@owlmeans/server-auth-identity 0.1.18-rc.1 → 0.1.18-rc.11

package/README.md

@@ -7,7 +7,7 @@ Mongo-backed local identity resources and provider account linking for OwlMeans
 - Registers three Mongo resources: local accounts, local profiles, and provider credentials.
 - Provides `IdentityLinkingService` to map external provider profile details into an OwlMeans `AuthPayload`.
 - Keeps external provider identity separate from local product identity and authorization scopes.
-- Designed to work with `@owlmeans/server-auth`, `@owlmeans/server-oidc-rp`, and product-specific module gates.
+- Designed to work with `@owlmeans/server-auth`, `@owlmeans/server-oidc-rp`, and product-specific entrypoint gates.
 
 ## Installation
 
@@ -43,9 +43,10 @@ import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
 import type { IdentityProfileResource } from '@owlmeans/server-auth-identity'
 
 const profiles = context.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
-const profile = await profiles.load(profileId, 'profileId')
+const profile = await profiles.load({ profileId })
+const scoped = await profiles.load({ entityId, profileId })
 
-const { items } = await profiles.list({ entityId, profileId } as any)
+const { items, total } = await profiles.list({ entityId })
 ```
 
 ## API
@@ -83,7 +84,7 @@ const { items } = await profiles.list({ entityId, profileId } as any)
 - Google/OIDC login is only the provider bootstrap path; durable authorization data lives in `IdentityProfile`.
 - Backend contexts should register `appendAuthService(context)`, then `appendAuthIdentityResources(context)`, then product gate services.
 - Product gates should read `AUTH_IDENTITY_PROFILE`, verify `entityId`, reject expired or blocked profiles, and compare gate params against profile scopes.
-- `Resource.pick()` is destructive and deletes the matching record. Never use `pick()` for gate or handler reads; use `load()` or `list()`.
+- `Resource.take()` is destructive and deletes the record it returns. Never use `take()` for gate or handler reads; use `load(where)` or `list(where)`.
 
 ## Related Packages
 

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.498Z",
+  "version": "0.1.18-rc.11",
+  "generatedAt": "2026-09-01T16:28:56.980Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-identity/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-identity
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.11"` in `dependencies`
 
 ## Key Exports
 
@@ -54,12 +54,12 @@ import type { IdentityProfileResource } from '@owlmeans/server-auth-identity'
 
 const profileRes = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
 
-// Single-field indexed lookup (read-only):
-const profile = await profileRes.load(profileId, 'profileId')
+// One record by any field, or by several at once — read-only, and typed by the resource:
+const profile = await profileRes.load({ profileId })
+const scoped = await profileRes.load({ entityId, profileId })
 
-// Multi-field criteria lookup (read-only):
-const { items } = await profileRes.list({ entityId, profileId } as any)
-const profile = items[0] ?? null
+// Every match, newest first:
+const { items, total } = await profileRes.list({ entityId }, { sort: [{ field: 'createdAt', order: 'desc' }] })
 ```
 
 ### Link an external provider to a local profile
@@ -120,7 +120,7 @@ by the reference conversion's design.
 
 ## Important Gotchas
 
-- **`Resource.pick()` is destructive** — it deletes the record it finds. For read-only identity lookups in gates or handlers, use `load(id, field)` for single-field indexed queries or `list(criteria)` for multi-field queries. Never use `pick()` in authorization checks.
+- **`Resource.take()` is destructive** — it deletes the record it returns. For read-only identity lookups in gates or handlers use `load(where)`, which answers a multi-field query in one call (`load({ type, userId, credential })`), or `list(where, opts)` when you need every match. Never use `take()` in authorization checks.
 - **`IdentityLinkingService` is compatible with `AccountLinkingService`** from `@owlmeans/server-oidc-rp` but defined independently to avoid circular dependency. Both return `AuthPayload`.
 - First-login profiles are created with `ALL_SCOPES` and `AuthRole.User` — the gate layer is initially permissive per entity. Restrict scopes as needed for fine-grained authorization.
 - Account `credential` slug generation retries up to 5 times on duplicate key collision — this is the designed behavior for the Base58 slug space.

package/build/consts.d.ts

@@ -2,10 +2,13 @@ export declare const AUTH_IDENTITY_ACCOUNT = "auth-identity:account";
 export declare const AUTH_IDENTITY_PROFILE = "auth-identity:profile";
 export declare const AUTH_IDENTITY_CREDENTIALS = "auth-identity:credentials";
 export declare const AUTH_IDENTITY_LINKING = "auth-identity:linking";
+export declare const AUTH_IDENTITY_ORG_ENTITY = "auth-identity:org-entity";
 export declare const AUTH_IDENTITY_ACCOUNT_COLLECTION = "account";
 export declare const AUTH_IDENTITY_PROFILE_COLLECTION = "profile";
 export declare const AUTH_IDENTITY_CREDENTIALS_COLLECTION = "credentials";
+export declare const AUTH_IDENTITY_ORG_ENTITY_COLLECTION = "org-entity";
 export declare const AUTH_IDENTITY_DB_ALIAS = "auth-identity";
+export declare const MAX_ENTITY_SLUG_ATTEMPTS = 8;
 export declare const LOGIN_SERVICE_PREFIX = "service";
 export declare const EXTERNAL_KEY_DELIMITER = ":";
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAM5D,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,oCAAoC,gBAAgB,CAAA;AAIjE,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAGrD,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,wBAAwB,6BAA6B,CAAA;AAMlE,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,oCAAoC,gBAAgB,CAAA;AACjE,eAAO,MAAM,mCAAmC,eAAe,CAAA;AAI/D,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAIrD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAGzC,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}

package/build/consts.js

@@ -6,6 +6,7 @@ export const AUTH_IDENTITY_ACCOUNT = 'auth-identity:account';
 export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile';
 export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials';
 export const AUTH_IDENTITY_LINKING = 'auth-identity:linking';
+export const AUTH_IDENTITY_ORG_ENTITY = 'auth-identity:org-entity';
 // Colon-free Mongo collection base names. The final collection name is
 // `${resourcePrefix}${collection}` — e.g. with the project prefix 'viam-' this yields
 // 'viam-account'. Register the identity resources against a db config that carries the
@@ -13,9 +14,13 @@ export const AUTH_IDENTITY_LINKING = 'auth-identity:linking';
 export const AUTH_IDENTITY_ACCOUNT_COLLECTION = 'account';
 export const AUTH_IDENTITY_PROFILE_COLLECTION = 'profile';
 export const AUTH_IDENTITY_CREDENTIALS_COLLECTION = 'credentials';
+export const AUTH_IDENTITY_ORG_ENTITY_COLLECTION = 'org-entity';
 // Suggested db-config alias for a dedicated config whose resourcePrefix scopes the
 // collection prefix to identity collections only (not the whole database).
 export const AUTH_IDENTITY_DB_ALIAS = 'auth-identity';
+// How many slugs to try before giving up on minting a free one. Collisions are settled against a
+// unique index, so this bounds a retry loop rather than a probability.
+export const MAX_ENTITY_SLUG_ATTEMPTS = 8;
 // Helper prefixes for stable key derivation
 export const LOGIN_SERVICE_PREFIX = 'service';
 export const EXTERNAL_KEY_DELIMITER = ':';

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAE5D,uEAAuE;AACvE,sFAAsF;AACtF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAA;AAEjE,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAElE,uEAAuE;AACvE,sFAAsF;AACtF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAA;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,YAAY,CAAA;AAE/D,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,iGAAiG;AACjG,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD,eAAO,MAAM,2BAA2B,YAC7B,YAAY,CAAC,GAAG,CAAC,YAChB,MAAM,KACf,IAKF,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,eAAO,MAAM,2BAA2B,GACtC,SAAS,YAAY,CAAC,GAAG,CAAC,EAC1B,UAAU,MAAM,KACf,IAUF,CAAA"}

package/build/helper.js

@@ -1,9 +1,15 @@
-import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource } from './resource.js';
+import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource, makeOrgEntityResource } from './resource.js';
 import { makeIdentityLinkingService } from './service.js';
+import { makeEntityResolverService } from './resolver.js';
 export const appendAuthIdentityResources = (context, dbAlias) => {
     context.registerResource(makeIdentityAccountResource(dbAlias));
     context.registerResource(makeIdentityProfileResource(dbAlias));
     context.registerResource(makeIdentityCredentialsResource(dbAlias));
+    context.registerResource(makeOrgEntityResource(dbAlias));
     context.registerService(makeIdentityLinkingService());
+    // Registering the resolver is what tells the server boundary that this deployment HAS
+    // organizations: without it `request.entity` stays undefined and every consumer falls back to
+    // treating the token's slug as the only entity value there is.
+    context.registerService(makeEntityResolverService());
 };
 //# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAA;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;AACvD,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAChJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;IACxD,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;IACrD,sFAAsF;IACtF,8FAA8F;IAC9F,+DAA+D;IAC/D,OAAO,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAA;AACtD,CAAC,CAAA"}

package/build/index.d.ts

@@ -2,6 +2,7 @@ export * from './consts.js';
 export type * from './types.js';
 export * from './resource.js';
 export * from './service.js';
+export * from './resolver.js';
 export * from './helper.js';
 export * from './iam.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}

package/build/index.js

@@ -1,6 +1,7 @@
 export * from './consts.js';
 export * from './resource.js';
 export * from './service.js';
+export * from './resolver.js';
 export * from './helper.js';
 export * from './iam.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}

package/build/resolver.d.ts

@@ -0,0 +1,3 @@
+import type { EntityResolverService } from '@owlmeans/auth-common';
+export declare const makeEntityResolverService: (alias?: string) => EntityResolverService;
+//# sourceMappingURL=resolver.d.ts.map

package/build/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAgB,MAAM,uBAAuB,CAAA;AA6BhF,eAAO,MAAM,yBAAyB,GACpC,QAAO,MAAwB,KAC9B,qBAkIF,CAAA"}

package/build/resolver.js

@@ -0,0 +1,133 @@
+import { appendContextual } from '@owlmeans/context';
+import { ENTITY_RESOLVER, ENTITY_SLUG_PATTERN } from '@owlmeans/auth-common';
+import { generateWordSlug, nextSlugCandidate } from '@owlmeans/basic-ids';
+import { AUTH_IDENTITY_ORG_ENTITY, MAX_ENTITY_SLUG_ATTEMPTS } from './consts.js';
+/**
+ * How long a resolution is trusted without re-reading the registry.
+ *
+ * Every authenticated request resolves an entity, so an uncached resolver would put a database
+ * round-trip in front of the whole API. The cost of the cache is a rename taking up to this long
+ * to be seen by other replicas — which is survivable precisely because the old slug keeps
+ * resolving through `formerSlugs` rather than failing.
+ */
+const CACHE_TTL = 30_000;
+/** A stored record as the contract exposes it. Persisted records always carry an id. */
+const toRef = (entity) => entity == null ? null : {
+    id: entity.id, slug: entity.slug, formerSlugs: entity.formerSlugs, iamKey: entity.iamKey,
+};
+export const makeEntityResolverService = (alias = ENTITY_RESOLVER) => {
+    // Keyed by every name a caller might arrive with — id, slug, former slug, iamKey — so a hit
+    // costs one lookup regardless of which one it was.
+    const cache = new Map();
+    const now = () => Date.now();
+    const remember = (entity, ...keys) => {
+        const at = now();
+        for (const key of keys) {
+            if (key !== '')
+                cache.set(key, { entity, at });
+        }
+        if (entity != null) {
+            cache.set(entity.id, { entity, at });
+            cache.set(entity.slug, { entity, at });
+            cache.set(entity.iamKey, { entity, at });
+            for (const former of entity.formerSlugs ?? [])
+                cache.set(former, { entity, at });
+        }
+        return entity;
+    };
+    const forget = (entity) => {
+        for (const key of [entity.id, entity.slug, entity.iamKey, ...(entity.formerSlugs ?? [])]) {
+            if (key != null)
+                cache.delete(key);
+        }
+    };
+    const resource = () => service.ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
+    const load = async (value) => {
+        const cached = cache.get(value);
+        if (cached != null && now() - cached.at < CACHE_TTL) {
+            return cached.entity;
+        }
+        const res = resource();
+        // Id first: an id is authoritative, so a slug that happens to look like some other entity's
+        // id can never shadow it. A value that is not a record id simply misses. Then the current
+        // slug, then the names it has retired, then the frozen key external systems still quote.
+        const byId = await res.load(value);
+        if (byId != null)
+            return remember(byId, value);
+        const candidates = [
+            { slug: value },
+            { formerSlugs: { $contains: [value] } },
+            { iamKey: value },
+        ];
+        for (const where of candidates) {
+            const found = await res.load(where);
+            if (found != null)
+                return remember(found, value);
+        }
+        return remember(null, value);
+    };
+    const service = appendContextual(alias, {
+        resolve: async (value) => toRef(await load(value)),
+        byId: async (id) => toRef(remember(await resource().load(id), id)),
+        mintSlug: async () => {
+            const res = resource();
+            // A word slug is picked from 2^22 pairs, so a collision is rare — but "rare" is not "never"
+            // once an installation has many organizations, and the numeric suffix keeps the readable
+            // name rather than rerolling into an unrelated one.
+            for (let attempt = 1; attempt <= MAX_ENTITY_SLUG_ATTEMPTS; ++attempt) {
+                const base = generateWordSlug();
+                for (let suffix = 1; suffix <= 3; ++suffix) {
+                    const candidate = nextSlugCandidate(base, suffix);
+                    const taken = await res.load({
+                        $or: [{ slug: candidate }, { formerSlugs: { $contains: [candidate] } }],
+                    });
+                    if (taken == null)
+                        return candidate;
+                }
+            }
+            throw new SyntaxError('entity:slug-exhausted');
+        },
+        rename: async (id, slug) => {
+            if (!ENTITY_SLUG_PATTERN.test(slug)) {
+                throw new SyntaxError(`entity:slug-malformed:${slug}`);
+            }
+            const res = resource();
+            const entity = await res.get(id);
+            if (entity.slug === slug) {
+                return toRef(entity);
+            }
+            // A slug another entity has ever answered to cannot be taken: tokens and third-party records
+            // quoting it would start resolving to the wrong organization.
+            const taken = await res.load({
+                $or: [{ slug }, { formerSlugs: { $contains: [slug] } }],
+            });
+            if (taken != null && taken.id !== id) {
+                throw new SyntaxError(`entity:slug-taken:${slug}`);
+            }
+            forget(entity);
+            const formerSlugs = [...new Set([...(entity.formerSlugs ?? []), entity.slug])]
+                .filter(former => former !== slug);
+            const updated = await res.update({ ...entity, slug, formerSlugs, updatedAt: new Date() });
+            return toRef(remember(updated));
+        },
+        mintName: async (id, key, mint) => {
+            const res = resource();
+            const entity = await res.get(id);
+            const existing = entity.names?.[key];
+            // Read-before-mint is what freezes the name: the second caller gets the first caller's
+            // answer, so a rename between the two cannot produce two names for one live resource.
+            if (existing != null && existing !== '') {
+                return existing;
+            }
+            const minted = mint(toRef(entity));
+            forget(entity);
+            const updated = await res.update({
+                ...entity, names: { ...entity.names, [key]: minted }, updatedAt: new Date(),
+            });
+            remember(updated);
+            return updated.names?.[key] ?? minted;
+        },
+    });
+    return service;
+};
+//# sourceMappingURL=resolver.js.map

package/build/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIpD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEzE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAIhF;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,MAAM,CAAA;AAExB,wFAAwF;AACxF,MAAM,KAAK,GAAG,CAAC,MAAwB,EAAuB,EAAE,CAC9D,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;CAC1F,CAAA;AAOH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAgB,eAAe,EACR,EAAE;IACzB,4FAA4F;IAC5F,mDAAmD;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC3C,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;IAE5B,MAAM,QAAQ,GAAG,CAAC,MAAwB,EAAE,GAAG,IAAc,EAAoB,EAAE;QACjF,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YACrC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YACtC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YACxC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,EAAE;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACzF,IAAI,GAAG,IAAI,IAAI;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,GAAsB,EAAE,CACtC,OAAO,CAAC,GAAe,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;IAEhF,MAAM,IAAI,GAAG,KAAK,EAAE,KAAa,EAA6B,EAAE;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,4FAA4F;QAC5F,0FAA0F;QAC1F,yFAAyF;QACzF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAE9C,MAAM,UAAU,GAA0B;YACxC,EAAE,IAAI,EAAE,KAAK,EAAE;YACf,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;YACvC,EAAE,MAAM,EAAE,KAAK,EAAE;SAClB,CAAA;QACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI;gBAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAClD,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IAED,MAAM,OAAO,GAA0B,gBAAgB,CAAwB,KAAK,EAAE;QACpF,OAAO,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAEhD,IAAI,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhE,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,4FAA4F;YAC5F,yFAAyF;YACzF,oDAAoD;YACpD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC;gBACrE,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;gBAC/B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;oBAC3C,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBACjD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;wBAC3B,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;qBACxE,CAAC,CAAA;oBACF,IAAI,KAAK,IAAI,IAAI;wBAAE,OAAO,SAAS,CAAA;gBACrC,CAAC;YACH,CAAC;YAED,MAAM,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,WAAW,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,MAAM,CAAE,CAAA;YACvB,CAAC;YAED,6FAA6F;YAC7F,8DAA8D;YAC9D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;gBAC3B,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;aACxD,CAAC,CAAA;YACF,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrC,MAAM,IAAI,WAAW,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,CAAA;YACd,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;YACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;YAEzF,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAE,CAAA;QAClC,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;YACpC,uFAAuF;YACvF,sFAAsF;YACtF,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAA;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,CAAA;YACd,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAC/B,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;aAC5E,CAAC,CAAA;YACF,QAAQ,CAAC,OAAO,CAAC,CAAA;YAEjB,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAA;QACvC,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/resource.d.ts

@@ -1,4 +1,14 @@
-import type { IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource } from './types.js';
+import type { IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource, OrgEntityResource } from './types.js';
+/**
+ * The organization-entity registry.
+ *
+ * Both unique indexes are load-bearing. `slug` is what a rename writes, so the index is the only
+ * thing standing between two organizations and the same public name; `iamKey` is quoted by systems
+ * that were told it once and never asked again, so a duplicate there would silently hand one
+ * organization another's realm. `formerSlugs` is indexed but NOT unique-scoped as a set — a retired
+ * slug must stay findable, and uniqueness against it is enforced when a rename is applied.
+ */
+export declare const makeOrgEntityResource: (dbAlias?: string) => OrgEntityResource;
 export declare const makeIdentityAccountResource: (dbAlias?: string) => IdentityAccountResource;
 export declare const makeIdentityProfileResource: (dbAlias?: string) => IdentityProfileResource;
 export declare const makeIdentityCredentialsResource: (dbAlias?: string) => IdentityCredentialsResource;

package/build/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,uBAAuB,EAAmB,uBAAuB,EAAuB,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAMtK,eAAO,MAAM,2BAA2B,aAAc,MAAM,KAAG,uBAQ9D,CAAA;AAED,eAAO,MAAM,2BAA2B,aAAc,MAAM,KAAG,uBAe9D,CAAA;AAED,eAAO,MAAM,+BAA+B,aAAc,MAAM,KAAG,2BAOlE,CAAA"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,uBAAuB,EAAmB,uBAAuB,EAAuB,2BAA2B,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAOpM;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,iBAQxD,CAAA;AAED,eAAO,MAAM,2BAA2B,GAAI,UAAU,MAAM,KAAG,uBAQ9D,CAAA;AAED,eAAO,MAAM,2BAA2B,GAAI,UAAU,MAAM,KAAG,uBAe9D,CAAA;AAED,eAAO,MAAM,+BAA+B,GAAI,UAAU,MAAM,KAAG,2BAOlE,CAAA"}

package/build/resource.js

@@ -1,14 +1,30 @@
 import { makeMongoResource } from '@owlmeans/mongo-resource';
-import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_ACCOUNT_COLLECTION, AUTH_IDENTITY_PROFILE_COLLECTION, AUTH_IDENTITY_CREDENTIALS_COLLECTION } from './consts.js';
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_ORG_ENTITY, AUTH_IDENTITY_ACCOUNT_COLLECTION, AUTH_IDENTITY_PROFILE_COLLECTION, AUTH_IDENTITY_CREDENTIALS_COLLECTION, AUTH_IDENTITY_ORG_ENTITY_COLLECTION } from './consts.js';
+/**
+ * The organization-entity registry.
+ *
+ * Both unique indexes are load-bearing. `slug` is what a rename writes, so the index is the only
+ * thing standing between two organizations and the same public name; `iamKey` is quoted by systems
+ * that were told it once and never asked again, so a duplicate there would silently hand one
+ * organization another's realm. `formerSlugs` is indexed but NOT unique-scoped as a set — a retired
+ * slug must stay findable, and uniqueness against it is enforced when a rename is applied.
+ */
+export const makeOrgEntityResource = (dbAlias) => {
+    const resource = makeMongoResource(AUTH_IDENTITY_ORG_ENTITY, dbAlias, undefined, AUTH_IDENTITY_ORG_ENTITY_COLLECTION);
+    resource.index('slug', { slug: 1 }, { unique: true });
+    resource.index('iamKey', { iamKey: 1 }, { unique: true });
+    resource.index('formerSlugs', { formerSlugs: 1 });
+    return resource;
+};
 export const makeIdentityAccountResource = (dbAlias) => {
-    const resource = makeMongoResource(AUTH_IDENTITY_ACCOUNT, dbAlias, undefined, undefined, AUTH_IDENTITY_ACCOUNT_COLLECTION);
+    const resource = makeMongoResource(AUTH_IDENTITY_ACCOUNT, dbAlias, undefined, AUTH_IDENTITY_ACCOUNT_COLLECTION);
     resource.index('credential', { credential: 1 }, { unique: true });
     resource.index('entityId', { entityId: 1 });
     resource.index('secret', { secret: 1 }, { unique: true, sparse: true });
     return resource;
 };
 export const makeIdentityProfileResource = (dbAlias) => {
-    const resource = makeMongoResource(AUTH_IDENTITY_PROFILE, dbAlias, undefined, undefined, AUTH_IDENTITY_PROFILE_COLLECTION);
+    const resource = makeMongoResource(AUTH_IDENTITY_PROFILE, dbAlias, undefined, AUTH_IDENTITY_PROFILE_COLLECTION);
     /**
      * The account's mongo id — the ONLY ObjectId reference in the identity trio.
      * `profileId` is a composite key (`"{type}:{accountId}"`), `entityId` is the Base58
@@ -22,7 +38,7 @@ export const makeIdentityProfileResource = (dbAlias) => {
     return resource;
 };
 export const makeIdentityCredentialsResource = (dbAlias) => {
-    const resource = makeMongoResource(AUTH_IDENTITY_CREDENTIALS, dbAlias, undefined, undefined, AUTH_IDENTITY_CREDENTIALS_COLLECTION);
+    const resource = makeMongoResource(AUTH_IDENTITY_CREDENTIALS, dbAlias, undefined, AUTH_IDENTITY_CREDENTIALS_COLLECTION);
     resource.index('provider', { type: 1, userId: 1, credential: 1 }, { unique: true });
     resource.index('profileId', { profileId: 1 });
     return resource;

package/build/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EACL,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EACvE,gCAAgC,EAAE,gCAAgC,EAAE,oCAAoC,EACzG,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gCAAgC,CACvF,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gCAAgC,CACvF,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAA;IACnD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAChD,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAgB,EAA+B,EAAE;IAC/F,MAAM,QAAQ,GAAG,iBAAiB,CAChC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,CAC/F,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EACL,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,wBAAwB,EACjG,gCAAgC,EAAE,gCAAgC,EAAE,oCAAoC,EACxG,mCAAmC,EACpC,MAAM,aAAa,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAgB,EAAqB,EAAE;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAChC,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,CAClF,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;IACjD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,gCAAgC,CAC5E,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,gCAAgC,CAC5E,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAA;IACnD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAChD,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAgB,EAA+B,EAAE;IAC/F,MAAM,QAAQ,GAAG,iBAAiB,CAChC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,CACpF,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAepJ,eAAO,MAAM,0BAA0B,QAAO,sBA6K7C,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAmBpJ,eAAO,MAAM,0BAA0B,QAAO,sBAqM7C,CAAA"}

package/build/service.js

@@ -1,29 +1,41 @@
 import { appendContextual } from '@owlmeans/context';
 import { ALL_SCOPES, AuthRole } from '@owlmeans/auth';
 import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids';
-import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, AUTH_IDENTITY_ORG_ENTITY, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js';
 const MAX_SLUG_RETRIES = 5;
 // Stable external login key: "{type}:{service}:{providerSub}"
 const externalKey = (details) => [details.type, details.service, details.userId].join(EXTERNAL_KEY_DELIMITER);
 // Login-service credential stored on profile and credentials: "service:{type}:{service}"
 const loginService = (details) => [LOGIN_SERVICE_PREFIX, details.type, details.service].join(EXTERNAL_KEY_DELIMITER);
 export const makeIdentityLinkingService = () => {
+    /**
+     * The wire value for a stored entity id.
+     *
+     * Records key on the id; everything this service hands back is an auth payload, and payloads
+     * carry the slug. An id that no longer resolves yields undefined rather than leaking the raw
+     * id onto the wire, where a consumer would mistake it for a slug and compose names from it.
+     */
+    const slugOf = async (entityId) => {
+        if (entityId == null || entityId === '')
+            return undefined;
+        const ctx = service.ctx;
+        const entity = await ctx.service(ENTITY_RESOLVER).byId(entityId);
+        return entity?.slug;
+    };
     const service = appendContextual(AUTH_IDENTITY_LINKING, {
         getLinkedProfile: async (details) => {
             const ctx = service.ctx;
             const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
-            const { items: creds } = await credsResource.list({
-                criteria: {
-                    type: details.type,
-                    userId: externalKey(details),
-                    credential: loginService(details),
-                }
+            const cred = await credsResource.load({
+                type: details.type,
+                userId: externalKey(details),
+                credential: loginService(details),
             });
-            const cred = creds[0] ?? null;
             if (cred == null)
                 return null;
             const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
-            const profile = await profileResource.load(cred.profileId, 'profileId');
+            const profile = await profileResource.load({ profileId: cred.profileId });
             if (profile == null)
                 return null;
             return {
@@ -31,7 +43,7 @@ export const makeIdentityLinkingService = () => {
                 role: profile.role,
                 userId: profile.userId ?? profile.profileId,
                 profileId: profile.profileId,
-                entityId: profile.entityId,
+                entitySlug: await slugOf(profile.entityId),
                 scopes: profile.scopes,
             };
         },
@@ -40,19 +52,31 @@ export const makeIdentityLinkingService = () => {
             const accountResource = ctx.resource(AUTH_IDENTITY_ACCOUNT);
             const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
             const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
-            // Generate a unique local entity slug stored as the account credential.
+            const entityResource = ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
+            const resolver = ctx.service(ENTITY_RESOLVER);
+            // Every account gets its own organization. The entity record is created FIRST because it
+            // owns the two values that outlive everything else here: the id the account and its profiles
+            // are keyed by, and the frozen `iamKey` that realms and object names are minted from.
+            const entity = await entityResource.create({
+                slug: await resolver.mintSlug(),
+                formerSlugs: [],
+                // Frozen at birth and never recomputed. It cannot be the slug — the slug moves — and it
+                // cannot be the record id, which does not exist until this create returns.
+                iamKey: createIdOfLength(16, IdStyle.Base58),
+                names: {},
+                createdAt: new Date(),
+            });
+            const entityId = entity.id;
             let accountId = null;
-            let entityId = null;
             for (let i = 0; i < MAX_SLUG_RETRIES; i++) {
                 const credential = createIdOfLength(16, IdStyle.Base58);
                 try {
                     const account = await accountResource.create({
                         credential,
                         name: meta.username,
-                        entityId: credential,
+                        entityId,
                     });
                     accountId = account.id;
-                    entityId = account.credential;
                     break;
                 }
                 catch (err) {
@@ -61,7 +85,7 @@ export const makeIdentityLinkingService = () => {
                     throw err;
                 }
             }
-            if (accountId == null || entityId == null) {
+            if (accountId == null) {
                 throw new Error('Failed to generate unique account credential after retries');
             }
             const profileId = [details.type, accountId].join(EXTERNAL_KEY_DELIMITER);
@@ -80,7 +104,7 @@ export const makeIdentityLinkingService = () => {
             }
             catch (err) {
                 if (err?.code === 11000 || err?.message?.includes('duplicate')) {
-                    profile = await profileResource.get(profileId, 'profileId');
+                    profile = await profileResource.get({ profileId });
                 }
                 else {
                     throw err;
@@ -98,7 +122,7 @@ export const makeIdentityLinkingService = () => {
                 role: profile.role,
                 userId: profile.userId ?? profile.profileId,
                 profileId: profile.profileId,
-                entityId: profile.entityId,
+                entitySlug: await slugOf(profile.entityId),
                 scopes: profile.scopes,
             };
         },
@@ -123,17 +147,17 @@ export const makeIdentityLinkingService = () => {
         getOwnerProfiles: async (entityId) => {
             const ctx = service.ctx;
             const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
-            const { items: profiles } = await profileResource.list({ criteria: { entityId } });
-            return profiles.map(p => ({
+            const { items: profiles } = await profileResource.list({ entityId });
+            return await Promise.all(profiles.map(async (p) => ({
                 id: p.profileId,
                 name: p.name,
                 credential: p.credential,
-                entityId: p.entityId,
+                entitySlug: await slugOf(p.entityId),
                 scopes: p.scopes,
                 groups: p.groups,
                 permissions: p.permissions,
                 attributes: p.attributes,
-            }));
+            })));
         },
         getOwnerCredentials: async (userId, entityId, type) => {
             const ctx = service.ctx;
@@ -150,17 +174,16 @@ export const makeIdentityLinkingService = () => {
             };
             if (type != null)
                 credsFilter.type = type;
-            const { items: creds } = await credsResource.list(credsFilter);
-            if (creds.length === 0)
+            const cred = await credsResource.load(credsFilter);
+            if (cred == null)
                 return undefined;
-            const cred = creds[0];
             const profile = profiles.find(p => p.profileId === cred.profileId) ?? profiles[0];
             return {
                 type: cred.type,
                 role: profile.role,
                 userId: profile.userId ?? profile.profileId,
                 profileId: profile.profileId,
-                entityId: profile.entityId,
+                entitySlug: await slugOf(profile.entityId),
                 scopes: profile.scopes,
                 challenge: cred.challenge,
                 credential: cred.credential,