@owlmeans/server-auth 0.1.18-rc.50 → 0.1.18-rc.51

package/README.md

@@ -13,7 +13,7 @@ account/profile records `@owlmeans/server-auth-identity`, and the browser side `
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth@^0.1.18-rc.50
+bun add @owlmeans/server-auth@^0.1.18-rc.51
 ```
 
 ## Concepts
@@ -222,7 +222,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.45
+npx @owlmeans/agent-skills@^0.1.18-rc.46
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.50",
-  "generatedAt": "2026-10-01T23:27:48.729Z",
+  "version": "0.1.18-rc.51",
+  "generatedAt": "2026-10-03T11:19:50.779Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.50"` in `dependencies`
+**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.51"` in `dependencies`
 
 Two halves, deliberately split by subpath:
 
@@ -30,7 +30,6 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
 | `AUTH_CACHE` | `'auth-cache'` — the single-use challenge store |
 | `AUTH_SRV_KEY` | `'auth-service'` — the TRUSTED record whose key signs credential envelopes |
 | `AUTHEN_TIMEFRAME` | `15 * 60 * 1000` — challenge lifetime and anti-replay window, in ms |
-| `AUTH_SESSION_MANAGER` / `appendMemoryAuthSessionManager` | Seven-day session registry contract and the process-local default; use the Redis implementation from `@owlmeans/server-auth-session` for a shared authority |
 | `AuthService`, `AuthServiceAppend`, `AuthSpent` | Types |
 | `makeRelyModel`, `makeProviderRely`, `makeConsumerRely`, `RelyOptions` | The rely (wallet handshake) models |
 
@@ -108,7 +107,8 @@ registerPlugin('my-method', context => ({
   context with `AUTH_SESSION_MANAGER`, the guard rejects an absent, expired, pending or revoked
   session and re-signs fresh profile claims after a registry revision. Registry or identity-store
   failure is `AuthUnavailable` (503), never a false 401/logout.
-- `appendAuthService` installs the memory session manager only as a single-process default. A
+- The session registry (`AUTH_SESSION_MANAGER`) is `@owlmeans/server-auth-session`'s, not exported
+  here; `appendAuthService` installs its memory manager only as a single-process default. A
   central or multi-replica issuer registers `appendRedisAuthSessionManager(context)` before it;
   the manager is the authority that fences, refreshes or revokes an organization profile's sessions.
 - The manager canonicalizes the organization entity: whatever slug (current, retired, or the frozen

package/agent-meta/skills/supervisor-auth/SKILL.md

@@ -52,8 +52,8 @@ Options:
   front-end signs with. Pick aliases whose private keys you actually have (e.g. in `.env.dev.secrets`).
 - `resolveUser` — `(userId, context, { register }) => Promise<SupervisorUserResolution>`. Default:
   trust the id as-is (`{ userId }`). Wire it to `@owlmeans/server-auth-identity`'s
-  `IdentityLinkingService` (`getLinkedProfile` / `linkProfile`) to find-or-create a real profile and
-  organization entity. `SupervisorUserResolution` is `{ userId }` plus optional `profileId`,
+  `IdentityLinkingService` (`getLinkedProfile` / `linkProfile`) to find-or-create the person's
+  account and the deployment's own row (a new address registers a personal organization). `SupervisorUserResolution` is `{ userId }` plus optional `profileId`,
   `entitySlug`, `role` and `scopes` — the organization value is a SLUG, the renameable public name
   that a token carries, never the stable `entityId`. `profileId` defaults to `userId`, `scopes` to
   the credential's own or `[ALL_SCOPES]`, and `role` to `AuthRole.User`.

package/build/manager/entrypoints.d.ts

@@ -1,9 +1,3 @@
 /** Server entrypoints for the full authentication manager. */
-export declare const entrypoints: (import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, import("@owlmeans/entrypoint").OpenValue>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    body: import("@owlmeans/auth").AllowanceRequest;
-}, import("@owlmeans/auth").AllowanceResponse>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    body: import("@owlmeans/auth").AuthCredentials;
-}, import("@owlmeans/auth").AuthToken>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    query: Partial<import("@owlmeans/auth").AuthToken>;
-}, undefined>>)[];
+export declare const entrypoints: import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<any>[];
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/manager/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,eAAO,MAAM,WAAW;;;;;;iBAOvB,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,eAAO,MAAM,WAAW,uEAOvB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.50",
+  "version": "0.1.18-rc.51",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,30 +37,30 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/api": "^0.1.18-rc.43",
-    "@owlmeans/api-config-server": "^0.1.18-rc.47",
-    "@owlmeans/auth": "^0.1.18-rc.37",
-    "@owlmeans/auth-common": "^0.1.18-rc.43",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.42",
+    "@owlmeans/api": "^0.1.18-rc.44",
+    "@owlmeans/api-config-server": "^0.1.18-rc.48",
+    "@owlmeans/auth": "^0.1.18-rc.38",
+    "@owlmeans/auth-common": "^0.1.18-rc.44",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.43",
     "@owlmeans/basic-ids": "^0.1.18-rc.34",
-    "@owlmeans/basic-keys": "^0.1.18-rc.44",
-    "@owlmeans/client-config": "^0.1.18-rc.40",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.43",
-    "@owlmeans/config": "^0.1.18-rc.40",
+    "@owlmeans/basic-keys": "^0.1.18-rc.45",
+    "@owlmeans/client-config": "^0.1.18-rc.41",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.44",
+    "@owlmeans/config": "^0.1.18-rc.41",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/kluster": "^0.1.18-rc.39",
-    "@owlmeans/entrypoint": "^0.1.18-rc.38",
-    "@owlmeans/redis-resource": "^0.1.18-rc.40",
+    "@owlmeans/kluster": "^0.1.18-rc.40",
+    "@owlmeans/entrypoint": "^0.1.18-rc.39",
+    "@owlmeans/redis-resource": "^0.1.18-rc.41",
     "@owlmeans/resource": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-api": "^0.1.18-rc.47",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.43",
-    "@owlmeans/server-auth-session": "^0.1.18-rc.12",
-    "@owlmeans/server-context": "^0.1.18-rc.39",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/server-api": "^0.1.18-rc.48",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.44",
+    "@owlmeans/server-auth-session": "^0.1.18-rc.13",
+    "@owlmeans/server-context": "^0.1.18-rc.40",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.38",
     "@owlmeans/server-route": "^0.1.18-rc.32",
-    "@owlmeans/server-socket": "^0.1.18-rc.50",
-    "@owlmeans/socket": "^0.1.18-rc.36",
+    "@owlmeans/server-socket": "^0.1.18-rc.51",
+    "@owlmeans/socket": "^0.1.18-rc.37",
     "@owlmeans/static-resource": "^0.1.18-rc.36",
     "@scure/base": "^2.3.0"
   },
@@ -69,7 +69,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.42",
+    "@owlmeans/test-auth": "^0.1.18-rc.43",
     "@types/bun": "^1.4.0",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",

package/src/manager/README.md

@@ -38,7 +38,7 @@ The manager is built on the OwlMeans entrypoint system, providing:
 This manager app is part of the `@owlmeans/server-auth` package:
 
 ```bash
-npm install @owlmeans/server-auth@^0.1.18-rc.50
+npm install @owlmeans/server-auth@^0.1.18-rc.51
 ```
 
 ## API Reference