@owlmeans/oidc 0.1.18-rc.15 → 0.1.18-rc.24

package/README.md

@@ -4,7 +4,7 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and entrypoint
 
 ## Overview
 
-- `OIDC_GATE` — gate alias to compose with `gate(...)` inside `guard(...)` declarations
+- `OIDC_GATE` — gate alias to put in a protocol's `gate` option
 - `OIDC_GUARD`, `WRAPPED_OIDC`, `OIDC_FLOW`, `OIDC_AUTHEN_MODULE`, `OIDC_WRAPPED_TOKEN` — shared aliases
 - `OidcGuard`, `WithSharedConfig`, `OidcProviderConfig` — shared types
 - Entrypoint declarations for the OIDC dispatcher (`/authenticate/oidc/init`, `/authenticate/oidc/process`)
@@ -12,22 +12,23 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and entrypoint
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc@^0.1.18-rc.12
+bun add @owlmeans/oidc@^0.1.18-rc.24
 ```
 
 ## Usage
 
-Compose `OIDC_GATE` into a guard on an entrypoint:
+Compose `OIDC_GATE` into a protocol declaration:
 
 ```typescript
-import { entrypoint, guard, gate } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 
-entrypoint(
+protocol(
   route(manager.back.account.base, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: OIDC_GATE, params: [`my-service-account-{entity}`] } },
 )
 ```
 
@@ -92,7 +93,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.14
+npx @owlmeans/agent-skills@^0.1.18-rc.15
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.15",
-  "generatedAt": "2026-09-10T23:12:07.511Z",
+  "version": "0.1.18-rc.24",
+  "generatedAt": "2026-09-12T08:39:52.725Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oidc
-description: How to use @owlmeans/oidc — the OIDC names both sides share — the OIDC_GATE alias, the guard, the requested-scope contract, provider descriptors, the dispatcher entrypoints and the error query params. Auto-invoked when importing OIDC types or constants, wiring OIDC into a guard(), or declaring an identity provider in configuration.
+description: How to use @owlmeans/oidc — the OIDC names both sides share — the OIDC_GATE alias, the guard, the requested-scope contract, provider descriptors, the dispatcher entrypoints and the error query params. Auto-invoked when importing OIDC types or constants, wiring OIDC into a protocol gate, or declaring an identity provider in configuration.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.15"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.24"` in `dependencies`
 
 The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
 guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party
@@ -18,12 +18,12 @@ guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser re
 
 | Export | Description |
 |--------|-------------|
-| `OIDC_GATE` | Gate alias to pass to `gate(...)` inside `guard(...)` |
+| `OIDC_GATE` | Gate alias to pass in a protocol's `gate` option |
 | `OIDC_GUARD` | The guard's alias |
 | `OIDC_GUARD_CACHE` | A resource-alias constant nothing reads — the guard has no cache lookup, so registering a resource under it changes no behaviour |
 | `makeOidcGuard(opts?)` / `appendOidcGuard(context, opts?)` | The wrapped-token guard, and its registration. The target-specific packages wrap these |
-| `setupOidcGuard(entrypoints, coguards?)` | Appends the two dispatcher entrypoints and prepends `OIDC_GUARD` to every entrypoint already guarded by a coguard (default `DEFAULT_GUARD`) |
-| `entrypoints` | Those two declarations: `DISPATCHER_OIDC_INIT` (`POST /authenticate/oidc/init`) and `DISPATCHER_OIDC` (`POST /authenticate/oidc/process`) |
+| `withOidcGuard(protocolTree, coguards?)` | Returns a decorated immutable protocol tree, prepending `OIDC_GUARD` to selected guarded declarations (default `DEFAULT_GUARD`) |
+| `oidcProtocols` | Shared dispatcher declarations: `DISPATCHER_OIDC_INIT` (`POST /authenticate/oidc/init`) and `DISPATCHER_OIDC` (`POST /authenticate/oidc/process`) |
 | `DISPATCHER_OIDC_INIT`, `DISPATCHER_OIDC` | Their aliases |
 | `OIDC_WRAPPED_TOKEN`, `WRAPPED_OIDC` | The authorization-header scheme for an OIDC-wrapped token, and the service alias that refreshes one |
 | `OIDC_CLIENT_AUTH`, `GOOGLE_CLIENT_AUTH` | Authentication plugin types — the generic OIDC one and the Google one |
@@ -47,14 +47,15 @@ guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser re
 ## Usage
 
 ```typescript
-import { entrypoint, guard, gate } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 
-entrypoint(
+protocol(
   route(accountAlias, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, ['my-service-account--read']))
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: OIDC_GATE, params: ['my-service-account--read'] } },
 )
 ```
 

package/build/entrypoints.d.ts

@@ -1,2 +1,10 @@
-export declare const entrypoints: import("@owlmeans/entrypoint").CommonEntrypoint[];
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export declare const oidcProtocols: {
+    init: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OIDCAuthInitParams;
+    }, any>;
+    authenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OIDCClientAuthPayload;
+    }, any>;
+};
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,WAAW,mDAUvB,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAKA,oFAAoF;AACpF,eAAO,MAAM,aAAa;IACxB,IAAI;;;IAIJ,YAAY;;;CAIb,CAAA"}

package/build/entrypoints.js

@@ -1,9 +1,10 @@
-import { body, filter, entrypoint } from '@owlmeans/entrypoint';
+import { contract, protocol, typed } from '@owlmeans/entrypoint';
 import { route, RouteMethod, backend } from '@owlmeans/route';
 import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js';
 import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js';
-export const entrypoints = [
-    entrypoint(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), filter(body(OIDCAuthInitParamsSchema))),
-    entrypoint(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), filter(body(OIDCClientAuthPayloadSchema)))
-];
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export const oidcProtocols = {
+    init: protocol(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCAuthInitParamsSchema) }, typed())),
+    authenticate: protocol(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed())),
+};
 //# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEnF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU,CACR,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAEvC;IACD,UAAU,CACR,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAC1C;CACF,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEnF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,QAAQ,CACZ,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC1E;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC7E;CACF,CAAA"}

package/build/guard.d.ts

@@ -1,6 +1,13 @@
 import type { Config, Context, OidcGuard, OidcGuardOptions } from './types.js';
-import type { CommonEntrypoint } from '@owlmeans/entrypoint';
+import type { EntrypointTree } from '@owlmeans/entrypoint';
 export declare const makeOidcGuard: (opts?: OidcGuardOptions) => OidcGuard;
 export declare const appendOidcGuard: <C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions) => T;
-export declare const setupOidcGuard: (entrypoints: CommonEntrypoint[], coguards?: string | string[]) => void;
+/**
+ * Decorate an immutable protocol tree so the OIDC guard runs before each selected auth guard.
+ *
+ * The tree's shape and protocol types are preserved; only declarations that explicitly carry a
+ * selected guard are cloned. Parent inheritance then carries OIDC to their children exactly as
+ * the route model does for every other guard.
+ */
+export declare const withOidcGuard: <Tree extends EntrypointTree>(tree: Tree, coguards?: string | readonly string[]) => Tree;
 //# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAElG,OAAO,KAAK,EAAqC,gBAAgB,EAAgB,MAAM,sBAAsB,CAAA;AAS7G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SA4FvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,gBAAiB,gBAAgB,EAAE,aAAa,MAAM,GAAG,MAAM,EAAE,SAU3F,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAGlG,OAAO,KAAK,EAAqC,cAAc,EAAgB,MAAM,sBAAsB,CAAA;AAQ3G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SA4FvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,SAAS,cAAc,QACjD,IAAI,aAAa,MAAM,GAAG,SAAS,MAAM,EAAE,KAChD,IAcF,CAAA"}

package/build/guard.js

@@ -1,12 +1,12 @@
 import { createService } from '@owlmeans/context';
 import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js';
+import { decorateEntrypoint, isEntrypointProtocol } from '@owlmeans/entrypoint';
 import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common';
 import { AUTH_HEADER, AuthorizationError } from '@owlmeans/auth';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { trust } from '@owlmeans/auth-common/utils';
 import { TRUSTED } from '@owlmeans/config';
 import { extractAuthToken } from '@owlmeans/auth-common/utils';
-import { entrypoints as oidcEntrypoints } from './entrypoints.js';
 export const makeOidcGuard = (opts) => {
     // const cache = (context: Context) => context.hasResource(opts?.cache ?? OIDC_GUARD_CACHE)
     //   ? context.resource<Resource<ResourceRecord>>(opts?.cache ?? OIDC_GUARD_CACHE)
@@ -86,15 +86,24 @@ export const appendOidcGuard = (context, opts) => {
     context.registerService(makeOidcGuard(opts));
     return context;
 };
-export const setupOidcGuard = (entrypoints, coguards) => {
-    entrypoints.push(...oidcEntrypoints);
-    coguards = Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD];
-    entrypoints.forEach(module => {
-        if (module.guards != null && !module.guards.includes(OIDC_GUARD)
-            && module.guards.some(guard => coguards.includes(guard))) {
-            module.guards.unshift(OIDC_GUARD);
+/**
+ * Decorate an immutable protocol tree so the OIDC guard runs before each selected auth guard.
+ *
+ * The tree's shape and protocol types are preserved; only declarations that explicitly carry a
+ * selected guard are cloned. Parent inheritance then carries OIDC to their children exactly as
+ * the route model does for every other guard.
+ */
+export const withOidcGuard = (tree, coguards) => {
+    const selected = new Set(Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD]);
+    const decorate = (node) => Object.fromEntries(Object.entries(node).map(([key, value]) => {
+        if (!isEntrypointProtocol(value))
+            return [key, decorate(value)];
+        if (value.guards.includes(OIDC_GUARD) || !value.guards.some(guard => selected.has(guard))) {
+            return [key, value];
         }
-    });
+        return [key, decorateEntrypoint(value, { guards: [OIDC_GUARD, ...value.guards] })];
+    }));
+    return decorate(tree);
 };
 const wrapper = (context) => context.hasService(WRAPPED_OIDC)
     ? context.service(WRAPPED_OIDC)

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAA+B,EAAE,QAA4B,EAAE,EAAE;IAC9F,WAAW,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAA;IACpC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAA;IAE3E,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAC3B,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;eAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAU,EAAE,QAAqC,EAC3C,EAAE;IACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,CAAC,IAAoB,EAAkB,EAAE,CAAC,MAAM,CAAC,WAAW,CAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC,CAAC,CACH,CAAA;IAED,OAAO,QAAQ,CAAC,IAAI,CAAS,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}

package/build/index.d.ts

@@ -4,5 +4,4 @@ export * from './guard.js';
 export * from './entrypoints.js';
 export * from './models.js';
 export type * from './iam.js';
-export * from './advertise.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,mBAAmB,UAAU,CAAA;AAC7B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,mBAAmB,UAAU,CAAA"}

package/build/index.js

@@ -2,5 +2,4 @@ export * from './consts.js';
 export * from './guard.js';
 export * from './entrypoints.js';
 export * from './models.js';
-export * from './advertise.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAE3B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.18-rc.15",
+  "version": "0.1.18-rc.24",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,15 +21,14 @@
     }
   },
   "dependencies": {
-    "@owlmeans/api-config": "^0.1.18-rc.14",
-    "@owlmeans/auth": "^0.1.18-rc.11",
-    "@owlmeans/auth-common": "^0.1.18-rc.15",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.14",
-    "@owlmeans/config": "^0.1.18-rc.14",
-    "@owlmeans/context": "^0.1.18-rc.10",
-    "@owlmeans/entrypoint": "^0.1.18-rc.13",
-    "@owlmeans/resource": "^0.1.18-rc.11",
-    "@owlmeans/route": "^0.1.18-rc.11"
+    "@owlmeans/auth": "^0.1.18-rc.12",
+    "@owlmeans/auth-common": "^0.1.18-rc.16",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.15",
+    "@owlmeans/config": "^0.1.18-rc.15",
+    "@owlmeans/context": "^0.1.18-rc.11",
+    "@owlmeans/entrypoint": "^0.1.18-rc.14",
+    "@owlmeans/resource": "^0.1.18-rc.12",
+    "@owlmeans/route": "^0.1.18-rc.12"
   },
   "peerDependencies": {
     "ajv": "*"

package/src/entrypoints.ts

@@ -1,16 +1,16 @@
-import { body, filter, entrypoint } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route, RouteMethod, backend } from '@owlmeans/route'
 import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js'
 import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js'
 
-export const entrypoints = [
-  entrypoint(
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export const oidcProtocols = {
+  init: protocol(
     route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)),
-    filter(body(OIDCAuthInitParamsSchema))
-
+    contract.request({ body: typed(OIDCAuthInitParamsSchema) }, typed<any>()),
   ),
-  entrypoint(
+  authenticate: protocol(
     route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)),
-    filter(body(OIDCClientAuthPayloadSchema))
-  )
-]
+    contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed<any>()),
+  ),
+}

package/src/guard.ts

@@ -1,14 +1,14 @@
 import { createService } from '@owlmeans/context'
 import type { Config, Context, OidcGuard, OidcGuardOptions, WrappedOIDCService } from './types.js'
 import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js'
-import type { AbstractRequest, AbstractResponse, CommonEntrypoint, GuardService } from '@owlmeans/entrypoint'
+import { decorateEntrypoint, isEntrypointProtocol } from '@owlmeans/entrypoint'
+import type { AbstractRequest, AbstractResponse, EntrypointTree, GuardService } from '@owlmeans/entrypoint'
 import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common'
 import { AUTH_HEADER, type Auth, AuthToken, AuthorizationError } from '@owlmeans/auth'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import { trust } from '@owlmeans/auth-common/utils'
 import { TRUSTED } from '@owlmeans/config'
 import { extractAuthToken } from '@owlmeans/auth-common/utils'
-import { entrypoints as oidcEntrypoints } from './entrypoints.js'
 
 export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
   // const cache = (context: Context) => context.hasResource(opts?.cache ?? OIDC_GUARD_CACHE)
@@ -112,16 +112,29 @@ export const appendOidcGuard = <C extends Config, T extends Context<C>>(
   return context
 }
 
-export const setupOidcGuard = (entrypoints: CommonEntrypoint[], coguards?: string | string[]) => {
-  entrypoints.push(...oidcEntrypoints)
-  coguards = Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD]
+/**
+ * Decorate an immutable protocol tree so the OIDC guard runs before each selected auth guard.
+ *
+ * The tree's shape and protocol types are preserved; only declarations that explicitly carry a
+ * selected guard are cloned. Parent inheritance then carries OIDC to their children exactly as
+ * the route model does for every other guard.
+ */
+export const withOidcGuard = <Tree extends EntrypointTree>(
+  tree: Tree, coguards?: string | readonly string[],
+): Tree => {
+  const selected = new Set(Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD])
+  const decorate = (node: EntrypointTree): EntrypointTree => Object.fromEntries(
+    Object.entries(node).map(([key, value]) => {
+      if (!isEntrypointProtocol(value)) return [key, decorate(value)]
+      if (value.guards.includes(OIDC_GUARD) || !value.guards.some(guard => selected.has(guard))) {
+        return [key, value]
+      }
 
-  entrypoints.forEach(module => {
-    if (module.guards != null && !module.guards.includes(OIDC_GUARD)
-      && module.guards.some(guard => coguards.includes(guard))) {
-      module.guards.unshift(OIDC_GUARD)
-    }
-  })
+      return [key, decorateEntrypoint(value, { guards: [OIDC_GUARD, ...value.guards] })]
+    }),
+  )
+
+  return decorate(tree) as Tree
 }
 
 const wrapper = (context: Context): WrappedOIDCService =>

package/src/index.ts

@@ -4,4 +4,3 @@ export * from './guard.js'
 export * from './entrypoints.js'
 export * from './models.js'
 export type * from './iam.js'
-export * from './advertise.js'

package/build/advertise.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=advertise.d.ts.map

package/build/advertise.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"advertise.d.ts","sourceRoot":"","sources":["../src/advertise.ts"],"names":[],"mappings":""}

package/build/advertise.js

@@ -1,28 +0,0 @@
-import { apiConfigPlugin, every } from '@owlmeans/api-config';
-apiConfigPlugin({
-    allow: {
-        oidc: {
-            clientCookie: true,
-            restrictedProviders: true,
-            providers: every({
-                entityId: true,
-                service: true,
-                discoveryUrl: true,
-                basePath: true,
-                clientId: true,
-                redirectUri: true,
-                extraScopes: true,
-                authEndpoint: true,
-                tokenEndpoint: true,
-                userinfoEndpoint: true,
-                idOverride: true,
-                def: true,
-                label: true,
-                icon: true,
-                order: true,
-                hidden: true,
-            }, value => value != null && typeof value === 'object' && value.internal !== true),
-        },
-    },
-});
-//# sourceMappingURL=advertise.js.map

package/build/advertise.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"advertise.js","sourceRoot":"","sources":["../src/advertise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE7D,eAAe,CAAC;IACd,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,IAAI;YACzB,SAAS,EAAE,KAAK,CAAC;gBACf,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,IAAI;gBAClB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE,IAAI;gBACnB,gBAAgB,EAAE,IAAI;gBACtB,UAAU,EAAE,IAAI;gBAChB,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;aACb,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAgC,CAAC,QAAQ,KAAK,IAAI,CAAC;SAC/G;KACF;CACF,CAAC,CAAA"}

package/src/advertise.ts

@@ -1,28 +0,0 @@
-import { apiConfigPlugin, every } from '@owlmeans/api-config'
-
-apiConfigPlugin({
-  allow: {
-    oidc: {
-      clientCookie: true,
-      restrictedProviders: true,
-      providers: every({
-        entityId: true,
-        service: true,
-        discoveryUrl: true,
-        basePath: true,
-        clientId: true,
-        redirectUri: true,
-        extraScopes: true,
-        authEndpoint: true,
-        tokenEndpoint: true,
-        userinfoEndpoint: true,
-        idOverride: true,
-        def: true,
-        label: true,
-        icon: true,
-        order: true,
-        hidden: true,
-      }, value => value != null && typeof value === 'object' && (value as { internal?: boolean }).internal !== true),
-    },
-  },
-})