@owlmeans/server-auth-token 0.1.18-rc.1 → 0.1.18-rc.11

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.13
+npx @owlmeans/agent-skills@^0.1.18-rc.23
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.1",
-  "generatedAt": "2026-09-10T18:54:42.508Z",
+  "version": "0.1.18-rc.11",
+  "generatedAt": "2026-09-15T12:50:32.651Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-token/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-token
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.1"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.11"` in `dependencies`
 **Contracts:** `@owlmeans/auth-token` — the record, the routes, the format helpers
 
 ## Key Exports
@@ -21,7 +21,7 @@ user-invocable: false
 | `makeAccessTokenResource(dbAlias?)` | The Mongo resource, with its three indexes |
 | `prefixOf(context, opts?)` | The deployment's prefix: guard options → config → default |
 | `hashAccessToken(token)` · `mintAccessToken(prefix)` | The stored form; one minted `{ token, hash, display }` |
-| `setupAuthTokenCoguard(entrypoints, guard?)` | Append the guard to every entrypoint that already has one |
+| `withAuthTokenCoguard(protocolTree, guard?)` | Return the same-shaped immutable tree with the guard appended to every already-guarded protocol |
 | `listAccessTokens` · `createAccessToken` · `revokeAccessToken` | The three handlers |
 | `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`) · `AuthTokenConfig` · `AccessTokenResource` | Types |
 
@@ -99,7 +99,7 @@ tokens that are not theirs.
 ## The coguard admits a token everywhere, and the deny list lives in the GUARD
 
 ```typescript
-setupAuthTokenCoguard(managerEntrypoints as Array<{ guards?: string[] }>)
+const guardedManagerProtocols = withAuthTokenCoguard(managerProtocols)
 ```
 
 An API client drives the same surface a browser does — projects, stories, files — so admitting the
@@ -108,8 +108,8 @@ never substitutes: the primary guard stays first and still claims its own creden
 matches only a value carrying the prefix. It skips entrypoints that have no guard, and it is
 idempotent.
 
-**Run it after the last elevation**, because it reads the guard list each entrypoint actually ended
-up with.
+Decorate the declaration tree before bindings are created. The helper preserves the input tree's
+shape, leaves unguarded protocols unchanged, and is idempotent.
 
 Routes that must stay behind an interactive session — opening a checkout, starting an OAuth flow,
 minting another token — are named in `AuthTokenGuardOptions.denyAliases` rather than skipped here.

package/build/coguard.d.ts

@@ -1,3 +1,4 @@
+import type { EntrypointTree } from '@owlmeans/entrypoint';
 /**
  * Let an access token authenticate every route that already has a guard.
  *
@@ -10,7 +11,5 @@
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export declare const setupAuthTokenCoguard: (entrypoints: Array<{
-    guards?: string[];
-}>, guard?: string) => void;
+export declare const withAuthTokenCoguard: <Tree extends EntrypointTree>(tree: Tree, guard?: string) => Tree;
 //# sourceMappingURL=coguard.d.ts.map

package/build/coguard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,gBACnB,KAAK,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,UAAS,MAAM,KACvD,IAMF,CAAA"}
+{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAAI,IAAI,SAAS,cAAc,QACxD,IAAI,UAAS,MAAM,KACxB,IAID,CAAA"}

package/build/coguard.js

@@ -1,4 +1,5 @@
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token';
+import { decorateEntrypoint, mapProtocols } from '@owlmeans/entrypoint';
 /**
  * Let an access token authenticate every route that already has a guard.
  *
@@ -11,13 +12,9 @@ import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token';
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export const setupAuthTokenCoguard = (entrypoints, guard = GUARD_AUTH_TOKEN) => {
-    entrypoints.forEach(entrypoint => {
-        if (entrypoint.guards == null || entrypoint.guards.length < 1)
-            return;
-        if (entrypoint.guards.includes(guard))
-            return;
-        entrypoint.guards = [...entrypoint.guards, guard];
-    });
-};
+export const withAuthTokenCoguard = (tree, guard = GUARD_AUTH_TOKEN) => mapProtocols(tree, declaration => {
+    if (declaration.guards.length < 1 || declaration.guards.includes(guard))
+        return declaration;
+    return decorateEntrypoint(declaration, { guards: [...declaration.guards, guard] });
+});
 //# sourceMappingURL=coguard.js.map

package/build/coguard.js.map

@@ -1 +1 @@
-{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,WAAyC,EAAE,KAAK,GAAW,gBAAgB,EACrE,EAAE;IACR,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC/B,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAM;QACrE,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAM;QAC7C,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGvE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAU,EAAE,KAAK,GAAW,gBAAgB,EACtC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;IAC1C,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAE3F,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA"}

package/build/handlers/index.d.ts

@@ -1,4 +1,12 @@
-export declare const listAccessTokens: import("@owlmeans/server-entrypoint").RefedEntrypointHandler<import("@owlmeans/entrypoint").AbstractResponse<any>>;
-export declare const createAccessToken: import("@owlmeans/server-entrypoint").RefedEntrypointHandler<import("@owlmeans/entrypoint").AbstractResponse<any>>;
-export declare const revokeAccessToken: import("@owlmeans/server-entrypoint").RefedEntrypointHandler<import("@owlmeans/entrypoint").AbstractResponse<any>>;
+import type { AccessTokenList, IssuedAccessToken } from '@owlmeans/auth-token';
+import type { AuthTokenEntrypoints } from '@owlmeans/auth-token';
+export declare const listAccessTokens: (protocol: AuthTokenEntrypoints['list']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, AccessTokenList>>;
+export declare const createAccessToken: (protocol: AuthTokenEntrypoints['create']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/auth-token").CreateAccessToken;
+}, IssuedAccessToken>>;
+export declare const revokeAccessToken: (protocol: AuthTokenEntrypoints['revoke']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    params: import("@owlmeans/auth-token").AccessTokenParams;
+}, {
+    id: string;
+}>>;
 //# sourceMappingURL=index.d.ts.map

package/build/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,gBAAgB,oHAa3B,CAAA;AAEF,eAAO,MAAM,iBAAiB,oHAsC5B,CAAA;AAEF,eAAO,MAAM,iBAAiB,oHAqB5B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EAAsC,iBAAiB,EACvE,MAAM,sBAAsB,CAAA;AAM7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AA0BhE,eAAO,MAAM,gBAAgB,aAAc,oBAAoB,CAAC,MAAM,CAAC,iLAarE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;sBAsCxE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;;;GAqBxE,CAAA"}

package/build/handlers/index.js

@@ -1,7 +1,7 @@
 import { AuthForbidden, AuthroizationType, ALL_SCOPES, AuthRole } from '@owlmeans/auth';
 import { AUTH_TOKEN_MAX_TTL, AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token';
 import { requireEntityKey } from '@owlmeans/auth-common';
-import { handleBody, handleParams, handleRequest } from '@owlmeans/server-api';
+import { handlers } from '@owlmeans/server-api';
 import { mintAccessToken } from '../hash.js';
 import { prefixOf } from '../guard.js';
 const view = (record) => {
@@ -23,7 +23,7 @@ const refuseTokenAuth = (req, what) => {
         throw new AuthForbidden(what);
     }
 };
-export const listAccessTokens = handleRequest(async (req, context) => {
+export const listAccessTokens = (protocol) => handlers().request(protocol, async (req, context) => {
     const ctx = context;
     const entityId = requireEntityKey(req);
     const profileId = req.auth?.profileId;
@@ -36,7 +36,7 @@ export const listAccessTokens = handleRequest(async (req, context) => {
             .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
     };
 });
-export const createAccessToken = handleBody(async (payload, context, req) => {
+export const createAccessToken = (protocol) => handlers().body(protocol, async (payload, context, req) => {
     const ctx = context;
     refuseTokenAuth(req, 'token-mint');
     const entityId = requireEntityKey(req);
@@ -72,7 +72,7 @@ export const createAccessToken = handleBody(async (payload, context, req) => {
     // The only moment the plaintext exists outside the caller's own machine.
     return { token: minted.token, record: view(record) };
 });
-export const revokeAccessToken = handleParams(async (payload, context, req) => {
+export const revokeAccessToken = (protocol) => handlers().params(protocol, async (payload, context, req) => {
     const ctx = context;
     refuseTokenAuth(req, 'token-revoke');
     const entityId = requireEntityKey(req);

package/build/handlers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,kBAAkB,EAAE,mBAAmB,EACxC,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGtC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAEhC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IAChF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IACnE,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAoB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC7F,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,8FAA8F;IAC9F,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;YACjG,CAAC,CAAC,EAAE,CAAC;KACa,CAAC,CAAA;IAEvB,yEAAyE;IACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;AAClF,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAoB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC/F,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,kBAAkB,EAAE,mBAAmB,EACxC,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAItC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAEhC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IAChF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAsC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAChJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,8FAA8F;IAC9F,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;YACjG,CAAC,CAAC,EAAE,CAAC;KACa,CAAC,CAAA;IAEvB,yEAAyE;IACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;AAClF,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC3J,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.1",
+  "version": "0.1.18-rc.11",
   "license": "MIT",
   "description": "The server half of OwlMeans access tokens — the store, the guard that verifies a presented token, the management handlers and the coguard that admits one on an existing route.",
   "type": "module",
@@ -24,16 +24,16 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.10",
-    "@owlmeans/auth-common": "^0.1.18-rc.14",
-    "@owlmeans/auth-token": "^0.1.18-rc.1",
-    "@owlmeans/context": "^0.1.18-rc.9",
-    "@owlmeans/entrypoint": "^0.1.18-rc.12",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.13",
-    "@owlmeans/resource": "^0.1.18-rc.10",
-    "@owlmeans/server-api": "^0.1.18-rc.18",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.14",
-    "@owlmeans/server-context": "^0.1.18-rc.13",
+    "@owlmeans/auth": "^0.1.18-rc.20",
+    "@owlmeans/auth-common": "^0.1.18-rc.24",
+    "@owlmeans/auth-token": "^0.1.18-rc.11",
+    "@owlmeans/context": "^0.1.18-rc.19",
+    "@owlmeans/entrypoint": "^0.1.18-rc.22",
+    "@owlmeans/mongo-resource": "^0.1.18-rc.23",
+    "@owlmeans/resource": "^0.1.18-rc.20",
+    "@owlmeans/server-api": "^0.1.18-rc.28",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.24",
+    "@owlmeans/server-context": "^0.1.18-rc.23",
     "@scure/base": "^1.1.9"
   },
   "devDependencies": {

package/src/coguard.ts

@@ -1,4 +1,6 @@
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
+import { decorateEntrypoint, mapProtocols } from '@owlmeans/entrypoint'
+import type { EntrypointTree } from '@owlmeans/entrypoint'
 
 /**
  * Let an access token authenticate every route that already has a guard.
@@ -12,12 +14,10 @@ import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export const setupAuthTokenCoguard = (
-  entrypoints: Array<{ guards?: string[] }>, guard: string = GUARD_AUTH_TOKEN
-): void => {
-  entrypoints.forEach(entrypoint => {
-    if (entrypoint.guards == null || entrypoint.guards.length < 1) return
-    if (entrypoint.guards.includes(guard)) return
-    entrypoint.guards = [...entrypoint.guards, guard]
-  })
-}
+export const withAuthTokenCoguard = <Tree extends EntrypointTree>(
+  tree: Tree, guard: string = GUARD_AUTH_TOKEN,
+): Tree => mapProtocols(tree, declaration => {
+  if (declaration.guards.length < 1 || declaration.guards.includes(guard)) return declaration
+
+  return decorateEntrypoint(declaration, { guards: [...declaration.guards, guard] })
+})

package/src/handlers/index.ts

@@ -3,14 +3,14 @@ import {
   AUTH_TOKEN_MAX_TTL, AUTH_TOKEN_RESOURCE
 } from '@owlmeans/auth-token'
 import type {
-  AccessTokenList, AccessTokenParams, AccessTokenRecord, AccessTokenView, CreateAccessToken,
-  IssuedAccessToken
+  AccessTokenList, AccessTokenRecord, AccessTokenView, IssuedAccessToken
 } from '@owlmeans/auth-token'
 import { requireEntityKey } from '@owlmeans/auth-common'
-import { handleBody, handleParams, handleRequest } from '@owlmeans/server-api'
+import { handlers } from '@owlmeans/server-api'
 import { mintAccessToken } from '../hash.js'
 import { prefixOf } from '../guard.js'
 import type { AccessTokenResource, AuthTokenContext } from '../types.js'
+import type { AuthTokenEntrypoints } from '@owlmeans/auth-token'
 
 const view = (record: AccessTokenRecord): AccessTokenView => {
   const { hash, ...rest } = record
@@ -36,7 +36,7 @@ const refuseTokenAuth = (req: { auth?: { type?: string } }, what: string): void
   }
 }
 
-export const listAccessTokens = handleRequest(async (req, context) => {
+export const listAccessTokens = (protocol: AuthTokenEntrypoints['list']) => handlers<AuthTokenContext>().request(protocol, async (req, context) => {
   const ctx = context as AuthTokenContext
   const entityId = requireEntityKey(req)
   const profileId = req.auth?.profileId
@@ -51,7 +51,7 @@ export const listAccessTokens = handleRequest(async (req, context) => {
   } satisfies AccessTokenList
 })
 
-export const createAccessToken = handleBody<CreateAccessToken>(async (payload, context, req) => {
+export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => handlers<AuthTokenContext>().body(protocol, async (payload, context, req) => {
   const ctx = context as AuthTokenContext
   refuseTokenAuth(req, 'token-mint')
 
@@ -91,7 +91,7 @@ export const createAccessToken = handleBody<CreateAccessToken>(async (payload, c
   return { token: minted.token, record: view(record) } satisfies IssuedAccessToken
 })
 
-export const revokeAccessToken = handleParams<AccessTokenParams>(async (payload, context, req) => {
+export const revokeAccessToken = (protocol: AuthTokenEntrypoints['revoke']) => handlers<AuthTokenContext>().params(protocol, async (payload, context, req) => {
   const ctx = context as AuthTokenContext
   refuseTokenAuth(req, 'token-revoke')
 

package/tests/coguard.spec.ts

@@ -1,36 +1,34 @@
 import { describe, expect, test } from 'bun:test'
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
-import { setupAuthTokenCoguard } from '../src/coguard.js'
+import { openProtocol, protocols } from '@owlmeans/entrypoint'
+import { route } from '@owlmeans/route'
+import { withAuthTokenCoguard } from '../src/coguard.js'
 
 describe('@owlmeans/server-auth-token — the coguard', () => {
-  test('appends to a guarded entrypoint and leaves the primary guard first', () => {
-    const entrypoints = [{ guards: ['auth'] }]
-    setupAuthTokenCoguard(entrypoints)
+  test('decorates a guarded protocol and leaves the primary guard first', () => {
+    const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
+    const [decorated] = protocols(withAuthTokenCoguard({ guarded }))
 
-    expect(entrypoints[0].guards).toEqual(['auth', GUARD_AUTH_TOKEN])
+    expect(decorated.guards).toEqual(['auth', GUARD_AUTH_TOKEN])
+    expect(guarded.guards).toEqual(['auth'])
   })
 
-  test('leaves an unguarded entrypoint unguarded', () => {
-    // A public route stays public: adding a guard here would turn an open page into a 401.
-    const entrypoints: Array<{ guards?: string[] }> = [{}, { guards: [] }]
-    setupAuthTokenCoguard(entrypoints)
-
-    expect(entrypoints[0].guards).toBeUndefined()
-    expect(entrypoints[1].guards).toEqual([])
+  test('leaves an unguarded protocol unchanged', () => {
+    const open = openProtocol(route('open', '/open'))
+    expect(protocols(withAuthTokenCoguard({ open }))[0]).toBe(open)
   })
 
-  test('is idempotent — a second pass adds nothing', () => {
-    const entrypoints = [{ guards: ['auth'] }]
-    setupAuthTokenCoguard(entrypoints)
-    setupAuthTokenCoguard(entrypoints)
+  test('is idempotent', () => {
+    const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
+    const [once] = protocols(withAuthTokenCoguard({ guarded }))
+    const [twice] = protocols(withAuthTokenCoguard({ once }))
 
-    expect(entrypoints[0].guards).toEqual(['auth', GUARD_AUTH_TOKEN])
+    expect(twice.guards).toEqual(['auth', GUARD_AUTH_TOKEN])
   })
 
   test('honours a custom guard alias', () => {
-    const entrypoints = [{ guards: ['auth'] }]
-    setupAuthTokenCoguard(entrypoints, 'other-guard')
-
-    expect(entrypoints[0].guards).toEqual(['auth', 'other-guard'])
+    const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
+    expect(protocols(withAuthTokenCoguard({ guarded }, 'other-guard'))[0].guards)
+      .toEqual(['auth', 'other-guard'])
   })
 })

package/tests/handlers.spec.ts

@@ -1,24 +1,32 @@
 import { describe, expect, test } from 'bun:test'
 import { AuthroizationType, AuthRole } from '@owlmeans/auth'
-import { AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token'
+import { AUTH_TOKEN_RESOURCE, makeAuthTokenEntrypoints } from '@owlmeans/auth-token'
 import type { AccessTokenRecord, IssuedAccessToken } from '@owlmeans/auth-token'
-import { createAccessToken, listAccessTokens, revokeAccessToken } from '../src/handlers/index.js'
+import {
+  createAccessToken as bindCreateAccessToken,
+  listAccessTokens as bindListAccessTokens,
+  revokeAccessToken as bindRevokeAccessToken,
+} from '../src/handlers/index.js'
 import { hashAccessToken } from '../src/hash.js'
 import { makeTestContext, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE, TEST_USER } from './context.js'
 
 /**
- * A handler is a `RefedEntrypointHandler`: it is given the entrypoint reference it was elevated
- * onto and answers with `(req, res)`. Calling it directly is what lets these tests be about the
- * RULES — who may mint, what a list shows, whose token may be revoked — rather than about routing.
+ * A protocol-bound implementation is run with the smallest binding context the transport needs.
+ * This keeps the tests about the authorization rules rather than a router's alias lookup.
  */
 const invoke = async (handler: any, context: any, req: any): Promise<any> => {
   const res: any = { resolve: (value: unknown) => { res.value = value }, reject: (e: Error) => { res.error = e } }
-  await handler({ ref: { ctx: context } })(req, res)
+  await handler.bind({ ref: { ctx: context } })(req, res)
   if (res.error != null) throw res.error
 
   return res.value
 }
 
+const protocols = makeAuthTokenEntrypoints()
+const listAccessTokens = bindListAccessTokens(protocols.list)
+const createAccessToken = bindCreateAccessToken(protocols.create)
+const revokeAccessToken = bindRevokeAccessToken(protocols.revoke)
+
 const session = (patch: Record<string, unknown> = {}): any => ({
   headers: {}, params: {}, query: {}, body: {},
   entity: { id: TEST_ENTITY, slug: TEST_ENTITY },