@owlmeans/server-auth-identity 0.1.18-rc.8 → 0.1.18-rc.9

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.7",
-  "generatedAt": "2026-08-24T21:14:00.093Z",
+  "version": "0.1.18-rc.8",
+  "generatedAt": "2026-08-27T16:32:18.461Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-identity/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-identity
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.7"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.8"` in `dependencies`
 
 ## Key Exports
 

package/build/consts.d.ts

@@ -2,10 +2,13 @@ export declare const AUTH_IDENTITY_ACCOUNT = "auth-identity:account";
 export declare const AUTH_IDENTITY_PROFILE = "auth-identity:profile";
 export declare const AUTH_IDENTITY_CREDENTIALS = "auth-identity:credentials";
 export declare const AUTH_IDENTITY_LINKING = "auth-identity:linking";
+export declare const AUTH_IDENTITY_ORG_ENTITY = "auth-identity:org-entity";
 export declare const AUTH_IDENTITY_ACCOUNT_COLLECTION = "account";
 export declare const AUTH_IDENTITY_PROFILE_COLLECTION = "profile";
 export declare const AUTH_IDENTITY_CREDENTIALS_COLLECTION = "credentials";
+export declare const AUTH_IDENTITY_ORG_ENTITY_COLLECTION = "org-entity";
 export declare const AUTH_IDENTITY_DB_ALIAS = "auth-identity";
+export declare const MAX_ENTITY_SLUG_ATTEMPTS = 8;
 export declare const LOGIN_SERVICE_PREFIX = "service";
 export declare const EXTERNAL_KEY_DELIMITER = ":";
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAM5D,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,oCAAoC,gBAAgB,CAAA;AAIjE,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAGrD,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,wBAAwB,6BAA6B,CAAA;AAMlE,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,gCAAgC,YAAY,CAAA;AACzD,eAAO,MAAM,oCAAoC,gBAAgB,CAAA;AACjE,eAAO,MAAM,mCAAmC,eAAe,CAAA;AAI/D,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAIrD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAGzC,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}

package/build/consts.js

@@ -6,6 +6,7 @@ export const AUTH_IDENTITY_ACCOUNT = 'auth-identity:account';
 export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile';
 export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials';
 export const AUTH_IDENTITY_LINKING = 'auth-identity:linking';
+export const AUTH_IDENTITY_ORG_ENTITY = 'auth-identity:org-entity';
 // Colon-free Mongo collection base names. The final collection name is
 // `${resourcePrefix}${collection}` — e.g. with the project prefix 'viam-' this yields
 // 'viam-account'. Register the identity resources against a db config that carries the
@@ -13,9 +14,13 @@ export const AUTH_IDENTITY_LINKING = 'auth-identity:linking';
 export const AUTH_IDENTITY_ACCOUNT_COLLECTION = 'account';
 export const AUTH_IDENTITY_PROFILE_COLLECTION = 'profile';
 export const AUTH_IDENTITY_CREDENTIALS_COLLECTION = 'credentials';
+export const AUTH_IDENTITY_ORG_ENTITY_COLLECTION = 'org-entity';
 // Suggested db-config alias for a dedicated config whose resourcePrefix scopes the
 // collection prefix to identity collections only (not the whole database).
 export const AUTH_IDENTITY_DB_ALIAS = 'auth-identity';
+// How many slugs to try before giving up on minting a free one. Collisions are settled against a
+// unique index, so this bounds a retry loop rather than a probability.
+export const MAX_ENTITY_SLUG_ATTEMPTS = 8;
 // Helper prefixes for stable key derivation
 export const LOGIN_SERVICE_PREFIX = 'service';
 export const EXTERNAL_KEY_DELIMITER = ':';

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAE5D,uEAAuE;AACvE,sFAAsF;AACtF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAA;AAEjE,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,wFAAwF;AACxF,sFAAsF;AACtF,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAElE,uEAAuE;AACvE,sFAAsF;AACtF,uFAAuF;AACvF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAA;AACzD,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAA;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAG,YAAY,CAAA;AAE/D,mFAAmF;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,iGAAiG;AACjG,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}

package/build/helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD,eAAO,MAAM,2BAA2B,YAC7B,YAAY,CAAC,GAAG,CAAC,YAChB,MAAM,KACf,IAKF,CAAA"}
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,eAAO,MAAM,2BAA2B,YAC7B,YAAY,CAAC,GAAG,CAAC,YAChB,MAAM,KACf,IAUF,CAAA"}

package/build/helper.js

@@ -1,9 +1,15 @@
-import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource } from './resource.js';
+import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource, makeOrgEntityResource } from './resource.js';
 import { makeIdentityLinkingService } from './service.js';
+import { makeEntityResolverService } from './resolver.js';
 export const appendAuthIdentityResources = (context, dbAlias) => {
     context.registerResource(makeIdentityAccountResource(dbAlias));
     context.registerResource(makeIdentityProfileResource(dbAlias));
     context.registerResource(makeIdentityCredentialsResource(dbAlias));
+    context.registerResource(makeOrgEntityResource(dbAlias));
     context.registerService(makeIdentityLinkingService());
+    // Registering the resolver is what tells the server boundary that this deployment HAS
+    // organizations: without it `request.entity` stays undefined and every consumer falls back to
+    // treating the token's slug as the only entity value there is.
+    context.registerService(makeEntityResolverService());
 };
 //# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAA;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;AACvD,CAAC,CAAA"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAChJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;IACxD,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;IACrD,sFAAsF;IACtF,8FAA8F;IAC9F,+DAA+D;IAC/D,OAAO,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAA;AACtD,CAAC,CAAA"}

package/build/index.d.ts

@@ -2,6 +2,7 @@ export * from './consts.js';
 export type * from './types.js';
 export * from './resource.js';
 export * from './service.js';
+export * from './resolver.js';
 export * from './helper.js';
 export * from './iam.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}

package/build/index.js

@@ -1,6 +1,7 @@
 export * from './consts.js';
 export * from './resource.js';
 export * from './service.js';
+export * from './resolver.js';
 export * from './helper.js';
 export * from './iam.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA"}

package/build/resolver.d.ts

@@ -0,0 +1,3 @@
+import type { EntityResolverService } from '@owlmeans/auth-common';
+export declare const makeEntityResolverService: (alias?: string) => EntityResolverService;
+//# sourceMappingURL=resolver.d.ts.map

package/build/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAgB,MAAM,uBAAuB,CAAA;AAgChF,eAAO,MAAM,yBAAyB,WAC7B,MAAM,KACZ,qBAsIF,CAAA"}

package/build/resolver.js

@@ -0,0 +1,138 @@
+import { appendContextual } from '@owlmeans/context';
+import { ENTITY_RESOLVER, ENTITY_SLUG_PATTERN } from '@owlmeans/auth-common';
+import { generateWordSlug, nextSlugCandidate } from '@owlmeans/basic-ids';
+import { AUTH_IDENTITY_ORG_ENTITY, MAX_ENTITY_SLUG_ATTEMPTS } from './consts.js';
+/**
+ * How long a resolution is trusted without re-reading the registry.
+ *
+ * Every authenticated request resolves an entity, so an uncached resolver would put a database
+ * round-trip in front of the whole API. The cost of the cache is a rename taking up to this long
+ * to be seen by other replicas — which is survivable precisely because the old slug keeps
+ * resolving through `formerSlugs` rather than failing.
+ */
+const CACHE_TTL = 30_000;
+/** What a stored record id looks like. Anything else can only be a slug or a frozen key. */
+const RECORD_ID = /^[0-9a-f]{24}$/i;
+/** A stored record as the contract exposes it. Persisted records always carry an id. */
+const toRef = (entity) => entity == null ? null : {
+    id: entity.id, slug: entity.slug, formerSlugs: entity.formerSlugs, iamKey: entity.iamKey,
+};
+export const makeEntityResolverService = (alias = ENTITY_RESOLVER) => {
+    // Keyed by every name a caller might arrive with — id, slug, former slug, iamKey — so a hit
+    // costs one lookup regardless of which one it was.
+    const cache = new Map();
+    const now = () => Date.now();
+    const remember = (entity, ...keys) => {
+        const at = now();
+        for (const key of keys) {
+            if (key !== '')
+                cache.set(key, { entity, at });
+        }
+        if (entity != null) {
+            cache.set(entity.id, { entity, at });
+            cache.set(entity.slug, { entity, at });
+            cache.set(entity.iamKey, { entity, at });
+            for (const former of entity.formerSlugs ?? [])
+                cache.set(former, { entity, at });
+        }
+        return entity;
+    };
+    const forget = (entity) => {
+        for (const key of [entity.id, entity.slug, entity.iamKey, ...(entity.formerSlugs ?? [])]) {
+            if (key != null)
+                cache.delete(key);
+        }
+    };
+    const resource = () => service.ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
+    const load = async (value) => {
+        const cached = cache.get(value);
+        if (cached != null && now() - cached.at < CACHE_TTL) {
+            return cached.entity;
+        }
+        const res = resource();
+        // Id first: an id is authoritative, so a slug that happens to look like some other entity's
+        // id can never shadow it. Then the current slug, then the names it has retired, then the
+        // frozen key external systems still quote.
+        //
+        // The shape test is not an optimisation. `load` reads its argument as a record id, and the
+        // store turns that into an ObjectId unconditionally — so handing it a slug throws a driver
+        // error out of what is meant to be a lookup that simply misses.
+        const byId = RECORD_ID.test(value) ? await res.load(value) : null;
+        if (byId != null)
+            return remember(byId, value);
+        for (const field of ['slug', 'formerSlugs', 'iamKey']) {
+            const { items } = await res.list({ criteria: { [field]: value }, pager: { size: 1 } });
+            if (items[0] != null)
+                return remember(items[0], value);
+        }
+        return remember(null, value);
+    };
+    const service = appendContextual(alias, {
+        resolve: async (value) => toRef(await load(value)),
+        byId: async (id) => {
+            const entity = RECORD_ID.test(id) ? await resource().load(id) : null;
+            return toRef(remember(entity, id));
+        },
+        mintSlug: async () => {
+            const res = resource();
+            // A word slug is picked from 2^22 pairs, so a collision is rare — but "rare" is not "never"
+            // once an installation has many organizations, and the numeric suffix keeps the readable
+            // name rather than rerolling into an unrelated one.
+            for (let attempt = 1; attempt <= MAX_ENTITY_SLUG_ATTEMPTS; ++attempt) {
+                const base = generateWordSlug();
+                for (let suffix = 1; suffix <= 3; ++suffix) {
+                    const candidate = nextSlugCandidate(base, suffix);
+                    const { items } = await res.list({
+                        criteria: { $or: [{ slug: candidate }, { formerSlugs: candidate }] },
+                        pager: { size: 1 },
+                    });
+                    if (items.length === 0)
+                        return candidate;
+                }
+            }
+            throw new SyntaxError('entity:slug-exhausted');
+        },
+        rename: async (id, slug) => {
+            if (!ENTITY_SLUG_PATTERN.test(slug)) {
+                throw new SyntaxError(`entity:slug-malformed:${slug}`);
+            }
+            const res = resource();
+            const entity = await res.get(id);
+            if (entity.slug === slug) {
+                return toRef(entity);
+            }
+            // A slug another entity has ever answered to cannot be taken: tokens and third-party records
+            // quoting it would start resolving to the wrong organization.
+            const { items: taken } = await res.list({
+                criteria: { $or: [{ slug }, { formerSlugs: slug }] }, pager: { size: 1 },
+            });
+            if (taken[0] != null && taken[0].id !== id) {
+                throw new SyntaxError(`entity:slug-taken:${slug}`);
+            }
+            forget(entity);
+            const formerSlugs = [...new Set([...(entity.formerSlugs ?? []), entity.slug])]
+                .filter(former => former !== slug);
+            const updated = await res.update({ ...entity, slug, formerSlugs, updatedAt: new Date() });
+            return toRef(remember(updated));
+        },
+        mintName: async (id, key, mint) => {
+            const res = resource();
+            const entity = await res.get(id);
+            const existing = entity.names?.[key];
+            // Read-before-mint is what freezes the name: the second caller gets the first caller's
+            // answer, so a rename between the two cannot produce two names for one live resource.
+            if (existing != null && existing !== '') {
+                return existing;
+            }
+            const minted = mint(toRef(entity));
+            forget(entity);
+            const updated = await res.update({
+                ...entity, names: { ...entity.names, [key]: minted }, updatedAt: new Date(),
+            });
+            remember(updated);
+            return updated.names?.[key] ?? minted;
+        },
+    });
+    return service;
+};
+//# sourceMappingURL=resolver.js.map

package/build/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEzE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAIhF;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,MAAM,CAAA;AAExB,4FAA4F;AAC5F,MAAM,SAAS,GAAG,iBAAiB,CAAA;AAEnC,wFAAwF;AACxF,MAAM,KAAK,GAAG,CAAC,MAAwB,EAAuB,EAAE,CAC9D,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;CAC1F,CAAA;AAOH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,KAAK,GAAW,eAAe,EACR,EAAE;IACzB,4FAA4F;IAC5F,mDAAmD;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC3C,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;IAE5B,MAAM,QAAQ,GAAG,CAAC,MAAwB,EAAE,GAAG,IAAc,EAAoB,EAAE;QACjF,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YACrC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YACtC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;YACxC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAE,EAAE;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACzF,IAAI,GAAG,IAAI,IAAI;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,GAAsB,EAAE,CACtC,OAAO,CAAC,GAAe,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;IAEhF,MAAM,IAAI,GAAG,KAAK,EAAE,KAAa,EAA6B,EAAE;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,MAAM,IAAI,IAAI,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;QACtB,4FAA4F;QAC5F,yFAAyF;QACzF,2CAA2C;QAC3C,EAAE;QACF,2FAA2F;QAC3F,2FAA2F;QAC3F,gEAAgE;QAChE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACjE,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAE9C,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAU,EAAE,CAAC;YAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;YAC/F,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxD,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IAED,MAAM,OAAO,GAA0B,gBAAgB,CAAwB,KAAK,EAAE;QACpF,OAAO,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAEhD,IAAI,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAEpE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QACpC,CAAC;QAED,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,4FAA4F;YAC5F,yFAAyF;YACzF,oDAAoD;YACpD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC;gBACrE,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;gBAC/B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;oBAC3C,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBACjD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;wBAC/B,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,EAAW;wBAC7E,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;qBACnB,CAAC,CAAA;oBACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,SAAS,CAAA;gBAC1C,CAAC;YACH,CAAC;YAED,MAAM,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,WAAW,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,MAAM,CAAE,CAAA;YACvB,CAAC;YAED,6FAA6F;YAC7F,8DAA8D;YAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;gBACtC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;aAClF,CAAC,CAAA;YACF,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,WAAW,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,CAAA;YACd,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;YACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;YAEzF,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAE,CAAA;QAClC,CAAC;QAED,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;YACpC,uFAAuF;YACvF,sFAAsF;YACtF,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAA;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,CAAA;YACd,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAC/B,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;aAC5E,CAAC,CAAA;YACF,QAAQ,CAAC,OAAO,CAAC,CAAA;YAEjB,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAA;QACvC,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/resource.d.ts

@@ -1,4 +1,14 @@
-import type { IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource } from './types.js';
+import type { IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource, OrgEntityResource } from './types.js';
+/**
+ * The organization-entity registry.
+ *
+ * Both unique indexes are load-bearing. `slug` is what a rename writes, so the index is the only
+ * thing standing between two organizations and the same public name; `iamKey` is quoted by systems
+ * that were told it once and never asked again, so a duplicate there would silently hand one
+ * organization another's realm. `formerSlugs` is indexed but NOT unique-scoped as a set — a retired
+ * slug must stay findable, and uniqueness against it is enforced when a rename is applied.
+ */
+export declare const makeOrgEntityResource: (dbAlias?: string) => OrgEntityResource;
 export declare const makeIdentityAccountResource: (dbAlias?: string) => IdentityAccountResource;
 export declare const makeIdentityProfileResource: (dbAlias?: string) => IdentityProfileResource;
 export declare const makeIdentityCredentialsResource: (dbAlias?: string) => IdentityCredentialsResource;

package/build/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,uBAAuB,EAAmB,uBAAuB,EAAuB,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAMtK,eAAO,MAAM,2BAA2B,aAAc,MAAM,KAAG,uBAQ9D,CAAA;AAED,eAAO,MAAM,2BAA2B,aAAc,MAAM,KAAG,uBAe9D,CAAA;AAED,eAAO,MAAM,+BAA+B,aAAc,MAAM,KAAG,2BAOlE,CAAA"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,uBAAuB,EAAmB,uBAAuB,EAAuB,2BAA2B,EAAa,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAOpM;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,aAAc,MAAM,KAAG,iBAQxD,CAAA;AAED,eAAO,MAAM,2BAA2B,aAAc,MAAM,KAAG,uBAQ9D,CAAA;AAED,eAAO,MAAM,2BAA2B,aAAc,MAAM,KAAG,uBAe9D,CAAA;AAED,eAAO,MAAM,+BAA+B,aAAc,MAAM,KAAG,2BAOlE,CAAA"}

package/build/resource.js

@@ -1,5 +1,21 @@
 import { makeMongoResource } from '@owlmeans/mongo-resource';
-import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_ACCOUNT_COLLECTION, AUTH_IDENTITY_PROFILE_COLLECTION, AUTH_IDENTITY_CREDENTIALS_COLLECTION } from './consts.js';
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_ORG_ENTITY, AUTH_IDENTITY_ACCOUNT_COLLECTION, AUTH_IDENTITY_PROFILE_COLLECTION, AUTH_IDENTITY_CREDENTIALS_COLLECTION, AUTH_IDENTITY_ORG_ENTITY_COLLECTION } from './consts.js';
+/**
+ * The organization-entity registry.
+ *
+ * Both unique indexes are load-bearing. `slug` is what a rename writes, so the index is the only
+ * thing standing between two organizations and the same public name; `iamKey` is quoted by systems
+ * that were told it once and never asked again, so a duplicate there would silently hand one
+ * organization another's realm. `formerSlugs` is indexed but NOT unique-scoped as a set — a retired
+ * slug must stay findable, and uniqueness against it is enforced when a rename is applied.
+ */
+export const makeOrgEntityResource = (dbAlias) => {
+    const resource = makeMongoResource(AUTH_IDENTITY_ORG_ENTITY, dbAlias, undefined, undefined, AUTH_IDENTITY_ORG_ENTITY_COLLECTION);
+    resource.index('slug', { slug: 1 }, { unique: true });
+    resource.index('iamKey', { iamKey: 1 }, { unique: true });
+    resource.index('formerSlugs', { formerSlugs: 1 });
+    return resource;
+};
 export const makeIdentityAccountResource = (dbAlias) => {
     const resource = makeMongoResource(AUTH_IDENTITY_ACCOUNT, dbAlias, undefined, undefined, AUTH_IDENTITY_ACCOUNT_COLLECTION);
     resource.index('credential', { credential: 1 }, { unique: true });

package/build/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EACL,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EACvE,gCAAgC,EAAE,gCAAgC,EAAE,oCAAoC,EACzG,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gCAAgC,CACvF,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gCAAgC,CACvF,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAA;IACnD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAChD,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAgB,EAA+B,EAAE;IAC/F,MAAM,QAAQ,GAAG,iBAAiB,CAChC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,CAC/F,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EACL,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,wBAAwB,EACjG,gCAAgC,EAAE,gCAAgC,EAAE,oCAAoC,EACxG,mCAAmC,EACpC,MAAM,aAAa,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAgB,EAAqB,EAAE;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAChC,wBAAwB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,mCAAmC,CAC7F,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;IACjD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gCAAgC,CACvF,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,gCAAgC,CACvF,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAA;IACnD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAChD,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAgB,EAA+B,EAAE;IAC/F,MAAM,QAAQ,GAAG,iBAAiB,CAChC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,CAC/F,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAepJ,eAAO,MAAM,0BAA0B,QAAO,sBA6K7C,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAkBpJ,eAAO,MAAM,0BAA0B,QAAO,sBAyM7C,CAAA"}

package/build/service.js

@@ -1,13 +1,28 @@
 import { appendContextual } from '@owlmeans/context';
 import { ALL_SCOPES, AuthRole } from '@owlmeans/auth';
 import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids';
-import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, AUTH_IDENTITY_ORG_ENTITY, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js';
 const MAX_SLUG_RETRIES = 5;
 // Stable external login key: "{type}:{service}:{providerSub}"
 const externalKey = (details) => [details.type, details.service, details.userId].join(EXTERNAL_KEY_DELIMITER);
 // Login-service credential stored on profile and credentials: "service:{type}:{service}"
 const loginService = (details) => [LOGIN_SERVICE_PREFIX, details.type, details.service].join(EXTERNAL_KEY_DELIMITER);
 export const makeIdentityLinkingService = () => {
+    /**
+     * The wire value for a stored entity id.
+     *
+     * Records key on the id; everything this service hands back is an auth payload, and payloads
+     * carry the slug. An id that no longer resolves yields undefined rather than leaking the raw
+     * id onto the wire, where a consumer would mistake it for a slug and compose names from it.
+     */
+    const slugOf = async (entityId) => {
+        if (entityId == null || entityId === '')
+            return undefined;
+        const ctx = service.ctx;
+        const entity = await ctx.service(ENTITY_RESOLVER).byId(entityId);
+        return entity?.slug;
+    };
     const service = appendContextual(AUTH_IDENTITY_LINKING, {
         getLinkedProfile: async (details) => {
             const ctx = service.ctx;
@@ -31,7 +46,7 @@ export const makeIdentityLinkingService = () => {
                 role: profile.role,
                 userId: profile.userId ?? profile.profileId,
                 profileId: profile.profileId,
-                entityId: profile.entityId,
+                entitySlug: await slugOf(profile.entityId),
                 scopes: profile.scopes,
             };
         },
@@ -40,19 +55,31 @@ export const makeIdentityLinkingService = () => {
             const accountResource = ctx.resource(AUTH_IDENTITY_ACCOUNT);
             const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
             const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
-            // Generate a unique local entity slug stored as the account credential.
+            const entityResource = ctx.resource(AUTH_IDENTITY_ORG_ENTITY);
+            const resolver = ctx.service(ENTITY_RESOLVER);
+            // Every account gets its own organization. The entity record is created FIRST because it
+            // owns the two values that outlive everything else here: the id the account and its profiles
+            // are keyed by, and the frozen `iamKey` that realms and object names are minted from.
+            const entity = await entityResource.create({
+                slug: await resolver.mintSlug(),
+                formerSlugs: [],
+                // Frozen at birth and never recomputed. It cannot be the slug — the slug moves — and it
+                // cannot be the record id, which does not exist until this create returns.
+                iamKey: createIdOfLength(16, IdStyle.Base58),
+                names: {},
+                createdAt: new Date(),
+            });
+            const entityId = entity.id;
             let accountId = null;
-            let entityId = null;
             for (let i = 0; i < MAX_SLUG_RETRIES; i++) {
                 const credential = createIdOfLength(16, IdStyle.Base58);
                 try {
                     const account = await accountResource.create({
                         credential,
                         name: meta.username,
-                        entityId: credential,
+                        entityId,
                     });
                     accountId = account.id;
-                    entityId = account.credential;
                     break;
                 }
                 catch (err) {
@@ -61,7 +88,7 @@ export const makeIdentityLinkingService = () => {
                     throw err;
                 }
             }
-            if (accountId == null || entityId == null) {
+            if (accountId == null) {
                 throw new Error('Failed to generate unique account credential after retries');
             }
             const profileId = [details.type, accountId].join(EXTERNAL_KEY_DELIMITER);
@@ -98,7 +125,7 @@ export const makeIdentityLinkingService = () => {
                 role: profile.role,
                 userId: profile.userId ?? profile.profileId,
                 profileId: profile.profileId,
-                entityId: profile.entityId,
+                entitySlug: await slugOf(profile.entityId),
                 scopes: profile.scopes,
             };
         },
@@ -124,16 +151,16 @@ export const makeIdentityLinkingService = () => {
             const ctx = service.ctx;
             const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
             const { items: profiles } = await profileResource.list({ criteria: { entityId } });
-            return profiles.map(p => ({
+            return await Promise.all(profiles.map(async (p) => ({
                 id: p.profileId,
                 name: p.name,
                 credential: p.credential,
-                entityId: p.entityId,
+                entitySlug: await slugOf(p.entityId),
                 scopes: p.scopes,
                 groups: p.groups,
                 permissions: p.permissions,
                 attributes: p.attributes,
-            }));
+            })));
         },
         getOwnerCredentials: async (userId, entityId, type) => {
             const ctx = service.ctx;
@@ -160,7 +187,7 @@ export const makeIdentityLinkingService = () => {
                 role: profile.role,
                 userId: profile.userId ?? profile.profileId,
                 profileId: profile.profileId,
-                entityId: profile.entityId,
+                entitySlug: await slugOf(profile.entityId),
                 scopes: profile.scopes,
                 challenge: cred.challenge,
                 credential: cred.credential,

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAI1K,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,8DAA8D;AAC9D,MAAM,WAAW,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC9D,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAE9E,yFAAyF;AACzF,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC/D,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAA2B,EAAE;IACrE,MAAM,OAAO,GAA2B,gBAAgB,CAAyB,qBAAqB,EAAE;QACtG,gBAAgB,EAAE,KAAK,EAAE,OAA+B,EAA+B,EAAE;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBAChD,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC;aACF,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;YAC7B,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAE7B,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEhC,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAA+B,EAAE,IAAiB,EAAwB,EAAE;YAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,wEAAwE;YACxE,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC3C,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,QAAQ,EAAE,UAAU;qBACrB,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBACtB,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAA;oBAC7B,MAAK;gBACP,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;wBAAE,SAAQ;oBACxE,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,IAAI,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACxE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,OAAO,CAAA;YACX,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;oBACrC,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,QAAQ;oBACR,MAAM,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;gBAC7D,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,MAAM,aAAa,CAAC,MAAM,CAAC;gBACzB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,SAAS;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAA;YAEF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,OAA+B,EAAwB,EAAE;YAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;gBAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;gBAC1F,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,QAAgB,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;YAElF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAA;QACL,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAa,EAAwC,EAAE;YACpH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,aAAa,GAA4B,EAAE,MAAM,EAAE,CAAA;YACzD,IAAI,QAAQ,IAAI,IAAI;gBAAE,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAA;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,aAAoB,CAAC,CAAA;YAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,WAAW,GAA4B;gBAC3C,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;aACnD,CAAA;YACD,IAAI,IAAI,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAA;YACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAkB,CAAC,CAAA;YACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAExC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEjF,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAI/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAIpM,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,8DAA8D;AAC9D,MAAM,WAAW,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC9D,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAE9E,yFAAyF;AACzF,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC/D,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAA2B,EAAE;IACrE;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,QAAiB,EAA+B,EAAE;QACtE,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAA;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEvF,OAAO,MAAM,EAAE,IAAI,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,OAAO,GAA2B,gBAAgB,CAAyB,qBAAqB,EAAE;QACtG,gBAAgB,EAAE,KAAK,EAAE,OAA+B,EAA+B,EAAE;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBAChD,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC;aACF,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;YAC7B,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAE7B,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEhC,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAA+B,EAAE,IAAiB,EAAwB,EAAE;YAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAC1F,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAoB,wBAAwB,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;YAEpE,yFAAyF;YACzF,6FAA6F;YAC7F,sFAAsF;YACtF,MAAM,MAAM,GAAc,MAAM,cAAc,CAAC,MAAM,CAAC;gBACpD,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE;gBAC/B,WAAW,EAAE,EAAE;gBACf,wFAAwF;gBACxF,2EAA2E;gBAC3E,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;gBAC5C,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAG,CAAA;YAE3B,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC3C,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,QAAQ;qBACT,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBACtB,MAAK;gBACP,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;wBAAE,SAAQ;oBACxE,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACxE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,OAAO,CAAA;YACX,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;oBACrC,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,QAAQ;oBACR,MAAM,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;gBAC7D,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,MAAM,aAAa,CAAC,MAAM,CAAC;gBACzB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,SAAS;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAA;YAEF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,OAA+B,EAAwB,EAAE;YAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;gBAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;gBAC1F,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,QAAgB,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;YAElF,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,MAAM,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACpC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAC,CAAA;QACN,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAa,EAAwC,EAAE;YACpH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,aAAa,GAA4B,EAAE,MAAM,EAAE,CAAA;YACzD,IAAI,QAAQ,IAAI,IAAI;gBAAE,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAA;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,aAAoB,CAAC,CAAA;YAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,WAAW,GAA4B;gBAC3C,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;aACnD,CAAA;YACD,IAAI,IAAI,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAA;YACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAkB,CAAC,CAAA;YACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAExC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEjF,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -6,22 +6,28 @@ import type { AuthCredentials, AuthPayload, AuthRole, Profile } from '@owlmeans/
 import type { ProviderProfileDetails } from '@owlmeans/oidc';
 /**
  * Local account record — one per user.
- * id is the Mongo resource id; credential is the stable unique local entity slug.
+ *
+ * `id` is the Mongo resource id; `credential` is the account's stable unique key. `entityId`
+ * (inherited from Profile below) holds the organization entity's record id — never its slug.
  */
-export interface IdentityAccount extends Profile, ResourceRecord {
+export interface IdentityAccount extends Omit<Profile, 'entitySlug'>, ResourceRecord {
     id: string;
     credential: string;
+    /** Stable organization-entity id. Renaming the organization does not touch this. */
+    entityId?: string;
 }
 /**
  * Local profile record — ties a user to an entity with a role.
  * Mirrors IAMProfile from @owlmeans/auth backend.
  */
-export interface IdentityProfile extends Profile, ResourceRecord {
+export interface IdentityProfile extends Omit<Profile, 'entitySlug'>, ResourceRecord {
     id: string;
     profileId: string;
     userId?: string;
     role: AuthRole;
     expiresAt?: Date;
+    /** Stable organization-entity id — the value every per-organization query filters on. */
+    entityId?: string;
 }
 /**
  * Provider credentials record — one per provider link per profile.
@@ -32,6 +38,27 @@ export interface IdentityProfile extends Profile, ResourceRecord {
 export interface IdentityCredentials extends AuthCredentials, ResourceRecord {
     profileId: string;
 }
+/**
+ * An organization entity — the record every per-organization store keys on.
+ *
+ * Its `id` is the stable entity id. The slug is the value users, URLs and tokens see, and it may
+ * move; nothing here except `slug` itself changes when it does, which is the entire point of the
+ * record existing.
+ */
+export interface OrgEntity extends ResourceRecord {
+    id?: string;
+    slug: string;
+    formerSlugs?: string[];
+    iamKey: string;
+    /**
+     * Names this organization is known by in systems that cannot rename: a Kubernetes namespace, a
+     * storage prefix, an IAM realm. Minted once through `mintName` and read back forever after.
+     */
+    names?: Record<string, string>;
+    createdAt: Date;
+    updatedAt?: Date;
+}
+export type OrgEntityResource = MongoResource<OrgEntity>;
 export type IdentityAccountResource = MongoResource<IdentityAccount>;
 export type IdentityProfileResource = MongoResource<IdentityProfile>;
 export type IdentityCredentialsResource = MongoResource<IdentityCredentials>;

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,OAAO,EAAE,cAAc;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,OAAO,EAAE,cAAc;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe,EAAE,cAAc;IAC1E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,gBAAgB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAClF,WAAW,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACzF,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1E,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;CAChH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;CACnD;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc;IAClF,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc;IAClF,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe,EAAE,cAAc;IAC1E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;AAExD,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,gBAAgB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAClF,WAAW,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACzF,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1E,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;CAChH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;CACnD;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-identity",
-  "version": "0.1.18-rc.8",
+  "version": "0.1.18-rc.9",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,20 +22,21 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/basic-ids": "^0.1.18-rc.6",
+    "@owlmeans/auth": "^0.1.18-rc.7",
+    "@owlmeans/auth-common": "^0.1.18-rc.9",
+    "@owlmeans/basic-ids": "^0.1.18-rc.7",
     "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.7",
-    "@owlmeans/oidc": "^0.1.18-rc.8",
+    "@owlmeans/mongo-resource": "^0.1.18-rc.8",
+    "@owlmeans/oidc": "^0.1.18-rc.9",
     "@owlmeans/resource": "^0.1.18-rc.7",
-    "@owlmeans/server-context": "^0.1.18-rc.7"
+    "@owlmeans/server-context": "^0.1.18-rc.8"
   },
   "peerDependencies": {
     "mongodb": "*"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/consts.ts

@@ -7,6 +7,7 @@ export const AUTH_IDENTITY_ACCOUNT = 'auth-identity:account'
 export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile'
 export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials'
 export const AUTH_IDENTITY_LINKING = 'auth-identity:linking'
+export const AUTH_IDENTITY_ORG_ENTITY = 'auth-identity:org-entity'
 
 // Colon-free Mongo collection base names. The final collection name is
 // `${resourcePrefix}${collection}` — e.g. with the project prefix 'viam-' this yields
@@ -15,11 +16,16 @@ export const AUTH_IDENTITY_LINKING = 'auth-identity:linking'
 export const AUTH_IDENTITY_ACCOUNT_COLLECTION = 'account'
 export const AUTH_IDENTITY_PROFILE_COLLECTION = 'profile'
 export const AUTH_IDENTITY_CREDENTIALS_COLLECTION = 'credentials'
+export const AUTH_IDENTITY_ORG_ENTITY_COLLECTION = 'org-entity'
 
 // Suggested db-config alias for a dedicated config whose resourcePrefix scopes the
 // collection prefix to identity collections only (not the whole database).
 export const AUTH_IDENTITY_DB_ALIAS = 'auth-identity'
 
+// How many slugs to try before giving up on minting a free one. Collisions are settled against a
+// unique index, so this bounds a retry loop rather than a probability.
+export const MAX_ENTITY_SLUG_ATTEMPTS = 8
+
 // Helper prefixes for stable key derivation
 export const LOGIN_SERVICE_PREFIX = 'service'
 export const EXTERNAL_KEY_DELIMITER = ':'

package/src/helper.ts

@@ -1,6 +1,7 @@
 import type { BasicContext } from '@owlmeans/context'
-import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource } from './resource.js'
+import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource, makeOrgEntityResource } from './resource.js'
 import { makeIdentityLinkingService } from './service.js'
+import { makeEntityResolverService } from './resolver.js'
 
 export const appendAuthIdentityResources = (
   context: BasicContext<any>,
@@ -9,5 +10,10 @@ export const appendAuthIdentityResources = (
   context.registerResource(makeIdentityAccountResource(dbAlias))
   context.registerResource(makeIdentityProfileResource(dbAlias))
   context.registerResource(makeIdentityCredentialsResource(dbAlias))
+  context.registerResource(makeOrgEntityResource(dbAlias))
   context.registerService(makeIdentityLinkingService())
+  // Registering the resolver is what tells the server boundary that this deployment HAS
+  // organizations: without it `request.entity` stays undefined and every consumer falls back to
+  // treating the token's slug as the only entity value there is.
+  context.registerService(makeEntityResolverService())
 }

package/src/index.ts

@@ -2,5 +2,6 @@ export * from './consts.js'
 export type * from './types.js'
 export * from './resource.js'
 export * from './service.js'
+export * from './resolver.js'
 export * from './helper.js'
 export * from './iam.js'

package/src/resolver.ts

@@ -0,0 +1,171 @@
+import { appendContextual } from '@owlmeans/context'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { EntityResolverService, OrgEntityRef } from '@owlmeans/auth-common'
+import { ENTITY_RESOLVER, ENTITY_SLUG_PATTERN } from '@owlmeans/auth-common'
+import { generateWordSlug, nextSlugCandidate } from '@owlmeans/basic-ids'
+import type { OrgEntity, OrgEntityResource } from './types.js'
+import { AUTH_IDENTITY_ORG_ENTITY, MAX_ENTITY_SLUG_ATTEMPTS } from './consts.js'
+
+type Context = ServerContext<ServerConfig>
+
+/**
+ * How long a resolution is trusted without re-reading the registry.
+ *
+ * Every authenticated request resolves an entity, so an uncached resolver would put a database
+ * round-trip in front of the whole API. The cost of the cache is a rename taking up to this long
+ * to be seen by other replicas — which is survivable precisely because the old slug keeps
+ * resolving through `formerSlugs` rather than failing.
+ */
+const CACHE_TTL = 30_000
+
+/** What a stored record id looks like. Anything else can only be a slug or a frozen key. */
+const RECORD_ID = /^[0-9a-f]{24}$/i
+
+/** A stored record as the contract exposes it. Persisted records always carry an id. */
+const toRef = (entity: OrgEntity | null): OrgEntityRef | null =>
+  entity == null ? null : {
+    id: entity.id!, slug: entity.slug, formerSlugs: entity.formerSlugs, iamKey: entity.iamKey,
+  }
+
+interface CacheEntry {
+  entity: OrgEntity | null
+  at: number
+}
+
+export const makeEntityResolverService = (
+  alias: string = ENTITY_RESOLVER
+): EntityResolverService => {
+  // Keyed by every name a caller might arrive with — id, slug, former slug, iamKey — so a hit
+  // costs one lookup regardless of which one it was.
+  const cache = new Map<string, CacheEntry>()
+  const now = () => Date.now()
+
+  const remember = (entity: OrgEntity | null, ...keys: string[]): OrgEntity | null => {
+    const at = now()
+    for (const key of keys) {
+      if (key !== '') cache.set(key, { entity, at })
+    }
+    if (entity != null) {
+      cache.set(entity.id!, { entity, at })
+      cache.set(entity.slug, { entity, at })
+      cache.set(entity.iamKey, { entity, at })
+      for (const former of entity.formerSlugs ?? []) cache.set(former, { entity, at })
+    }
+
+    return entity
+  }
+
+  const forget = (entity: OrgEntity) => {
+    for (const key of [entity.id, entity.slug, entity.iamKey, ...(entity.formerSlugs ?? [])]) {
+      if (key != null) cache.delete(key)
+    }
+  }
+
+  const resource = (): OrgEntityResource =>
+    (service.ctx as Context).resource<OrgEntityResource>(AUTH_IDENTITY_ORG_ENTITY)
+
+  const load = async (value: string): Promise<OrgEntity | null> => {
+    const cached = cache.get(value)
+    if (cached != null && now() - cached.at < CACHE_TTL) {
+      return cached.entity
+    }
+
+    const res = resource()
+    // Id first: an id is authoritative, so a slug that happens to look like some other entity's
+    // id can never shadow it. Then the current slug, then the names it has retired, then the
+    // frozen key external systems still quote.
+    //
+    // The shape test is not an optimisation. `load` reads its argument as a record id, and the
+    // store turns that into an ObjectId unconditionally — so handing it a slug throws a driver
+    // error out of what is meant to be a lookup that simply misses.
+    const byId = RECORD_ID.test(value) ? await res.load(value) : null
+    if (byId != null) return remember(byId, value)
+
+    for (const field of ['slug', 'formerSlugs', 'iamKey'] as const) {
+      const { items } = await res.list({ criteria: { [field]: value } as never, pager: { size: 1 } })
+      if (items[0] != null) return remember(items[0], value)
+    }
+
+    return remember(null, value)
+  }
+
+  const service: EntityResolverService = appendContextual<EntityResolverService>(alias, {
+    resolve: async value => toRef(await load(value)),
+
+    byId: async id => {
+      const entity = RECORD_ID.test(id) ? await resource().load(id) : null
+
+      return toRef(remember(entity, id))
+    },
+
+    mintSlug: async () => {
+      const res = resource()
+      // A word slug is picked from 2^22 pairs, so a collision is rare — but "rare" is not "never"
+      // once an installation has many organizations, and the numeric suffix keeps the readable
+      // name rather than rerolling into an unrelated one.
+      for (let attempt = 1; attempt <= MAX_ENTITY_SLUG_ATTEMPTS; ++attempt) {
+        const base = generateWordSlug()
+        for (let suffix = 1; suffix <= 3; ++suffix) {
+          const candidate = nextSlugCandidate(base, suffix)
+          const { items } = await res.list({
+            criteria: { $or: [{ slug: candidate }, { formerSlugs: candidate }] } as never,
+            pager: { size: 1 },
+          })
+          if (items.length === 0) return candidate
+        }
+      }
+
+      throw new SyntaxError('entity:slug-exhausted')
+    },
+
+    rename: async (id, slug) => {
+      if (!ENTITY_SLUG_PATTERN.test(slug)) {
+        throw new SyntaxError(`entity:slug-malformed:${slug}`)
+      }
+
+      const res = resource()
+      const entity = await res.get(id)
+      if (entity.slug === slug) {
+        return toRef(entity)!
+      }
+
+      // A slug another entity has ever answered to cannot be taken: tokens and third-party records
+      // quoting it would start resolving to the wrong organization.
+      const { items: taken } = await res.list({
+        criteria: { $or: [{ slug }, { formerSlugs: slug }] } as never, pager: { size: 1 },
+      })
+      if (taken[0] != null && taken[0].id !== id) {
+        throw new SyntaxError(`entity:slug-taken:${slug}`)
+      }
+
+      forget(entity)
+      const formerSlugs = [...new Set([...(entity.formerSlugs ?? []), entity.slug])]
+        .filter(former => former !== slug)
+      const updated = await res.update({ ...entity, slug, formerSlugs, updatedAt: new Date() })
+
+      return toRef(remember(updated))!
+    },
+
+    mintName: async (id, key, mint) => {
+      const res = resource()
+      const entity = await res.get(id)
+      const existing = entity.names?.[key]
+      // Read-before-mint is what freezes the name: the second caller gets the first caller's
+      // answer, so a rename between the two cannot produce two names for one live resource.
+      if (existing != null && existing !== '') {
+        return existing
+      }
+
+      const minted = mint(toRef(entity)!)
+      forget(entity)
+      const updated = await res.update({
+        ...entity, names: { ...entity.names, [key]: minted }, updatedAt: new Date(),
+      })
+      remember(updated)
+
+      return updated.names?.[key] ?? minted
+    },
+  })
+
+  return service
+}

package/src/resource.ts

@@ -1,10 +1,30 @@
 import { makeMongoResource } from '@owlmeans/mongo-resource'
-import type { IdentityAccount, IdentityAccountResource, IdentityProfile, IdentityProfileResource, IdentityCredentials, IdentityCredentialsResource } from './types.js'
+import type { IdentityAccount, IdentityAccountResource, IdentityProfile, IdentityProfileResource, IdentityCredentials, IdentityCredentialsResource, OrgEntity, OrgEntityResource } from './types.js'
 import {
-  AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS,
-  AUTH_IDENTITY_ACCOUNT_COLLECTION, AUTH_IDENTITY_PROFILE_COLLECTION, AUTH_IDENTITY_CREDENTIALS_COLLECTION
+  AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_ORG_ENTITY,
+  AUTH_IDENTITY_ACCOUNT_COLLECTION, AUTH_IDENTITY_PROFILE_COLLECTION, AUTH_IDENTITY_CREDENTIALS_COLLECTION,
+  AUTH_IDENTITY_ORG_ENTITY_COLLECTION
 } from './consts.js'
 
+/**
+ * The organization-entity registry.
+ *
+ * Both unique indexes are load-bearing. `slug` is what a rename writes, so the index is the only
+ * thing standing between two organizations and the same public name; `iamKey` is quoted by systems
+ * that were told it once and never asked again, so a duplicate there would silently hand one
+ * organization another's realm. `formerSlugs` is indexed but NOT unique-scoped as a set — a retired
+ * slug must stay findable, and uniqueness against it is enforced when a rename is applied.
+ */
+export const makeOrgEntityResource = (dbAlias?: string): OrgEntityResource => {
+  const resource = makeMongoResource<OrgEntity, OrgEntityResource>(
+    AUTH_IDENTITY_ORG_ENTITY, dbAlias, undefined, undefined, AUTH_IDENTITY_ORG_ENTITY_COLLECTION
+  )
+  resource.index('slug', { slug: 1 }, { unique: true })
+  resource.index('iamKey', { iamKey: 1 }, { unique: true })
+  resource.index('formerSlugs', { formerSlugs: 1 })
+  return resource
+}
+
 export const makeIdentityAccountResource = (dbAlias?: string): IdentityAccountResource => {
   const resource = makeMongoResource<IdentityAccount, IdentityAccountResource>(
     AUTH_IDENTITY_ACCOUNT, dbAlias, undefined, undefined, AUTH_IDENTITY_ACCOUNT_COLLECTION

package/src/service.ts

@@ -5,7 +5,10 @@ import { ALL_SCOPES, AuthRole } from '@owlmeans/auth'
 import type { ProviderProfileDetails } from '@owlmeans/oidc'
 import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids'
 import type { AccountMeta, IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource, IdentityLinkingService } from './types.js'
-import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js'
+import type { OrgEntity, OrgEntityResource } from './types.js'
+import type { EntityResolverService } from '@owlmeans/auth-common'
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, AUTH_IDENTITY_ORG_ENTITY, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js'
 
 type Context = ServerContext<ServerConfig>
 
@@ -20,6 +23,21 @@ const loginService = (details: ProviderProfileDetails): string =>
   [LOGIN_SERVICE_PREFIX, details.type, details.service].join(EXTERNAL_KEY_DELIMITER)
 
 export const makeIdentityLinkingService = (): IdentityLinkingService => {
+  /**
+   * The wire value for a stored entity id.
+   *
+   * Records key on the id; everything this service hands back is an auth payload, and payloads
+   * carry the slug. An id that no longer resolves yields undefined rather than leaking the raw
+   * id onto the wire, where a consumer would mistake it for a slug and compose names from it.
+   */
+  const slugOf = async (entityId?: string): Promise<string | undefined> => {
+    if (entityId == null || entityId === '') return undefined
+    const ctx = service.ctx as Context
+    const entity = await ctx.service<EntityResolverService>(ENTITY_RESOLVER).byId(entityId)
+
+    return entity?.slug
+  }
+
   const service: IdentityLinkingService = appendContextual<IdentityLinkingService>(AUTH_IDENTITY_LINKING, {
     getLinkedProfile: async (details: ProviderProfileDetails): Promise<AuthPayload | null> => {
       const ctx = service.ctx as Context
@@ -44,7 +62,7 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
         role: profile.role,
         userId: profile.userId ?? profile.profileId,
         profileId: profile.profileId,
-        entityId: profile.entityId,
+        entitySlug: await slugOf(profile.entityId),
         scopes: profile.scopes,
       }
     },
@@ -54,20 +72,33 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
       const accountResource = ctx.resource<IdentityAccountResource>(AUTH_IDENTITY_ACCOUNT)
       const profileResource = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
       const credsResource = ctx.resource<IdentityCredentialsResource>(AUTH_IDENTITY_CREDENTIALS)
+      const entityResource = ctx.resource<OrgEntityResource>(AUTH_IDENTITY_ORG_ENTITY)
+      const resolver = ctx.service<EntityResolverService>(ENTITY_RESOLVER)
+
+      // Every account gets its own organization. The entity record is created FIRST because it
+      // owns the two values that outlive everything else here: the id the account and its profiles
+      // are keyed by, and the frozen `iamKey` that realms and object names are minted from.
+      const entity: OrgEntity = await entityResource.create({
+        slug: await resolver.mintSlug(),
+        formerSlugs: [],
+        // Frozen at birth and never recomputed. It cannot be the slug — the slug moves — and it
+        // cannot be the record id, which does not exist until this create returns.
+        iamKey: createIdOfLength(16, IdStyle.Base58),
+        names: {},
+        createdAt: new Date(),
+      })
+      const entityId = entity.id!
 
-      // Generate a unique local entity slug stored as the account credential.
       let accountId: string | null = null
-      let entityId: string | null = null
       for (let i = 0; i < MAX_SLUG_RETRIES; i++) {
         const credential = createIdOfLength(16, IdStyle.Base58)
         try {
           const account = await accountResource.create({
             credential,
             name: meta.username,
-            entityId: credential,
+            entityId,
           })
           accountId = account.id
-          entityId = account.credential
           break
         } catch (err: any) {
           if (err?.code === 11000 || err?.message?.includes('duplicate')) continue
@@ -75,7 +106,7 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
         }
       }
 
-      if (accountId == null || entityId == null) {
+      if (accountId == null) {
         throw new Error('Failed to generate unique account credential after retries')
       }
 
@@ -114,7 +145,7 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
         role: profile.role,
         userId: profile.userId ?? profile.profileId,
         profileId: profile.profileId,
-        entityId: profile.entityId,
+        entitySlug: await slugOf(profile.entityId),
         scopes: profile.scopes,
       }
     },
@@ -145,16 +176,16 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
       const profileResource = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
       const { items: profiles } = await profileResource.list({ criteria: { entityId } })
 
-      return profiles.map(p => ({
+      return await Promise.all(profiles.map(async p => ({
         id: p.profileId,
         name: p.name,
         credential: p.credential,
-        entityId: p.entityId,
+        entitySlug: await slugOf(p.entityId),
         scopes: p.scopes,
         groups: p.groups,
         permissions: p.permissions,
         attributes: p.attributes,
-      }))
+      })))
     },
 
     getOwnerCredentials: async (userId: string, entityId?: string, type?: string): Promise<AuthCredentials | undefined> => {
@@ -182,7 +213,7 @@ export const makeIdentityLinkingService = (): IdentityLinkingService => {
         role: profile.role,
         userId: profile.userId ?? profile.profileId,
         profileId: profile.profileId,
-        entityId: profile.entityId,
+        entitySlug: await slugOf(profile.entityId),
         scopes: profile.scopes,
         challenge: cred.challenge,
         credential: cred.credential,

package/src/types.ts

@@ -7,23 +7,29 @@ import type { ProviderProfileDetails } from '@owlmeans/oidc'
 
 /**
  * Local account record — one per user.
- * id is the Mongo resource id; credential is the stable unique local entity slug.
+ *
+ * `id` is the Mongo resource id; `credential` is the account's stable unique key. `entityId`
+ * (inherited from Profile below) holds the organization entity's record id — never its slug.
  */
-export interface IdentityAccount extends Profile, ResourceRecord {
+export interface IdentityAccount extends Omit<Profile, 'entitySlug'>, ResourceRecord {
   id: string
   credential: string
+  /** Stable organization-entity id. Renaming the organization does not touch this. */
+  entityId?: string
 }
 
 /**
  * Local profile record — ties a user to an entity with a role.
  * Mirrors IAMProfile from @owlmeans/auth backend.
  */
-export interface IdentityProfile extends Profile, ResourceRecord {
+export interface IdentityProfile extends Omit<Profile, 'entitySlug'>, ResourceRecord {
   id: string
   profileId: string
   userId?: string
   role: AuthRole
   expiresAt?: Date
+  /** Stable organization-entity id — the value every per-organization query filters on. */
+  entityId?: string
 }
 
 /**
@@ -36,6 +42,29 @@ export interface IdentityCredentials extends AuthCredentials, ResourceRecord {
   profileId: string
 }
 
+/**
+ * An organization entity — the record every per-organization store keys on.
+ *
+ * Its `id` is the stable entity id. The slug is the value users, URLs and tokens see, and it may
+ * move; nothing here except `slug` itself changes when it does, which is the entire point of the
+ * record existing.
+ */
+export interface OrgEntity extends ResourceRecord {
+  id?: string
+  slug: string
+  formerSlugs?: string[]
+  iamKey: string
+  /**
+   * Names this organization is known by in systems that cannot rename: a Kubernetes namespace, a
+   * storage prefix, an IAM realm. Minted once through `mintName` and read back forever after.
+   */
+  names?: Record<string, string>
+  createdAt: Date
+  updatedAt?: Date
+}
+
+export type OrgEntityResource = MongoResource<OrgEntity>
+
 export type IdentityAccountResource = MongoResource<IdentityAccount>
 export type IdentityProfileResource = MongoResource<IdentityProfile>
 export type IdentityCredentialsResource = MongoResource<IdentityCredentials>