@owlmeans/auth-token 0.1.18-rc.2 → 0.1.18-rc.4

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.14
+npx @owlmeans/agent-skills@^0.1.18-rc.16
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-token",
-  "version": "0.1.18-rc.2",
-  "generatedAt": "2026-09-10T23:12:07.513Z",
+  "version": "0.1.18-rc.4",
+  "generatedAt": "2026-09-12T12:32:46.376Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-token/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-token
 
 **Layer:** Auth shared
-**Install:** `"@owlmeans/auth-token": "^0.1.18-rc.2"` in `dependencies`
+**Install:** `"@owlmeans/auth-token": "^0.1.18-rc.4"` in `dependencies`
 
 The contract half of long-lived access tokens: the record shape, the route declarations, the
 format helpers, and one client-side guard that presents a token it was handed. The server half —

package/build/entrypoints.d.ts

@@ -1,5 +1,4 @@
-import type { CommonEntrypoint } from '@owlmeans/entrypoint';
-import type { AuthTokenEntrypointOptions } from './types.js';
+import type { AuthTokenEntrypoints, AuthTokenEntrypointOptions } from './types.js';
 /**
  * The three routes a token surface needs, ready to be spread into an application's entrypoints.
  *
@@ -11,5 +10,5 @@ import type { AuthTokenEntrypointOptions } from './types.js';
  * issuance, because a token that can be widened later is a token whose grant nobody can reason
  * about from the moment it was created.
  */
-export declare const makeAuthTokenEntrypoints: (opts?: AuthTokenEntrypointOptions) => CommonEntrypoint[];
+export declare const makeAuthTokenEntrypoints: (opts?: AuthTokenEntrypointOptions) => AuthTokenEntrypoints;
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAI5D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,UAC7B,0BAA0B,KAC/B,gBAAgB,EAoBlB,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAsC,oBAAoB,EAAE,0BAA0B,EAAwC,MAAM,YAAY,CAAA;AAE5J;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,UAC7B,0BAA0B,KAC/B,oBAoBF,CAAA"}

package/build/entrypoints.js

@@ -1,4 +1,4 @@
-import { body, entrypoint, filter, guard, params } from '@owlmeans/entrypoint';
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
 import { route, RouteMethod } from '@owlmeans/route';
 import { authToken } from './consts.js';
 import { AccessTokenParamsSchema, CreateAccessTokenSchema } from './schemas.js';
@@ -16,15 +16,15 @@ import { AccessTokenParamsSchema, CreateAccessTokenSchema } from './schemas.js';
 export const makeAuthTokenEntrypoints = (opts = {}) => {
     const path = opts.path ?? '/tokens';
     const base = opts.parent != null
-        ? entrypoint(route(authToken.base, path, { parent: opts.parent }))
-        : entrypoint(route(authToken.base, path), opts.guard != null ? guard(opts.guard) : undefined);
-    return [
+        ? openProtocol(route(authToken.base, path, { parent: opts.parent }))
+        : openProtocol(route(authToken.base, path), opts.guard == null ? undefined : { guards: opts.guard });
+    return {
         base,
-        entrypoint(route(authToken.list, '/', {
+        list: protocol(route(authToken.list, '/', {
             parent: authToken.base, method: RouteMethod.GET
-        })),
-        entrypoint(route(authToken.create, '/', { parent: authToken.base, method: RouteMethod.POST }), filter(body(CreateAccessTokenSchema))),
-        entrypoint(route(authToken.revoke, '/:id', { parent: authToken.base, method: RouteMethod.DELETE }), filter(params(AccessTokenParamsSchema))),
-    ];
+        }), contract(typed())),
+        create: protocol(route(authToken.create, '/', { parent: authToken.base, method: RouteMethod.POST }), contract.request({ body: typed(CreateAccessTokenSchema) }, typed())),
+        revoke: protocol(route(authToken.revoke, '/:id', { parent: authToken.base, method: RouteMethod.DELETE }), contract.request({ params: typed(AccessTokenParamsSchema) }, typed())),
+    };
 };
 //# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAG/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,IAAI,GAA+B,EAAE,EACjB,EAAE;IACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI;QAC9B,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE/F,OAAO;QACL,IAAI;QACJ,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE;YACpC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG;SAChD,CAAC,CAAC;QACH,UAAU,CACR,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,EAClF,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CACtC;QACD,UAAU,CACR,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,EACvF,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CACxC;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAG/E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,IAAI,GAA+B,EAAE,EACf,EAAE;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI;QAC9B,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAEtG,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE;YACxC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG;SAChD,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAmB,CAAC,CAAC;QACvC,MAAM,EAAE,QAAQ,CACd,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,EAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAoB,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAqB,CAAC,CAC1G;QACD,MAAM,EAAE,QAAQ,CACd,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,EACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAoB,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAkB,CAAC,CACzG;KACF,CAAA;AACH,CAAC,CAAA"}

package/build/types.d.ts

@@ -1,5 +1,6 @@
 import type { AuthRole } from '@owlmeans/auth';
 import type { ResourceRecord } from '@owlmeans/resource';
+import type { EntrypointProtocol, OpenRequest, OpenValue } from '@owlmeans/entrypoint';
 /**
  * One long-lived access token, as stored.
  *
@@ -69,4 +70,17 @@ export interface AuthTokenEntrypointOptions {
     /** The guard the base carries when it has no parent to inherit one from. */
     guard?: string;
 }
+/** The immutable declarations for a token-management surface. */
+export interface AuthTokenEntrypoints {
+    base: EntrypointProtocol<OpenRequest, OpenValue>;
+    list: EntrypointProtocol<OpenRequest, AccessTokenList>;
+    create: EntrypointProtocol<{
+        body: CreateAccessToken;
+    }, IssuedAccessToken>;
+    revoke: EntrypointProtocol<{
+        params: AccessTokenParams;
+    }, {
+        id: string;
+    }>;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAA;IACZ,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,mFAAmF;IACnF,UAAU,CAAC,EAAE,IAAI,CAAA;IACjB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;AAE7D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,eAAe,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChD,MAAM,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAA;CACjC;AAED,MAAM,WAAW,0BAA0B;IACzC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtF;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAA;IACZ,4FAA4F;IAC5F,OAAO,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,mFAAmF;IACnF,UAAU,CAAC,EAAE,IAAI,CAAA;IACjB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;AAE7D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,eAAe,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChD,MAAM,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAA;CACjC;AAED,MAAM,WAAW,0BAA0B;IACzC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,kBAAkB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAChD,IAAI,EAAE,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAA;IACtD,MAAM,EAAE,kBAAkB,CAAC;QAAE,IAAI,EAAE,iBAAiB,CAAA;KAAE,EAAE,iBAAiB,CAAC,CAAA;IAC1E,MAAM,EAAE,kBAAkB,CAAC;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC1E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-token",
-  "version": "0.1.18-rc.2",
+  "version": "0.1.18-rc.4",
   "license": "MIT",
   "description": "Long-lived access tokens (API keys) on the OwlMeans auth rails — the record shape, the token format, the management entrypoints and the client-side carrier guard.",
   "type": "module",
@@ -23,11 +23,11 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.11",
-    "@owlmeans/context": "^0.1.18-rc.10",
-    "@owlmeans/entrypoint": "^0.1.18-rc.13",
-    "@owlmeans/resource": "^0.1.18-rc.11",
-    "@owlmeans/route": "^0.1.18-rc.11"
+    "@owlmeans/auth": "^0.1.18-rc.13",
+    "@owlmeans/context": "^0.1.18-rc.12",
+    "@owlmeans/entrypoint": "^0.1.18-rc.15",
+    "@owlmeans/resource": "^0.1.18-rc.13",
+    "@owlmeans/route": "^0.1.18-rc.13"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",

package/src/entrypoints.ts

@@ -1,9 +1,8 @@
-import { body, entrypoint, filter, guard, params } from '@owlmeans/entrypoint'
-import type { CommonEntrypoint } from '@owlmeans/entrypoint'
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint'
 import { route, RouteMethod } from '@owlmeans/route'
 import { authToken } from './consts.js'
 import { AccessTokenParamsSchema, CreateAccessTokenSchema } from './schemas.js'
-import type { AuthTokenEntrypointOptions } from './types.js'
+import type { AccessTokenList, AccessTokenParams, AuthTokenEntrypoints, AuthTokenEntrypointOptions, CreateAccessToken, IssuedAccessToken } from './types.js'
 
 /**
  * The three routes a token surface needs, ready to be spread into an application's entrypoints.
@@ -18,24 +17,24 @@ import type { AuthTokenEntrypointOptions } from './types.js'
  */
 export const makeAuthTokenEntrypoints = (
   opts: AuthTokenEntrypointOptions = {}
-): CommonEntrypoint[] => {
+): AuthTokenEntrypoints => {
   const path = opts.path ?? '/tokens'
   const base = opts.parent != null
-    ? entrypoint(route(authToken.base, path, { parent: opts.parent }))
-    : entrypoint(route(authToken.base, path), opts.guard != null ? guard(opts.guard) : undefined)
+    ? openProtocol(route(authToken.base, path, { parent: opts.parent }))
+    : openProtocol(route(authToken.base, path), opts.guard == null ? undefined : { guards: opts.guard })
 
-  return [
+  return {
     base,
-    entrypoint(route(authToken.list, '/', {
+    list: protocol(route(authToken.list, '/', {
       parent: authToken.base, method: RouteMethod.GET
-    })),
-    entrypoint(
+    }), contract(typed<AccessTokenList>())),
+    create: protocol(
       route(authToken.create, '/', { parent: authToken.base, method: RouteMethod.POST }),
-      filter(body(CreateAccessTokenSchema))
+      contract.request({ body: typed<CreateAccessToken>(CreateAccessTokenSchema) }, typed<IssuedAccessToken>())
     ),
-    entrypoint(
+    revoke: protocol(
       route(authToken.revoke, '/:id', { parent: authToken.base, method: RouteMethod.DELETE }),
-      filter(params(AccessTokenParamsSchema))
+      contract.request({ params: typed<AccessTokenParams>(AccessTokenParamsSchema) }, typed<{ id: string }>())
     ),
-  ]
+  }
 }

package/src/types.ts

@@ -1,5 +1,6 @@
 import type { AuthRole } from '@owlmeans/auth'
 import type { ResourceRecord } from '@owlmeans/resource'
+import type { EntrypointProtocol, OpenRequest, OpenValue } from '@owlmeans/entrypoint'
 
 /**
  * One long-lived access token, as stored.
@@ -77,3 +78,11 @@ export interface AuthTokenEntrypointOptions {
   /** The guard the base carries when it has no parent to inherit one from. */
   guard?: string
 }
+
+/** The immutable declarations for a token-management surface. */
+export interface AuthTokenEntrypoints {
+  base: EntrypointProtocol<OpenRequest, OpenValue>
+  list: EntrypointProtocol<OpenRequest, AccessTokenList>
+  create: EntrypointProtocol<{ body: CreateAccessToken }, IssuedAccessToken>
+  revoke: EntrypointProtocol<{ params: AccessTokenParams }, { id: string }>
+}