@owlmeans/oidc 0.1.18-rc.5 → 0.1.18-rc.51

package/README.md

@@ -1,33 +1,34 @@
 # @owlmeans/oidc
 
-Shared OIDC protocol abstractions — guard/gate aliases, models, and module declarations used by both server and browser OIDC packages.
+Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable protocol declarations used by both server and browser OIDC packages.
 
 ## Overview
 
-- `OIDC_GATE` — gate alias to compose with `gate(...)` inside `guard(...)` declarations
+- `OIDC_GATE` — gate alias to put in a protocol's `gate` option
 - `OIDC_GUARD`, `WRAPPED_OIDC`, `OIDC_FLOW`, `OIDC_AUTHEN_MODULE`, `OIDC_WRAPPED_TOKEN` — shared aliases
 - `OidcGuard`, `WithSharedConfig`, `OidcProviderConfig` — shared types
-- Module declarations for the OIDC dispatcher (`/authenticate/oidc/init`, `/authenticate/oidc/process`)
+- Entrypoint declarations for the OIDC dispatcher (`/authenticate/oidc/init`, `/authenticate/oidc/process`)
 
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc
+bun add @owlmeans/oidc@^0.1.18-rc.51
 ```
 
 ## Usage
 
-Compose `OIDC_GATE` into a guard on a module:
+Compose `OIDC_GATE` into a protocol declaration:
 
 ```typescript
-import { module, guard, gate } from '@owlmeans/module'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 
-module(
+protocol(
   route(manager.back.account.base, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: OIDC_GATE, params: [`my-service-account-{entity}`] } },
 )
 ```
 
@@ -56,7 +57,7 @@ import { OIDC_GUARD } from '@owlmeans/oidc'
 - `WRAPPED_OIDC` — `'wrapped-oidc-authz'`
 - `OIDC_AUTHEN_MODULE` — `'iam-oidc-authen'`
 - `OIDC_WRAPPED_TOKEN` — `'oidc-wrapped-token'`
-- `DISPATCHER_OIDC`, `DISPATCHER_OIDC_INIT` — auth dispatcher module aliases
+- `DISPATCHER_OIDC`, `DISPATCHER_OIDC_INIT` — auth dispatcher entrypoint aliases
 - `INTERACTION`, `INTERACTION_PATH` — interaction route aliases
 - `OIDC_GUARD_CACHE` — guard cache resource alias
 
@@ -73,9 +74,11 @@ import { OIDC_GUARD } from '@owlmeans/oidc'
 - `GOOGLE_CLIENT_AUTH` identifies the browser Google auth plugin registered by `@owlmeans/web-oidc-rp/auth/plugins`.
 - `OIDC_GATE` is for OIDC-backed authorization. Apps that only use Google/OIDC for login and authorize against local identity records should define their own product gate alias.
 
-### `modules`
+### `oidcProtocols`
 
-Array of dispatcher module declarations: `POST /authenticate/oidc/init` and `POST /authenticate/oidc/process`.
+Immutable dispatcher declaration tree: `POST /authenticate/oidc/init` and
+`POST /authenticate/oidc/process`. The relying-party packages bind these exact protocol objects
+locally; do not recreate them or consume an alias-addressed compatibility list.
 
 ## Related Packages
 
@@ -92,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.45
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.507Z",
+  "version": "0.1.18-rc.51",
+  "generatedAt": "2026-10-01T23:27:48.732Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oidc
-description: How to use @owlmeans/oidc — shared OIDC protocol abstractions including OIDC_GATE constant used in module gate() declarations. Auto-invoked when importing OIDC types/constants or wiring OIDC into a guard().
+description: How to use @owlmeans/oidc — the OIDC names both sides share — the OIDC_GATE alias, the guard, the requested-scope contract, provider descriptors, the dispatcher entrypoints, the organizations scope and switch protocols, and the error query params. Auto-invoked when importing OIDC types or constants, wiring OIDC into a protocol gate, or declaring an identity provider in configuration.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,60 +8,134 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.51"` in `dependencies`
+
+The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
+guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party
+(`@owlmeans/web-oidc-rp`) and the embedded provider (`@owlmeans/server-oidc-provider`) must agree on.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `OIDC_GATE` | Gate alias to pass to `gate(...)` inside `guard(...)` |
-| `GOOGLE_CLIENT_AUTH` | Client auth plugin type for Google OAuth |
-| `GOOGLE_SERVICE` | Provider service key for Google (`'google'`) |
+| `OIDC_GATE` | Gate alias to pass in a protocol's `gate` option |
+| `OIDC_GUARD` | The guard's alias |
+| `OIDC_GUARD_CACHE` | A resource-alias constant nothing reads — the guard has no cache lookup, so registering a resource under it changes no behaviour |
+| `makeOidcGuard(opts?)` / `appendOidcGuard(context, opts?)` | The wrapped-token guard, and its registration. The target-specific packages wrap these |
+| `withOidcGuard(protocolTree, coguards?)` | Returns a decorated immutable protocol tree, prepending `OIDC_GUARD` to selected guarded declarations (default `DEFAULT_GUARD`) |
+| `oidcProtocols` | Shared declarations: the sign-in pair `init` (`POST /authenticate/oidc/init`) and `authenticate` (`POST /authenticate/oidc/process`), and the organization switch `organizations` (`GET /authenticate/oidc/organizations`) and `organization` (`POST /authenticate/oidc/organization`, body `{ entitySlug }`), both guarded by `OIDC_GUARD` |
+| `DISPATCHER_OIDC_INIT`, `DISPATCHER_OIDC`, `DISPATCHER_OIDC_ORGANIZATIONS`, `DISPATCHER_OIDC_ORGANIZATION` | Their aliases |
+| `OIDC_WRAPPED_TOKEN`, `WRAPPED_OIDC` | The authorization-header scheme for an OIDC-wrapped token, and the service alias that refreshes one |
+| `OIDC_CLIENT_AUTH`, `GOOGLE_CLIENT_AUTH` | Authentication plugin types — the generic OIDC one and the Google one |
+| `GOOGLE_SERVICE` | Provider service value for Google (`'google'`) |
 | `OIDC_RP_BASE_SCOPES` / `OIDC_RP_BASE_SCOPE` | The scopes every OwlMeans RP requests, as array / space-delimited string |
-| `EMAIL_SCOPE`, `PERMISSIONS_SCOPE`, `PERMISSIONS_CLAIM` | Standard email scope; the integrated-IAM grant scope and its claim |
-| `OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY` | Redirect-URI params an authorization server sets on failure |
-| `INTERACTION`, `INTERACTION_PATH`, `INTERACTION_UID` | Interaction screen entrypoint alias, path, and its uid path param |
-| `OidcProviderDescriptor` | Shared provider config shape, including service, endpoints, redirect URI, and optional default flag |
-| `OidcGuard` types | Guard payload shapes |
-| Modules | Shared OIDC module declarations |
-| Models | Token/profile shapes |
+| `EMAIL_SCOPE`, `PERMISSIONS_SCOPE`, `PERMISSIONS_CLAIM` | The standard email scope; the integrated-IAM grant scope and the claim it produces |
+| `ORGANIZATIONS_SCOPE`, `ORGANIZATIONS_CLAIM` | `'organizations'` — the tenanted-client scope and the claim carrying `OidcOrganizationClaim[]` |
+| `ORGANIZATION_REFUSAL`, `ORGANIZATION_OWNER_REFUSAL` | `AuthForbidden` reasons: not one of the subject's organizations; the action needs its owner |
+| `IAM_API_METADATA` | `'owlmeans_iam_api'` — the discovery-document field naming the provider's runtime IAM API |
+| `OIDC_CODE_QUERY`, `OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY` | Redirect-URI params an authorization server sets on success and on failure |
+| `INTERACTION`, `INTERACTION_PATH`, `INTERACTION_UID` | Interaction screen alias, path, and the uid path param the path must declare |
+| `PROVIDER_INTERACTION`, `OIDC_AUTHEN_MODULE`, `OIDC_FLOW` | The provider-side interaction alias, the IAM authentication entrypoint alias, and the flow name |
+| `DEFAULT_PATH`, `DEFAULT_FRONT` | `'oidc'` and `'oidc-client'` — the provider's default base path and the default front service alias |
+| `OidcProviderDescriptor` | One identity provider as configuration: `clientId`, `secret?`, `discoveryUrl?`, `service?`/`basePath?`, `redirectUri?`, `extraScopes?`, `entityId?`, `idOverride?`, the three endpoint overrides `authEndpoint?`/`tokenEndpoint?`/`userinfoEndpoint?`, plus the presentation fields below |
+| `OidcProviderConfig` | A descriptor plus `internal?` (machine use only) and `apiClientId?` (the admin client) |
+| `OidcSharedConfig` / `WithSharedConfig` | `cfg.oidc`: `providers`, `restrictedProviders`, `clientCookie.interaction` |
+| `OidcIamConfig` | `{ iamMode?: 'keycloak' \| 'integrated' }` — the IAM-mode seam, kept here to avoid a cycle with `@owlmeans/iam` |
+| `OidcGuard`, `OidcGuardOptions` | The guard service type, and `{ coguards, cache?, tokenService? }` — only `coguards` (its **first** entry, default `DEFAULT_GUARD`) and `tokenService` are read; `cache` is declared and never used |
+| `OIDCAuthInitParams`, `OIDCClientAuthPayload`, `OIDCTokenUpdate`, `CommonTokenSetParams` | The dispatcher wire shapes; init's `entitySlug?` is the organization the person asks to act in |
+| `OIDCAuthInitParamsSchema`, `OIDCClientAuthPayloadSchema`, `OIDCTokenUpdateSchema`, `ProviderProfileDetailsSchema`, `OidcOrganizationSwitchSchema` | Their AJV schemas — closed: the server's AJV strips an undeclared field silently, so every field a caller sends is declared |
+| `OidcOrganizationClaim` | `{ entitySlug, entityKey, title?, owner, groups?, home? }` — one organization of the subject as the provider claims it; `entityKey` is the frozen IAM key and never leaves a server |
+| `OidcPermissionSetClaim` | `PermissionSet` + `entitySlug?` — a set bound to that organization |
+| `OidcOrganizationItem`, `OidcOrganizationList`, `OidcOrganizationSwitch` | The switch's wire shapes: `{ entitySlug, title?, owner, groups?, home?, acting }` items (no key), the `{ items }` list, the `{ entitySlug }` body |
+| `WrappedOIDCUpdate` | `AuthToken` + `entity?: ResolvedEntity` — what `WrappedOIDCService.update` answers |
+| `ProviderProfileDetails`, `OidcUserDetails`, `OidcProviderSettings` | What an identity provider reports about a subject |
+| `WrappedOIDCService` | The `AuthorizationService` that keeps a wrapped token fresh; `update` answers a `WrappedOIDCUpdate` |
 
 ## Usage
 
 ```typescript
-import { entrypoint, guard, gate } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 
-entrypoint(
-  route(manager.back.account.base, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
+protocol(
+  route(accountAlias, '/account'),
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: OIDC_GATE, params: ['my-service-account--read'] } },
 )
 ```
 
-The actual OIDC verification happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp` (browser). The `oidc` package gives both sides a shared name to refer to.
+The verification itself happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp`
+(browser); this package gives both sides one name to refer to. `OIDC_GATE` is for OIDC/UMA-style
+authorization. A product that authenticates over OIDC but authorizes against its own identity
+resources declares its own gate alias instead.
 
 ## Scope names are a cross-package contract
 
 `OIDC_RP_BASE_SCOPES` is the one definition of what an OwlMeans relying party asks an authorization
-server for. Two sides must agree on it and both read it from here:
+server for, and two sides read it from here:
 
 - the **RP** builds its request from it (`requestedScope()` in `@owlmeans/server-oidc-rp`);
 - whoever **registers the client** must allow at least these scopes — an authorization server
-  rejects the entire request with `invalid_scope` when a requested scope is one it supports but
-  the client is not allowed to use (see `@owlmeans/iam-integrated`'s `INTEGRATED_CLIENT_SCOPES`).
+  rejects the entire request with `invalid_scope` when a requested scope is one it supports but the
+  client is not allowed to use.
 
-Never hardcode a scope string on either side; adding one to `OIDC_RP_BASE_SCOPES` must widen every
+Never hardcode a scope string on either side. Adding one to `OIDC_RP_BASE_SCOPES` must widen every
 client allowlist derived from it in the same change.
 
-## Product-Viable Usage Notes
+## Organizations of a tenanted client
+
+A client that asks for `ORGANIZATIONS_SCOPE` gets two claims from the integrated provider: the
+`organizations` claim (`OidcOrganizationClaim[]`) and the FULL `permissions` claim, in which a set
+bound to an organization carries `entitySlug`. A client that never asks gets the flattened claim of
+the one organization it acts in and no `organizations` claim — so the scope is what turns tenancy
+on, and an old client is untouched by it.
+
+Only the relying party's server sees the claims. The browser token carries the acting
+organization's `entitySlug`, `groups` and its sets with the binding stripped; `entityKey` and the
+bound sets of other organizations never leave the server (`@owlmeans/server-oidc-rp`).
+
+The guard attaches `updated.entity` to the request whenever the wrapping service answers one. A
+relying party of a tenanted client has no organization registry of its own, so this is the only
+way `req.entity` gets set there; `attachEntity` (`@owlmeans/auth-common`) keeps it only while its
+`slug` is exactly the token's.
+
+The switch is two protocols guarded by `OIDC_GUARD` alone — they act on the session the wrapped
+token names, after the guard has validated it against the provider. There is no per-request
+organization selector: the server's AJV strips unknown query keys, and the session, not the
+request, decides which organization a request acts in.
+
+## Provider descriptors
+
+`cfg.oidc.providers` is the list. `discoveryUrl` is the canonical form — the fully-qualified issuer,
+used verbatim; `service` + `basePath` is the legacy fallback that reassembles the issuer from a
+registered service host, and it forces the relying party to know the provider's URL layout.
+
+Presentation lives on the descriptor too, because a browser never talks to the issuer directly and
+has no discovery document to read a name out of: `label` (the human-readable name), `icon` (an icon
+registry **name**, never markup), `order` (ascending; absent sorts after the default) and `hidden`
+(registered but never offered). `internal: true` means machine use and is never offered either.
+
+`def` marks the default provider, and **both sides read it**. On the server, `getDefault()` in
+`@owlmeans/server-oidc-rp` returns the `clientId` of the first provider carrying the flag, and the
+init handler resolves the OIDC client from that value before it looks at `entityId` at all — so `def`
+in a server config decides which provider the browser-starts-server-finishes flow runs against. In
+the browser it drives presentation as well: `@owlmeans/web-oidc-rp` gives the flagged provider a
+login method of `order` 20 (unless the descriptor sets its own) and renders it with primary emphasis.
+
+`restrictedProviders` narrows what an application may use: `false` forbids identity-provider sign-in
+outright, `true` allows only the default one, and an array is an allowlist matched against a
+provider's `entityId ?? service ?? clientId`.
 
-- Provider config is stored in `cfg.oidc.providers`; viable config registers both an internal admin provider and a Google provider with `service: GOOGLE_SERVICE`.
-- `GOOGLE_SERVICE` is the provider service value `'google'`. Keep it stable so browser plugins, backend provider lookup, and identity credentials derive the same login-service key.
-- `GOOGLE_CLIENT_AUTH` names the browser authentication plugin registered by `@owlmeans/web-oidc-rp/auth/plugins`.
-- `OIDC_GATE` is for OIDC/UMA-style authorization gates. Do not use it for downstream products that authenticate with OIDC/Google but authorize against local identity resources; those products should declare their own gate alias.
+`authEndpoint`, `tokenEndpoint` and `userinfoEndpoint` name a provider's endpoints outright, for a
+provider reached without discovery. The shipped reader of all three is the Google sign-in plugin in
+`@owlmeans/server-oidc-rp`, which falls back to Google's own endpoints when they are absent; a
+descriptor that carries a `discoveryUrl` gets its endpoints from the discovery document instead and
+these fields do nothing.
 
 ## Depends On
 
-- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`
+- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`, `@owlmeans/auth-common`,
+  `@owlmeans/basic-envelope`, `@owlmeans/config`, `@owlmeans/context`, `@owlmeans/resource`
+- `ajv` (peer) — the schemas above are `JSONSchemaType` declarations

package/agent-meta/skills/oidc-versions/SKILL.md

@@ -1,13 +1,15 @@
 ---
 name: oidc-versions
 description: How to manage and upgrade the four OIDC/OAuth third-party dependencies used by OwlMeans OIDC packages. Covers exact-pin policy, official doc anchors, breaking-change checklists for each lib, the OwlMeans isolation principle, and the verification flow across common and downstream repos. Auto-invoked when touching oidc-provider, openid-client, jose, or oidc-client-ts version strings in package.json files.
-allowed-tools: Bash(npm view *) Bash(grep *) Bash(bun *)
+allowed-tools: Bash(npm view *), Bash(grep *), Bash(bun *)
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # OIDC / OAuth dependency version management — OwlMeans Common
 
-This skill is the sibling of [[versions]] (internal `@owlmeans/*` version sync) and [[shadcn-versions]] (UI lib bumps). Use it whenever upgrading the upstream OIDC/OAuth libraries, and cross-read it before touching any OIDC package implementation.
+The sibling of [[versions]] (internal `@owlmeans/*` version sync) and [[shadcn-versions]] (UI lib
+bumps). Use it whenever upgrading the upstream OIDC/OAuth libraries, and cross-read it before
+touching any OIDC package implementation.
 
 ## The four libraries and their owning packages
 
@@ -18,9 +20,12 @@ This skill is the sibling of [[versions]] (internal `@owlmeans/*` version sync)
 | `openid-client` | `@owlmeans/server-oidc-rp` | **exact** | `6.8.4` |
 | `oidc-client-ts` | `@owlmeans/web-oidc-rp`, `@owlmeans/mui-oidc-rp` | **exact** | `3.5.0` |
 
-`@types/oidc-provider` is a dev dep of `server-oidc-provider` and must track the oidc-provider major: `9.5.0` (v9 ships no bundled types).
+`@types/oidc-provider` is a dev dependency of `@owlmeans/server-oidc-provider` and must track the
+oidc-provider major: `9.5.0` (v9 ships no bundled types).
 
-All four are authored by panva or authts and follow semantic versioning. **Exact pins** are the project policy — every bump is deliberate and reviewed.
+All four are authored by panva or authts and follow semantic versioning. **Exact pins** are the
+policy — no caret, no range — so that every bump is a deliberate, reviewed change. The pinned value
+lives in each owning package's `dependencies`; nothing else may declare one of these libraries.
 
 ## Checking installed vs latest
 
@@ -43,91 +48,114 @@ Consult these before every bump — especially for same-major minors that might
 
 ## Breaking-change checklist per library
 
-### oidc-provider (v9.x — current)
-
-Migrated from v8 in this project. Key differences to keep in mind:
-
-- **Provider is a Koa app instance.** `oidc.use()` middleware registered after `api.server.use(base, oidc.callback())` is *downstream* of the Koa router — `await next()` inside such middleware does **not** run after a matched route completes. Move any post-response header manipulation (e.g. CSP rewrites) to a **Fastify `onSend` hook** scoped to the OIDC base path instead.
-- **`enableHttpPostMethods`** defaults to `false` (authorization/logout endpoints no longer accept POST by default). Set `enableHttpPostMethods: true` in the Provider config if the interaction flow POSTs.
-- **DPoP is on by default.** `features.dPoP.enabled` is `true` without explicit config. Disable if the OIDC clients don't send DPoP proofs.
-- **Cookie `sameSite` defaults to `lax`** (was `none`). Review if the interaction UI lives on a different subdomain.
-- **JWK `kid` must be unique.** No two keys in `jwks.keys` can share the same `kid`. Generate or assign a deterministic unique `kid` when building the JWKS.
-- **`provider.Account` getter removed.** Use `findAccount` callback; do not read `oidc.Account`.
-- **Node 22+ required.**
-- **ESM-only** (was already ESM in v8).
-- HTTP requests now use the **global `fetch()`** (not `got`). `httpOptions` is replaced with a `fetch` config option that mirrors the fetch API.
-- **`@types/oidc-provider`** must be `9.x` (`^9.5.0` or exact); the v8 types are incompatible.
-
-### jose (v6.x — current)
-
-Migrated from v5 in this project:
-
-- **WebCrypto is the only crypto backend.** `importPKCS8`, `importSPKI`, `importJWK`, `generateKeyPair` now return `CryptoKey` (not `KeyObject`).
-- **`extractable` must be set when you need to call `exportJWK` on an imported key.** In v5 Node `KeyObject` was always extractable. In v6 the `CryptoKey` default is `extractable: false`. The fix:
+### oidc-provider v9
+
+- **The provider is a Koa app instance**, and `Provider#use(fn)` splices `fn` **ahead of** the
+  provider's own router in the Koa chain, so such a middleware runs before routing and resumes
+  normally after `await next()`. Header corrections for an OwlMeans server nonetheless belong in a
+  middleware registered on the API server **before** `oidc.callback()`, writing to the raw response
+  where `@fastify/helmet` has already put its defaults. They must never be a Fastify `onSend` hook:
+  `oidc.callback()` ends the response outside Fastify's reply lifecycle, so `onSend` never fires for
+  a route the provider answers.
+- **`enableHttpPostMethods` is `false`.** Turning it on requires `cookies.long.sameSite: 'none'` in
+  the same configuration; otherwise the constructor throws `TypeError: HTTP POST Method support
+  requires that cookies.long.sameSite is set to none`.
+- **DPoP is on.** `features.dPoP.enabled` is `true` with no configuration. Disable it when the
+  clients send no DPoP proofs.
+- **Cookie `sameSite` is `lax`** for both `cookies.long` and `cookies.short`. Review it when the
+  interaction UI lives on a different subdomain.
+- **JWK `kid` must be unique.** No two keys in `jwks.keys` may share one.
+- **There is no `provider.Account` getter.** Accounts come from the `findAccount` callback.
+- **ESM-only**, and outbound HTTP goes through the `fetch` configuration option — a function
+  mirroring the fetch API, defaulting to `globalThis.fetch`. There is no `httpOptions`.
+- **`@types/oidc-provider` must track the major** (`9.5.0`); v9 ships no bundled types.
+
+### jose v6
+
+- **WebCrypto is the only crypto backend.** `importPKCS8`, `importSPKI` and `importX509` resolve to a
+  `CryptoKey`; `importJWK` resolves to a `CryptoKey` for every key type except `oct`, which yields a
+  `Uint8Array`. `KeyObject` survives only as an exported type.
+- **`extractable` defaults to `false` for a private key** and `true` for everything else, so an
+  imported private key cannot be exported unless the import asked for it:
   ```typescript
-  // ✅ v6 — must pass { extractable: true }
   const key = await jose.importPKCS8(pkcs8String, 'RS256', { extractable: true })
   const jwk = await jose.exportJWK(key)   // works
   ```
-- **`decodeJwt` unchanged** — still `decodeJwt(jwt): JWTPayload`.
-- **Subpath exports removed.** All exports are from the root `'jose'` entry; e.g. `'jose/jwt/verify'` no longer works.
-- **CJS `require()` requires Node's `require(esm)` support** (Node 22+, or use dynamic `import()`).
-
-### openid-client (v6.x — no migration needed from v6.1)
+- `decodeJwt(jwt): JWTPayload`.
+- Both the root entry and the subpath entries (`jose/jwt/verify`, `jose/key/import`, `jose/errors`, …)
+  are exported. Prefer the root entry — an `import * as jose from 'jose'` is what the OwlMeans
+  packages use, and a subpath import buys nothing under a bundler.
+- **CJS `require()` needs Node's `require(esm)` support**; use dynamic `import()` otherwise.
 
-v6 introduced a **functional API** (replacing the class-based v5 API). OwlMeans already targets v6 (migrated earlier). Key API surface used:
+### openid-client v6
 
-- `client.discovery(issuerUrl, clientId, secret, authMethod, options)` — returns a `Configuration` object.
-- `client.buildAuthorizationUrl(config, params)` — returns a `URL`.
-- `client.authorizationCodeGrant(config, url, checks)` — returns `TokenEndpointResponse`.
-- `client.clientCredentialsGrant(config)` / `client.refreshTokenGrant(config, refreshToken)`.
-- `client.tokenIntrospection(config, token)`.
-- `client.allowInsecureRequests` — passed in the `execute` array option of `discovery` when behind HTTP (dev/internal).
+A functional API — there is no client class. The surface OwlMeans uses:
 
-Breaking changes within v6.x are documented in the CHANGELOG; check before bumping patch/minor versions.
+- `discovery(issuerUrl, clientId, metadata?, clientAuthentication?, options?)` → `Configuration`.
+  `metadata` accepts the client secret as a bare string. `clientAuthentication` is a `ClientAuth`
+  function (`ClientSecretPost(secret)`, `ClientSecretBasic(secret)`, …) and defaults to
+  `ClientSecretPost` when a secret is present — passing `undefined` takes that default.
+- `buildAuthorizationUrl(config, params)` → `URL`.
+- `authorizationCodeGrant(config, url, checks)` → `TokenEndpointResponse`.
+- `clientCredentialsGrant(config)` / `refreshTokenGrant(config, refreshToken)`.
+- `tokenIntrospection(config, token)`.
+- `allowInsecureRequests` — passed inside the `execute` array of `discovery`'s options to permit
+  plain HTTP for an internal or development issuer.
 
-### oidc-client-ts (v3.x — no migration from v3.1)
+### oidc-client-ts v3
 
-Current pin is `3.5.0`. OwlMeans only uses `UserManager` (browser-side, currently a stub). Check the CHANGELOG for breaking changes to `UserManager` constructor or `signinRedirect` between minor versions.
+Only `UserManager` is referenced, in the incomplete fully-browser-side path; the production flow is a
+server-side token exchange. Check the CHANGELOG for changes to the `UserManager` constructor or
+`signinRedirect` before bumping a minor.
 
 ## OwlMeans isolation principle
 
-**No upstream OIDC library type may appear in a package's public `index.ts` exports.** Define OwlMeans-owned interfaces and map at the service boundary.
-
-Canonical example — `@owlmeans/server-oidc-rp` public types:
-- `OidcTokenSet` — OwlMeans-owned shape for `access_token`, `refresh_token`, `id_token`, etc.
-- `OidcGrantChecks` — owned shape for PKCE checks.
-- `OidcServerMetadata` — owned shape for issuer/endpoint metadata.
-- `OidcIntrospectionResponse` — owned shape for token introspection.
-- `OidcClientDescriptor` — **opaque branded type** (consumers receive and pass it back; never read its internal structure).
-
-The implementation in `src/service.ts` imports and uses the upstream types internally, mapping to/from the owned types at method boundaries. This means a future library swap is confined to a single file.
+**No upstream OIDC library NAME may appear in a package's public `index.ts` exports.** Declare
+OwlMeans-owned types and map at the service boundary, so a consumer never imports from
+`openid-client` or `oidc-provider` to type a variable this stack handed it.
+
+The public types of `@owlmeans/server-oidc-rp` are the canonical example:
+
+- `OidcTokenSet` / `OidcTokenSetParameters` — declared shapes for `access_token`, `refresh_token`,
+  `id_token`, `token_type`, `expires_in`, `scope`, with and without the `claims()` helper.
+- `OidcGrantChecks` — the declared shape for PKCE checks.
+- `OidcIntrospectionResponse` — the declared shape for token introspection.
+- `OidcServerMetadata` and `OidcClientDescriptor` — deliberate aliases onto the upstream metadata and
+  configuration objects, exported under owned names. `OidcClientDescriptor` is **opaque**: consumers
+  receive it and pass it back, and never read its internals.
+
+What the principle guarantees is the **exported name**: a consumer types every value this stack hands
+it without importing `openid-client` or `oidc-provider`. It does not confine upstream imports to one
+file, and reading it that way misleads. In `@owlmeans/server-oidc-rp` the type module imports
+`Configuration`, `ServerMetadata`, `TokenEndpointResponse` and `TokenEndpointResponseHelpers` from
+`openid-client` in order to alias them under the owned names; the service module imports the
+functional API; and `jose`'s `decodeJwt` is imported directly by the token wrapper, the `oidc-client`
+auth plugin and the exchange handler. A library swap touches each of those — the owned names are what
+keep it from reaching any consumer.
 
 See [[server-oidc-rp]] for the full public surface.
 
 ## Performing a bump
 
-1. **Read the CHANGELOG** for the target version (link above). Enumerate every breaking change against the checklist above.
+1. **Read the CHANGELOG** for the target version (link above). Enumerate every breaking change
+   against the checklist above.
 2. Update the version string in **each owning package's `package.json`** — exact pins only, no caret.
-3. Update `@types/oidc-provider` if bumping `oidc-provider` across a major.
-4. **Run `bun install`** in the monorepo root to update the lockfile.
-5. **Fix any code changes** using the checklist (particularly the `extractable` gotcha for jose and the CSP/debug middleware placement for oidc-provider).
-6. Build affected packages: `bun run build` (or `tsc -b`) per package.
-7. Run unit tests: `bun test ./tests` per package.
+3. Update `@types/oidc-provider` when bumping `oidc-provider` across a major.
+4. Reinstall so the lockfile is regenerated.
+5. **Fix the code** using the checklist — particularly the jose `extractable` argument and the
+   placement of the header-correcting middleware for oidc-provider.
+6. Build every affected package, then run its unit tests.
 
 ## Downstream verification
 
-Downstream repos that link `@owlmeans/*` packages as local workspace entries (bun hoisted linker) pick up the rebuilt outputs automatically. After rebuilding the affected packages, verify each downstream:
-
-```bash
-# per repo: viable, viable-agent, internal
-cd <your-project-root>
-bun install           # refresh transitive third-party versions
-bun run build         # or per-workspace build command
-bun test              # or per-workspace test command
-```
+A project that links these packages as local workspace entries picks up the rebuilt outputs
+automatically, but its own transitive copies of the four libraries do not move on their own. After
+rebuilding, in every consuming project: reinstall, build, and run the tests.
 
-Check `overrides` in each repo's root `package.json` — remove stale pins of oidc-provider/jose/openid-client/oidc-client-ts if present.
+Then check `overrides` (or the equivalent resolution field) in each consuming project's root
+manifest and remove any stale pin of `oidc-provider`, `jose`, `openid-client` or `oidc-client-ts` —
+an override outranks the exact pin the owning package declares, so a forgotten one silently keeps the
+old version installed.
 
 ## Cross-references
 

package/build/consts.d.ts

@@ -14,6 +14,10 @@ export declare const OIDC_GUARD = "guard:oidc";
 export declare const OIDC_GUARD_CACHE = "resource:oidc-guard:cache";
 export declare const DISPATCHER_OIDC_INIT = "dispatcher:oidc:init";
 export declare const DISPATCHER_OIDC = "dispatcher:oidc:authenticate";
+/** Lists the organizations the session's subject belongs to. */
+export declare const DISPATCHER_OIDC_ORGANIZATIONS = "dispatcher:oidc:organizations";
+/** Switches the organization the session acts in. */
+export declare const DISPATCHER_OIDC_ORGANIZATION = "dispatcher:oidc:organization";
 export declare const OIDC_CODE_QUERY = "code";
 /**
  * Query params an authorization server sets on the redirect URI when the request failed
@@ -42,4 +46,18 @@ export declare const OIDC_RP_BASE_SCOPES: string[];
 export declare const OIDC_RP_BASE_SCOPE: string;
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export declare const PERMISSIONS_CLAIM = "permissions";
+/**
+ * OIDC scope of a tenanted client: the provider answers it with the subject's organizations and
+ * the full permission claim, bound sets included. A client that never asks for it gets the
+ * flattened claim of the one organization it acts in, exactly as before the scope existed.
+ */
+export declare const ORGANIZATIONS_SCOPE = "organizations";
+/** Token/userinfo claim carrying the subject's `OidcOrganizationClaim[]`. */
+export declare const ORGANIZATIONS_CLAIM = "organizations";
+/** `AuthForbidden` reason: the organization named is not one the subject belongs to. */
+export declare const ORGANIZATION_REFUSAL = "organization";
+/** `AuthForbidden` reason: the action needs the organization's owner. */
+export declare const ORGANIZATION_OWNER_REFUSAL = "organization:owner";
+/** Discovery-document field carrying the base URL of the provider's runtime IAM API. */
+export declare const IAM_API_METADATA = "owlmeans_iam_api";
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAAQ,CAAA;AAEpC,eAAO,MAAM,gBAAgB,sBAA4C,CAAA;AAEzE,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C,eAAO,MAAM,SAAS,SAAS,CAAA;AAE/B,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAE7D,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAGhD,eAAO,MAAM,cAAc,WAAW,CAAA;AAEtC,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAE3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,eAAO,MAAM,eAAe,SAAS,CAAA;AAErC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,eAAO,MAAM,4BAA4B,sBAAsB,CAAA;AAE/D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,SAAS,cAAc,CAAA;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,WAAW,UAAU,CAAA;AAElC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,UAAqC,CAAA;AAErE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAgC,CAAA;AAE/D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAAQ,CAAA;AAEpC,eAAO,MAAM,gBAAgB,sBAA4C,CAAA;AAEzE,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C,eAAO,MAAM,SAAS,SAAS,CAAA;AAE/B,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAE7D,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAGhD,eAAO,MAAM,cAAc,WAAW,CAAA;AAEtC,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAE3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,gEAAgE;AAChE,eAAO,MAAM,6BAA6B,kCAAkC,CAAA;AAE5E,qDAAqD;AACrD,eAAO,MAAM,4BAA4B,iCAAiC,CAAA;AAE1E,eAAO,MAAM,eAAe,SAAS,CAAA;AAErC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,eAAO,MAAM,4BAA4B,sBAAsB,CAAA;AAE/D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,SAAS,cAAc,CAAA;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,WAAW,UAAU,CAAA;AAElC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,UAAqC,CAAA;AAErE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAgC,CAAA;AAE/D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,kBAAkB,CAAA;AAElD,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,kBAAkB,CAAA;AAElD,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAA;AAElD,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,uBAAuB,CAAA;AAE9D,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,qBAAqB,CAAA"}

package/build/consts.js

@@ -16,6 +16,10 @@ export const OIDC_GUARD = 'guard:oidc';
 export const OIDC_GUARD_CACHE = 'resource:oidc-guard:cache';
 export const DISPATCHER_OIDC_INIT = 'dispatcher:oidc:init';
 export const DISPATCHER_OIDC = 'dispatcher:oidc:authenticate';
+/** Lists the organizations the session's subject belongs to. */
+export const DISPATCHER_OIDC_ORGANIZATIONS = 'dispatcher:oidc:organizations';
+/** Switches the organization the session acts in. */
+export const DISPATCHER_OIDC_ORGANIZATION = 'dispatcher:oidc:organization';
 export const OIDC_CODE_QUERY = 'code';
 /**
  * Query params an authorization server sets on the redirect URI when the request failed
@@ -44,4 +48,18 @@ export const OIDC_RP_BASE_SCOPES = ['openid', 'profile', EMAIL_SCOPE];
 export const OIDC_RP_BASE_SCOPE = OIDC_RP_BASE_SCOPES.join(' ');
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export const PERMISSIONS_CLAIM = 'permissions';
+/**
+ * OIDC scope of a tenanted client: the provider answers it with the subject's organizations and
+ * the full permission claim, bound sets included. A client that never asks for it gets the
+ * flattened claim of the one organization it acts in, exactly as before the scope existed.
+ */
+export const ORGANIZATIONS_SCOPE = 'organizations';
+/** Token/userinfo claim carrying the subject's `OidcOrganizationClaim[]`. */
+export const ORGANIZATIONS_CLAIM = 'organizations';
+/** `AuthForbidden` reason: the organization named is not one the subject belongs to. */
+export const ORGANIZATION_REFUSAL = 'organization';
+/** `AuthForbidden` reason: the action needs the organization's owner. */
+export const ORGANIZATION_OWNER_REFUSAL = 'organization:owner';
+/** Discovery-document field carrying the base URL of the provider's runtime IAM API. */
+export const IAM_API_METADATA = 'owlmeans_iam_api';
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,GAAG,eAAe,EAAE,CAAA;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAE7D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAA;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAA;AAEpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,GAAG,eAAe,EAAE,CAAA;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAE7D,gEAAgE;AAChE,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAA;AAE5E,qDAAqD;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAA;AAE1E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAA;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAA;AAEpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAElD,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAElD,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAA"}

package/build/entrypoints.d.ts

@@ -0,0 +1,16 @@
+import type { AuthToken } from '@owlmeans/auth';
+import type { OidcOrganizationList } from './types.js';
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export declare const oidcProtocols: {
+    init: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OIDCAuthInitParams;
+    }, any>;
+    authenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OIDCClientAuthPayload;
+    }, any>;
+    organizations: import("@owlmeans/entrypoint").EntrypointProtocol<{}, OidcOrganizationList>;
+    organization: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OidcOrganizationSwitch;
+    }, AuthToken>;
+};
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAK/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD,oFAAoF;AACpF,eAAO,MAAM,aAAa;IACxB,IAAI;;;IAIJ,YAAY;;;IAOZ,aAAa;IAKb,YAAY;;;CAKb,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,15 @@
+import { contract, protocol, typed } from '@owlmeans/entrypoint';
+import { route, RouteMethod, backend } from '@owlmeans/route';
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT, DISPATCHER_OIDC_ORGANIZATION, DISPATCHER_OIDC_ORGANIZATIONS, OIDC_GUARD, } from './consts.js';
+import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema, OidcOrganizationSwitchSchema } from './models.js';
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export const oidcProtocols = {
+    init: protocol(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCAuthInitParamsSchema) }, typed())),
+    authenticate: protocol(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed())),
+    // The organization switch acts on the session the wrapped token names, so only that token's own
+    // guard can reach it — and it runs after the guard has refreshed the session against the
+    // provider, so the list it answers from is the provider's current one.
+    organizations: protocol(route(DISPATCHER_OIDC_ORGANIZATIONS, '/authenticate/oidc/organizations', backend(null, RouteMethod.GET)), contract(typed()), { guards: OIDC_GUARD }),
+    organization: protocol(route(DISPATCHER_OIDC_ORGANIZATION, '/authenticate/oidc/organization', backend(null, RouteMethod.POST)), contract.request({ body: typed(OidcOrganizationSwitchSchema) }, typed()), { guards: OIDC_GUARD }),
+};
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAE7D,OAAO,EACL,eAAe,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,UAAU,GAC/G,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAGjH,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,QAAQ,CACZ,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC1E;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC7E;IACD,gGAAgG;IAChG,yFAAyF;IACzF,uEAAuE;IACvE,aAAa,EAAE,QAAQ,CACrB,KAAK,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EACxG,QAAQ,CAAC,KAAK,EAAwB,CAAC,EACvC,EAAE,MAAM,EAAE,UAAU,EAAE,CACvB;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,4BAA4B,EAAE,iCAAiC,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,4BAA4B,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,EACnF,EAAE,MAAM,EAAE,UAAU,EAAE,CACvB;CACF,CAAA"}