@owlmeans/server-auth 0.1.18-rc.2 → 0.1.18-rc.20

package/README.md

@@ -12,7 +12,7 @@ Server-side Ed25519 authentication service for OwlMeans backends.
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth
+bun add @owlmeans/server-auth@^0.1.18-rc.17
 ```
 
 ## Usage
@@ -35,7 +35,7 @@ Reference the guard by alias when protecting routes:
 import { DAUTH_GUARD } from '@owlmeans/server-app'
 // same as DEFAULT_ALIAS from @owlmeans/server-auth
 
-const adminModule = module(route('admin', '/admin'), guard(DAUTH_GUARD))
+const adminEntrypoint = entrypoint(route('admin', '/admin'), guard(DAUTH_GUARD))
 ```
 
 ## API
@@ -60,12 +60,12 @@ Resource alias for the nonce replay-prevention cache.
 
 - Register `appendAuthService(context)` before `appendAuthIdentityResources(context)` and product-specific gate services.
 - Register `AUTH_CACHE` explicitly as a Redis resource when customizing the backend context.
-- This package verifies bearer tokens and populates `request.auth`; authorization remains the job of module gates and handler-level entity checks.
+- This package verifies bearer tokens and populates `request.auth`; authorization remains the job of entrypoint gates and handler-level organization entity checks.
 - Pair it with `@owlmeans/server-auth-identity` when external provider login should produce durable local account/profile/credentials records.
 
 ## Related Packages
 
-- [`@owlmeans/auth-common`](../auth-common) — `GUARD_ED25519` constant and auth modules
+- [`@owlmeans/auth-common`](../auth-common) — `GUARD_ED25519` constant and auth entrypoints
 - [`@owlmeans/server-app`](../server-app) — `makeContext` calls `appendAuthService` by default
 
 <!-- owlmeans:agent-guidance:start -->
@@ -76,7 +76,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.14
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.502Z",
+  "version": "0.1.18-rc.20",
+  "generatedAt": "2026-09-10T23:12:07.508Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {
@@ -11,6 +11,13 @@
       "category": "package-specific",
       "file": "skills/server-auth/SKILL.md",
       "canonicalPath": ".agents/skills/server-auth/SKILL.md"
+    },
+    {
+      "kind": "skill",
+      "name": "supervisor-auth",
+      "category": "multi-package",
+      "file": "skills/supervisor-auth/SKILL.md",
+      "canonicalPath": ".agents/skills/supervisor-auth/SKILL.md"
     }
   ]
 }

package/agent-meta/skills/server-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-auth
-description: How to use @owlmeans/server-auth — server-side authentication manager, AUTH_API alias, setupAuthServiceModules() to wire auth modules into your app. Auto-invoked when importing auth manager primitives.
+description: How to use @owlmeans/server-auth — the server side of OwlMeans authentication. Two halves in one package - appendAuthService/makeAuthService, which verify Ed25519 bearer tokens on an ordinary API server, and the ./manager subpath, which IS the auth manager service (challenge, plugin registry, credential envelope, rely). Auto-invoked when importing the server auth guard, registering an auth plugin, or building the auth manager.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,41 +8,112 @@ user-invocable: false
 # @owlmeans/server-auth
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.20"` in `dependencies`
 
-## Key Exports
+Two halves, deliberately split by subpath:
+
+- the **root** export is what every protected API server needs — the guard that verifies an
+  `Ed25519BasicToken` bearer and resolves an `Auth`;
+- **`./manager`** is the auth manager application itself — it serves `/authentication/init` and
+  `/authentication/authenticate`, owns the plugin registry, and signs the credential envelope.
+
+An ordinary service imports the root. Only the auth manager imports `./manager`.
+
+## Key Exports — root
+
+| Export | Description |
+|--------|-------------|
+| `appendAuthService(ctx, alias?)` | Register the guard on a server context and expose it as `context.auth()`. Registers a static `AUTH_CACHE` resource when the context has none |
+| `makeAuthService(alias?)` | The guard service itself: `match`, `handle`, `unpack(token)`, `authenticate(token)` |
+| `entrypoints` | `DISPATCHER` and `DISPATCHER_AUTHEN`, elevated — spread these into a service that accepts a manager-issued credential and exchanges it for a bearer |
+| `DEFAULT_ALIAS` | `'auth'` — the guard's service alias, matching `DEFAULT_GUARD` |
+| `AUTH_CACHE` | `'auth-cache'` — the single-use challenge store |
+| `AUTH_SRV_KEY` | `'auth-service'` — the TRUSTED record whose key signs credential envelopes |
+| `AUTHEN_TIMEFRAME` | `15 * 60 * 1000` — challenge lifetime and anti-replay window, in ms |
+| `AuthService`, `AuthServiceAppend`, `AuthSpent` | Types |
+| `makeRelyModel`, `makeProviderRely`, `makeConsumerRely`, `RelyOptions` | The rely (wallet handshake) models |
+
+## Key Exports — `./manager`
 
 | Export | Description |
 |--------|-------------|
-| `setupAuthServiceModules(modules, alias)` | Wire auth modules into your app modules array |
-| `AUTH_API` (re-exported) | Auth service alias |
-| Auth service factory | Backend auth manager |
-| Plugin types | Pluggable auth verifiers |
+| `makeContext(cfg, customize?)` | A server context preconfigured with the API server, API client, socket service and static `AUTH_CACHE` |
+| `main(ctx)` | Register the manager entrypoints, configure, init and listen |
+| `entrypoints` | `AUTHEN`, `AUTHEN_INIT`, `AUTHEN_AUTHEN`, `AUTHEN_RELY`, the api-config entrypoints and the reCAPTCHA siteverify entrypoint |
+| `authenticationInit`, `authenticate`, `rely` | The handlers those entrypoints elevate to: `init(request)` → challenge, `authenticate(credential)` → signed credential envelope, and the rely socket |
+| `plugins`, `registerPlugin(type, factory)` | The plugin registry (also on `./manager/plugins`) |
+| `appendSupervisorAuth(ctx, opts?)`, `setupInternalTokenCoguard(entrypoints, guard?)` | PK supervisor login — see the `supervisor-auth` skill |
+| `createRelyService(alias?)`, `DEFAULT_RELY`, `RELY_TUNNEL` | The rely guard service |
+| `AppConfig`, `AppContext`, `AuthModel`, `RelyService`, `RelyAllowanceRequest`, `RelyLinker`, `RelyCarrier` | Types |
+
+`./manager` also re-exports the handful of symbols a manager application needs from elsewhere
+(`config`, `service`, `TRUSTED`, `elevate`, `handleBody` / `handleRequest`, `backend`,
+`GUARD_ED25519`, `AUTHEN*` aliases, `TrustedRecord`), so a manager app can be written against this
+one import.
 
-## Subpath Exports
+## Key Exports — `./manager/plugins`
 
-- `./manager` — auth manager service implementation
-- `./manager/plugins` — pluggable manager plugins
+| Export | Description |
+|--------|-------------|
+| `AuthPlugin` | `{ type, init(request), authenticate(credential) }` — `AuthModel` minus `rely` |
+| `registerPlugin(type, factory)` | Add a plugin under a type string. The registry is a module-level singleton |
+| `plugins` | The registry map |
+| `getPlugin(type, context)`, `assertType(type, plugin)` | Resolution; `getPlugin` throws `AuthUnknown(type)` for an unregistered type |
+| `basicEd25519`, `reCaptcha`, `basicRely` | The plugins registered out of the box, for `AuthenticationType.BasicEd25519`, `ReCaptcha` and `RelyHandshake` |
+| `makeSupervisorPlugin(context, opts)` | The PK supervisor plugin factory |
+| `RecpatchaResponse`, `RecaptchaRequest`, `RelyRecord`, `AuthRedisResource` | Types |
 
 ## Usage
 
+Protect an ordinary API server:
+
+```typescript
+import { appendAuthService } from '@owlmeans/server-auth'
+import { appendAuthIdentityResources } from '@owlmeans/server-auth-identity'
+
+// in makeContext, after the db/cache services are appended:
+appendAuthService(context)
+appendAuthIdentityResources(context)
+```
+
+Add an authentication method to the manager:
+
 ```typescript
-import { setupAuthServiceModules } from '@owlmeans/server-auth'
-import { AUTH_API } from '@owlmeans/auth-common'
+import { registerPlugin } from '@owlmeans/server-auth/manager/plugins'
+import type { AuthPlugin } from '@owlmeans/server-auth/manager/plugins'
 
-setupAuthServiceModules(appModules, AUTH_API)
+registerPlugin('my-method', context => ({
+  type: 'my-method',
+  init: async request => ({ challenge: /* unique per request */ '' }),
+  authenticate: async credential => {
+    // verify credential.credential, then set userId / profileId / entitySlug / role / scopes
+    return { token: '' }   // '' keeps the manager's own challenge as the credential token
+  },
+}) as AuthPlugin)
 ```
 
-## Product-Viable Usage Notes
+## Rules
 
-- Backend context registers `appendAuthService(context)` before identity resources and product-specific gate services.
-- `AUTH_CACHE` must be registered as a Redis resource when the backend context does not rely on the default `server-app` setup.
-- `server-auth` verifies bearer tokens and populates `req.auth`; it does not decide product ownership or permissions by itself.
-- Pair this package with `@owlmeans/server-auth-identity` when an external provider such as Google should map into local account/profile/credentials records.
-- Pair it with `@owlmeans/entrypoint` gates for authorization, and keep handler-level `entityId` checks as a second line of defense.
+- The guard verifies a bearer token and populates `req.auth`. It decides nothing about ownership or
+  permissions — pair it with `@owlmeans/entrypoint` gates, and keep a handler-level organization
+  check as a second line of defence.
+- `AUTH_CACHE` is the anti-replay store: the manager burns each decoded challenge into it as a
+  create-once record with `AUTHEN_TIMEFRAME` TTL. `appendAuthService` registers a **static**
+  (in-process) resource when the context has none, which is correct for a single replica only —
+  register a Redis resource under the same alias before calling it in any scaled deployment.
+- A plugin's `init` must return a challenge that is unique per request. A challenge that repeats
+  across independent attempts collides in `AUTH_CACHE` and surfaces as `AuthenFailed('challenge')`.
+- The manager canonicalizes the organization entity: whatever slug (current, retired, or the frozen
+  key) a plugin leaves on `credential.entitySlug` is resolved through `ENTITY_RESOLVER` and replaced
+  with the current slug before the envelope is signed. An unresolvable value throws
+  `AuthenFailed('entity')`. Where no resolver is registered the value is passed through untouched.
+- Pair this package with `@owlmeans/server-auth-identity` when an external provider (Google, OIDC,
+  email OTP) must map onto local account/profile/credential records.
 
 ## Depends On
 
-- `@owlmeans/auth`, `@owlmeans/auth-common`
-- `@owlmeans/server-entrypoint`, `@owlmeans/server-context`
-- `@owlmeans/basic-keys` — Ed25519 verification
+- `@owlmeans/auth`, `@owlmeans/auth-common` — types, aliases, `trust()`, `extractAuthToken`
+- `@owlmeans/basic-envelope`, `@owlmeans/basic-keys` — envelope signing and Ed25519 verification
+- `@owlmeans/server-context`, `@owlmeans/server-entrypoint`, `@owlmeans/server-api`
+- `@owlmeans/config` — the `TRUSTED` config resource
+- `@owlmeans/static-resource` — the default `AUTH_CACHE` backing

package/agent-meta/skills/supervisor-auth/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: supervisor-auth
+description: PK-based supervisor authentication — a development-only login where a holder of one of the project's trusted private keys mints a token for any user id/email (registering them on first use), bypassing external IdPs. Primary use is end-to-end tests. Covers appendSupervisorAuth (server + web), the supervisor plugin, and the @owlmeans/test-ui helpers. Use when wiring or testing supervisor auth.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# PK-Based Supervisor Authentication
+
+**Layer:** Server (`@owlmeans/server-auth`) + Web (`@owlmeans/web-auth`) + Tests (`@owlmeans/test-ui`)
+
+A privileged, **development-only** auth path: a holder of one of the project's trusted private keys
+(the allowlisted "supervisors") signs a server challenge to mint a valid owlmeans token for an
+arbitrary user id / email — **without** Google/OIDC. Unknown users are **registered** on first use.
+The primary purpose is deterministic **end-to-end tests** that authenticate against real environments.
+
+It reuses the existing flow end-to-end: the plugin only **verifies the supervisor signature and
+resolves/registers the user**, then hands the mutated credential back to the auth manager's own
+model (which signs the credential envelope) and to the project's auth service (which exchanges it
+for the final `Ed25519BasicToken` bearer). No new token-minting code.
+
+## Type & payload
+
+- `AuthenticationType.Supervisor = 'pk-supervisor'` (in `@owlmeans/auth`).
+- Shared signed payload: `buildSupervisorPayload(challenge, userId, salt)` (in `@owlmeans/auth`) —
+  binds the signature to the **single-use server challenge** (replay protection), the target
+  `userId`, and a fresh client `salt`. The front-end packs `{ salt, signature }` (JSON) into
+  `AuthCredentials.credential`.
+
+## Server: `appendSupervisorAuth` (from `@owlmeans/server-auth/manager`)
+
+Call once on the **auth-manager** context (the one that serves `AUTHEN_INIT`/`AUTHEN_AUTHEN` and holds
+`AUTH_SRV_KEY`), beside other plugin appends (e.g. `appendOtpPlugin`).
+
+```ts
+import { appendSupervisorAuth } from '@owlmeans/server-auth/manager'
+
+appendSupervisorAuth(context, {
+  supervisors: ['master-key', 'super-user', 'shared-key'], // TRUSTED record `name`s allowed to sign
+  resolveUser: async (userId, ctx, { register }) => {        // find-or-create the target identity
+    // wire to your identity store; return { userId, profileId?, entitySlug?, role?, scopes? }
+  },
+  allowRegistration: true,        // default true
+  enabled: undefined,             // default: development only (cfg.debug.all || cfg.debug.supervisor)
+  acceptInternalTokens: true,     // default true — see below
+})
+```
+
+Options:
+- `supervisors` — TRUSTED-record `name`s authorized to sign. Default `['master','superuser']`. The
+  matching **public** key must be in the project's TRUSTED config; the **private** key is what the
+  front-end signs with. Pick aliases whose private keys you actually have (e.g. in `.env.dev.secrets`).
+- `resolveUser` — `(userId, context, { register }) => Promise<SupervisorUserResolution>`. Default:
+  trust the id as-is (`{ userId }`). Wire it to `@owlmeans/server-auth-identity`'s
+  `IdentityLinkingService` (`getLinkedProfile` / `linkProfile`) to find-or-create a real profile and
+  organization entity. `SupervisorUserResolution` is `{ userId }` plus optional `profileId`,
+  `entitySlug`, `role` and `scopes` — the organization value is a SLUG, the renameable public name
+  that a token carries, never the stable `entityId`. `profileId` defaults to `userId`, `scopes` to
+  the credential's own or `[ALL_SCOPES]`, and `role` to `AuthRole.User`.
+- `enabled` — force on/off. Default is development only. **Never enable in real production.**
+- `acceptInternalTokens` — when `true`, appends the internal `Ed25519BasicToken` guard
+  (`DEFAULT_GUARD`) as a coguard on every already-guarded backend entrypoint, so internal OwlMeans
+  tokens keep working where another guard (OIDC, say) is the primary one. The primary guard stays
+  first; the internal guard only matches an `Ed25519BasicToken` authorization header. Also exposed
+  standalone as `setupInternalTokenCoguard(entrypoints, guard?)`. Set `false` when the entrypoints
+  already use `DEFAULT_GUARD` as their primary guard.
+- `guard` — which guard alias `acceptInternalTokens` appends. Default `DEFAULT_GUARD` (`'auth'`).
+
+## Web: `appendSupervisorAuth` (from `@owlmeans/web-auth`)
+
+Call once on the web client context. Registers the self-contained login form plugin; the form renders
+at the standard typed route `SUPERVISOR_LOGIN_PATH` = `/authentication/login/pk-supervisor`.
+
+```ts
+import { appendSupervisorAuth } from '@owlmeans/web-auth'
+
+appendSupervisorAuth(context) // dev-only by default; or appendSupervisorAuth(context, { enabled })
+```
+
+The form (`data-testid="supervisor-auth-form"`, inputs `supervisor-user-id`, `supervisor-pk`, button
+`supervisor-submit`, error `supervisor-error`) fetches a challenge, signs it, exchanges it for a
+bearer, stores it, and redirects HOME — mirroring the Google plugin. (Alternatively, the side-effect
+import `@owlmeans/web-auth/auth/plugins` always-registers it.)
+
+The web append reads `cfg.debug.supervisor` alone; the server append accepts either
+`cfg.debug.all` or `cfg.debug.supervisor`. A deployment that wants the operator login therefore sets
+`debug.supervisor` — it is the flag both halves honour, and the only one that does not arrive by
+accident. The plugin is `restricted`, so `appendSupervisorAuth` also writes
+`cfg.security.auth.login.overrides` to make it offerable; `{ offer: false }` registers it without
+advertising it.
+
+## Tests: `@owlmeans/test-ui` helpers
+
+- `authenticateViaSupervisorApi({ apiBaseUrl, userId, pk })` — drives the live API
+  (`/authentication/init` → sign → `/authentication/authenticate` → `/authenticate`) and returns the
+  final bearer. **No browser**; registers the user on first use. The "set a token directly via API" path.
+- `loginViaSupervisorForm(page, { baseUrl, userId, pk })` — Playwright: drives the real login form
+  end-to-end (faithful path that exercises the plugin + registration).
+- `loginViaDispatcher(page, baseUrl, token)` — inject a pregenerated bearer via the standard
+  `/dispatcher?token=` route (apps that override DISPATCHER, e.g. for a forced IdP, can't use this —
+  use the form).
+- `pregenerateAuthToken({ userId, pk, scopes?, role?, profileId?, source?, ... })` — offline mint via
+  `@owlmeans/test-auth`'s `makeBearer`, using the project's **own** trusted signing key (lowest-level
+  primitive). No plugin, no registration.
+
+`loginViaSupervisorForm` answers a cookie-consent dialog by default (`consent: 'accept'`): an
+OwlMeans app refuses to start an authentication flow until consent is answered, and the modal
+intercepts every click at the form underneath. Both browser helpers navigate with
+`waitUntil: 'domcontentloaded'` rather than Playwright's `load`, because `load` waits for every
+subresource and a tag manager or analytics beacon that never settles holds it open until timeout.
+
+## Security
+
+- Development/stage only. Gate on `cfg.debug`; never ship enabled to real production.
+- Anyone with a supervisor **private** key can impersonate/register any user — treat those keys as
+  highly sensitive.
+
+## Depends On
+- `@owlmeans/auth` (type + `buildSupervisorPayload` + `SupervisorCredentialPayload`),
+  `@owlmeans/basic-keys` (sign/verify), `@owlmeans/basic-ids` (the salt),
+  `@owlmeans/auth-common` (`DEFAULT_GUARD`, `TrustedRecord`), `@owlmeans/config` (`TRUSTED`).
+- Tests: `@owlmeans/test-ui` (the helpers above) over `@owlmeans/test-auth` (`makeBearer`).
+
+## Related
+
+`server-auth` (the plugin registry and the manager) · `web-auth` (the form package) ·
+`server-auth-identity` (what `resolveUser` should be wired to) · `login-methods` (why a
+`restricted` method has to be named in the configuration)

package/build/entrypoints.d.ts

@@ -0,0 +1,3 @@
+import type { ServerEntrypoint } from '@owlmeans/server-entrypoint';
+export declare const entrypoints: ServerEntrypoint<unknown>[];
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAOnE,eAAO,MAAM,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAKlD,CAAA"}

package/build/{modules.js → entrypoints.js}

@@ -1,11 +1,11 @@
 import { elevate } from '@owlmeans/server-entrypoint';
-import { modules as list } from '@owlmeans/auth-common';
+import { entrypoints as list } from '@owlmeans/auth-common';
 import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth';
 import { authenticate } from './actions/service.js';
 import { stab, elevate as celevate } from '@owlmeans/client-entrypoint';
 elevate(list, DISPATCHER_AUTHEN, authenticate);
 celevate(list, DISPATCHER, stab);
-export const modules = [
-    ...list.filter((module) => [DISPATCHER, DISPATCHER_AUTHEN].includes(module.getAlias()))
+export const entrypoints = [
+    ...list.filter((module) => [DISPATCHER, DISPATCHER_AUTHEN].includes(module.alias))
 ];
-//# sourceMappingURL=modules.js.map
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAC9C,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,WAAW,GAAgC;IACtD,GAAG,IAAI,CAAC,MAAM,CACZ,CAAC,MAAM,EAAuC,EAAE,CAC9C,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CACzD;CACF,CAAA"}

package/build/index.d.ts

@@ -1,6 +1,6 @@
 export type * from './types.js';
 export * from './model/index.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './service.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA"}

package/build/index.js

@@ -1,5 +1,5 @@
 export * from './model/index.js';
 export * from './consts.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './service.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA"}

package/build/manager/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/manager/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AASvD,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,cAAa,OAAO,KAAW,CAsB9G,CAAA"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/manager/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AASvD,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,cAAa,OAAO,KAAW,CAoB9G,CAAA"}

package/build/manager/context.js

@@ -20,7 +20,6 @@ export const makeContext = (cfg, customize = false) => {
     if (!customize && !context.hasResource(AUTH_CACHE)) {
         appendStaticResource(context, AUTH_CACHE);
     }
-    context.makeContext = (cfg => makeContext(cfg, customize));
     return context;
 };
 //# sourceMappingURL=context.js.map

package/build/manager/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/manager/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAEhE,MAAM,CAAC,MAAM,WAAW,GAAG,CAA+C,GAAM,EAAE,SAAS,GAAY,KAAK,EAAK,EAAE;IACjH,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAE3C,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,mBAAmB,CAAO,OAAO,CAAC,CAAA;IAElC,OAAO,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,CAAA;IAEpD,4CAA4C;IAC5C,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,oBAAoB,CAAO,OAAO,EAAE,UAAU,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAA+B,CAAA;IAExF,OAAO,OAAY,CAAA;AACrB,CAAC,CAAA"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/manager/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAEhE,MAAM,CAAC,MAAM,WAAW,GAAG,CAA+C,GAAM,EAAE,SAAS,GAAY,KAAK,EAAK,EAAE;IACjH,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAE3C,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,mBAAmB,CAAO,OAAO,CAAC,CAAA;IAElC,OAAO,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,CAAA;IAEpD,4CAA4C;IAC5C,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,oBAAoB,CAAO,OAAO,EAAE,UAAU,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,OAAY,CAAA;AACrB,CAAC,CAAA"}

package/build/manager/entrypoints.d.ts

@@ -0,0 +1,2 @@
+export declare const entrypoints: import("@owlmeans/entrypoint").CommonEntrypoint[];
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/manager/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,WAAW,mDAAO,CAAA"}

package/build/manager/{modules.js → entrypoints.js}

@@ -1,21 +1,21 @@
 import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, MOD_RECAPTCHA } from '@owlmeans/auth';
-import { modules as list } from '@owlmeans/auth-common';
-import { modules as apiConfig } from '@owlmeans/api-config-server';
+import { entrypoints as list } from '@owlmeans/auth-common';
+import { entrypoints as apiConfig } from '@owlmeans/api-config-server';
 import { elevate, guard } from '@owlmeans/server-entrypoint';
 import * as actions from './actions/index.js';
 import { entrypoint } from '@owlmeans/client-entrypoint';
 import { backend, route, RouteMethod } from '@owlmeans/route';
 import { handleIntermediate } from '@owlmeans/server-api';
 import { DEFAULT_RELY } from './consts.js';
-elevate(list, AUTHEN, handleIntermediate(async (_, context) => await context.updateContext()), { intermediate: true });
+elevate(list, AUTHEN, handleIntermediate(async (_, context) => context), { intermediate: true });
 elevate(list, AUTHEN_INIT, actions.authenticationInit);
 elevate(list, AUTHEN_AUTHEN, actions.authenticate);
 elevate(list, AUTHEN_RELY, actions.rely, guard(DEFAULT_RELY));
-export const modules = list;
+export const entrypoints = list;
 list.push(...apiConfig);
 list.push(entrypoint(route(MOD_RECAPTCHA, '/api/siteverify', backend({
     host: 'https://www.google.com',
     base: 'recaptcha',
     secure: true,
 }, RouteMethod.POST))));
-//# sourceMappingURL=modules.js.map
+//# sourceMappingURL=entrypoints.js.map

package/build/manager/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,WAAW,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CACtC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAC9B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1B,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACtD,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AAClD,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAA;AAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;AACvB,IAAI,CAAC,IAAI,CACP,UAAU,CACR,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,IAAI;CACb,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CACtB,CACF,CAAA"}

package/build/manager/index.d.ts

@@ -1,5 +1,5 @@
 export type * from './types.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './exports.js';
 export * from './context.js';
 export * from './main.js';

package/build/manager/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manager/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manager/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA"}

package/build/manager/index.js

@@ -1,4 +1,4 @@
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './exports.js';
 export * from './context.js';
 export * from './main.js';

package/build/manager/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manager/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manager/index.ts"],"names":[],"mappings":"AAEA,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA"}

package/build/manager/main.js

@@ -1,6 +1,6 @@
-import { modules } from './modules.js';
+import { entrypoints } from './entrypoints.js';
 export const main = async (ctx) => {
-    ctx.registerEntrypoints(modules);
+    ctx.registerEntrypoints(entrypoints);
     await ctx.configure().init();
     await ctx.getApiServer().listen();
 };

package/build/manager/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/manager/main.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAGtC,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAgD,GAAM,EAAE,EAAE;IACjF,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/manager/main.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAgD,GAAM,EAAE,EAAE;IACjF,GAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC,CAAA"}

package/build/manager/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAgBlE,eAAO,MAAM,aAAa,YAAa,UAAU,CAAC,SAAS,CAAC,KAAG,SA4E9D,CAAA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAkBlE,eAAO,MAAM,aAAa,YAAa,UAAU,CAAC,SAAS,CAAC,KAAG,SAyF9D,CAAA"}

package/build/manager/model.js

@@ -1,4 +1,5 @@
-import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth';
+import { AuthenFailed, AuthenPayloadError, entitySlugOf } from '@owlmeans/auth';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
 import { getPlugin } from './plugins/utils.js';
 import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
@@ -52,6 +53,18 @@ export const makeAuthModel = (context) => {
             const challenge = credential.challenge;
             const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }));
             credential.challenge = token === '' ? challenge : token;
+            // Plugins accept whatever the caller typed — a current slug, a slug the organization has
+            // since retired, or (for a token minted before slugs existed) its stable key. The token is
+            // signed once and read for as long as it lives, so the value is canonicalized here rather
+            // than at every place that later reads it back.
+            const entitySlug = entitySlugOf(credential);
+            if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
+                const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
+                if (entity == null) {
+                    throw new AuthenFailed('entity');
+                }
+                credential.entitySlug = entity.slug;
+            }
             credential.credential = trustedUser.id;
             return {
                 token: await makeEnvelopeModel(credential.type)

package/build/manager/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAQ5C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;YACrC,CAAC;YAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;YACvG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;oBACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAExD,2EAA2E;YAC3E,kEAAkE;YAClE,gCAAgC;YAChC,kEAAkE;YAClE,kEAAkE;YAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAEvD,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;YAEtC,OAAO;gBACL,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;qBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;qBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAG/E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAQ5C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;YACrC,CAAC;YAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;YACvG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;oBACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAExD,2EAA2E;YAC3E,kEAAkE;YAClE,gCAAgC;YAChC,kEAAkE;YAClE,kEAAkE;YAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAEvD,yFAAyF;YACzF,2FAA2F;YAC3F,0FAA0F;YAC1F,gDAAgD;YAChD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;YAC3C,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAChG,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;gBAClC,CAAC;gBACD,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YACrC,CAAC;YAED,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;YAEtC,OAAO;gBACL,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;qBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;qBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/manager/plugins/basic-ed25519.js.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAA+C,OAAU,EAAc,EAAE;IACnG,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,YAAY;QACrC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B;;eAEG;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;iBACxD,IAAI,CAAgB,UAAU,CAAC,MAAM,CAAC,CAAA;YAEzC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAE7C,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,YAAY,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,8DAA8D;YAC9D,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAA;YACpC,UAAU,CAAC,SAAS,GAAG,KAAK,CAAA;YAC5B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;YAEjD,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAA+C,OAAU,EAAc,EAAE;IACnG,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,YAAY;QACrC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B;;eAEG;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAgB,OAAO,CAAC;iBACvE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAE1B,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAE7C,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,YAAY,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,8DAA8D;YAC9D,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAA;YACpC,UAAU,CAAC,SAAS,GAAG,KAAK,CAAA;YAC5B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;YAEjD,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/manager/plugins/basic-rely.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;AAS3E,eAAO,MAAM,SAAS,YAAa,UAAU,SAAS,MAAM,KAAG,UA0J9D,CAAA"}
+{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;AAU3E,eAAO,MAAM,SAAS,YAAa,UAAU,SAAS,MAAM,KAAG,UA0J9D,CAAA"}

package/build/manager/plugins/basic-rely.js

@@ -11,8 +11,8 @@ export const basicRely = (context, type) => {
         type: type ?? AuthenticationType.RelyHandshake,
         // This method is used by consumer and by provider (wallet)
         // to initialize shared authentication process.
-        // The idea is that both subscribe to wait for a handshake value
-        // from the peer, that in fact is a subscription to a redis message tunnel.  
+        // The idea is that both watch the record holding their own pin/token and wake
+        // up when the peer writes its handshake value into it.
         init: async (request) => {
             const [, keyPair] = await trusted(context);
             const tunnel = context.resource(AUTH_CACHE);
@@ -32,8 +32,8 @@ export const basicRely = (context, type) => {
                     }
                     if (request.provideRely != null) {
                         await Promise.all([pin, token].filter(key => key != null).map(async (key) => {
-                            _subscriptions[key] = await tunnel.subscribe(async (value) => {
-                                if (value.challenge != null) {
+                            _subscriptions[key] = await tunnel.watch(key, async (value) => {
+                                if (value?.challenge != null) {
                                     const rely = makeEnvelopeModel(value.challenge, EnvelopeKind.Wrap);
                                     if (await rely.verify(keyPair)) {
                                         [pin, token].filter(key => key != null).forEach(key => {
@@ -45,7 +45,7 @@ export const basicRely = (context, type) => {
                                         await request.provideRely?.(rely.message(), relyMsg, true);
                                     }
                                 }
-                            }, { /*ttl: RELY_CALL_TIMEOUT,*/ key, once: true });
+                            }, { once: true });
                             // @TODO they need to be killed on close - but actually live a little bit longer 
                             // then timeout for them is ok
                             setTimeout(() => {