@owlmeans/oidc 0.1.18-rc.51 → 0.1.18-rc.52

package/README.md

@@ -12,7 +12,7 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc@^0.1.18-rc.51
+bun add @owlmeans/oidc@^0.1.18-rc.52
 ```
 
 ## Usage
@@ -95,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.45
+npx @owlmeans/agent-skills@^0.1.18-rc.46
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.51",
-  "generatedAt": "2026-10-01T23:27:48.732Z",
+  "version": "0.1.18-rc.52",
+  "generatedAt": "2026-10-03T11:19:50.782Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.51"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.52"` in `dependencies`
 
 The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
 guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party
@@ -43,7 +43,7 @@ guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser re
 | `OidcIamConfig` | `{ iamMode?: 'keycloak' \| 'integrated' }` — the IAM-mode seam, kept here to avoid a cycle with `@owlmeans/iam` |
 | `OidcGuard`, `OidcGuardOptions` | The guard service type, and `{ coguards, cache?, tokenService? }` — only `coguards` (its **first** entry, default `DEFAULT_GUARD`) and `tokenService` are read; `cache` is declared and never used |
 | `OIDCAuthInitParams`, `OIDCClientAuthPayload`, `OIDCTokenUpdate`, `CommonTokenSetParams` | The dispatcher wire shapes; init's `entitySlug?` is the organization the person asks to act in |
-| `OIDCAuthInitParamsSchema`, `OIDCClientAuthPayloadSchema`, `OIDCTokenUpdateSchema`, `ProviderProfileDetailsSchema`, `OidcOrganizationSwitchSchema` | Their AJV schemas — closed: the server's AJV strips an undeclared field silently, so every field a caller sends is declared |
+| `OIDCAuthInitParamsSchema`, `OIDCClientAuthPayloadSchema`, `OIDCTokenUpdateSchema`, `ProviderProfileDetailsSchema`, `OidcOrganizationSwitchSchema` | Their AJV schemas — closed (the server's AJV strips an undeclared field silently, so every field a caller sends is declared), except `OIDCClientAuthPayloadSchema`, which admits any further string param of the provider's redirect |
 | `OidcOrganizationClaim` | `{ entitySlug, entityKey, title?, owner, groups?, home? }` — one organization of the subject as the provider claims it; `entityKey` is the frozen IAM key and never leaves a server |
 | `OidcPermissionSetClaim` | `PermissionSet` + `entitySlug?` — a set bound to that organization |
 | `OidcOrganizationItem`, `OidcOrganizationList`, `OidcOrganizationSwitch` | The switch's wire shapes: `{ entitySlug, title?, owner, groups?, home?, acting }` items (no key), the `{ items }` list, the `{ entitySlug }` body |
@@ -68,8 +68,7 @@ protocol(
 
 The verification itself happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp`
 (browser); this package gives both sides one name to refer to. `OIDC_GATE` is for OIDC/UMA-style
-authorization. A product that authenticates over OIDC but authorizes against its own identity
-resources declares its own gate alias instead.
+authorization only (`server-oidc-rp` → Rules).
 
 ## Scope names are a cross-package contract
 
@@ -90,11 +89,11 @@ A client that asks for `ORGANIZATIONS_SCOPE` gets two claims from the integrated
 `organizations` claim (`OidcOrganizationClaim[]`) and the FULL `permissions` claim, in which a set
 bound to an organization carries `entitySlug`. A client that never asks gets the flattened claim of
 the one organization it acts in and no `organizations` claim — so the scope is what turns tenancy
-on, and an old client is untouched by it.
+on, and a single-organization client never sees an `organizations` claim or a set carrying
+`entitySlug`.
 
-Only the relying party's server sees the claims. The browser token carries the acting
-organization's `entitySlug`, `groups` and its sets with the binding stripped; `entityKey` and the
-bound sets of other organizations never leave the server (`@owlmeans/server-oidc-rp`).
+Only the relying party's server sees the claims; what the session keeps and what the browser token
+carries is governed by `server-oidc-rp` → "Organizations".
 
 The guard attaches `updated.entity` to the request whenever the wrapping service answers one. A
 relying party of a tenanted client has no organization registry of its own, so this is the only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.18-rc.51",
+  "version": "0.1.18-rc.52",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,12 +21,12 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.37",
-    "@owlmeans/auth-common": "^0.1.18-rc.43",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.42",
-    "@owlmeans/config": "^0.1.18-rc.40",
+    "@owlmeans/auth": "^0.1.18-rc.38",
+    "@owlmeans/auth-common": "^0.1.18-rc.44",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.43",
+    "@owlmeans/config": "^0.1.18-rc.41",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.38",
+    "@owlmeans/entrypoint": "^0.1.18-rc.39",
     "@owlmeans/resource": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33"
   },