@owlmeans/server-auth-otp 0.1.18-rc.49 → 0.1.18-rc.50

package/README.md

@@ -12,7 +12,7 @@ Email OTP `AuthPlugin` for OwlMeans servers — passwordless login via time-limi
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth-otp@^0.1.18-rc.49
+bun add @owlmeans/server-auth-otp@^0.1.18-rc.50
 ```
 
 ## Usage
@@ -47,7 +47,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.45
+npx @owlmeans/agent-skills@^0.1.18-rc.46
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-otp",
-  "version": "0.1.18-rc.49",
-  "generatedAt": "2026-10-01T23:27:48.731Z",
+  "version": "0.1.18-rc.50",
+  "generatedAt": "2026-10-03T11:19:50.781Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-otp/SKILL.md

@@ -8,7 +8,7 @@ metadata:
 
 # Using `@owlmeans/server-auth-otp`
 
-**Install:** `"@owlmeans/server-auth-otp": "^0.1.18-rc.49"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-otp": "^0.1.18-rc.50"` in `dependencies`
 
 Email OTP authentication plugin for the OwlMeans auth-manager plugin system. Relies on `@owlmeans/auth-otp` for the OTP service interface, a Redis resource for code storage, and a `MailerService` to send codes.
 
@@ -71,9 +71,13 @@ appendOtpPlugin(context)
 **Authenticate** — client sends `{ challenge: <signed-envelope>, userId: email, credential: '123456', type: 'email-otp', role: AuthRole.User, scopes: [ALL_SCOPES] }`:
 - Envelope is opened → the plugin verifies the opaque issuance and code atomically. Five failed
   attempts invalidate it; one concurrent correct verification can consume it.
-- `IdentityLinkingService` finds the linked profile, or links this email to the person's platform
-  identity — registering an account, a profile and an organization entity only when the address is
-  new to the platform.
+- The `IdentityLinkingService` `cfg.otp.identityAlias` names answers the payload. The identity
+  store's own (`AUTH_IDENTITY_LINKING`) follows the e-mail code's credential to the person's
+  account, or finds the account by the address — the code becoming another credential on it — or
+  registers an account with a personal organization when the address is new; it answers the
+  deployment's own row in the account's main organization. An integrated provider's end-user login
+  names the e-mail proof linking service instead (`makeEmailProofLinkingService`,
+  `@owlmeans/iam-integrated`), which proves the address and writes nothing.
 - Copies `userId`, `profileId`, `entitySlug`, `role` and `scopes` from the resolved payload onto the
   credential, sets `credential.type = AuthenticationType.OneTimeToken`, and returns the signed auth
   token.
@@ -101,12 +105,11 @@ cfg.otp = {
 - Call `appendOtpPlugin(context)` once per context — it adds to the shared plugin registry singleton.
 - `credential.entitySlug` on the authenticate request **selects nothing**. The plugin copies it into
   the linking details as `clientId` (defaulting to `'default'`) and `entityId`, and
-  `@owlmeans/server-auth-identity` reads neither: `getLinkedProfile` keys on the external login key
-  built from the auth type, the `'email'` service and the address, and `linkProfile` either reuses
-  the person's existing platform profile — matched on the account name — or mints a brand-new
-  organization entity. Whatever the caller sent is then overwritten with the linked profile's own
-  slug before the envelope is signed, so the address alone decides which identity and which
-  organization the token names.
+  `@owlmeans/server-auth-identity` reads neither: `getLinkedProfile` keys on the credential built
+  from the auth type, the `'email'` service and the address, and `linkProfile` lands on the one
+  account of that address (registering it with a personal organization when it is new). Whatever
+  the caller sent is then overwritten with the linked payload's own slug before the envelope is
+  signed, so the address alone decides which account and which organization the token names.
 - Errors from this plugin are `AuthenFailed` (from `@owlmeans/auth`) — callers catch that, not raw `Error`.
 - Use the email throttle for the public integrated-IAM flow: one issuance per minute and ten per
   hour, with a 429 and Retry-After. The companion IP throttle is available for an ingress that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-otp",
-  "version": "0.1.18-rc.49",
+  "version": "0.1.18-rc.50",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,17 +22,17 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.37",
+    "@owlmeans/auth": "^0.1.18-rc.38",
     "@owlmeans/auth-otp": "^0.1.18-rc.32",
     "@owlmeans/context": "^0.1.18-rc.32",
     "@owlmeans/error": "^0.1.18-rc.36",
     "@owlmeans/mailer": "^0.1.18-rc.33",
-    "@owlmeans/oidc": "^0.1.18-rc.51",
-    "@owlmeans/redis-resource": "^0.1.18-rc.40",
+    "@owlmeans/oidc": "^0.1.18-rc.52",
+    "@owlmeans/redis-resource": "^0.1.18-rc.41",
     "@owlmeans/resource": "^0.1.18-rc.37",
-    "@owlmeans/server-auth": "^0.1.18-rc.50",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.43",
-    "@owlmeans/server-context": "^0.1.18-rc.39"
+    "@owlmeans/server-auth": "^0.1.18-rc.51",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.44",
+    "@owlmeans/server-context": "^0.1.18-rc.40"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",