI;QACnD,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,IAAI;QAE5C,OAAO,EAAE,KAAK,IAAgC,EAAE;YAC9C,IAAI,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,WAAW,CAAC,mCAAmC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC3E,CAAC;YAED,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;YAE9B,OAAO,EAAO,CAAA;QAChB,CAAC;QAED,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,WAAW,GAAG,EAAE,CAAC,cAAc,EAAE,CAAA;YACvC,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,IAAI,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,WAAW,CAAC,mCAAmC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC3E,CAAC;YAED,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QACvC,CAAC;QAED,UAAU,EAAE,OAAO,CAAC,EAAE;YACpB,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,WAAW,CAAC,yCAAyC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;QAClC,CAAC;QAED,SAAS,EAAE,GAAG,EAAE;YACd,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAA;YACf,CAAC;YACD,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAA;YAExB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxE,CAAA;YACH,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAA;YACd,CAAC;YAED,KAAK,GAAG,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBACzB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI;wBAC5B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;wBACjC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC;iBACtC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAEP,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CACR,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;qBACzB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CACzD,CAAA;YACH,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC;QAED,GAAG,IAAI;KACR,CAAC,CAAA;IAEF,OAAO,EAAE,CAAA;AACX,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,CAAkD,EAAK,EAAE,aAAqB,EAAE,OAAgB,EAAK,EAAE;IAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACtB,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,uDAAuD,CAAC,CAAA;QAC5E,CAAC;QACD,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,aAAa,CAAM,CAAA;QAC7D,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,wBAAwB,aAAa,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAA;IAErC,OAAO,EAAE,CAAA;AACX,CAAC,CAAA"}
+{"version":3,"file":"entrypoint.js","sourceRoot":"","sources":["../src/entrypoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EACL,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EACxE,MAAM,uBAAuB,CAAA;AAG9B,MAAM,CAAC,MAAM,UAAU,GAAgD,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrF,MAAM,EAAE,GAAqB,gBAAgB,CAAmB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;QACjF,WAAW,EAAE,IAAI;QAEjB,MAAM,EAAE,KAAK;QAEb,KAAK;QAEL,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAElC,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEvD,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzD,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAE7D,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAE7D,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAE3D,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAChD,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,UAAU,CAAmB,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAEtE,+FAA+F;QAC/F,4BAA4B;QAC5B,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAA;YAC1B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC7E,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED;;;;;;;;;;;WAWG;QACH,QAAQ,EAAE,GAAG,EAAE;YACb,MAAM,KAAK,GAAyB,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrD,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI;wBAC5B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;wBACjC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC;iBACtC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAEP,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAA;YAC1B,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;YACvF,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC;QAED,GAAG,IAAI;KACR,CAAC,CAAA;IAEF,OAAO,EAAE,CAAA;AACX,CAAC,CAAA"}

package/build/helper.d.ts

@@ -1,7 +1,6 @@
-import { Filter, CommonEntrypointOptions, AbstractResponse, CommonEntrypoint } from './types.js';
+import { Filter, CommonEntrypointOptions, AbstractResponse } from './types.js';
 export declare const filter: (filter: Filter, opts?: CommonEntrypointOptions) => CommonEntrypointOptions;
 export declare const guard: (guard: string, opts?: CommonEntrypointOptions) => CommonEntrypointOptions;
 export declare const gate: (gate: string, params: string | string[], opts?: CommonEntrypointOptions) => CommonEntrypointOptions;
 export declare const provideResponse: <T>(originalResponse?: unknown) => AbstractResponse<T>;
-export declare const clone: <M extends CommonEntrypoint>(entrypoints: M[], from: string, to: string, service: string) => void;
 //# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGhG,eAAO,MAAM,MAAM,WAAY,MAAM,SAAS,uBAAuB,KAAG,uBAAgD,CAAA;AAExH,eAAO,MAAM,KAAK,UAAW,MAAM,SAAS,uBAAuB,KAAG,uBACC,CAAA;AAEvE,eAAO,MAAM,IAAI,SAAU,MAAM,UAAU,MAAM,GAAG,MAAM,EAAE,SAAS,uBAAuB,KAAG,uBACtD,CAAA;AAEzC,eAAO,MAAM,eAAe,GAAI,CAAC,qBAAqB,OAAO,KAAG,gBAAgB,CAAC,CAAC,CAejF,CAAA;AAED,eAAO,MAAM,KAAK,GAAI,CAAC,SAAS,gBAAgB,eAAe,CAAC,EAAE,QAAQ,MAAM,MAAM,MAAM,WAAW,MAAM,SAO5G,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE9E,eAAO,MAAM,MAAM,WAAY,MAAM,SAAS,uBAAuB,KAAG,uBAAgD,CAAA;AAExH,eAAO,MAAM,KAAK,UAAW,MAAM,SAAS,uBAAuB,KAAG,uBACC,CAAA;AAEvE,eAAO,MAAM,IAAI,SAAU,MAAM,UAAU,MAAM,GAAG,MAAM,EAAE,SAAS,uBAAuB,KAAG,uBACtD,CAAA;AAEzC,eAAO,MAAM,eAAe,GAAI,CAAC,qBAAqB,OAAO,KAAG,gBAAgB,CAAC,CAAC,CAejF,CAAA"}

package/build/helper.js

@@ -1,5 +1,3 @@
-import { route } from '@owlmeans/route';
-import { entrypoint } from './entrypoint.js';
 export const filter = (filter, opts) => ({ filter, ...opts });
 export const guard = (guard, opts) => ({ ...opts, guards: [...new Set([guard, ...(opts?.guards ?? [])])] });
 export const gate = (gate, params, opts) => ({ ...opts, gate, gateParams: params });
@@ -16,11 +14,4 @@ export const provideResponse = (originalResponse) => {
     };
     return handler;
 };
-export const clone = (entrypoints, from, to, service) => {
-    const source = entrypoints.find(e => e.alias === from);
-    if (source?.route.route != null) {
-        const _route = { ...source.route.route, service, resolved: false, alias: to };
-        entrypoints.push(entrypoint(route(to, _route.path, _route)));
-    }
-};
 //# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,IAA8B,EAA2B,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAExH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAA8B,EAA2B,EAAE,CAC9F,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAEvE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAyB,EAAE,IAA8B,EAA2B,EAAE,CACvH,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AAEzC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,gBAA0B,EAAuB,EAAE;IACpF,MAAM,OAAO,GAAwB;QACnC,gBAAgB,EAAE,gBAAgB;QAElC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;QAC3B,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;QACvB,CAAC;KACF,CAAA;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAA6B,WAAgB,EAAE,IAAY,EAAE,EAAU,EAAE,OAAe,EAAE,EAAE;IAC/G,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;IAEtD,IAAI,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QAC7E,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,IAA8B,EAA2B,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAExH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAA8B,EAA2B,EAAE,CAC9F,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAEvE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAyB,EAAE,IAA8B,EAA2B,EAAE,CACvH,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AAEzC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,gBAA0B,EAAuB,EAAE;IACpF,MAAM,OAAO,GAAwB;QACnC,gBAAgB,EAAE,gBAAgB;QAElC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;QAC3B,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;QACvB,CAAC;KACF,CAAA;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -1,28 +1,42 @@
-import type { CommonRouteModel } from '@owlmeans/route';
+import type { ResolvedServiceRoute, RouteAddress, RouteModel, RouteProtocols } from '@owlmeans/route';
 import type { InitializedService, LazyService, BasicEntrypoint } from '@owlmeans/context';
 import type { AnySchemaObject } from 'ajv';
 import type { EntrypointOutcome } from './consts.js';
 import type { Auth } from '@owlmeans/auth';
+/**
+ * A URL unit: an immutable route declaration plus what guards, gates and schemas it answers under.
+ *
+ * Nothing here is rewritten once declared. Every address question — segment, path, mount, service,
+ * host — is a question about the declaration asked against the context the entrypoint is registered
+ * in, so the same declaration answers differently in a client and in a server without being touched.
+ */
 export interface CommonEntrypoint extends BasicEntrypoint {
-    route: CommonRouteModel;
+    route: RouteModel;
     /**
      * @property {boolean} - if true — router attaches this entrypoint unconditionally
      * @default false
      */
     sticky: boolean;
-    filter?: Filter;
+    /** The guards declared on this entrypoint alone — see `getGuards()` for the inherited set. */
     guards?: string[];
     gate?: string;
     gateParams?: string | string[];
+    filter?: Filter;
     handle?: EntrypointHandler;
-    getAlias: () => string;
-    getPath: () => string;
-    getParentAlias: () => string | null;
-    hasParent: () => boolean;
-    resolve: <M extends CommonEntrypoint>() => Promise<M>;
-    getParent: <M extends CommonEntrypoint>() => M;
-    setService: (service: string) => void;
+    /** The segment this entrypoint contributes under its parent. */
+    segment: () => string;
+    /** Every ancestor's segment, then this one. */
+    path: () => string;
+    /** `base` + `path()` — what a server mounts and a client requests. */
+    mount: () => string;
+    service: () => ResolvedServiceRoute;
+    address: () => RouteAddress;
+    /** Does this entrypoint belong to the service its context IS? */
+    isLocal: () => boolean;
+    parent: () => CommonEntrypoint | null;
+    /** Own guards and every ancestor's, deduped. Recomputed on each call. */
     getGuards: () => string[];
+    /** Own gate and every ancestor's, as `[gate, params]`. Recomputed on each call. */
     getGates: () => [string, string[]][];
 }
 export interface CommonEntrypointOptions extends Partial<CommonEntrypoint> {
@@ -39,6 +53,17 @@ export interface EntrypointAssert {
 export interface AbstractRequest<T extends {} = {}> {
     alias: string;
     auth?: Auth;
+    /**
+     * The organization entity this request acts for, resolved from `auth.entitySlug` once, at the
+     * server boundary.
+     *
+     * The slug on the token is renameable and therefore unusable as a key; `entity.id` is the stable
+     * value that records, grants and minted infrastructure names are keyed by. Resolving it here —
+     * rather than in each handler — is what keeps a rename from meaning a sweep of every call site,
+     * and it is absent whenever no resolver is registered (an implementation that has no notion of
+     * an organization store), so consumers must handle that rather than assume it.
+     */
+    entity?: ResolvedEntity;
     params: Record<string, string | number | undefined | null> | Partial<T>;
     body?: Record<string, any> | Partial<T>;
     headers: Record<string, string[] | string | undefined>;
@@ -53,6 +78,20 @@ export interface AbstractRequest<T extends {} = {}> {
     timeout?: number;
     signal?: AbortSignal;
 }
+/**
+ * An organization entity as request handlers see it: the stable id to key by, the current slug to
+ * compose user-facing names from, and the frozen key that external systems already know it under.
+ */
+export interface ResolvedEntity {
+    id: string;
+    slug: string;
+    /**
+     * The identifier this organization is known by in systems whose names cannot be rewritten —
+     * an IAM realm, an object-storage prefix, a cluster object. Minted once and never recomputed,
+     * so it stays valid across every later rename.
+     */
+    iamKey: string;
+}
 export interface AbstractResponse<T> {
     responseProvider?: any;
     value?: T;
@@ -80,4 +119,15 @@ export interface Filter {
     response?: AnySchemaObject;
     headers?: AnySchemaObject;
 }
+/**
+ * How a call to an entrypoint is actually carried.
+ *
+ * The transport is chosen by the route's protocol, so a consumer always writes `ep.call(...)` and
+ * never learns whether that became an HTTP request, a socket message or a queued job. An
+ * application binds a protocol by registering a transport service under `transportAlias(protocol)`.
+ */
+export interface EntrypointTransport extends InitializedService {
+    readonly protocol: RouteProtocols;
+    handle: EntrypointHandler;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,KAAK,CAAA;AAC1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAE1C,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,KAAK,EAAE,gBAAgB,CAAA;IACvB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,QAAQ,EAAE,MAAM,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IACnC,SAAS,EAAE,MAAM,OAAO,CAAA;IACxB,OAAO,EAAE,CAAC,CAAC,SAAS,gBAAgB,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;IACrD,SAAS,EAAE,CAAC,CAAC,SAAS,gBAAgB,OAAO,CAAC,CAAA;IAC9C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,SAAS,EAAE,MAAM,MAAM,EAAE,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,uBAAwB,SAAQ,OAAO,CAAC,gBAAgB,CAAC;CAAI;AAE9E,MAAM,WAAW,eAAe;IAC9B,CAAC,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/F;AAED,MAAM,WAAW,iBAAiB;IAChC,CACE,CAAC,EAAE,CAAC,SAAS,eAAe,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EACxD,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,EACvD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9G;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;IACtD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,IAAI,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAGlB,OAAO,CAAC,EAAE,MAAM,CAAA;IAGhB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,GAAG,CAAA;IACtB,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACxD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IAEtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEzE,KAAK,EAAE,eAAe,CAAA;IACtB,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,IAAI,CAAC,EAAE,eAAe,CAAA;IACtB,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,OAAO,CAAC,EAAE,eAAe,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACzF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,KAAK,CAAA;AAC1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,KAAK,EAAE,UAAU,CAAA;IACjB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAA;IACf,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAE1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,MAAM,CAAA;IACrB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,MAAM,CAAA;IAClB,sEAAsE;IACtE,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,oBAAoB,CAAA;IACnC,OAAO,EAAE,MAAM,YAAY,CAAA;IAC3B,iEAAiE;IACjE,OAAO,EAAE,MAAM,OAAO,CAAA;IACtB,MAAM,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAA;IACrC,yEAAyE;IACzE,SAAS,EAAE,MAAM,MAAM,EAAE,CAAA;IACzB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,uBAAwB,SAAQ,OAAO,CAAC,gBAAgB,CAAC;CAAI;AAE9E,MAAM,WAAW,eAAe;IAC9B,CAAC,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/F;AAED,MAAM,WAAW,iBAAiB;IAChC,CACE,CAAC,EAAE,CAAC,SAAS,eAAe,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EACxD,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,EACvD,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,CAAC,SAAS,eAAe,EAAE,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9G;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;IACtD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,IAAI,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAGlB,OAAO,CAAC,EAAE,MAAM,CAAA;IAGhB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,GAAG,CAAA;IACtB,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACxD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IAEtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEzE,KAAK,EAAE,eAAe,CAAA;IACtB,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,IAAI,CAAC,EAAE,eAAe,CAAA;IACtB,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,OAAO,CAAC,EAAE,eAAe,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,MAAM,EAAE,iBAAiB,CAAA;CAC1B"}

package/build/utils/entrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoint.d.ts","sourceRoot":"","sources":["../../src/utils/entrypoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,GAAG,IAAI,gBACR,CAAA"}
+{"version":3,"file":"entrypoint.d.ts","sourceRoot":"","sources":["../../src/utils/entrypoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,GAAG,IAAI,gBAC5B,CAAA"}

package/build/utils/entrypoint.js

@@ -1,2 +1,2 @@
-export const isEntrypoint = (obj) => '_entrypoint' in obj || '_module' in obj;
+export const isEntrypoint = (obj) => '_entrypoint' in obj;
 //# sourceMappingURL=entrypoint.js.map

package/build/utils/entrypoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoint.js","sourceRoot":"","sources":["../../src/utils/entrypoint.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAA2B,EAAE,CACnE,aAAa,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG,CAAA"}
+{"version":3,"file":"entrypoint.js","sourceRoot":"","sources":["../../src/utils/entrypoint.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAA2B,EAAE,CACnE,aAAa,IAAI,GAAG,CAAA"}

package/build/utils/types.d.ts

@@ -1,6 +1,6 @@
-import { CommonRouteModel } from '@owlmeans/route';
+import { RouteModel } from '@owlmeans/route';
 import { CommonEntrypointOptions } from '../types.js';
 export interface CreateEntrypointSignature<M> {
-    (route: CommonRouteModel, opts?: CommonEntrypointOptions): M;
+    (route: RouteModel, opts?: CommonEntrypointOptions): M;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/utils/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,uBAAuB,GAAG,CAAC,CAAC;CAC9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,uBAAuB,GAAG,CAAC,CAAC;CACxD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/entrypoint",
-  "version": "0.1.18-rc.1",
+  "version": "0.1.18-rc.11",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -28,9 +28,9 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.1",
-    "@owlmeans/context": "^0.1.18-rc.1",
-    "@owlmeans/route": "^0.1.18-rc.1",
+    "@owlmeans/auth": "^0.1.18-rc.9",
+    "@owlmeans/context": "^0.1.18-rc.8",
+    "@owlmeans/route": "^0.1.18-rc.9",
     "ajv": "^8.17.1"
   },
   "devDependencies": {

package/src/consts.ts

@@ -5,3 +5,9 @@ export enum EntrypointOutcome {
   Created = 'created',
   Finished = 'finished'
 }
+
+/**
+ * Service alias a transport registers under. The default protocol is the web one, so an application
+ * that binds nothing keeps talking HTTP.
+ */
+export const transportAlias = (protocol: string = 'http') => `transport:${protocol}`

package/src/entrypoint.ts

@@ -1,83 +1,67 @@
 import type { CommonEntrypoint } from './types.js'
 import { appendContextual } from '@owlmeans/context'
+import {
+  isLocalRoute, resolveAddress, resolveMount, resolvePath, resolveService
+} from '@owlmeans/route/utils'
 import type { CreateEntrypointSignature } from './utils/types.js'
 
 export const entrypoint: CreateEntrypointSignature<CommonEntrypoint> = (route, opts) => {
-  let guards: string[] | null = null
-  let gates: [string, string[]][] | null = null
   const ep: CommonEntrypoint = appendContextual<CommonEntrypoint>(route.route.alias, {
     _entrypoint: true,
-    _module: true,
 
     sticky: false,
 
     route,
 
-    getAlias: () => ep.route.route.alias,
-    getPath: () => ep.route.route.path,
-    getParentAlias: () => ep.route.route.parent ?? null,
-    hasParent: () => ep.getParentAlias() != null,
+    segment: () => ep.route.route.path,
 
-    resolve: async <M extends CommonEntrypoint>() => {
-      if (ep.ctx == null) {
-        throw new SyntaxError(`Entrypoint has no context yet - ${ep.getAlias()}`)
-      }
+    path: () => resolvePath(ep.assertCtx(), ep.route.route),
 
-      await ep.route.resolve(ep.ctx)
+    mount: () => resolveMount(ep.assertCtx(), ep.route.route),
 
-      return ep as M
-    },
+    service: () => resolveService(ep.assertCtx(), ep.route.route),
 
-    getParent: () => {
-      const parentAlias = ep.getParentAlias()
-      if (parentAlias == null) {
-        throw new SyntaxError(`Entrypoint has no parent - ${ep.getAlias()}`)
-      }
-      if (ep.ctx == null) {
-        throw new SyntaxError(`Entrypoint has no context yet - ${ep.getAlias()}`)
-      }
+    address: () => resolveAddress(ep.assertCtx(), ep.route.route),
 
-      return ep.ctx.entrypoint(parentAlias)
-    },
+    isLocal: () => isLocalRoute(ep.assertCtx(), ep.route.route),
 
-    setService: service => {
-      if (ep.route.route.resolved) {
-        throw new SyntaxError(`Cannot update a resolved entrypoint - ${ep.getAlias()}`)
-      }
-      ep.route.route.service = service
-    },
+    parent: () => ep.route.route.parent == null ? null
+      : ep.assertCtx().entrypoint<CommonEntrypoint>(ep.route.route.parent),
 
+    // Walked afresh on every call: a guard attached to an ancestor after this entrypoint was first
+    // asked still has to count.
     getGuards: () => {
-      if (guards != null) {
-        return guards
-      }
-      guards = ep.guards ?? []
-
-      if (ep.hasParent()) {
-        guards.push(
-          ...ep.getParent().getGuards().filter(guard => !guards?.includes(guard))
-        )
+      const guards = [...ep.guards ?? []]
+      const parent = ep.parent()
+      if (parent != null) {
+        guards.push(...parent.getGuards().filter(guard => !guards.includes(guard)))
       }
 
       return guards
     },
 
+    /**
+     * The gates standing over this entrypoint: its own, then an ancestor's for each gate service
+     * this entrypoint has not already named.
+     *
+     * KNOWN HAZARD, deliberately left alone: the dedup is by gate SERVICE, and two gates under one
+     * service are two different questions because their parameters differ — so a child that
+     * declares its own gate silently drops its ancestor's, which is the opposite of what
+     * "inherited" means. Anything that needs a group rule AND a member rule must therefore not
+     * express the group half as a gate under the same service. Changing this would widen every
+     * backend and socket entrypoint that today relies on the replacement, so it is a migration
+     * rather than a fix.
+     */
     getGates: () => {
-      if (gates != null) {
-        return gates
-      }
-
-      gates = ep.gate != null ? [[
+      const gates: [string, string[]][] = ep.gate != null ? [[
         ep.gate, ep.gateParams == null
           ? [] : Array.isArray(ep.gateParams)
             ? ep.gateParams : [ep.gateParams]
       ]] : []
 
-      if (ep.hasParent()) {
-        gates.push(
-          ...ep.getParent().getGates()
-            .filter(([gate]) => !gates?.some(([g]) => g === gate))
-        )
+      const parent = ep.parent()
+      if (parent != null) {
+        gates.push(...parent.getGates().filter(([gate]) => !gates.some(([g]) => g === gate)))
       }
 
       return gates
@@ -88,19 +72,3 @@ export const entrypoint: CreateEntrypointSignature<CommonEntrypoint> = (route, o
 
   return ep
 }
-
-export const parent = <T extends CommonEntrypoint | CommonEntrypoint[]>(ep: T, aliasOrParent: string, _parent?: string): T => {
-  if (Array.isArray(ep)) {
-    if (_parent == null) {
-      throw SyntaxError('Elevating parent requires parent name to be specified')
-    }
-    ep = ep.find(e => e.route.route.alias === aliasOrParent) as T
-    if (ep == null) {
-      throw SyntaxError(`Entrypoint not found ${aliasOrParent}`)
-    }
-    return parent(ep, _parent)
-  }
-  ep.route.route.parent = aliasOrParent
-
-  return ep
-}

package/src/helper.ts

@@ -1,6 +1,4 @@
-import { route } from '@owlmeans/route'
-import { Filter, CommonEntrypointOptions, AbstractResponse, CommonEntrypoint } from './types.js'
-import { entrypoint } from './entrypoint.js'
+import { Filter, CommonEntrypointOptions, AbstractResponse } from './types.js'
 
 export const filter = (filter: Filter, opts?: CommonEntrypointOptions): CommonEntrypointOptions => ({ filter, ...opts })
 
@@ -26,12 +24,3 @@ export const provideResponse = <T>(originalResponse?: unknown): AbstractResponse
 
   return handler
 }
-
-export const clone = <M extends CommonEntrypoint>(entrypoints: M[], from: string, to: string, service: string) => {
-  const source = entrypoints.find(e => e.alias === from)
-
-  if (source?.route.route != null) {
-    const _route = { ...source.route.route, service, resolved: false, alias: to }
-    entrypoints.push(entrypoint(route(to, _route.path, _route)) as M)
-  }
-}

package/src/types.ts

@@ -1,29 +1,44 @@
-import type { CommonRouteModel } from '@owlmeans/route'
+import type { ResolvedServiceRoute, RouteAddress, RouteModel, RouteProtocols } from '@owlmeans/route'
 import type { InitializedService, LazyService, BasicEntrypoint } from '@owlmeans/context'
 import type { AnySchemaObject } from 'ajv'
 import type { EntrypointOutcome } from './consts.js'
 import type { Auth } from '@owlmeans/auth'
 
+/**
+ * A URL unit: an immutable route declaration plus what guards, gates and schemas it answers under.
+ *
+ * Nothing here is rewritten once declared. Every address question — segment, path, mount, service,
+ * host — is a question about the declaration asked against the context the entrypoint is registered
+ * in, so the same declaration answers differently in a client and in a server without being touched.
+ */
 export interface CommonEntrypoint extends BasicEntrypoint {
-  route: CommonRouteModel
+  route: RouteModel
   /**
    * @property {boolean} - if true — router attaches this entrypoint unconditionally
    * @default false
    */
   sticky: boolean
-  filter?: Filter
+  /** The guards declared on this entrypoint alone — see `getGuards()` for the inherited set. */
   guards?: string[]
   gate?: string
   gateParams?: string | string[]
+  filter?: Filter
   handle?: EntrypointHandler
-  getAlias: () => string
-  getPath: () => string
-  getParentAlias: () => string | null
-  hasParent: () => boolean
-  resolve: <M extends CommonEntrypoint>() => Promise<M>
-  getParent: <M extends CommonEntrypoint>() => M
-  setService: (service: string) => void
+
+  /** The segment this entrypoint contributes under its parent. */
+  segment: () => string
+  /** Every ancestor's segment, then this one. */
+  path: () => string
+  /** `base` + `path()` — what a server mounts and a client requests. */
+  mount: () => string
+  service: () => ResolvedServiceRoute
+  address: () => RouteAddress
+  /** Does this entrypoint belong to the service its context IS? */
+  isLocal: () => boolean
+  parent: () => CommonEntrypoint | null
+  /** Own guards and every ancestor's, deduped. Recomputed on each call. */
   getGuards: () => string[]
+  /** Own gate and every ancestor's, as `[gate, params]`. Recomputed on each call. */
   getGates: () => [string, string[]][]
 }
 
@@ -47,6 +62,17 @@ export interface EntrypointAssert {
 export interface AbstractRequest<T extends {} = {}> {
   alias: string
   auth?: Auth
+  /**
+   * The organization entity this request acts for, resolved from `auth.entitySlug` once, at the
+   * server boundary.
+   *
+   * The slug on the token is renameable and therefore unusable as a key; `entity.id` is the stable
+   * value that records, grants and minted infrastructure names are keyed by. Resolving it here —
+   * rather than in each handler — is what keeps a rename from meaning a sweep of every call site,
+   * and it is absent whenever no resolver is registered (an implementation that has no notion of
+   * an organization store), so consumers must handle that rather than assume it.
+   */
+  entity?: ResolvedEntity
   params: Record<string, string | number | undefined | null> | Partial<T>
   body?: Record<string, any> | Partial<T>
   headers: Record<string, string[] | string | undefined>
@@ -66,6 +92,21 @@ export interface AbstractRequest<T extends {} = {}> {
   signal?: AbortSignal
 }
 
+/**
+ * An organization entity as request handlers see it: the stable id to key by, the current slug to
+ * compose user-facing names from, and the frozen key that external systems already know it under.
+ */
+export interface ResolvedEntity {
+  id: string
+  slug: string
+  /**
+   * The identifier this organization is known by in systems whose names cannot be rewritten —
+   * an IAM realm, an object-storage prefix, a cluster object. Minted once and never recomputed,
+   * so it stays valid across every later rename.
+   */
+  iamKey: string
+}
+
 export interface AbstractResponse<T> {
   responseProvider?: any
   value?: T,
@@ -98,3 +139,15 @@ export interface Filter {
   response?: AnySchemaObject
   headers?: AnySchemaObject
 }
+
+/**
+ * How a call to an entrypoint is actually carried.
+ *
+ * The transport is chosen by the route's protocol, so a consumer always writes `ep.call(...)` and
+ * never learns whether that became an HTTP request, a socket message or a queued job. An
+ * application binds a protocol by registering a transport service under `transportAlias(protocol)`.
+ */
+export interface EntrypointTransport extends InitializedService {
+  readonly protocol: RouteProtocols
+  handle: EntrypointHandler
+}

package/src/utils/entrypoint.ts

@@ -1,4 +1,4 @@
 import { CommonEntrypoint } from '../types.js'
 
 export const isEntrypoint = (obj: object): obj is CommonEntrypoint =>
-  '_entrypoint' in obj || '_module' in obj
+  '_entrypoint' in obj

package/src/utils/types.ts

@@ -1,6 +1,6 @@
-import { CommonRouteModel } from '@owlmeans/route'
+import { RouteModel } from '@owlmeans/route'
 import { CommonEntrypointOptions } from '../types.js'
 
 export interface CreateEntrypointSignature<M> {
-  (route: CommonRouteModel, opts?: CommonEntrypointOptions): M,
+  (route: RouteModel, opts?: CommonEntrypointOptions): M,
 }