@owlmeans/server-auth-identity 0.1.18-rc.47 → 0.1.18-rc.48

package/README.md

@@ -10,7 +10,7 @@ whose grants decide access (use `@owlmeans/server-oidc-rp`'s guard and gate, or
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-identity@^0.1.18-rc.47
+bun add @owlmeans/server-auth-identity@^0.1.18-rc.48
 ```
 
 ## Concepts
@@ -309,7 +309,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.49
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.47",
-  "generatedAt": "2026-10-05T21:03:06.364Z",
+  "version": "0.1.18-rc.48",
+  "generatedAt": "2026-10-06T11:45:57.652Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-identity/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-identity
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.47"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.48"` in `dependencies`
 
 The identity store a deployment owns when it does not delegate identity to an external IAM. It
 answers *who is this person* (account + credentials), *what are they in this app and organization*

package/build/iam.d.ts

@@ -0,0 +1,22 @@
+import type { AuthPayload } from '@owlmeans/auth';
+/** Find-or-create an end-user identity scoped to an entity by email address.
+ *
+ *  Used by the OTP auth plugin: after code verification, look up whether this
+ *  email already has a profile under the entity and create one if not.
+ */
+export interface EmailIdentityArgs {
+    email: string;
+    /** The entity (project owner) this login is scoped to */
+    entityId?: string;
+    /** Human-readable display name (defaults to email) */
+    username?: string;
+}
+/** Result matches AuthPayload so it can be embedded directly in the credential. */
+export type EmailIdentityPayload = AuthPayload;
+/** Extension seam for IAM-backed identity operations — Phase 2 fills this */
+export interface IdentityIamExtension {
+    /** Inputs and result types for the email find-or-create path */
+    EmailIdentityArgs: EmailIdentityArgs;
+    EmailIdentityPayload: EmailIdentityPayload;
+}
+//# sourceMappingURL=iam.d.ts.map

package/build/iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mFAAmF;AACnF,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C"}

package/build/iam.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=iam.js.map

package/build/iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":""}

package/build/native.d.ts

@@ -0,0 +1,14 @@
+import type { MongoResource } from '@owlmeans/mongo-resource';
+import type { ResourceRecord } from '@owlmeans/resource';
+import type { Document } from 'mongodb';
+/**
+ * The collection filter addressing one record by id, exactly as the resource itself addresses it —
+ * `id` onto `_id`, a 24-hex string as an `ObjectId`, anything else matching nothing.
+ *
+ * Field-level updates go through the native collection (the resource contract replaces whole
+ * records), so they need the id the way the collection stores it.
+ */
+export declare const idFilter: <T extends ResourceRecord>(resource: MongoResource<T>, id: string) => Document;
+/** A unique index refused the write. */
+export declare const isDuplicateKey: (error: unknown) => boolean;
+//# sourceMappingURL=native.d.ts.map

package/build/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,cAAc,YAAY,aAAa,CAAC,CAAC,CAAC,MAAM,MAAM,KAAG,QACL,CAAA;AAEvF,wCAAwC;AACxC,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,OACoB,CAAA"}

package/build/native.js

@@ -0,0 +1,12 @@
+import { criteriaToFilter, MONGO_DUPLICATE_KEY } from '@owlmeans/mongo-resource';
+/**
+ * The collection filter addressing one record by id, exactly as the resource itself addresses it —
+ * `id` onto `_id`, a 24-hex string as an `ObjectId`, anything else matching nothing.
+ *
+ * Field-level updates go through the native collection (the resource contract replaces whole
+ * records), so they need the id the way the collection stores it.
+ */
+export const idFilter = (resource, id) => criteriaToFilter({ id }, new Map(resource.references().map(ref => [ref.field, ref])));
+/** A unique index refused the write. */
+export const isDuplicateKey = (error) => error?.code === MONGO_DUPLICATE_KEY;
+//# sourceMappingURL=native.js.map

package/build/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAKhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAA2B,QAA0B,EAAE,EAAU,EAAY,EAAE,CACrG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAEvF,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE,CACvD,KAAmC,EAAE,IAAI,KAAK,mBAAmB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.47",
+  "version": "0.1.18-rc.48",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -23,12 +23,12 @@
   },
   "dependencies": {
     "@owlmeans/auth": "^0.1.18-rc.40",
-    "@owlmeans/auth-common": "^0.1.18-rc.47",
-    "@owlmeans/basic-ids": "^0.1.18-rc.37",
+    "@owlmeans/auth-common": "^0.1.18-rc.48",
+    "@owlmeans/basic-ids": "^0.1.18-rc.38",
     "@owlmeans/context": "^0.1.18-rc.34",
     "@owlmeans/log": "^0.1.18-rc.2",
     "@owlmeans/mongo-resource": "^0.1.18-rc.43",
-    "@owlmeans/oidc": "^0.1.18-rc.55",
+    "@owlmeans/oidc": "^0.1.18-rc.56",
     "@owlmeans/resource": "^0.1.18-rc.40",
     "@owlmeans/server-context": "^0.1.18-rc.43",
     "@scure/base": "^2.4.0"