@owlmeans/server-auth-identity 0.1.18-rc.46 → 0.1.18-rc.48

package/README.md

@@ -10,7 +10,7 @@ whose grants decide access (use `@owlmeans/server-oidc-rp`'s guard and gate, or
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-identity@^0.1.18-rc.46
+bun add @owlmeans/server-auth-identity@^0.1.18-rc.48
 ```
 
 ## Concepts
@@ -24,12 +24,12 @@ bun add @owlmeans/server-auth-identity@^0.1.18-rc.46
 - **Credentials (`IdentityCredentials`)** — one row per sign-in method of an account (`accountId`),
   keyed by `"{type}:{service}:{providerSub}"`.
 - **Profile row (`IdentityProfile`)** — one person in one organization for one app (`service`):
-  `profileId` (computed by `profileIdOf(service, accountId)`), `owner`, `role`, `scopes`,
+  `profileId` (computed by `identityKeyHelper.profileIdOf(service, accountId)`), `owner`, `role`, `scopes`,
   `permissions`, `groups`. The row in the account's own organization is the app's PRIMARY row.
 - **Groups (`OrgGroup`)** — an app's groups, kept in the organization record, unique per
   (`service`, `key`).
-- **Primitives** — `ensureAccount` (find-or-register an account by method, then address) and
-  `ensureProfile` (find-or-create a row, primary row first).
+- **Primitives** — `identityOf(ctx).ensureAccount` (find-or-register an account by method, then
+  address) and `identityOf(ctx).ensureProfile` (find-or-create a row, primary row first).
 - **Linking service** — `IdentityLinkingService` signs a provider login into the deployment's own
   app and returns an `AuthPayload`.
 - **Entity resolver** — the `EntityResolverService` registered under `ENTITY_RESOLVER`. Registering
@@ -79,7 +79,7 @@ context.registerService(makeMyAppGate())
 import { createLazyService } from '@owlmeans/context'
 import type { GateService } from '@owlmeans/entrypoint'
 import { AuthForbidden } from '@owlmeans/auth'
-import { entityKeyOf } from '@owlmeans/auth-common'
+import { makeEntityScope } from '@owlmeans/auth-common'
 import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
 import type { IdentityProfileResource } from '@owlmeans/server-auth-identity'
 
@@ -89,7 +89,7 @@ export const makeMyAppGate = (alias: string = MY_APP_GATE): GateService => {
       await service.ready()
       const ctx = service.assertCtx<Config, Context>()
 
-      const entityId = entityKeyOf(req)
+      const entityId = makeEntityScope(req).entityKeyOf()
       if (req.auth == null || entityId == null) {
         throw new AuthForbidden('auth')
       }
@@ -120,7 +120,7 @@ A protocol uses it with `{ guards: DEFAULT_GUARD, gate: { alias: MY_APP_GATE, pa
 
 ```ts
 import { handlers } from '@owlmeans/server-app'
-import { requireEntityKey } from '@owlmeans/auth-common'
+import { makeEntityScope } from '@owlmeans/auth-common'
 import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
 import type { IdentityProfileResource } from '@owlmeans/server-auth-identity'
 
@@ -128,7 +128,7 @@ const api = handlers<Context>()
 
 export const members = api.request(memberProtocols.list, async (request, context) => {
   const { items } = await context.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
-    .list({ entityId: requireEntityKey(request), service: MY_APP }, { size: 0, sort: [{ field: 'createdAt', order: 'desc' }] })
+    .list({ entityId: makeEntityScope(request).requireEntityKey(), service: MY_APP }, { size: 0, sort: [{ field: 'createdAt', order: 'desc' }] })
 
   return items.map(({ profileId, role, name }) => ({ profileId, role, name }))
 })
@@ -160,10 +160,11 @@ payload ??= await linking.linkProfile(details, { username: 'person@example.org'
 ### Rows for a hosted app
 
 ```ts
-import { ensureAccount, ensureProfile } from '@owlmeans/server-auth-identity'
+import { identityOf } from '@owlmeans/server-auth-identity'
 
-const { account } = await ensureAccount(context, { email }, details) // writes no row
-const row = await ensureProfile(context, { account, service: clientId, entityId: account.entityId, owner: true })
+const identity = identityOf(context)
+const { account } = await identity.ensureAccount({ email }, details) // writes no row
+const row = await identity.ensureProfile({ account, service: clientId, entityId: account.entityId, owner: true })
 // a hosted app's rows carry `scopes: []`; a row in another organization brings the primary row with it
 ```
 
@@ -189,12 +190,12 @@ and never fails the sign-in, so anything a listener provisions needs its own bac
 ### Rename an organization and mint a durable name
 
 ```ts
-import { ENTITY_RESOLVER, requireEntityKey } from '@owlmeans/auth-common'
+import { ENTITY_RESOLVER, makeEntityScope } from '@owlmeans/auth-common'
 import type { EntityResolverService } from '@owlmeans/auth-common'
 
 export const rename = api.body(organizationProtocols.rename, async ({ slug }, context, request) => {
   const resolver = context.service<EntityResolverService>(ENTITY_RESOLVER)
-  const entity = await resolver.rename(requireEntityKey(request), slug) // old slug moves to formerSlugs
+  const entity = await resolver.rename(makeEntityScope(request).requireEntityKey(), slug) // old slug moves to formerSlugs
 
   return { slug: entity.slug }
 })
@@ -210,11 +211,11 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 | Symbol | Kind | Purpose |
 |---|---|---|
 | `appendAuthIdentityResources(context, dbAlias?, { service? })` | function | Register the four resources, the linking service for app `service`, the entity resolver and (unless one is registered) the identity-events service |
-| `profileIdOf(service, accountId)` | function | The computed profile id of an (account, app) |
-| `ensureAccount(ctx, { email, name? }, details?)` | function | The person's account — by method, then address, else registered with a personal organization |
-| `ensureProfile(ctx, { account, service, entityId, … })` | function | Find-or-create a row; the primary row first |
-| `credentialKeyOf(details)`, `credentialOf(ctx, details)`, `normalizeEmail(email)` | function | A method's credential key and stored row; the stored address form |
-| `listOrgGroups`, `putOrgGroup`, `removeOrgGroup` | function | An organization's groups of one app, by guarded field-level writes |
+| `identityKeyHelper.profileIdOf(service, accountId)` | method | The computed profile id of an (account, app) |
+| `identityOf(ctx).ensureAccount({ email, name? }, details?)` | method | The person's account — by method, then address, else registered with a personal organization |
+| `identityOf(ctx).ensureProfile({ account, service, entityId, … })` | method | Find-or-create a row; the primary row first |
+| `identityKeyHelper.credentialKeyOf(details)`, `identityOf(ctx).credentialOf(details)`, `identityKeyHelper.normalizeEmail(email)` | method | A method's credential key and stored row; the stored address form |
+| `orgGroupsOf(ctx).listOrgGroups`, `.putOrgGroup`, `.removeOrgGroup` | method | An organization's groups of one app, by guarded field-level writes |
 | `makeOrgEntityResource(dbAlias?)` | function | Mongo resource for `OrgEntity` |
 | `makeIdentityAccountResource(dbAlias?)` | function | Mongo resource for `IdentityAccount` |
 | `makeIdentityProfileResource(dbAlias?)` | function | Mongo resource for `IdentityProfile` |
@@ -263,7 +264,7 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 - Account `email` — trimmed, lower-case, unique.
 - Account / profile `entityId`, profile `userId` and `home`, credentials `accountId` — record ids,
   declared ObjectId references; a first registration creates the organization first.
-- Profile `profileId` — `profileIdOf(service, accountId)`: `"{service}:"` + 22 Base58 characters of
+- Profile `profileId` — `identityKeyHelper.profileIdOf(service, accountId)`: `"{service}:"` + 22 Base58 characters of
   `sha256("{accountId}:{service}")`. Computed, the same on every row of one (account, app).
 - Credentials `userId` — `"{type}:{service}:{providerSub}"`; unrelated to the profile's `userId`.
 - Credentials `credential` — `"service:{type}:{service}"`.
@@ -272,8 +273,8 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 
 - `Resource.take()` deletes the record it returns. Use `load(where)` or `list(where)` in gates and
   handlers, never `take()`.
-- Query profiles and organization records by `entityId` from `requireEntityKey(request)` /
-  `entityKeyOf(request)`, never by the slug.
+- Query profiles and organization records by `entityId` from
+  `makeEntityScope(request).requireEntityKey()` / `.entityKeyOf()`, never by the slug.
 - Without the resolver `request.entity` stays undefined and consumers fall back to the slug — call
   `appendAuthIdentityResources` (or register the resolver) in every service that serves organization
   data.
@@ -293,7 +294,7 @@ const namespace = await resolver.mintName(entityId, 'namespace', entity => `my-a
 ## Related packages
 
 - [`@owlmeans/server-auth`](../server-auth) — bearer verification; canonicalizes the slug through the resolver
-- [`@owlmeans/auth-common`](../auth-common) — `EntityResolverService`, `ENTITY_RESOLVER`, `requireEntityKey`, `attachEntity`
+- [`@owlmeans/auth-common`](../auth-common) — `EntityResolverService`, `ENTITY_RESOLVER`, `makeEntityScope` (`requireEntityKey`, `attachEntity`)
 - [`@owlmeans/auth`](../auth) — `AuthPayload`, `AuthRole`, `Profile`, errors
 - [`@owlmeans/server-oidc-rp`](../server-oidc-rp) — calls the linking service during an OAuth callback
 - [`@owlmeans/server-auth-otp`](../server-auth-otp) — email OTP plugin resolving users through the linking service
@@ -308,7 +309,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.46",
-  "generatedAt": "2026-10-05T08:32:19.089Z",
+  "version": "0.1.18-rc.48",
+  "generatedAt": "2026-10-06T11:45:57.652Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-identity/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-auth-identity
-description: How to use @owlmeans/server-auth-identity — the Mongo-backed identity store shared by a deployment's own sign-in and the apps it hosts. One account per e-mail (every sign-in method a credential on it), a personal organization per account, profile rows per (account, app, organization) with a computed profileId, organization groups, the IdentityLinkingService for the deployment's own app, the ensureAccount / ensureProfile primitives, the EntityResolverService with field-level rename/mintName, and the identity-events seam (entity created, profile created). Auto-invoked when importing appendAuthIdentityResources, an identity resource alias, IdentityLinkingService, ensureAccount/ensureProfile/profileIdOf, the org group helpers, the entity resolver or identityEvents.
+description: How to use @owlmeans/server-auth-identity — the Mongo-backed identity store shared by a deployment's own sign-in and the apps it hosts. One account per e-mail (every sign-in method a credential on it), a personal organization per account, profile rows per (account, app, organization) with a computed profileId, organization groups, the IdentityLinkingService for the deployment's own app, the identityOf(ctx) ensureAccount / ensureProfile primitives, the EntityResolverService with field-level rename/mintName, and the identity-events seam (entity created, profile created). Auto-invoked when importing appendAuthIdentityResources, an identity resource alias, IdentityLinkingService, identityOf/identityKeyHelper, the org group helpers (orgGroupsOf), the entity resolver or identityEvents.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-identity
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.46"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.48"` in `dependencies`
 
 The identity store a deployment owns when it does not delegate identity to an external IAM. It
 answers *who is this person* (account + credentials), *what are they in this app and organization*
@@ -21,11 +21,11 @@ serves the deployment's own app and every app it hosts (a platform's generated t
 | Export | Description |
 |--------|-------------|
 | `appendAuthIdentityResources(context, dbAlias?, { service? })` | Register the four resources, the linking service for app `service` (default `DEFAULT_APP_SERVICE`), the entity resolver and — unless one is already registered — the identity-events service |
-| `profileIdOf(service, accountId)` | The computed profile id of an (account, app) — `"{service}:{22 Base58 chars of sha256}"` |
-| `ensureAccount(ctx, { email, name? }, details?)` | The person's account: by the method's credential, then by e-mail, else registered with a personal organization; attaches `details` as a credential |
-| `ensureProfile(ctx, { account, service, entityId, owner?, role?, scopes?, permissions?, groups?, managed? })` | Find-or-create the row of (account, app, organization); ensures the primary row first |
-| `credentialKeyOf(details)`, `credentialOf(ctx, details)`, `normalizeEmail(email)` | A method's unique credential key; its stored row and account; the stored address form |
-| `listOrgGroups(ctx, entityId, service)`, `putOrgGroup(ctx, entityId, group)`, `removeOrgGroup(ctx, entityId, service, key)` | An organization's groups of one app — guarded field-level writes, unique per (`service`, `key`) |
+| `identityKeyHelper.profileIdOf(service, accountId)` | The computed profile id of an (account, app) — `"{service}:{22 Base58 chars of sha256}"` |
+| `identityOf(ctx).ensureAccount({ email, name? }, details?)` | The person's account: by the method's credential, then by e-mail, else registered with a personal organization; attaches `details` as a credential |
+| `identityOf(ctx).ensureProfile({ account, service, entityId, owner?, role?, scopes?, permissions?, groups?, managed? })` | Find-or-create the row of (account, app, organization); ensures the primary row first |
+| `identityKeyHelper.credentialKeyOf(details)`, `identityOf(ctx).credentialOf(details)`, `identityKeyHelper.normalizeEmail(email)` | A method's unique credential key; its stored row and account; the stored address form |
+| `orgGroupsOf(ctx)` — `.listOrgGroups(entityId, service)`, `.putOrgGroup(entityId, group)`, `.removeOrgGroup(entityId, service, key)` | An organization's groups of one app — guarded field-level writes, unique per (`service`, `key`) |
 | `makeOrgEntityResource`, `makeIdentityAccountResource`, `makeIdentityProfileResource`, `makeIdentityCredentialsResource` | Mongo resource makers (`dbAlias?`) |
 | `makeIdentityLinkingService({ service? })` | The `IdentityLinkingService` for one app |
 | `makeEntityResolverService(alias?)` | The `EntityResolverService`, cached 30 s per resolved value (slim references only) |
@@ -49,7 +49,7 @@ serves the deployment's own app and every app it hosts (a platform's generated t
 | `OrgGroup` | `service`, `key`, `title?`, `managed?`, `permissions`, `bundles?` (`{ filter?, permissions? }`) | Members are the rows naming `key` in `groups`; one app never writes another app's group |
 
 **The primary row** of an (account, app) is its row in the account's main organization. It exists
-whenever any row of that pair does — `ensureProfile` creates it FIRST, as owner of the personal
+whenever any row of that pair does — `identityOf(ctx).ensureProfile` creates it FIRST, as owner of the personal
 organization — because it is what says whether the person may use the app at all.
 
 **`profileId` is computed, never minted.** Two first sign-ins racing write the same key and the
@@ -77,7 +77,7 @@ Registering the resolver is the signal that the deployment HAS organizations: wi
 resource's native `collection.updateOne`), never the whole document** — a replace from a stale read
 erases the groups or names another writer added since. The resolver's `rename` is guarded on the slug
 it read (`formerSlugs` moves only with it), `mintName` on the name still being unset (first minter
-wins, both answer what was stored), `putOrgGroup` replaces the matching element (`groups.$`) or
+wins, both answer what was stored), `orgGroupsOf(ctx).putOrgGroup` replaces the matching element (`groups.$`) or
 pushes where none matches (`$not: { $elemMatch }`) and retries if a concurrent put won.
 
 ## Usage
@@ -107,8 +107,8 @@ payload ??= await linking.linkProfile(details, { username: verifiedEmail })
 
 - `getLinkedProfile` — credential → account → the own app's row in the main organization. A method
   that is linked but has no row of THIS app answers `null`, and the caller's `linkProfile` writes it.
-- `linkProfile(details, { username })` — `ensureAccount` with `username` as the e-mail (the login
-  must have verified it) and `details.username` as the display name, then `ensureProfile` for the own
+- `linkProfile(details, { username })` — `identityOf(ctx).ensureAccount` with `username` as the e-mail (the login
+  must have verified it) and `details.username` as the display name, then `identityOf(ctx).ensureProfile` for the own
   app in the main organization (`owner: true`, `scopes: ['*']`). A second method of a known person
   adds a credential; a person known from another app gets this app's row in their existing
   organization.
@@ -121,21 +121,22 @@ payload ??= await linking.linkProfile(details, { username: verifiedEmail })
 ### Write rows for a hosted app
 
 ```typescript
-import { ensureAccount, ensureProfile } from '@owlmeans/server-auth-identity'
+import { identityOf } from '@owlmeans/server-auth-identity'
 
-const { account } = await ensureAccount(ctx, { email }, { type: 'email-otp', service: 'email', clientId, userId: email })
-const row = await ensureProfile(ctx, { account, service: clientId, entityId: account.entityId, owner: true })
+const identity = identityOf(ctx)
+const { account } = await identity.ensureAccount({ email }, { type: 'email-otp', service: 'email', clientId, userId: email })
+const row = await identity.ensureProfile({ account, service: clientId, entityId: account.entityId, owner: true })
 ```
 
-`ensureAccount` writes no row — which app a person is a user of is the caller's to say. Hosted-app
-rows carry `scopes: []` (the default); never give them the own app's wildcard. `ensureProfile`
+`identityOf(ctx).ensureAccount` writes no row — which app a person is a user of is the caller's to say. Hosted-app
+rows carry `scopes: []` (the default); never give them the own app's wildcard. `identityOf(ctx).ensureProfile`
 returns an existing row unchanged: it never rewrites owner, groups or grants.
 
 ### Read rows in a gate or handler
 
 ```typescript
 const profile = await ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
-  .load({ entityId: requireEntityKey(req), profileId: req.auth.profileId })
+  .load({ entityId: makeEntityScope(req).requireEntityKey(), profileId: req.auth.profileId })
 if (profile == null || profile.service !== MY_APP) throw new AuthForbidden('profile')
 ```
 
@@ -151,14 +152,14 @@ identityEvents(context)?.onProfileCreated(async (event, ctx) => {
 ```
 
 - **`onProfileCreated`** — `{ entityId, entitySlug, accountId, profileId, service, owner }`, fired
-  by `ensureProfile` when the PRIMARY row of an (account, app) is created, by the create that won
+  by `identityOf(ctx).ensureProfile` when the PRIMARY row of an (account, app) is created, by the create that won
   only. Once per (account, app); a further organization's row announces nothing. Key app-level
   provisioning here and filter on `service`.
 - **`onEntityCreated`** — `EntityCreatedEvent` (`entityId`, `entitySlug`, `iamKey`, `accountId`,
   `profileId`, `username`, login `type`, provider `service`, the owner row's app as
-  `profileService`, `createdAt`), fired by `linkProfile` when `ensureAccount` registered the person
-  (`registered`), after the owner row exists. A caller registering through `ensureAccount` +
-  `ensureProfile` itself announces with `propagateEntityCreated`.
+  `profileService`, `createdAt`), fired by `linkProfile` when `identityOf(ctx).ensureAccount` registered the person
+  (`registered`), after the owner row exists. A caller registering through `identityOf(ctx).ensureAccount` +
+  `.ensureProfile` itself announces with `propagateEntityCreated`.
 - Listeners run in registration order, each awaited; a throwing listener is logged and never fails
   the sign-in, and the next one still runs — so whatever a listener provisions needs a periodic
   backfill. `identityEvents(ctx)` is `null` where the service is not registered.
@@ -174,7 +175,7 @@ identityEvents(context)?.onProfileCreated(async (event, ctx) => {
 | One method attached twice at once | credentials (`type`, `userId`, `credential`) unique | Duplicate ignored |
 | One row created twice at once | profile (`profileId`, `entityId`) unique | Loser loads the winner's row; only the winner announces |
 
-A credential row pointing at a deleted account is removed by `ensureAccount`, so the method can be
+A credential row pointing at a deleted account is removed by `identityOf(ctx).ensureAccount`, so the method can be
 attached again.
 
 ## Resource indexes
@@ -206,13 +207,13 @@ across organizations, not inside one.
   a guarded `collection.updateOne`.
 - **`IdentityLinkingService` is compatible with `AccountLinkingService`** of
   `@owlmeans/server-oidc-rp` but declared independently (acyclic dependencies).
-- **The address is the identity.** Whoever calls `ensureAccount` / `linkProfile` with an address is
+- **The address is the identity.** Whoever calls `identityOf(ctx).ensureAccount` / `linkProfile` with an address is
   handed that person's account, so every caller must have verified it (a verified provider claim, a
   proven code, a full-trust key).
 - `mintSlug` throws `entity:slug-exhausted`; `rename` throws `entity:slug-malformed:<slug>`,
   `entity:slug-taken:<slug>` (a name any entity has ever answered to, or a unique-index race) and
   `entity:rename-contended:<id>`; `mintName` refuses an empty, dotted or `$` key
-  (`entity:name-key-malformed:<key>`); `putOrgGroup` throws `UnknownRecordError` for a missing
+  (`entity:name-key-malformed:<key>`); `orgGroupsOf(ctx).putOrgGroup` throws `UnknownRecordError` for a missing
   organization.
 - The resolver caches every name a hit was found under for 30 s (`OrgEntityRef` only); a rename is
   visible to other replicas within that window, survivable because the old slug keeps resolving.
@@ -221,7 +222,7 @@ across organizations, not inside one.
 
 - **`@owlmeans/server-auth`** — verifies the bearer token; re-reads the row through this package.
 - **`@owlmeans/auth-common`** — declares `EntityResolverService`, `ENTITY_RESOLVER`, `OrgEntityRef`
-  and the `entityKeyOf` / `requireEntityKey` / `attachEntity` helpers.
+  and `makeEntityScope(req)` with its `entityKeyOf` / `requireEntityKey` / `attachEntity`.
 - **`@owlmeans/server-oidc-rp`** — the relying party that calls the linking service on a callback.
 - **`@owlmeans/server-auth-otp`** — the e-mail-OTP plugin resolves its user through a linking service.
 - **`@owlmeans/iam-integrated`** — the IAM over the same store: hosted apps' rows, groups and grants.
@@ -230,6 +231,6 @@ across organizations, not inside one.
 
 - `@owlmeans/auth`, `@owlmeans/auth-common`, `@owlmeans/oidc`, `@owlmeans/context`,
   `@owlmeans/resource`, `@owlmeans/server-context`
-- `@owlmeans/basic-ids` — random keys and word slugs; `@scure/base` + `node:crypto` — `profileIdOf`
-- `@owlmeans/mongo-resource` — resources, declared references and indexes, `criteriaToFilter`
+- `@owlmeans/basic-ids` — random keys and word slugs; `@scure/base` + `node:crypto` — `identityKeyHelper.profileIdOf`
+- `@owlmeans/mongo-resource` — resources, declared references and indexes, `mongoCriteriaHelper.criteriaToFilter`
 - `mongodb` (peer)

package/build/groups/types.d.ts

@@ -0,0 +1,23 @@
+import type { OrgGroup } from '../types.js';
+/** The groups apps keep in organizations of one context's identity store. */
+export interface OrgGroupHelper {
+    /** The groups one app keeps in an organization. */
+    listOrgGroups: (entityId: string, service: string) => Promise<OrgGroup[]>;
+    /**
+     * Create or replace the group (`service`, `key`) of an organization, keeping that pair unique.
+     *
+     * Two guarded field-level updates rather than a read and a write: replace the element that matches,
+     * else push one where none matches. A concurrent put of the same pair makes the push match nothing,
+     * and the next pass replaces what it pushed — so the pair can never appear twice, and nothing else
+     * in the document (another app's groups, minted names, the slug) is ever written.
+     *
+     * @throws {UnknownRecordError} when the organization does not exist.
+     */
+    putOrgGroup: (entityId: string, group: OrgGroup) => Promise<OrgGroup>;
+    /**
+     * Remove the group (`service`, `key`) from an organization — `true` when it was there. The rows that
+     * name it in their `groups` are the caller's to update.
+     */
+    removeOrgGroup: (entityId: string, service: string, key: string) => Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/groups/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/groups/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE;;;;;;;;;OASG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrE;;;OAGG;IACH,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACrF"}

package/build/groups/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/groups/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/groups/types.ts"],"names":[],"mappings":""}

package/build/groups.d.ts

@@ -1,21 +1,13 @@
 import type { OrgGroup } from './types.js';
+import type { OrgGroupHelper } from './groups/types.js';
 import type { Context } from './types.local.js';
-/** The groups one app keeps in an organization. */
+export declare const makeOrgGroupHelper: (ctx: Context) => OrgGroupHelper;
+/** The organization groups of a context — one per context. */
+export declare const orgGroupsOf: (target: Context) => OrgGroupHelper;
+/** @deprecated compat:factory-refactor — use `orgGroupsOf(ctx).listOrgGroups(…)` */
 export declare const listOrgGroups: (ctx: Context, entityId: string, service: string) => Promise<OrgGroup[]>;
-/**
- * Create or replace the group (`service`, `key`) of an organization, keeping that pair unique.
- *
- * Two guarded field-level updates rather than a read and a write: replace the element that matches,
- * else push one where none matches. A concurrent put of the same pair makes the push match nothing,
- * and the next pass replaces what it pushed — so the pair can never appear twice, and nothing else
- * in the document (another app's groups, minted names, the slug) is ever written.
- *
- * @throws {UnknownRecordError} when the organization does not exist.
- */
+/** @deprecated compat:factory-refactor — use `orgGroupsOf(ctx).putOrgGroup(…)` */
 export declare const putOrgGroup: (ctx: Context, entityId: string, group: OrgGroup) => Promise<OrgGroup>;
-/**
- * Remove the group (`service`, `key`) from an organization — `true` when it was there. The rows that
- * name it in their `groups` are the caller's to update.
- */
+/** @deprecated compat:factory-refactor — use `orgGroupsOf(ctx).removeOrgGroup(…)` */
 export declare const removeOrgGroup: (ctx: Context, entityId: string, service: string, key: string) => Promise<boolean>;
 //# sourceMappingURL=groups.d.ts.map

package/build/groups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAqB,QAAQ,EAAE,MAAM,YAAY,CAAA;AAG7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAI/C,mDAAmD;AACnD,eAAO,MAAM,aAAa,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,KAAG,OAAO,CAAC,QAAQ,EAAE,CACT,CAAA;AAE/F;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,QAAe,OAAO,YAAY,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CA2BnG,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CAQlH,CAAA"}
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAqB,QAAQ,EAAE,MAAM,YAAY,CAAA;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/C,eAAO,MAAM,kBAAkB,QAAS,OAAO,KAAG,cA8CjD,CAAA;AAED,8DAA8D;AAC9D,eAAO,MAAM,WAAW,qCAAyC,CAAA;AAEjE,oFAAoF;AACpF,eAAO,MAAM,aAAa,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,KAAG,OAAO,CAAC,QAAQ,EAAE,CAC/C,CAAA;AAEzD,kFAAkF;AAClF,eAAO,MAAM,WAAW,QAAe,OAAO,YAAY,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,QAAQ,CAC/C,CAAA;AAErD,qFAAqF;AACrF,eAAO,MAAM,cAAc,QAAe,OAAO,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CACpD,CAAA"}

package/build/groups.js

@@ -1,50 +1,47 @@
 import { UnknownRecordError } from '@owlmeans/resource';
+import { memoHelper } from '@owlmeans/context';
 import { AUTH_IDENTITY_ORG_ENTITY, MAX_GUARDED_UPDATE_ATTEMPTS } from './consts.js';
-import { idFilter } from './native.js';
-const entities = (ctx) => ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
-/** The groups one app keeps in an organization. */
-export const listOrgGroups = async (ctx, entityId, service) => ((await entities(ctx).get(entityId)).groups ?? []).filter(group => group.service === service);
-/**
- * Create or replace the group (`service`, `key`) of an organization, keeping that pair unique.
- *
- * Two guarded field-level updates rather than a read and a write: replace the element that matches,
- * else push one where none matches. A concurrent put of the same pair makes the push match nothing,
- * and the next pass replaces what it pushed — so the pair can never appear twice, and nothing else
- * in the document (another app's groups, minted names, the slug) is ever written.
- *
- * @throws {UnknownRecordError} when the organization does not exist.
- */
-export const putOrgGroup = async (ctx, entityId, group) => {
-    if (group.service === '' || group.key === '') {
-        throw new SyntaxError(`entity:group-malformed:${group.service}:${group.key}`);
-    }
-    const res = entities(ctx);
-    const id = idFilter(res, entityId);
-    const pair = { service: group.service, key: group.key };
-    for (let attempt = 0; attempt < MAX_GUARDED_UPDATE_ATTEMPTS; ++attempt) {
-        const replaced = await res.collection.updateOne({ ...id, groups: { $elemMatch: pair } }, { $set: { 'groups.$': group, updatedAt: new Date() } });
-        if (replaced.matchedCount > 0) {
-            return group;
+import { nativeUtils } from './utils/native.js';
+export const makeOrgGroupHelper = (ctx) => {
+    const entities = () => ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
+    const listOrgGroups = async (entityId, service) => ((await entities().get(entityId)).groups ?? []).filter(group => group.service === service);
+    const putOrgGroup = async (entityId, group) => {
+        if (group.service === '' || group.key === '') {
+            throw new SyntaxError(`entity:group-malformed:${group.service}:${group.key}`);
         }
-        const push = { $push: { groups: group }, $set: { updatedAt: new Date() } };
-        const pushed = await res.collection.updateOne({ ...id, groups: { $not: { $elemMatch: pair } } }, push);
-        if (pushed.matchedCount > 0) {
-            return group;
+        const res = entities();
+        const id = nativeUtils.idFilter(res, entityId);
+        const pair = { service: group.service, key: group.key };
+        for (let attempt = 0; attempt < MAX_GUARDED_UPDATE_ATTEMPTS; ++attempt) {
+            const replaced = await res.collection.updateOne({ ...id, groups: { $elemMatch: pair } }, { $set: { 'groups.$': group, updatedAt: new Date() } });
+            if (replaced.matchedCount > 0) {
+                return group;
+            }
+            const push = { $push: { groups: group }, $set: { updatedAt: new Date() } };
+            const pushed = await res.collection.updateOne({ ...id, groups: { $not: { $elemMatch: pair } } }, push);
+            if (pushed.matchedCount > 0) {
+                return group;
+            }
+            if (await res.load(entityId) == null) {
+                throw new UnknownRecordError(entityId);
+            }
         }
-        if (await res.load(entityId) == null) {
-            throw new UnknownRecordError(entityId);
-        }
-    }
-    throw new SyntaxError(`entity:group-contended:${group.service}:${group.key}`);
-};
-/**
- * Remove the group (`service`, `key`) from an organization — `true` when it was there. The rows that
- * name it in their `groups` are the caller's to update.
- */
-export const removeOrgGroup = async (ctx, entityId, service, key) => {
-    const res = entities(ctx);
-    const pull = { $pull: { groups: { service, key } }, $set: { updatedAt: new Date() } };
-    const result = await res.collection.updateOne({ ...idFilter(res, entityId), groups: { $elemMatch: { service, key } } }, pull);
-    return result.matchedCount > 0;
+        throw new SyntaxError(`entity:group-contended:${group.service}:${group.key}`);
+    };
+    const removeOrgGroup = async (entityId, service, key) => {
+        const res = entities();
+        const pull = { $pull: { groups: { service, key } }, $set: { updatedAt: new Date() } };
+        const result = await res.collection.updateOne({ ...nativeUtils.idFilter(res, entityId), groups: { $elemMatch: { service, key } } }, pull);
+        return result.matchedCount > 0;
+    };
+    return { listOrgGroups, putOrgGroup, removeOrgGroup };
 };
+/** The organization groups of a context — one per context. */
+export const orgGroupsOf = memoHelper.oncePer(makeOrgGroupHelper);
+/** @deprecated compat:factory-refactor — use `orgGroupsOf(ctx).listOrgGroups(…)` */
+export const listOrgGroups = async (ctx, entityId, service) => await orgGroupsOf(ctx).listOrgGroups(entityId, service);
+/** @deprecated compat:factory-refactor — use `orgGroupsOf(ctx).putOrgGroup(…)` */
+export const putOrgGroup = async (ctx, entityId, group) => await orgGroupsOf(ctx).putOrgGroup(entityId, group);
+/** @deprecated compat:factory-refactor — use `orgGroupsOf(ctx).removeOrgGroup(…)` */
+export const removeOrgGroup = async (ctx, entityId, service, key) => await orgGroupsOf(ctx).removeOrgGroup(entityId, service, key);
 //# sourceMappingURL=groups.js.map

package/build/groups.js.map

@@ -1 +1 @@
-{"version":3,"file":"groups.js","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAGvD,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGtC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;AAE5F,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CAC1G,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;AAE/F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE;IACtG,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IAEvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC7C,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EACvC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CACvD,CAAA;QACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;QACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QACtG,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;AAC/E,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE;IACrH,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;IAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC3C,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAC/E,CAAA;IAED,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;AAChC,CAAC,CAAA"}
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../src/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG9C,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAI/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAkB,EAAE;IACjE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;IAEhF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CACrF,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAE5F,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE;QACjF,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAA;QAEvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC7C,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EACvC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CACvD,CAAA;YACD,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;YACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YACtG,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,0BAA0B,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/E,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE;QAChG,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,MAAM,IAAI,GAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAA;QAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAC3C,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAC3F,CAAA;QAED,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;IAChC,CAAC,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAuB,EAAE,CAC1G,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AAEzD,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,KAAe,EAAqB,EAAE,CACtG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;AAErD,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAoB,EAAE,CACrH,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA"}

package/build/iam/types.d.ts

@@ -0,0 +1,22 @@
+import type { AuthPayload } from '@owlmeans/auth';
+/** Find-or-create an end-user identity scoped to an entity by email address.
+ *
+ *  Used by the OTP auth plugin: after code verification, look up whether this
+ *  email already has a profile under the entity and create one if not.
+ */
+export interface EmailIdentityArgs {
+    email: string;
+    /** The entity (project owner) this login is scoped to */
+    entityId?: string;
+    /** Human-readable display name (defaults to email) */
+    username?: string;
+}
+/** Result matches AuthPayload so it can be embedded directly in the credential. */
+export type EmailIdentityPayload = AuthPayload;
+/** Extension seam for IAM-backed identity operations — Phase 2 fills this */
+export interface IdentityIamExtension {
+    /** Inputs and result types for the email find-or-create path */
+    EmailIdentityArgs: EmailIdentityArgs;
+    EmailIdentityPayload: EmailIdentityPayload;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/iam/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/iam/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mFAAmF;AACnF,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C"}

package/build/iam/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/iam/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/iam/types.ts"],"names":[],"mappings":""}

package/build/identity/types.d.ts

@@ -0,0 +1,35 @@
+import type { ProviderProfileDetails } from '@owlmeans/oidc';
+import type { EnsureAccountArgs, EnsuredAccount, EnsureProfileArgs, IdentityAccount, IdentityCredentials, IdentityProfile } from '../types.js';
+/** A sign-in method's credential row and the account it signs into, if any. */
+export interface LinkedCredential {
+    credential: IdentityCredentials;
+    account: IdentityAccount | null;
+}
+/** The identity store of one context: accounts, their app rows and their sign-in methods. */
+export interface IdentityHelper {
+    /** The credential row of a sign-in method and the account it signs into, if any. */
+    credentialOf: (details: ProviderProfileDetails) => Promise<LinkedCredential | null>;
+    /**
+     * The account of a person — one per e-mail address, whichever method they sign in by.
+     *
+     * Looked up by the sign-in method's credential first (a returning login), then by the address (a
+     * further method of a known person, which is attached as a credential); otherwise registered with a
+     * personal organization. Writes no profile row: which app the person is a user of is the caller's
+     * to say, through {@link IdentityHelper.ensureProfile}.
+     *
+     * Every caller must have established the address — a verified provider claim, a proven code, a
+     * full-trust key — because whoever names an address here is handed that person's account.
+     */
+    ensureAccount: (args: EnsureAccountArgs, details?: ProviderProfileDetails) => Promise<EnsuredAccount>;
+    /**
+     * The row of a person in one organization for one app. Idempotent: an existing row is returned as
+     * it is, never rewritten.
+     *
+     * A row outside the account's main organization brings the PRIMARY row of the same (account, app)
+     * with it — created first, as the owner of the personal organization — because the primary row is
+     * what says whether the person may use the app at all; a crash between the two must never leave a
+     * membership without it.
+     */
+    ensureProfile: (args: EnsureProfileArgs) => Promise<IdentityProfile>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EACV,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,eAAe,EAC5G,MAAM,aAAa,CAAA;AAEpB,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,mBAAmB,CAAA;IAC/B,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CAChC;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,YAAY,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACnF;;;;;;;;;;OAUG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IACrG;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;CACrE"}

package/build/identity/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":""}