@owlmeans/server-auth 0.1.18-rc.35 → 0.1.18-rc.36

package/README.md

@@ -13,7 +13,7 @@ account/profile records `@owlmeans/server-auth-identity`, and the browser side `
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth@^0.1.18-rc.35
+bun add @owlmeans/server-auth@^0.1.18-rc.36
 ```
 
 ## Concepts
@@ -222,7 +222,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.28
+npx @owlmeans/agent-skills@^0.1.18-rc.30
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.35",
-  "generatedAt": "2026-09-17T08:16:11.216Z",
+  "version": "0.1.18-rc.36",
+  "generatedAt": "2026-09-19T13:42:56.244Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.35"` in `dependencies`
+**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.36"` in `dependencies`
 
 Two halves, deliberately split by subpath:
 
@@ -30,6 +30,7 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
 | `AUTH_CACHE` | `'auth-cache'` — the single-use challenge store |
 | `AUTH_SRV_KEY` | `'auth-service'` — the TRUSTED record whose key signs credential envelopes |
 | `AUTHEN_TIMEFRAME` | `15 * 60 * 1000` — challenge lifetime and anti-replay window, in ms |
+| `AUTH_SESSION_MANAGER` / `appendMemoryAuthSessionManager` | Seven-day session registry contract and the process-local default; use the Redis implementation from `@owlmeans/server-auth-session` for a shared authority |
 | `AuthService`, `AuthServiceAppend`, `AuthSpent` | Types |
 | `makeRelyModel`, `makeProviderRely`, `makeConsumerRely`, `RelyOptions` | The rely (wallet handshake) models |
 
@@ -103,6 +104,13 @@ registerPlugin('my-method', context => ({
   register a Redis resource under the same alias before calling it in any scaled deployment.
 - A plugin's `init` must return a challenge that is unique per request. A challenge that repeats
   across independent attempts collides in `AUTH_CACHE` and surfaces as `AuthenFailed('challenge')`.
+- Bearers issued by this service carry an absolute seven-day expiry and an opaque session id. In a
+  context with `AUTH_SESSION_MANAGER`, the guard rejects an absent, expired, pending or revoked
+  session and re-signs fresh profile claims after a registry revision. Registry or identity-store
+  failure is `AuthUnavailable` (503), never a false 401/logout.
+- `appendAuthService` installs the memory session manager only as a single-process default. A
+  central or multi-replica issuer registers `appendRedisAuthSessionManager(context)` before it;
+  the manager is the authority that fences, refreshes or revokes an organization profile's sessions.
 - The manager canonicalizes the organization entity: whatever slug (current, retired, or the frozen
   key) a plugin leaves on `credential.entitySlug` is resolved through `ENTITY_RESOLVER` and replaced
   with the current slug before the envelope is signed. An unresolvable value throws

package/build/manager/entrypoints.d.ts

@@ -1,9 +1,3 @@
 /** Server entrypoints for the full authentication manager. */
-export declare const entrypoints: (import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    body: import("@owlmeans/auth").AllowanceRequest;
-}, import("@owlmeans/auth").AllowanceResponse>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    body: import("@owlmeans/auth").AuthCredentials;
-}, import("@owlmeans/auth").AuthToken>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    query: Partial<import("@owlmeans/auth").AuthToken>;
-}, undefined>>)[];
+export declare const entrypoints: any[];
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/manager/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,eAAO,MAAM,WAAW;;;;;;iBAOvB,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,eAAO,MAAM,WAAW,OAOvB,CAAA"}

package/build/manager/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAkBlE,eAAO,MAAM,aAAa,YAAa,UAAU,CAAC,SAAS,CAAC,KAAG,SAyF9D,CAAA"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAmBlE,eAAO,MAAM,aAAa,YAAa,UAAU,CAAC,SAAS,CAAC,KAAG,SA2F9D,CAAA"}

package/build/manager/model.js

@@ -5,6 +5,7 @@ import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { createRelyFlow } from './rely/flow.js';
 import { trusted } from './utils/trusted.js';
+import { AuthChallengeReplayPolicy } from './plugins/replay-policy.js';
 export const makeAuthModel = (context) => {
     const cache = (context) => context.resource(AUTH_CACHE);
     const model = {
@@ -31,20 +32,22 @@ export const makeAuthModel = (context) => {
                 throw new AuthenFailed('challenge');
             }
             const msg = envelope.message(true);
-            try {
-                await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
-            }
-            catch (e) {
-                const error = new AuthenFailed('challenge');
-                if (e instanceof Error) {
-                    error.oiriginalStack = `${e} : ${e.stack}`;
+            const plugin = await getPlugin(envelope.type(), context);
+            if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
+                try {
+                    await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
+                }
+                catch (e) {
+                    const error = new AuthenFailed('challenge');
+                    if (e instanceof Error) {
+                        error.oiriginalStack = `${e} : ${e.stack}`;
+                    }
+                    throw error;
                 }
-                throw error;
             }
             if (credential.userId == null) {
                 throw new AuthenPayloadError('userId');
             }
-            const plugin = await getPlugin(envelope.type(), context);
             // @TODO this token PROBABLY needs to be registered somewhere and rechecked
             // from time to time to make sure that the session is not deleted 
             // or permission hasn't changed.

package/build/manager/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAG/E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAQ5C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;YACrC,CAAC;YAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;YACvG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;oBACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAExD,2EAA2E;YAC3E,kEAAkE;YAClE,gCAAgC;YAChC,kEAAkE;YAClE,kEAAkE;YAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAEvD,yFAAyF;YACzF,2FAA2F;YAC3F,0FAA0F;YAC1F,gDAAgD;YAChD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;YAC3C,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAChG,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;gBAClC,CAAC;gBACD,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YACrC,CAAC;YAED,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;YAEtC,OAAO;gBACL,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;qBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;qBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAG/E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAI5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAKtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;YACrC,CAAC;YAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAE1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAExD,IAAI,MAAM,CAAC,qBAAqB,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;gBACtE,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;gBACvG,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;oBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;wBACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;oBAC5C,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,2EAA2E;YAC3E,kEAAkE;YAClE,gCAAgC;YAChC,kEAAkE;YAClE,kEAAkE;YAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAEvD,yFAAyF;YACzF,2FAA2F;YAC3F,0FAA0F;YAC1F,gDAAgD;YAChD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;YAC3C,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBAChG,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;gBAClC,CAAC;gBACD,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YACrC,CAAC;YAED,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;YAEtC,OAAO;gBACL,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;qBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;qBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/manager/plugins/export.d.ts

@@ -1,4 +1,5 @@
 export type * from './types.js';
+export * from './replay-policy.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';
 export * from './basic-rely.js';

package/build/manager/plugins/export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/build/manager/plugins/export.js

@@ -1,3 +1,4 @@
+export * from './replay-policy.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';
 export * from './basic-rely.js';

package/build/manager/plugins/export.js.map

@@ -1 +1 @@
-{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAEA,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAEA,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/build/manager/plugins/replay-policy.d.ts

@@ -0,0 +1,8 @@
+/** Ownership of atomic replay protection for a verified authentication challenge. */
+export declare enum AuthChallengeReplayPolicy {
+    /** Default: the auth manager consumes the challenge before plugin authentication. */
+    Manager = "manager",
+    /** The plugin owns bounded attempts and atomic success consumption. */
+    Plugin = "plugin"
+}
+//# sourceMappingURL=replay-policy.d.ts.map

package/build/manager/plugins/replay-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-policy.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/replay-policy.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,oBAAY,yBAAyB;IACnC,qFAAqF;IACrF,OAAO,YAAY;IACnB,uEAAuE;IACvE,MAAM,WAAW;CAClB"}

package/build/manager/plugins/replay-policy.js

@@ -0,0 +1,9 @@
+/** Ownership of atomic replay protection for a verified authentication challenge. */
+export var AuthChallengeReplayPolicy;
+(function (AuthChallengeReplayPolicy) {
+    /** Default: the auth manager consumes the challenge before plugin authentication. */
+    AuthChallengeReplayPolicy["Manager"] = "manager";
+    /** The plugin owns bounded attempts and atomic success consumption. */
+    AuthChallengeReplayPolicy["Plugin"] = "plugin";
+})(AuthChallengeReplayPolicy || (AuthChallengeReplayPolicy = {}));
+//# sourceMappingURL=replay-policy.js.map

package/build/manager/plugins/replay-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-policy.js","sourceRoot":"","sources":["../../../src/manager/plugins/replay-policy.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,qFAAqF;IACrF,gDAAmB,CAAA;IACnB,uEAAuE;IACvE,8CAAiB,CAAA;AACnB,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC"}

package/build/manager/plugins/types.d.ts

@@ -3,8 +3,14 @@ import type { AuthModel } from '../types.js';
 import type { AbstractRequest } from '@owlmeans/entrypoint';
 import type { RedisResource } from '@owlmeans/redis-resource';
 import type { ResourceRecord } from '@owlmeans/resource';
+import type { AuthChallengeReplayPolicy } from './replay-policy.js';
 export interface AuthPlugin extends Omit<AuthModel, "rely"> {
     type: string;
+    /**
+     * Who atomically consumes a verified challenge. The manager remains the default; a plugin may
+     * opt in only when its own credential protocol needs a bounded retry budget before consumption.
+     */
+    challengeReplayPolicy?: AuthChallengeReplayPolicy;
 }
 export interface RecpatchaResponse {
     success: boolean;

package/build/manager/plugins/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,WAAW,UAAW,SAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IACzD,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe,CAAC;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;CAAI;AAEN,MAAM,WAAW,UAAW,SAAQ,cAAc,EAAE,iBAAiB;CACpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa,CAAC,UAAU,CAAC;CAAG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAEnE,MAAM,WAAW,UAAW,SAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IACzD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,qBAAqB,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe,CAAC;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;CAAI;AAEN,MAAM,WAAW,UAAW,SAAQ,cAAc,EAAE,iBAAiB;CACpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa,CAAC,UAAU,CAAC;CAAG"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAU3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAG1B,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WA4F/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAaN,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAoB3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAG1B,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAqL/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}

package/build/service.js

@@ -2,12 +2,61 @@ import { TRUSTED } from '@owlmeans/config';
 import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js';
 import { assertContext, createService } from '@owlmeans/context';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
-import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth';
+import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth';
 import { createStaticResource } from '@owlmeans/static-resource';
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
+import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from '@owlmeans/server-auth-session';
+import { uuid } from '@owlmeans/basic-ids';
+import { TOKEN_UPDATE } from '@owlmeans/auth-common';
 export const makeAuthService = (alias = DEFAULT_ALIAS) => {
     const location = `server-auth:${alias}`;
     const cache = (context) => context.resource(AUTH_CACHE);
+    const sessions = (context) => context.hasService(AUTH_SESSION_MANAGER)
+        ? context.service(AUTH_SESSION_MANAGER)
+        : null;
+    const entityIdFor = async (context, entitySlug) => {
+        if (entitySlug == null || entitySlug === '')
+            return null;
+        if (!context.hasService(ENTITY_RESOLVER))
+            return entitySlug;
+        const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
+        return entity?.id ?? null;
+    };
+    const refresh = async (context, auth, version) => {
+        const entityId = await entityIdFor(context, auth.entitySlug);
+        if (entityId == null || auth.profileId == null || !context.hasResource(AUTH_IDENTITY_PROFILE))
+            return null;
+        const profiles = context.resource(AUTH_IDENTITY_PROFILE);
+        let profile = null;
+        try {
+            profile = await profiles.load({ entityId, profileId: auth.profileId });
+        }
+        catch {
+            // A missing profile is a definitive authentication refusal; a failed profile store is an
+            // availability dependency and must not look like a revoked browser session.
+            throw new AuthUnavailable('identity-profile');
+        }
+        if (profile == null || (profile.expiresAt != null && new Date(profile.expiresAt).getTime() <= Date.now()))
+            return null;
+        return {
+            ...auth,
+            userId: profile.userId ?? auth.userId,
+            role: profile.role,
+            scopes: profile.scopes ?? [],
+            ...(profile.permissions != null ? { permissions: profile.permissions } : {}),
+            authorizationVersion: version,
+            createdAt: new Date()
+        };
+    };
+    const sign = async (context, auth) => {
+        const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+        const ttl = auth.expiresAt == null ? AUTH_SESSION_TTL : Math.max(0, new Date(auth.expiresAt).getTime() - Date.now());
+        const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
+            .send(auth, ttl).sign(trusted.key, EnvelopeKind.Token);
+        return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}`;
+    };
     const service = createService(alias, {
         match: async (req) => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
         handle: async (req, res) => {
@@ -21,7 +70,32 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (!await envelope.verify(trusted.key)) {
                 return false;
             }
-            res.resolve(envelope.message());
+            let auth = envelope.message();
+            const manager = sessions(context);
+            if (manager != null) {
+                if (auth.sessionId == null)
+                    return false;
+                let decision;
+                try {
+                    decision = await manager.inspect(auth.sessionId);
+                }
+                catch {
+                    // Registry availability is a security dependency. A guard cannot authenticate through it.
+                    throw new AuthUnavailable('session-registry');
+                }
+                if (decision.state !== 'active' && decision.state !== 'refresh')
+                    return false;
+                if (decision.state === 'refresh') {
+                    const refreshed = await refresh(context, auth, decision.version);
+                    if (refreshed == null)
+                        return false;
+                    auth = refreshed;
+                    const replacement = await sign(context, auth);
+                    res.responseProvider?.header(TOKEN_UPDATE, replacement);
+                    req.headers = { ...req.headers, authorization: replacement };
+                }
+            }
+            res.resolve(auth);
             return true;
         },
         unpack: async (token) => {
@@ -32,7 +106,22 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (!await envelope.verify(trusted.key)) {
                 throw new AuthorizationError('unpack');
             }
-            return envelope.message();
+            const auth = envelope.message();
+            const manager = sessions(context);
+            if (manager != null) {
+                if (auth.sessionId == null)
+                    throw new AuthorizationError('session');
+                let decision;
+                try {
+                    decision = await manager.inspect(auth.sessionId);
+                }
+                catch {
+                    throw new AuthUnavailable('session-registry');
+                }
+                if (decision.state !== 'active')
+                    throw new AuthorizationError('session');
+            }
+            return auth;
         },
         authenticated: async () => {
             return null;
@@ -57,6 +146,8 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
                 throw new AuthenFailed();
             }
             // @TODO Move to a plugin
+            const issuedAt = Date.now();
+            const expiresAt = new Date(issuedAt + AUTH_SESSION_TTL);
             const auth = {
                 token: credentials.challenge,
                 userId: credentials.userId,
@@ -67,12 +158,25 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
                 profileId: credentials.profileId,
                 entitySlug: credentials.entitySlug,
                 isUser: true,
-                createdAt: new Date()
+                createdAt: new Date(issuedAt),
+                expiresAt,
+                sessionId: uuid(),
+                authorizationVersion: 1
             };
-            const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
-            const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
-                .send(auth, null).sign(trusted.key, EnvelopeKind.Token);
-            return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` };
+            const manager = sessions(context);
+            if (manager != null) {
+                const entityId = await entityIdFor(context, auth.entitySlug);
+                if (entityId == null || auth.profileId == null)
+                    throw new AuthenFailed('session');
+                const decision = await manager.register({
+                    id: auth.sessionId, kind: 'bearer', entityId, profileId: auth.profileId,
+                    issuedAt, expiresAt: expiresAt.getTime()
+                });
+                if (decision.state !== 'active')
+                    throw new AuthenFailed('session');
+                auth.authorizationVersion = decision.version;
+            }
+            return { token: await sign(context, auth) };
         }
     });
     return service;
@@ -81,6 +185,9 @@ export const appendAuthService = (ctx, alias = DEFAULT_ALIAS) => {
     if (!ctx.hasResource(AUTH_CACHE)) {
         ctx.registerResource(createStaticResource(AUTH_CACHE));
     }
+    // Every standalone server gets an expiring process-local registry. Scaled deployments replace
+    // it with appendRedisAuthSessionManager before calling this helper.
+    appendMemoryAuthSessionManager(ctx);
     const service = makeAuthService(alias);
     const context = ctx;
     context.registerService(service);

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAKrE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAE/B,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAA;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;iBACrF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEzD,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;QAC3F,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EACvE,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAKpD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,IAAI,EAAE;gBACjB,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;gBACjF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;gBAClE,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.35",
+  "version": "0.1.18-rc.36",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,29 +37,31 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/api": "^0.1.18-rc.29",
-    "@owlmeans/api-config-server": "^0.1.18-rc.33",
-    "@owlmeans/auth": "^0.1.18-rc.27",
-    "@owlmeans/auth-common": "^0.1.18-rc.29",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.28",
-    "@owlmeans/basic-ids": "^0.1.18-rc.26",
-    "@owlmeans/basic-keys": "^0.1.18-rc.30",
-    "@owlmeans/client-config": "^0.1.18-rc.29",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.29",
-    "@owlmeans/config": "^0.1.18-rc.29",
-    "@owlmeans/context": "^0.1.18-rc.25",
-    "@owlmeans/kluster": "^0.1.18-rc.28",
-    "@owlmeans/entrypoint": "^0.1.18-rc.28",
-    "@owlmeans/redis-resource": "^0.1.18-rc.28",
-    "@owlmeans/resource": "^0.1.18-rc.27",
-    "@owlmeans/route": "^0.1.18-rc.26",
-    "@owlmeans/server-api": "^0.1.18-rc.33",
-    "@owlmeans/server-context": "^0.1.18-rc.28",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.27",
-    "@owlmeans/server-route": "^0.1.18-rc.25",
-    "@owlmeans/server-socket": "^0.1.18-rc.35",
-    "@owlmeans/socket": "^0.1.18-rc.25",
-    "@owlmeans/static-resource": "^0.1.18-rc.25",
+    "@owlmeans/api": "^0.1.18-rc.30",
+    "@owlmeans/api-config-server": "^0.1.18-rc.34",
+    "@owlmeans/auth": "^0.1.18-rc.28",
+    "@owlmeans/auth-common": "^0.1.18-rc.30",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.29",
+    "@owlmeans/basic-ids": "^0.1.18-rc.27",
+    "@owlmeans/basic-keys": "^0.1.18-rc.31",
+    "@owlmeans/client-config": "^0.1.18-rc.30",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.30",
+    "@owlmeans/config": "^0.1.18-rc.30",
+    "@owlmeans/context": "^0.1.18-rc.26",
+    "@owlmeans/kluster": "^0.1.18-rc.29",
+    "@owlmeans/entrypoint": "^0.1.18-rc.29",
+    "@owlmeans/redis-resource": "^0.1.18-rc.29",
+    "@owlmeans/resource": "^0.1.18-rc.28",
+    "@owlmeans/route": "^0.1.18-rc.27",
+    "@owlmeans/server-api": "^0.1.18-rc.34",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.30",
+    "@owlmeans/server-auth-session": "^0.1.18-rc.1",
+    "@owlmeans/server-context": "^0.1.18-rc.29",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.28",
+    "@owlmeans/server-route": "^0.1.18-rc.26",
+    "@owlmeans/server-socket": "^0.1.18-rc.36",
+    "@owlmeans/socket": "^0.1.18-rc.26",
+    "@owlmeans/static-resource": "^0.1.18-rc.26",
     "@scure/base": "^2.3.0"
   },
   "peerDependencies": {
@@ -67,7 +69,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.28",
+    "@owlmeans/test-auth": "^0.1.18-rc.29",
     "@types/bun": "^1.4.0",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",

package/src/manager/README.md

@@ -38,7 +38,7 @@ The manager is built on the OwlMeans entrypoint system, providing:
 This manager app is part of the `@owlmeans/server-auth` package:
 
 ```bash
-npm install @owlmeans/server-auth@^0.1.18-rc.35
+npm install @owlmeans/server-auth@^0.1.18-rc.36
 ```
 
 ## API Reference

package/src/manager/model.ts

@@ -12,6 +12,7 @@ import { trusted } from './utils/trusted.js'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import type { Resource } from '@owlmeans/resource'
 import type { AuthSpent } from '../types.js'
+import { AuthChallengeReplayPolicy } from './plugins/replay-policy.js'
 
 type Config = ServerConfig
 type Context = ServerContext<Config>
@@ -51,22 +52,24 @@ export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
 
       const msg: string = envelope.message(true)
 
-      try {
-        await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
-      } catch (e) {
-        const error = new AuthenFailed('challenge')
-        if (e instanceof Error) {
-          error.oiriginalStack = `${e} : ${e.stack}`
+      const plugin = await getPlugin(envelope.type(), context)
+
+      if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
+        try {
+          await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
+        } catch (e) {
+          const error = new AuthenFailed('challenge')
+          if (e instanceof Error) {
+            error.oiriginalStack = `${e} : ${e.stack}`
+          }
+          throw error
         }
-        throw error
       }
 
       if (credential.userId == null) {
         throw new AuthenPayloadError('userId')
       }
 
-      const plugin = await getPlugin(envelope.type(), context)
-
       // @TODO this token PROBABLY needs to be registered somewhere and rechecked
       // from time to time to make sure that the session is not deleted 
       // or permission hasn't changed.

package/src/manager/plugins/export.ts

@@ -1,5 +1,6 @@
 
 export type * from './types.js'
+export * from './replay-policy.js'
 export * from './basic-ed25519.js'
 export * from './re-captcha.js'
 export * from './basic-rely.js'

package/src/manager/plugins/replay-policy.ts

@@ -0,0 +1,7 @@
+/** Ownership of atomic replay protection for a verified authentication challenge. */
+export enum AuthChallengeReplayPolicy {
+  /** Default: the auth manager consumes the challenge before plugin authentication. */
+  Manager = 'manager',
+  /** The plugin owns bounded attempts and atomic success consumption. */
+  Plugin = 'plugin',
+}

package/src/manager/plugins/types.ts

@@ -3,9 +3,15 @@ import type { AuthModel } from '../types.js'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
 import type { RedisResource } from '@owlmeans/redis-resource'
 import type { ResourceRecord } from '@owlmeans/resource'
+import type { AuthChallengeReplayPolicy } from './replay-policy.js'
 
 export interface AuthPlugin extends Omit<AuthModel, "rely"> {
   type: string
+  /**
+   * Who atomically consumes a verified challenge. The manager remains the default; a plugin may
+   * opt in only when its own credential protocol needs a bounded retry budget before consumption.
+   */
+  challengeReplayPolicy?: AuthChallengeReplayPolicy
 }
 
 export interface RecpatchaResponse {

package/src/service.ts

@@ -5,11 +5,21 @@ import type { AuthServiceAppend, AuthService, AuthSpent } from './types.js'
 import { assertContext, createService } from '@owlmeans/context'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import type { Auth, AuthCredentials } from '@owlmeans/auth'
-import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth'
+import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth'
 import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import type { Resource } from '@owlmeans/resource'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils'
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
+import type { EntityResolverService } from '@owlmeans/auth-common'
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
+import type { IdentityProfile, IdentityProfileResource } from '@owlmeans/server-auth-identity'
+import {
+  appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL
+} from '@owlmeans/server-auth-session'
+import type { AuthSessionManager } from '@owlmeans/server-auth-session'
+import { uuid } from '@owlmeans/basic-ids'
+import { TOKEN_UPDATE } from '@owlmeans/auth-common'
 
 type Config = ServerConfig
 type Context = ServerContext<Config>
@@ -20,6 +30,50 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
   const cache = (context: Context): Resource<AuthSpent> =>
     context.resource<Resource<AuthSpent>>(AUTH_CACHE)
 
+  const sessions = (context: Context): AuthSessionManager | null =>
+    context.hasService(AUTH_SESSION_MANAGER)
+      ? context.service<AuthSessionManager>(AUTH_SESSION_MANAGER)
+      : null
+
+  const entityIdFor = async (context: Context, entitySlug: string | undefined): Promise<string | null> => {
+    if (entitySlug == null || entitySlug === '') return null
+    if (!context.hasService(ENTITY_RESOLVER)) return entitySlug
+    const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(entitySlug)
+    return entity?.id ?? null
+  }
+
+  const refresh = async (context: Context, auth: Auth, version: number): Promise<Auth | null> => {
+    const entityId = await entityIdFor(context, auth.entitySlug)
+    if (entityId == null || auth.profileId == null || !context.hasResource(AUTH_IDENTITY_PROFILE)) return null
+    const profiles = context.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+    let profile: IdentityProfile | null = null
+    try {
+      profile = await profiles.load({ entityId, profileId: auth.profileId })
+    } catch {
+      // A missing profile is a definitive authentication refusal; a failed profile store is an
+      // availability dependency and must not look like a revoked browser session.
+      throw new AuthUnavailable('identity-profile')
+    }
+    if (profile == null || (profile.expiresAt != null && new Date(profile.expiresAt).getTime() <= Date.now())) return null
+    return {
+      ...auth,
+      userId: profile.userId ?? auth.userId,
+      role: profile.role,
+      scopes: profile.scopes ?? [],
+      ...(profile.permissions != null ? { permissions: profile.permissions } : {}),
+      authorizationVersion: version,
+      createdAt: new Date()
+    }
+  }
+
+  const sign = async (context: Context, auth: Auth): Promise<string> => {
+    const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
+    const ttl = auth.expiresAt == null ? AUTH_SESSION_TTL : Math.max(0, new Date(auth.expiresAt).getTime() - Date.now())
+    const authorization = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
+      .send(auth, ttl).sign(trusted.key, EnvelopeKind.Token)
+    return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}`
+  }
+
   const service: AuthService = createService<AuthService>(alias, {
     match: async req => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
 
@@ -37,7 +91,29 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
         return false as T
       }
 
-      res.resolve(envelope.message())
+      let auth = envelope.message()
+      const manager = sessions(context)
+      if (manager != null) {
+        if (auth.sessionId == null) return false as T
+        let decision
+        try {
+          decision = await manager.inspect(auth.sessionId)
+        } catch {
+          // Registry availability is a security dependency. A guard cannot authenticate through it.
+          throw new AuthUnavailable('session-registry')
+        }
+        if (decision.state !== 'active' && decision.state !== 'refresh') return false as T
+        if (decision.state === 'refresh') {
+          const refreshed = await refresh(context, auth, decision.version)
+          if (refreshed == null) return false as T
+          auth = refreshed
+          const replacement = await sign(context, auth)
+          res.responseProvider?.header(TOKEN_UPDATE, replacement)
+          req.headers = { ...req.headers, authorization: replacement }
+        }
+      }
+
+      res.resolve(auth)
 
       return true as T
     },
@@ -51,8 +127,19 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
       if (!await envelope.verify(trusted.key)) {
         throw new AuthorizationError('unpack')
       }
-
-      return envelope.message()
+      const auth = envelope.message()
+      const manager = sessions(context)
+      if (manager != null) {
+        if (auth.sessionId == null) throw new AuthorizationError('session')
+        let decision
+        try {
+          decision = await manager.inspect(auth.sessionId)
+        } catch {
+          throw new AuthUnavailable('session-registry')
+        }
+        if (decision.state !== 'active') throw new AuthorizationError('session')
+      }
+      return auth
     },
 
     authenticated: async () => {
@@ -84,6 +171,8 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
       }
 
       // @TODO Move to a plugin
+      const issuedAt = Date.now()
+      const expiresAt = new Date(issuedAt + AUTH_SESSION_TTL)
       const auth: Auth = {
         token: credentials.challenge,
         userId: credentials.userId,
@@ -94,14 +183,24 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
         profileId: credentials.profileId,
         entitySlug: credentials.entitySlug,
         isUser: true,
-        createdAt: new Date()
+        createdAt: new Date(issuedAt),
+        expiresAt,
+        sessionId: uuid(),
+        authorizationVersion: 1
+      }
+      const manager = sessions(context)
+      if (manager != null) {
+        const entityId = await entityIdFor(context, auth.entitySlug)
+        if (entityId == null || auth.profileId == null) throw new AuthenFailed('session')
+        const decision = await manager.register({
+          id: auth.sessionId!, kind: 'bearer', entityId, profileId: auth.profileId,
+          issuedAt, expiresAt: expiresAt.getTime()
+        })
+        if (decision.state !== 'active') throw new AuthenFailed('session')
+        auth.authorizationVersion = decision.version
       }
 
-      const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
-      const authorization = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
-        .send(auth, null).sign(trusted.key, EnvelopeKind.Token)
-
-      return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` }
+      return { token: await sign(context, auth) }
     }
   })
 
@@ -116,6 +215,10 @@ export const appendAuthService = <C extends Config, T extends ServerContext<C>>(
     ctx.registerResource(createStaticResource(AUTH_CACHE))
   }
 
+  // Every standalone server gets an expiring process-local registry. Scaled deployments replace
+  // it with appendRedisAuthSessionManager before calling this helper.
+  appendMemoryAuthSessionManager(ctx)
+
   const service = makeAuthService(alias)
   const context = ctx as T & AuthServiceAppend
 

package/tests/context.ts

@@ -25,6 +25,8 @@ export const makeTestContext = () => {
     id: authServiceKP.exportAddress(),
     name: AUTH_SRV_KEY,
     credential: authServiceKP.exportPublic(),
+    // Local, deterministic test-only key: the manager signs its synthetic exchange envelope.
+    secret: authServiceKP.export(),
     scopes: ['*'],
   }
 

package/tests/replay-policy.spec.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthenFailed, AuthRole } from '@owlmeans/auth'
+import { makeAuthModel } from '../src/manager/model.js'
+import { AuthChallengeReplayPolicy } from '../src/manager/plugins/replay-policy.js'
+import { registerPlugin } from '../src/manager/plugins/index.js'
+import { makeTestContext } from './context.js'
+
+describe('@owlmeans/server-auth — plugin-owned challenge replay', () => {
+  test('lets a bounded-retry plugin receive a second credential attempt', async () => {
+    const type = `replay-policy-${Date.now()}`
+    let attempts = 0
+    registerPlugin(type, () => ({
+      type,
+      challengeReplayPolicy: AuthChallengeReplayPolicy.Plugin,
+      init: async () => ({ challenge: 'opaque-issuance' }),
+      authenticate: async () => {
+        attempts += 1
+        if (attempts === 1) throw new AuthenFailed('first-guess')
+        return { token: '' }
+      },
+    }))
+
+    const { context } = makeTestContext()
+    await context.configure().init()
+    const model = makeAuthModel(context as never)
+    const { challenge } = await model.init({ type, userId: 'retry@example.com' })
+    const credential = () => ({
+      type, challenge, credential: 'guess', userId: 'retry@example.com',
+      role: AuthRole.User, scopes: ['*'],
+    })
+
+    await expect(model.authenticate(credential())).rejects.toBeInstanceOf(AuthenFailed)
+    await expect(model.authenticate(credential())).resolves.toHaveProperty('token')
+    expect(attempts).toBe(2)
+  })
+})