@owlmeans/server-auth 0.1.18-rc.20 → 0.1.18-rc.21

package/README.md

@@ -33,9 +33,15 @@ Reference the guard by alias when protecting routes:
 
 ```typescript
 import { DAUTH_GUARD } from '@owlmeans/server-app'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
+import { route } from '@owlmeans/route'
 // same as DEFAULT_ALIAS from @owlmeans/server-auth
 
-const adminEntrypoint = entrypoint(route('admin', '/admin'), guard(DAUTH_GUARD))
+const adminProtocol = protocol(
+  route('admin', '/admin'),
+  contract(typed<AdminResponse>()),
+  { guards: DAUTH_GUARD },
+)
 ```
 
 ## API
@@ -76,7 +82,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.14
+npx @owlmeans/agent-skills@^0.1.18-rc.15
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.20",
-  "generatedAt": "2026-09-10T23:12:07.508Z",
+  "version": "0.1.18-rc.21",
+  "generatedAt": "2026-09-12T08:39:52.721Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.20"` in `dependencies`
+**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.21"` in `dependencies`
 
 Two halves, deliberately split by subpath:
 
@@ -25,7 +25,7 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
 |--------|-------------|
 | `appendAuthService(ctx, alias?)` | Register the guard on a server context and expose it as `context.auth()`. Registers a static `AUTH_CACHE` resource when the context has none |
 | `makeAuthService(alias?)` | The guard service itself: `match`, `handle`, `unpack(token)`, `authenticate(token)` |
-| `entrypoints` | `DISPATCHER` and `DISPATCHER_AUTHEN`, elevated — spread these into a service that accepts a manager-issued credential and exchanges it for a bearer |
+| `entrypoints` | `DISPATCHER` and `DISPATCHER_AUTHEN`, server-bound — spread these into a service that accepts a manager-issued credential and exchanges it for a bearer |
 | `DEFAULT_ALIAS` | `'auth'` — the guard's service alias, matching `DEFAULT_GUARD` |
 | `AUTH_CACHE` | `'auth-cache'` — the single-use challenge store |
 | `AUTH_SRV_KEY` | `'auth-service'` — the TRUSTED record whose key signs credential envelopes |
@@ -40,14 +40,14 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
 | `makeContext(cfg, customize?)` | A server context preconfigured with the API server, API client, socket service and static `AUTH_CACHE` |
 | `main(ctx)` | Register the manager entrypoints, configure, init and listen |
 | `entrypoints` | `AUTHEN`, `AUTHEN_INIT`, `AUTHEN_AUTHEN`, `AUTHEN_RELY`, the api-config entrypoints and the reCAPTCHA siteverify entrypoint |
-| `authenticationInit`, `authenticate`, `rely` | The handlers those entrypoints elevate to: `init(request)` → challenge, `authenticate(credential)` → signed credential envelope, and the rely socket |
+| `authenticationInit`, `authenticate`, `rely` | Implementations bound to auth protocols: `init(request)` → challenge, `authenticate(credential)` → signed credential envelope, and the rely socket |
 | `plugins`, `registerPlugin(type, factory)` | The plugin registry (also on `./manager/plugins`) |
 | `appendSupervisorAuth(ctx, opts?)`, `setupInternalTokenCoguard(entrypoints, guard?)` | PK supervisor login — see the `supervisor-auth` skill |
 | `createRelyService(alias?)`, `DEFAULT_RELY`, `RELY_TUNNEL` | The rely guard service |
 | `AppConfig`, `AppContext`, `AuthModel`, `RelyService`, `RelyAllowanceRequest`, `RelyLinker`, `RelyCarrier` | Types |
 
 `./manager` also re-exports the handful of symbols a manager application needs from elsewhere
-(`config`, `service`, `TRUSTED`, `elevate`, `handleBody` / `handleRequest`, `backend`,
+(`config`, `service`, `TRUSTED`, `bind`, `handlers`, `backend`,
 `GUARD_ED25519`, `AUTHEN*` aliases, `TrustedRecord`), so a manager app can be written against this
 one import.
 

package/build/actions/service.d.ts

@@ -1,4 +1,8 @@
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
+import type { EntrypointProtocol } from '@owlmeans/entrypoint';
 import type { AuthToken } from '@owlmeans/auth';
-export declare const authenticate: RefedEntrypointHandler<AuthToken>;
+export declare const authenticate: (protocol: EntrypointProtocol<{
+    body: AuthToken;
+}, AuthToken>) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<EntrypointProtocol<{
+    body: AuthToken;
+}, AuthToken>>;
 //# sourceMappingURL=service.d.ts.map

package/build/actions/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/actions/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAS/C,eAAO,MAAM,YAAY,EAAE,sBAAsB,CAAC,SAAS,CAK1D,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/actions/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAS/C,eAAO,MAAM,YAAY,aAAc,kBAAkB,CAAC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,EAAE,SAAS,CAAC;UAAvB,SAAS;cAKvE,CAAA"}

package/build/actions/service.js

@@ -1,7 +1,8 @@
-import { handleBody } from '@owlmeans/server-api';
+import { handlers } from '@owlmeans/server-api';
 import { assertContext } from '@owlmeans/context';
-export const authenticate = handleBody(async (payload, ctx) => {
-    const context = assertContext(ctx, 'authenticate');
-    return await context.auth().authenticate(payload);
+const api = handlers();
+export const authenticate = (protocol) => api.request(protocol, async (request, context) => {
+    const ctx = assertContext(context, 'authenticate');
+    return await ctx.auth().authenticate(request.body);
 });
 //# sourceMappingURL=service.js.map

package/build/actions/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/actions/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAGjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAKjD,MAAM,CAAC,MAAM,YAAY,GAAsC,UAAU,CACvE,KAAK,EAAE,OAAkB,EAAE,GAAG,EAAE,EAAE;IAChC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,cAAc,CAAY,CAAA;IAC7D,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;AACnD,CAAC,CACF,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/actions/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAK/C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAIjD,MAAM,GAAG,GAAG,QAAQ,EAAW,CAAA;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAA4D,EAAE,EAAE,CAC3F,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,cAAc,CAAY,CAAA;IAE7D,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;AACpD,CAAC,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -1,3 +1,5 @@
-import type { ServerEntrypoint } from '@owlmeans/server-entrypoint';
-export declare const entrypoints: ServerEntrypoint<unknown>[];
+import type { ServerProtocolEntrypoint } from '@owlmeans/server-entrypoint';
+import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint';
+/** Server entrypoints required by the generic authentication service. */
+export declare const entrypoints: ServerProtocolEntrypoint<EntrypointProtocolDeclaration>[];
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAOnE,eAAO,MAAM,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAKlD,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAE3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAGzE,yEAAyE;AACzE,eAAO,MAAM,WAAW,EAAE,wBAAwB,CAAC,6BAA6B,CAAC,EAGhF,CAAA"}

package/build/entrypoints.js

@@ -1,11 +1,9 @@
-import { elevate } from '@owlmeans/server-entrypoint';
-import { entrypoints as list } from '@owlmeans/auth-common';
-import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth';
+import { bind } from '@owlmeans/server-entrypoint';
+import { authProtocols } from '@owlmeans/auth-common';
 import { authenticate } from './actions/service.js';
-import { stab, elevate as celevate } from '@owlmeans/client-entrypoint';
-elevate(list, DISPATCHER_AUTHEN, authenticate);
-celevate(list, DISPATCHER, stab);
+/** Server entrypoints required by the generic authentication service. */
 export const entrypoints = [
-    ...list.filter((module) => [DISPATCHER, DISPATCHER_AUTHEN].includes(module.alias))
+    bind(authProtocols.dispatcher),
+    bind(authProtocols.dispatcherAuthenticate, authenticate(authProtocols.dispatcherAuthenticate)),
 ];
 //# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAC9C,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,WAAW,GAAgC;IACtD,GAAG,IAAI,CAAC,MAAM,CACZ,CAAC,MAAM,EAAuC,EAAE,CAC9C,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CACzD;CACF,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAA8D;IACpF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IAC9B,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,YAAY,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAC/F,CAAA"}

package/build/manager/actions/manager.d.ts

@@ -1,6 +1,18 @@
-import type { AllowanceRequest, AuthCredentials } from '@owlmeans/auth';
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
-export declare const authenticationInit: RefedEntrypointHandler<AllowanceRequest>;
-export declare const authenticate: RefedEntrypointHandler<AuthCredentials>;
-export declare const rely: RefedEntrypointHandler<void>;
+import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth';
+import type { EntrypointProtocol } from '@owlmeans/entrypoint';
+export declare const authenticationInit: (protocol: EntrypointProtocol<{
+    body: AllowanceRequest;
+}, AllowanceResponse>) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<EntrypointProtocol<{
+    body: AllowanceRequest;
+}, AllowanceResponse>>;
+export declare const authenticate: (protocol: EntrypointProtocol<{
+    body: AuthCredentials;
+}, AuthToken>) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<EntrypointProtocol<{
+    body: AuthCredentials;
+}, AuthToken>>;
+export declare const rely: (protocol: EntrypointProtocol<{
+    query: Partial<AuthToken>;
+}, undefined>) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<EntrypointProtocol<{
+    query: Partial<AuthToken>;
+}, undefined>>;
 //# sourceMappingURL=manager.d.ts.map

package/build/manager/actions/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/manager/actions/manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAIzE,eAAO,MAAM,kBAAkB,EAAE,sBAAsB,CAAC,gBAAgB,CAGvE,CAAA;AAED,eAAO,MAAM,YAAY,EAAE,sBAAsB,CAAC,eAAe,CAGhE,CAAA;AAED,eAAO,MAAM,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAK7C,CAAA"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/manager/actions/manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAQ9D,eAAO,MAAM,kBAAkB,aAAc,kBAAkB,CAAC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,EAAE,iBAAiB,CAAC;UAAtC,gBAAgB;sBAGvF,CAAA;AAED,eAAO,MAAM,YAAY,aAAc,kBAAkB,CAAC;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,EAAE,SAAS,CAAC;UAA7B,eAAe;cAGhF,CAAA;AAED,eAAO,MAAM,IAAI,aAAc,kBAAkB,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAAE,EAAE,SAAS,CAAC;WAAhC,OAAO,CAAC,SAAS,CAAC;cAK5E,CAAA"}

package/build/manager/actions/manager.js

@@ -1,10 +1,11 @@
-import { handleBody } from '@owlmeans/server-api';
+import { handlers } from '@owlmeans/server-api';
 import { makeAuthModel } from '../model.js';
-import { handleConnection } from '@owlmeans/server-socket';
-export const authenticationInit = handleBody(async (payload, ctx) => await makeAuthModel(ctx).init(payload));
-export const authenticate = handleBody(async (payload, ctx) => await makeAuthModel(ctx).authenticate(payload));
-export const rely = handleConnection(
+import { connection } from '@owlmeans/server-socket';
+const api = handlers();
+export const authenticationInit = (protocol) => api.body(protocol, async (body, context) => await makeAuthModel(context).init(body));
+export const authenticate = (protocol) => api.body(protocol, async (body, context) => await makeAuthModel(context).authenticate(body));
+export const rely = (protocol) => connection(protocol, 
 // @TODO Request will contain information is there requrest 
 // privileged or not (privileged request implies auth provider)
-async (conn, ctx, req) => await makeAuthModel(ctx).rely(conn, req.auth));
+async (conn, context, request) => await makeAuthModel(context).rely(conn, request.auth));
 //# sourceMappingURL=manager.js.map

package/build/manager/actions/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/manager/actions/manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAA6C,UAAU,CACpF,KAAK,EAAE,OAAyB,EAAE,GAAG,EAAE,EAAE,CACvC,MAAM,aAAa,CAAC,GAA4B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAClE,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAA4C,UAAU,CAC7E,KAAK,EAAE,OAAwB,EAAE,GAAG,EAAE,EAAE,CACtC,MAAM,aAAa,CAAC,GAA4B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAC1E,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAiC,gBAAgB;AAChE,4DAA4D;AAC5D,+DAA+D;AAC/D,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CACvB,MAAM,aAAa,CAAC,GAA4B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CACzE,CAAA"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/manager/actions/manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEpD,MAAM,GAAG,GAAG,QAAQ,EAAyB,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAA2E,EAAE,EAAE,CAChH,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC3C,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAkE,EAAE,EAAE,CACjG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAC3C,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAChD,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAsE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ;AACjH,4DAA4D;AAC5D,+DAA+D;AAC/D,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC/B,MAAM,aAAa,CAAC,OAAgC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CACjF,CAAA"}

package/build/manager/entrypoints.d.ts

@@ -1,2 +1,9 @@
-export declare const entrypoints: import("@owlmeans/entrypoint").CommonEntrypoint[];
+/** Server entrypoints for the full authentication manager. */
+export declare const entrypoints: (import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AllowanceRequest;
+}, import("@owlmeans/auth").AllowanceResponse>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth").AuthCredentials;
+}, import("@owlmeans/auth").AuthToken>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    query: Partial<import("@owlmeans/auth").AuthToken>;
+}, undefined>>)[];
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/manager/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,WAAW,mDAAO,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,eAAO,MAAM,WAAW;;;;;;iBAOvB,CAAA"}

package/build/manager/entrypoints.js

@@ -1,21 +1,24 @@
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, MOD_RECAPTCHA } from '@owlmeans/auth';
-import { entrypoints as list } from '@owlmeans/auth-common';
-import { entrypoints as apiConfig } from '@owlmeans/api-config-server';
-import { elevate, guard } from '@owlmeans/server-entrypoint';
+import { MOD_RECAPTCHA } from '@owlmeans/auth';
+import { authProtocols } from '@owlmeans/auth-common';
+import { entrypoints as apiConfigBindings } from '@owlmeans/api-config-server';
+import { bind } from '@owlmeans/server-entrypoint';
+import { decorateEntrypoint, openProtocol } from '@owlmeans/entrypoint';
 import * as actions from './actions/index.js';
-import { entrypoint } from '@owlmeans/client-entrypoint';
 import { backend, route, RouteMethod } from '@owlmeans/route';
-import { handleIntermediate } from '@owlmeans/server-api';
 import { DEFAULT_RELY } from './consts.js';
-elevate(list, AUTHEN, handleIntermediate(async (_, context) => context), { intermediate: true });
-elevate(list, AUTHEN_INIT, actions.authenticationInit);
-elevate(list, AUTHEN_AUTHEN, actions.authenticate);
-elevate(list, AUTHEN_RELY, actions.rely, guard(DEFAULT_RELY));
-export const entrypoints = list;
-list.push(...apiConfig);
-list.push(entrypoint(route(MOD_RECAPTCHA, '/api/siteverify', backend({
+const relyProtocol = decorateEntrypoint(authProtocols.rely, { guards: DEFAULT_RELY });
+const reCaptchaProtocol = openProtocol(route(MOD_RECAPTCHA, '/api/siteverify', backend({
     host: 'https://www.google.com',
     base: 'recaptcha',
     secure: true,
-}, RouteMethod.POST))));
+}, RouteMethod.POST)));
+/** Server entrypoints for the full authentication manager. */
+export const entrypoints = [
+    bind(authProtocols.authen, undefined, { intermediate: true }),
+    bind(authProtocols.init, actions.authenticationInit(authProtocols.init)),
+    bind(authProtocols.authenticate, actions.authenticate(authProtocols.authenticate)),
+    bind(relyProtocol, actions.rely(relyProtocol)),
+    ...apiConfigBindings,
+    bind(reCaptchaProtocol),
+];
 //# sourceMappingURL=entrypoints.js.map

package/build/manager/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,WAAW,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CACtC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAC9B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1B,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACtD,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AAClD,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAA;AAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;AACvB,IAAI,CAAC,IAAI,CACP,UAAU,CACR,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,IAAI;CACb,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CACtB,CACF,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;AACrF,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC;IACrF,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,IAAI;CACb,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAEtB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,GAAG,iBAAiB;IACpB,IAAI,CAAC,iBAAiB,CAAC;CACxB,CAAA"}

package/build/manager/exports.d.ts

@@ -4,8 +4,7 @@ export { addWebService } from '@owlmeans/client-config';
 export { service, TRUSTED } from '@owlmeans/config';
 export { AppType, assertContext } from '@owlmeans/context';
 export { klusterize } from '@owlmeans/kluster';
-export { elevate } from '@owlmeans/server-entrypoint';
-export { elevate as celevate, stab } from '@owlmeans/client-entrypoint';
+export { stab } from '@owlmeans/client-entrypoint';
 export type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
 export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api';
 export type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint';

package/build/manager/exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../src/manager/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAClG,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../src/manager/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAClD,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAClG,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/build/manager/exports.js

@@ -3,8 +3,7 @@ export { addWebService } from '@owlmeans/client-config';
 export { service, TRUSTED } from '@owlmeans/config';
 export { AppType, assertContext } from '@owlmeans/context';
 export { klusterize } from '@owlmeans/kluster';
-export { elevate } from '@owlmeans/server-entrypoint';
-export { elevate as celevate, stab } from '@owlmeans/client-entrypoint';
+export { stab } from '@owlmeans/client-entrypoint';
 export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api';
 export { backend } from '@owlmeans/route';
 export { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT } from '@owlmeans/auth';

package/build/manager/exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../src/manager/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAElG,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../src/manager/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAElG,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/build/model/rely/consumer.d.ts

@@ -1,3 +1,5 @@
+import type { RelyToken } from '@owlmeans/auth';
+import type { EnvelopeModel } from '@owlmeans/basic-envelope';
 import type { RelyOptions } from './types.js';
-export declare const makeConsumerRely: (opts?: RelyOptions) => import("@owlmeans/basic-envelope").EnvelopeModel<import("@owlmeans/auth").RelyToken>;
+export declare const makeConsumerRely: (opts?: RelyOptions) => EnvelopeModel<RelyToken>;
 //# sourceMappingURL=consumer.d.ts.map

package/build/model/rely/consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,yFAOlD,CAAA"}
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,KAAG,aAAa,CAAC,SAAS,CAO5E,CAAA"}

package/build/model/rely/consumer.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumer.js","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAGzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAA;IAC3B,OAAO,GAAG,CAAC,GAAG,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEf,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"consumer.js","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAKzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAA4B,EAAE;IAC/E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAA;IAC3B,OAAO,GAAG,CAAC,GAAG,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEf,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/model/rely/provider.d.ts

@@ -1,3 +1,5 @@
+import type { RelyToken } from '@owlmeans/auth';
+import type { EnvelopeModel } from '@owlmeans/basic-envelope';
 import type { RelyOptions } from './types.js';
-export declare const makeProviderRely: (opts?: RelyOptions) => import("@owlmeans/basic-envelope").EnvelopeModel<import("@owlmeans/auth").RelyToken>;
+export declare const makeProviderRely: (opts?: RelyOptions) => EnvelopeModel<RelyToken>;
 //# sourceMappingURL=provider.d.ts.map

package/build/model/rely/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,yFAIlD,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,KAAG,aAAa,CAAC,SAAS,CAI5E,CAAA"}

package/build/model/rely/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAGzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAEjC,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAKzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAA4B,EAAE;IAC/E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAEjC,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.20",
+  "version": "0.1.18-rc.21",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,29 +37,29 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/api": "^0.1.18-rc.15",
-    "@owlmeans/api-config-server": "^0.1.18-rc.19",
-    "@owlmeans/auth": "^0.1.18-rc.11",
-    "@owlmeans/auth-common": "^0.1.18-rc.15",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.14",
-    "@owlmeans/basic-ids": "^0.1.18-rc.11",
-    "@owlmeans/basic-keys": "^0.1.18-rc.14",
-    "@owlmeans/client-config": "^0.1.18-rc.14",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.15",
-    "@owlmeans/config": "^0.1.18-rc.14",
-    "@owlmeans/context": "^0.1.18-rc.10",
-    "@owlmeans/kluster": "^0.1.18-rc.14",
-    "@owlmeans/entrypoint": "^0.1.18-rc.13",
-    "@owlmeans/redis-resource": "^0.1.18-rc.14",
-    "@owlmeans/resource": "^0.1.18-rc.11",
-    "@owlmeans/route": "^0.1.18-rc.11",
-    "@owlmeans/server-api": "^0.1.18-rc.19",
-    "@owlmeans/server-context": "^0.1.18-rc.14",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.13",
-    "@owlmeans/server-route": "^0.1.18-rc.11",
-    "@owlmeans/server-socket": "^0.1.18-rc.20",
-    "@owlmeans/socket": "^0.1.18-rc.11",
-    "@owlmeans/static-resource": "^0.1.18-rc.11",
+    "@owlmeans/api": "^0.1.18-rc.16",
+    "@owlmeans/api-config-server": "^0.1.18-rc.20",
+    "@owlmeans/auth": "^0.1.18-rc.12",
+    "@owlmeans/auth-common": "^0.1.18-rc.16",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.15",
+    "@owlmeans/basic-ids": "^0.1.18-rc.12",
+    "@owlmeans/basic-keys": "^0.1.18-rc.15",
+    "@owlmeans/client-config": "^0.1.18-rc.15",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.16",
+    "@owlmeans/config": "^0.1.18-rc.15",
+    "@owlmeans/context": "^0.1.18-rc.11",
+    "@owlmeans/kluster": "^0.1.18-rc.15",
+    "@owlmeans/entrypoint": "^0.1.18-rc.14",
+    "@owlmeans/redis-resource": "^0.1.18-rc.15",
+    "@owlmeans/resource": "^0.1.18-rc.12",
+    "@owlmeans/route": "^0.1.18-rc.12",
+    "@owlmeans/server-api": "^0.1.18-rc.20",
+    "@owlmeans/server-context": "^0.1.18-rc.15",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.14",
+    "@owlmeans/server-route": "^0.1.18-rc.12",
+    "@owlmeans/server-socket": "^0.1.18-rc.21",
+    "@owlmeans/socket": "^0.1.18-rc.12",
+    "@owlmeans/static-resource": "^0.1.18-rc.12",
     "@scure/base": "^2.3.0"
   },
   "peerDependencies": {
@@ -67,7 +67,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.15",
+    "@owlmeans/test-auth": "^0.1.18-rc.16",
     "@types/bun": "^1.4.0",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",

package/src/actions/service.ts

@@ -1,16 +1,17 @@
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
+import { handlers } from '@owlmeans/server-api'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
 import type { AuthToken } from '@owlmeans/auth'
-import { handleBody } from '@owlmeans/server-api'
 import { AuthServiceAppend } from '../types.js'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import { assertContext } from '@owlmeans/context'
 
 type Config = ServerConfig
 type Context = ServerContext<Config> & AuthServiceAppend
+const api = handlers<Context>()
 
-export const authenticate: RefedEntrypointHandler<AuthToken> = handleBody(
-  async (payload: AuthToken, ctx) => {
-    const context = assertContext(ctx, 'authenticate') as Context
-    return await context.auth().authenticate(payload)
-  }
-)
+export const authenticate = (protocol: EntrypointProtocol<{ body: AuthToken }, AuthToken>) =>
+  api.request(protocol, async (request, context) => {
+    const ctx = assertContext(context, 'authenticate') as Context
+
+    return await ctx.auth().authenticate(request.body)
+  })

package/src/entrypoints.ts

@@ -1,17 +1,12 @@
 
-import { elevate } from '@owlmeans/server-entrypoint'
-import { entrypoints as list } from '@owlmeans/auth-common'
-import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth'
-import type { ServerEntrypoint } from '@owlmeans/server-entrypoint'
+import { bind } from '@owlmeans/server-entrypoint'
+import type { ServerProtocolEntrypoint } from '@owlmeans/server-entrypoint'
+import { authProtocols } from '@owlmeans/auth-common'
+import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
 import { authenticate } from './actions/service.js'
-import { stab, elevate as celevate } from '@owlmeans/client-entrypoint'
 
-elevate(list, DISPATCHER_AUTHEN, authenticate)
-celevate(list, DISPATCHER, stab)
-
-export const entrypoints: ServerEntrypoint<unknown>[] = [
-  ...list.filter(
-    (module): module is ServerEntrypoint<unknown> =>
-      [DISPATCHER, DISPATCHER_AUTHEN].includes(module.alias)
-  )
+/** Server entrypoints required by the generic authentication service. */
+export const entrypoints: ServerProtocolEntrypoint<EntrypointProtocolDeclaration>[] = [
+  bind(authProtocols.dispatcher),
+  bind(authProtocols.dispatcherAuthenticate, authenticate(authProtocols.dispatcherAuthenticate)),
 ]

package/src/manager/README.md

@@ -27,11 +27,11 @@ A specialized guard service that enables authentication token relay between micr
 - **Wallet DID Authentication**: Decentralized identity authentication support
 - **Challenge Validation**: Anti-replay protection using challenge-response mechanisms
 
-### Module-Based Architecture
-The manager is built on the OwlMeans module system, providing:
+### Entrypoint-Based Architecture
+The manager is built on the OwlMeans entrypoint system, providing:
 - **Route Management**: Standardized API endpoints for authentication operations
-- **Handler Registration**: Modular request handlers for different authentication flows
-- **Guard Integration**: Automatic security enforcement at the module level
+- **Handler Registration**: Protocol-backed request handlers for different authentication flows
+- **Guard Integration**: Automatic security enforcement at the entrypoint level
 
 ## Installation
 
@@ -317,20 +317,16 @@ await authModel.rely(connection, authToken.auth)
 
 ### API Integration
 
-```typescript
-import { modules } from '@owlmeans/server-auth/manager'
-
-// The manager automatically registers these API endpoints:
+`main(context)` registers the manager's immutable `entrypoints` and starts the API server. For a
+custom bootstrap, register the exported collection yourself; the manager's protocols are then
+addressed through the same `context.entrypoint(protocol)` lookup as application endpoints.
 
-// POST /api/auth/init - Authentication initialization
-// POST /api/auth/authenticate - User authentication  
-// WebSocket /api/auth/rely - Authentication relay
+```typescript
+import { entrypoints, makeContext } from '@owlmeans/server-auth/manager'
 
-// Access modules for custom routing
-modules.forEach(module => {
-  console.log(`Route: ${module.getPath()}`)
-  console.log(`Method: ${module.route.method}`)
-})
+const context = makeContext(config)
+context.registerEntrypoints(entrypoints)
+await context.configure().init()
 ```
 
 ## API Endpoints
@@ -504,4 +500,4 @@ This manager app depends on:
 - [`@owlmeans/server-auth`](../../../README.md) - Parent server authentication package
 - [`@owlmeans/auth`](../../../auth/README.md) - Core authentication library
 - [`@owlmeans/client-auth`](../../../client-auth/README.md) - Client-side authentication
-- [`@owlmeans/context`](../../../context/README.md) - Context management system
+- [`@owlmeans/context`](../../../context/README.md) - Context management system

package/src/manager/actions/manager.ts

@@ -1,23 +1,25 @@
-import type { AllowanceRequest, AuthCredentials } from '@owlmeans/auth'
-import { handleBody } from '@owlmeans/server-api'
+import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
+import { handlers } from '@owlmeans/server-api'
 import { makeAuthModel } from '../model.js'
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 import type { AppContext, AppConfig } from '../types.js'
-import { handleConnection } from '@owlmeans/server-socket'
+import { connection } from '@owlmeans/server-socket'
 
-export const authenticationInit: RefedEntrypointHandler<AllowanceRequest> = handleBody(
-  async (payload: AllowanceRequest, ctx) =>
-    await makeAuthModel(ctx as AppContext<AppConfig>).init(payload)
+const api = handlers<AppContext<AppConfig>>()
+
+export const authenticationInit = (protocol: EntrypointProtocol<{ body: AllowanceRequest }, AllowanceResponse>) =>
+  api.body(protocol, async (body, context) =>
+  await makeAuthModel(context).init(body)
 )
 
-export const authenticate: RefedEntrypointHandler<AuthCredentials> = handleBody(
-  async (payload: AuthCredentials, ctx) =>
-    await makeAuthModel(ctx as AppContext<AppConfig>).authenticate(payload)
+export const authenticate = (protocol: EntrypointProtocol<{ body: AuthCredentials }, AuthToken>) =>
+  api.body(protocol, async (body, context) =>
+  await makeAuthModel(context).authenticate(body)
 )
 
-export const rely: RefedEntrypointHandler<void> = handleConnection(
+export const rely = (protocol: EntrypointProtocol<{ query: Partial<AuthToken> }, undefined>) => connection(protocol,
   // @TODO Request will contain information is there requrest 
   // privileged or not (privileged request implies auth provider)
-  async (conn, ctx, req) =>
-    await makeAuthModel(ctx as AppContext<AppConfig>).rely(conn, req.auth)
+  async (conn, context, request) =>
+    await makeAuthModel(context as AppContext<AppConfig>).rely(conn, request.auth)
 )

package/src/manager/entrypoints.ts

@@ -1,29 +1,26 @@
 
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, MOD_RECAPTCHA } from '@owlmeans/auth'
-import { entrypoints as list } from '@owlmeans/auth-common'
-import { entrypoints as apiConfig } from '@owlmeans/api-config-server'
-import { elevate, guard } from '@owlmeans/server-entrypoint'
+import { MOD_RECAPTCHA } from '@owlmeans/auth'
+import { authProtocols } from '@owlmeans/auth-common'
+import { entrypoints as apiConfigBindings } from '@owlmeans/api-config-server'
+import { bind } from '@owlmeans/server-entrypoint'
+import { decorateEntrypoint, openProtocol } from '@owlmeans/entrypoint'
 import * as actions from './actions/index.js'
-import { entrypoint } from '@owlmeans/client-entrypoint'
 import { backend, route, RouteMethod } from '@owlmeans/route'
-import { handleIntermediate } from '@owlmeans/server-api'
 import { DEFAULT_RELY } from './consts.js'
 
-elevate(list, AUTHEN, handleIntermediate(
-  async (_, context) => context
-), { intermediate: true })
-elevate(list, AUTHEN_INIT, actions.authenticationInit)
-elevate(list, AUTHEN_AUTHEN, actions.authenticate)
-elevate(list, AUTHEN_RELY, actions.rely, guard(DEFAULT_RELY))
+const relyProtocol = decorateEntrypoint(authProtocols.rely, { guards: DEFAULT_RELY })
+const reCaptchaProtocol = openProtocol(route(MOD_RECAPTCHA, '/api/siteverify', backend({
+  host: 'https://www.google.com',
+  base: 'recaptcha',
+  secure: true,
+}, RouteMethod.POST)))
 
-export const entrypoints = list
-list.push(...apiConfig)
-list.push(
-  entrypoint(
-    route(MOD_RECAPTCHA, '/api/siteverify', backend({
-      host: 'https://www.google.com',
-      base: 'recaptcha',
-      secure: true,
-    }, RouteMethod.POST))
-  )
-)
+/** Server entrypoints for the full authentication manager. */
+export const entrypoints = [
+  bind(authProtocols.authen, undefined, { intermediate: true }),
+  bind(authProtocols.init, actions.authenticationInit(authProtocols.init)),
+  bind(authProtocols.authenticate, actions.authenticate(authProtocols.authenticate)),
+  bind(relyProtocol, actions.rely(relyProtocol)),
+  ...apiConfigBindings,
+  bind(reCaptchaProtocol),
+]

package/src/manager/exports.ts

@@ -5,8 +5,7 @@ export { addWebService } from '@owlmeans/client-config'
 export { service, TRUSTED } from '@owlmeans/config'
 export { AppType, assertContext } from '@owlmeans/context'
 export { klusterize } from '@owlmeans/kluster'
-export { elevate } from '@owlmeans/server-entrypoint'
-export { elevate as celevate, stab } from '@owlmeans/client-entrypoint'
+export { stab } from '@owlmeans/client-entrypoint'
 export type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api'
 export type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'

package/src/model/rely/consumer.ts

@@ -1,7 +1,9 @@
 import { makeRelyModel } from './peer.js'
+import type { RelyToken } from '@owlmeans/auth'
+import type { EnvelopeModel } from '@owlmeans/basic-envelope'
 import type { RelyOptions } from './types.js'
 
-export const makeConsumerRely = (opts?: RelyOptions) => {
+export const makeConsumerRely = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
   const model = makeRelyModel(opts)
   const msg = model.message()
   delete msg.pin

package/src/model/rely/provider.ts

@@ -1,8 +1,10 @@
 
 import { makeRelyModel } from './peer.js'
+import type { RelyToken } from '@owlmeans/auth'
+import type { EnvelopeModel } from '@owlmeans/basic-envelope'
 import type { RelyOptions } from './types.js'
 
-export const makeProviderRely = (opts?: RelyOptions) => {
+export const makeProviderRely = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
   const model = makeRelyModel(opts)
 
   return model