@owlmeans/server-auth-token 0.1.18-rc.3 → 0.1.18-rc.30

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.15
+npx @owlmeans/agent-skills@^0.1.18-rc.47
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.3",
-  "generatedAt": "2026-09-12T08:39:52.739Z",
+  "version": "0.1.18-rc.30",
+  "generatedAt": "2026-10-03T20:05:07.610Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-token/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-auth-token
-description: How to use @owlmeans/server-auth-token — the server half of long-lived access tokens — the Mongo store, the guard that verifies a presented token and intersects its scopes with the profile's, the mint/list/revoke handlers, and the coguard that admits a token on every already-guarded route. Auto-invoked when registering the token guard or resources, mounting the token handlers, or diagnosing a 401 on a route an access token should reach.
+description: How to use @owlmeans/server-auth-token — the server half of long-lived access tokens — the Mongo store, the guard that verifies a presented token and intersects its scopes with the profile's, the mint/list/revoke handlers, the shared `issueAccessToken`, audience admission for OAuth-issued tokens, and the coguard that admits a token on every already-guarded route. Auto-invoked when registering the token guard or resources, mounting the token handlers, or diagnosing a 401 on a route an access token should reach.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-token
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.3"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.30"` in `dependencies`
 **Contracts:** `@owlmeans/auth-token` — the record, the routes, the format helpers
 
 ## Key Exports
@@ -21,9 +21,11 @@ user-invocable: false
 | `makeAccessTokenResource(dbAlias?)` | The Mongo resource, with its three indexes |
 | `prefixOf(context, opts?)` | The deployment's prefix: guard options → config → default |
 | `hashAccessToken(token)` · `mintAccessToken(prefix)` | The stored form; one minted `{ token, hash, display }` |
-| `setupAuthTokenCoguard(entrypoints, guard?)` | Append the guard to every entrypoint that already has one |
+| `withAuthTokenCoguard(protocolTree, guard?)` | Return the same-shaped immutable tree with the guard appended to every already-guarded protocol |
 | `listAccessTokens` · `createAccessToken` · `revokeAccessToken` | The three handlers |
-| `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`) · `AuthTokenConfig` · `AccessTokenResource` | Types |
+| `issueAccessToken(ctx, subject, request)` | Mint one token for `{ entityId, userId, profileId, role, scopes }` — what `createAccessToken` does over an HTTP body, and what an OAuth token endpoint calls over a session it verified itself. `request` is `CreateAccessToken` plus `audience?: string[]` |
+| `refuseTokenAuth(req, what)` | The one "interactive session only" check — throws `AuthForbidden` when `req.auth.type` is an access token |
+| `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`, `resources`) · `IssueAccessTokenSubject` · `IssueAccessTokenRequest` · `AuthTokenConfig` · `AccessTokenResource` | Types |
 
 ## Wiring
 
@@ -77,6 +79,16 @@ Three properties keep it from colliding with the guards beside it:
 - `entitySlug` is resolved through `ENTITY_RESOLVER` when one is registered, so the payload is
   identical to a browser session's rather than carrying a raw id.
 
+**Audience admission is opt-in.** A token minted through an OAuth grant carries `audience` (the resources
+it is FOR, RFC 8707). A guard configured with `resources` (`string[]` or `(ctx) => string[]`, resolved
+per request, because `appendAuthTokenGuard` runs from `makeContext` before a secret-mounted hostname is
+necessarily readable) refuses — as an ordinary non-match, a 401 — a token whose non-empty `audience`
+does not intersect it. A token with **no** audience (every hand-minted one) is admitted everywhere its
+scopes reach, and a guard with no `resources` admits every token whatever its audience, so a deployment
+that never mints an audience-restricted token sees no change. Two guards over different surfaces are
+how a token bound to `/mcp` stays out of the ordinary REST API while a REST-scoped token still works
+through `/mcp`.
+
 `lastUsedAt` is a **throttled, fire-and-forget** write (`touchInterval`, default 5 minutes). A usage
 timestamp is never a reason to fail a request, and awaiting it would put a database write on the
 critical path of every authenticated call. It answers one question — "is this token still in use?" —
@@ -85,8 +97,8 @@ and is not an access log.
 ## A token may never mint or revoke a token
 
 Minting is the one operation that turns a stolen credential into a permanent one: a token that can
-create tokens survives the revocation of the token that leaked. `createAccessToken` and
-`revokeAccessToken` refuse a request whose `auth.type` is `AuthroizationType.AuthToken`, and a
+create tokens survives the revocation of the token that leaked. `createAccessToken`, `revokeAccessToken` and any other minting path (an OAuth consent approval calls
+`refuseTokenAuth` before it snapshots the subject) refuse a request whose `auth.type` is `AuthroizationType.AuthToken`, and a
 deployment additionally names those routes in the guard's **deny list**, so the refusal is a 401 at
 the boundary rather than a check every future handler has to remember.
 
@@ -99,7 +111,7 @@ tokens that are not theirs.
 ## The coguard admits a token everywhere, and the deny list lives in the GUARD
 
 ```typescript
-setupAuthTokenCoguard(managerEntrypoints as Array<{ guards?: string[] }>)
+const guardedManagerProtocols = withAuthTokenCoguard(managerProtocols)
 ```
 
 An API client drives the same surface a browser does — projects, stories, files — so admitting the
@@ -108,8 +120,8 @@ never substitutes: the primary guard stays first and still claims its own creden
 matches only a value carrying the prefix. It skips entrypoints that have no guard, and it is
 idempotent.
 
-**Run it after the final binding**, because it reads the guard list each entrypoint actually ended
-up with.
+Decorate the declaration tree before bindings are created. The helper preserves the input tree's
+shape, leaves unguarded protocols unchanged, and is idempotent.
 
 Routes that must stay behind an interactive session — opening a checkout, starting an OAuth flow,
 minting another token — are named in `AuthTokenGuardOptions.denyAliases` rather than skipped here.
@@ -121,7 +133,7 @@ works.
 ## Tests
 
 `bun test ./tests` in the package — what the guard claims, what it resolves (including that a token
-can never outrank its profile), the mint/list/revoke rules, and the coguard's four properties.
+can never outrank its profile), the mint/list/revoke rules, `issueAccessToken` parity with the route, audience admission, and the coguard's four properties.
 
 ## Depends On
 
@@ -132,5 +144,6 @@ can never outrank its profile), the mint/list/revoke rules, and the coguard's fo
 
 ## Related
 
-- [[auth-token]] — the format, the routes and the client carrier guard
+- [[auth-token]] — the format, the routes, `audience` and the client carrier guard
+- [[server-oauth]] — the authorization server that mints audience-scoped tokens through `issueAccessToken`
 - [[web-auth-token]] — the management panel · [[auth-protocol]] · [[server-auth]]

package/build/coguard.d.ts

@@ -1,4 +1,4 @@
-import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint';
+import type { EntrypointTree } from '@owlmeans/entrypoint';
 /**
  * Let an access token authenticate every route that already has a guard.
  *
@@ -11,5 +11,5 @@ import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint';
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export declare const withAuthTokenCoguard: <Protocol extends EntrypointProtocolDeclaration>(declarations: readonly Protocol[], guard?: string) => Protocol[];
+export declare const withAuthTokenCoguard: <Tree extends EntrypointTree>(tree: Tree, guard?: string) => Tree;
 //# sourceMappingURL=coguard.d.ts.map

package/build/coguard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,SAAS,6BAA6B,gBACnE,SAAS,QAAQ,EAAE,UAAS,MAAM,KAC/C,QAAQ,EAIT,CAAA"}
+{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAAI,IAAI,SAAS,cAAc,QACxD,IAAI,UAAS,MAAM,KACxB,IAID,CAAA"}

package/build/coguard.js

@@ -1,5 +1,5 @@
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token';
-import { decorateEntrypoint } from '@owlmeans/entrypoint';
+import { decorateEntrypoint, mapProtocols } from '@owlmeans/entrypoint';
 /**
  * Let an access token authenticate every route that already has a guard.
  *
@@ -12,7 +12,7 @@ import { decorateEntrypoint } from '@owlmeans/entrypoint';
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export const withAuthTokenCoguard = (declarations, guard = GUARD_AUTH_TOKEN) => declarations.map(declaration => {
+export const withAuthTokenCoguard = (tree, guard = GUARD_AUTH_TOKEN) => mapProtocols(tree, declaration => {
     if (declaration.guards.length < 1 || declaration.guards.includes(guard))
         return declaration;
     return decorateEntrypoint(declaration, { guards: [...declaration.guards, guard] });

package/build/coguard.js.map

@@ -1 +1 @@
-{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,YAAiC,EAAE,KAAK,GAAW,gBAAgB,EACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;IAC9C,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAE3F,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA"}
+{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGvE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAU,EAAE,KAAK,GAAW,gBAAgB,EACtC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;IAC1C,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAE3F,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA"}

package/build/guard.d.ts

@@ -2,23 +2,5 @@ import type { GuardService } from '@owlmeans/entrypoint';
 import type { AuthTokenContext, AuthTokenGuardOptions } from './types.js';
 /** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
 export declare const prefixOf: (context: AuthTokenContext, opts?: AuthTokenGuardOptions) => string;
-/**
- * The guard that verifies a long-lived access token.
- *
- * It is a GUARD, not an authentication method: nothing is exchanged, no envelope is signed, no
- * session begins. A caller presents a credential it was handed once, and the guard turns it into
- * the same `Auth` payload every other guard produces — so ownership gates, entitlement gates and
- * handlers written against a browser session work unchanged for an API client.
- *
- * Three properties are what keep it from colliding with the guards it sits beside:
- *
- * - it claims a header only when the value carries the deployment's prefix, so an OwlMeans
- *   `ED25519-BASIC-TOKEN` bearer, an OIDC one, and this one can all arrive under `Authorization`
- *   without any of them shadowing the others;
- * - it accepts the OwlMeans `AUTH-TOKEN` scheme AND plain `Bearer`, because a third-party client
- *   configured with a URL sends the latter whatever the documentation says;
- * - it intersects the token's scopes with its profile's on every request, so a token can never
- *   outlive or outrank the person who minted it.
- */
 export declare const makeAuthTokenGuard: (alias?: string, opts?: AuthTokenGuardOptions) => GuardService;
 //# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqC,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAI3F,OAAO,KAAK,EAAwC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAE/G,oGAAoG;AACpG,eAAO,MAAM,QAAQ,YAAa,gBAAgB,SAAS,qBAAqB,KAAG,MACc,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,WACtB,MAAM,SAA2B,qBAAqB,KAC5D,YAsGF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqC,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAI3F,OAAO,KAAK,EAAwC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAG/G,oGAAoG;AACpG,eAAO,MAAM,QAAQ,YAAa,gBAAgB,SAAS,qBAAqB,KAAG,MACc,CAAA;AAmCjG,eAAO,MAAM,kBAAkB,WACtB,MAAM,SAA2B,qBAAqB,KAC5D,YAgHF,CAAA"}

package/build/guard.js

@@ -5,6 +5,7 @@ import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
 import { createService } from '@owlmeans/context';
 import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
 import { hashAccessToken } from './hash.js';
+import { logger, logThrottle } from '@owlmeans/log';
 /** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
 export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX;
 /**
@@ -25,6 +26,19 @@ export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken
  * - it intersects the token's scopes with its profile's on every request, so a token can never
  *   outlive or outrank the person who minted it.
  */
+const log = logger('server-auth-token');
+/**
+ * A presented access token the guard did not accept. Never the token, not even its display form:
+ * its record id only. Once a minute per token and reason — a client retrying a revoked token calls every second.
+ */
+const refuse = (reason, record) => {
+    if (logThrottle(`auth-token:${reason}:${record?.id ?? ''}`, 60_000)) {
+        log.warn('Access token refused', {
+            reason, tokenId: record?.id, entityId: record?.entityId,
+        }, { event: 'auth.refused' });
+    }
+    return false;
+};
 export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
     const touchInterval = opts.touchInterval ?? AUTH_TOKEN_TOUCH_INTERVAL;
     const present = (req, prefix) => {
@@ -58,11 +72,21 @@ export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
             const tokens = context.resource(opts.resourceAlias ?? AUTH_TOKEN_RESOURCE);
             const record = await tokens.load({ hash: hashAccessToken(presented) });
             if (record == null)
-                return false;
+                return refuse('unknown');
             if (record.revokedAt != null)
-                return false;
+                return refuse('revoked', record);
             if (record.expiresAt != null && new Date(record.expiresAt) < new Date())
-                return false;
+                return refuse('expired', record);
+            // A token minted through an OAuth grant carries the resource(s) it was issued FOR. A token
+            // with no audience is the ordinary hand-minted kind and is admitted everywhere its scopes
+            // reach, exactly as before this check existed — the guard has to OPT IN with `resources` to
+            // narrow anything, so a deployment that never touches this option sees no change at all.
+            const resources = typeof opts.resources === 'function' ? opts.resources(context) : opts.resources;
+            if (record.audience != null && record.audience.length > 0
+                && resources != null && resources.length > 0
+                && !record.audience.some(resource => resources.includes(resource))) {
+                return refuse('audience', record);
+            }
             // A token is only ever as good as the profile behind it. Reading the profile per request is
             // what makes revoking a person's access revoke every token they ever minted, without any
             // token record being touched.
@@ -72,12 +96,12 @@ export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
                 profile = await profiles.load({ entityId: record.entityId, profileId: record.profileId });
             }
             catch {
-                return false;
+                return refuse('profile-unreadable', record);
             }
             if (profile == null)
-                return false;
+                return refuse('profile', record);
             if (profile.expiresAt != null && new Date(profile.expiresAt) < new Date())
-                return false;
+                return refuse('profile-expired', record);
             const profileScopes = profile.scopes ?? [];
             const scopes = profileScopes.includes(ALL_SCOPES)
                 ? record.scopes
@@ -114,7 +138,7 @@ export const makeAuthTokenGuard = (alias = GUARD_AUTH_TOKEN, opts = {}) => {
                 // Fire and forget: a usage timestamp is never a reason to fail a request, and awaiting it
                 // would put a database write on the critical path of every authenticated call.
                 void tokens.save({ ...record, lastUsedAt: new Date() })
-                    .catch((e) => console.error('auth-token: lastUsedAt', e));
+                    .catch((e) => { log.warn('Access token lastUsedAt not saved', { tokenId: record.id, error: e }); });
             }
             return true;
         },

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACL,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAC5F,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EACzE,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG3C,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAyB,EAAE,IAA4B,EAAU,EAAE,CAC1F,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAuB,CAAC,SAAS,EAAE,MAAM,IAAI,yBAAyB,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAK,GAAW,gBAAgB,EAAE,IAAI,GAA0B,EAAE,EACpD,EAAE;IAChB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAA;IAErE,MAAM,OAAO,GAAG,CAAC,GAA6B,EAAE,MAAc,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACnE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;QAEvF,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC,CAAA;IAED,MAAM,OAAO,GAAiB,aAAa,CAAe,KAAK,EAAE;QAC/D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAA;YAC7B,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,uEAAuE;YACvE,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,OAAO,KAAK,CAAA;YACd,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAA;QACtD,CAAC;QAED,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAExC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAsB,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAA;YAC/F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtE,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YACrC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAC/C,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,KAAU,CAAA;YAE1F,4FAA4F;YAC5F,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAC/B,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAC3C,CAAA;YACD,IAAI,OAAO,GAA2B,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAU,CAAA;YACnB,CAAC;YACD,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YACtC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,KAAU,CAAA;YAE5F,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;YAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAClC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAElE,0FAA0F;YAC1F,2FAA2F;YAC3F,4BAA4B;YAC5B,IAAI,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAA;YAChC,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;gBACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACnD,IAAI,MAAM,IAAI,IAAI;oBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YAC9C,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,uFAAuF;gBACvF,0CAA0C;gBAC1C,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,IAAI,EAAE,iBAAiB,CAAC,SAAS;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU;gBACV,MAAM;gBACN,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC,CAAA;YAEV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;YAClF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC;gBACtC,0FAA0F;gBAC1F,+EAA+E;gBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACpD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAA;YACtE,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,mFAAmF;QACnF,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EACL,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAC5F,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EACzE,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEnD,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAyB,EAAE,IAA4B,EAAU,EAAE,CAC1F,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAuB,CAAC,SAAS,EAAE,MAAM,IAAI,yBAAyB,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAA;AAEvC;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,MAA2C,EAAS,EAAE;IACpF,IAAI,WAAW,CAAC,cAAc,MAAM,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;SACxD,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAK,GAAW,gBAAgB,EAAE,IAAI,GAA0B,EAAE,EACpD,EAAE;IAChB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAA;IAErE,MAAM,OAAO,GAAG,CAAC,GAA6B,EAAE,MAAc,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA;QACnE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,IAAI,CAAA;QAEvF,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC,CAAA;IAED,MAAM,OAAO,GAAiB,aAAa,CAAe,KAAK,EAAE;QAC/D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,IAAI,GAAG,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAA;YAC7B,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,uEAAuE;YACvE,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1F,OAAO,KAAK,CAAA;YACd,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAA;QACtD,CAAC;QAED,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAqC,CAAA;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACtC,IAAI,SAAS,IAAI,IAAI;gBAAE,OAAO,KAAU,CAAA;YAExC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAsB,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAA;YAC/F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtE,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,SAAS,CAAM,CAAA;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,MAAM,CAAM,CAAA;YACnE,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,MAAM,CAAM,CAAA;YAC9G,2FAA2F;YAC3F,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAA;YACjG,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;mBACpD,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;mBACzC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,MAAM,CAAC,UAAU,EAAE,MAAM,CAAM,CAAA;YACxC,CAAC;YAED,4FAA4F;YAC5F,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAC/B,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAC3C,CAAA;YACD,IAAI,OAAO,GAA2B,IAAI,CAAA;YAC1C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAM,CAAA;YAClD,CAAC;YACD,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,SAAS,EAAE,MAAM,CAAM,CAAA;YAC1D,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;gBAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAM,CAAA;YAExH,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;YAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAClC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAElE,0FAA0F;YAC1F,2FAA2F;YAC3F,4BAA4B;YAC5B,IAAI,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAA;YAChC,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAA;gBACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACnD,IAAI,MAAM,IAAI,IAAI;oBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;YAC9C,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,uFAAuF;gBACvF,0CAA0C;gBAC1C,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,IAAI,EAAE,iBAAiB,CAAC,SAAS;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU;gBACV,MAAM;gBACN,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC,CAAA;YAEV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAA;YAClF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC;gBACtC,0FAA0F;gBAC1F,+EAA+E;gBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBACpD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC/G,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,mFAAmF;QACnF,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/handlers/index.d.ts

@@ -1,8 +1,51 @@
-import type { AccessTokenList, IssuedAccessToken } from '@owlmeans/auth-token';
+import { AuthRole } from '@owlmeans/auth';
+import type { AccessTokenList, CreateAccessToken, IssuedAccessToken } from '@owlmeans/auth-token';
+import type { AuthTokenContext } from '../types.js';
 import type { AuthTokenEntrypoints } from '@owlmeans/auth-token';
+/**
+ * A token may never mint another token.
+ *
+ * Minting is the one operation that turns a stolen credential into a permanent one: a token that
+ * can create tokens survives the revocation of the token that leaked. Creating and revoking
+ * therefore require a credential a person produced in a browser — which is also why the deployment
+ * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
+ * a check every future handler has to remember.
+ *
+ * Exported because an OAuth authorization server's consent-approval handler
+ * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
+ * verified itself rather than a route this package bound.
+ */
+export declare const refuseTokenAuth: (req: {
+    auth?: {
+        type?: string;
+    };
+}, what: string) => void;
+/** Whoever is minting the token — read once, by whichever caller resolved the session. */
+export interface IssueAccessTokenSubject {
+    entityId: string;
+    userId: string;
+    profileId: string;
+    role: AuthRole;
+    /** The subject's OWN scopes — minting can only narrow, never widen, this set. */
+    scopes: string[];
+}
+export interface IssueAccessTokenRequest extends CreateAccessToken {
+    /**
+     * The resource(s) this token is FOR (RFC 8707), when it is minted through an OAuth grant.
+     * Absent for a token minted by hand — the ordinary, unrestricted kind.
+     */
+    audience?: string[];
+}
+/**
+ * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
+ * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
+ * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
+ * TTL clamp silently drifting from this one.
+ */
+export declare const issueAccessToken: (ctx: AuthTokenContext, subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest) => Promise<IssuedAccessToken>;
 export declare const listAccessTokens: (protocol: AuthTokenEntrypoints['list']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, AccessTokenList>>;
 export declare const createAccessToken: (protocol: AuthTokenEntrypoints['create']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
-    body: import("@owlmeans/auth-token").CreateAccessToken;
+    body: CreateAccessToken;
 }, IssuedAccessToken>>;
 export declare const revokeAccessToken: (protocol: AuthTokenEntrypoints['revoke']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
     params: import("@owlmeans/auth-token").AccessTokenParams;

package/build/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EAAsC,iBAAiB,EACvE,MAAM,sBAAsB,CAAA;AAM7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AA0BhE,eAAO,MAAM,gBAAgB,aAAc,oBAAoB,CAAC,MAAM,CAAC,iLAarE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;sBAsCxE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;;;GAqBxE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAIvF,OAAO,KAAK,EACV,eAAe,EAAsC,iBAAiB,EAAE,iBAAiB,EAC1F,MAAM,sBAAsB,CAAA;AAK7B,OAAO,KAAK,EAAuB,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAWhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,QAAS;IAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,QAAQ,MAAM,KAAG,IAIjF,CAAA;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;IACd,iFAAiF;IACjF,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QACtB,gBAAgB,WAAW,uBAAuB,WAAW,uBAAuB,KACxF,OAAO,CAAC,iBAAiB,CA+B3B,CAAA;AAED,eAAO,MAAM,gBAAgB,aAAc,oBAAoB,CAAC,MAAM,CAAC,iLAarE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;sBAYxE,CAAA;AAEF,eAAO,MAAM,iBAAiB,aAAc,oBAAoB,CAAC,QAAQ,CAAC;;;;GAqBxE,CAAA"}

package/build/handlers/index.js

@@ -17,34 +17,24 @@ const tokens = (ctx) => ctx.resource(AUTH_TOKEN_RESOURCE);
  * therefore require a credential a person produced in a browser — which is also why the deployment
  * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
  * a check every future handler has to remember.
+ *
+ * Exported because an OAuth authorization server's consent-approval handler
+ * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
+ * verified itself rather than a route this package bound.
  */
-const refuseTokenAuth = (req, what) => {
+export const refuseTokenAuth = (req, what) => {
     if (req.auth?.type === AuthroizationType.AuthToken) {
         throw new AuthForbidden(what);
     }
 };
-export const listAccessTokens = (protocol) => handlers().request(protocol, async (req, context) => {
-    const ctx = context;
-    const entityId = requireEntityKey(req);
-    const profileId = req.auth?.profileId;
-    if (profileId == null)
-        throw new AuthForbidden('profile');
-    const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 });
-    return {
-        items: result.items
-            .map(view)
-            .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
-    };
-});
-export const createAccessToken = (protocol) => handlers().body(protocol, async (payload, context, req) => {
-    const ctx = context;
-    refuseTokenAuth(req, 'token-mint');
-    const entityId = requireEntityKey(req);
-    const profileId = req.auth?.profileId;
-    const userId = req.auth?.userId;
-    if (profileId == null || userId == null)
-        throw new AuthForbidden('profile');
-    const own = req.auth?.scopes ?? [];
+/**
+ * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
+ * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
+ * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
+ * TTL clamp silently drifting from this one.
+ */
+export const issueAccessToken = async (ctx, subject, payload) => {
+    const own = subject.scopes;
     const scopes = payload.scopes ?? own;
     // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
     // hold is refused rather than silently dropped: a token that quietly grants less than it was
@@ -59,18 +49,44 @@ export const createAccessToken = (protocol) => handlers().body(protocol, async (
         hash: minted.hash,
         display: minted.display,
         name: payload.name,
-        userId,
-        profileId,
-        entityId,
+        userId: subject.userId,
+        profileId: subject.profileId,
+        entityId: subject.entityId,
         scopes,
-        role: req.auth?.role ?? AuthRole.User,
+        role: subject.role,
         createdAt: now,
+        ...(payload.audience != null ? { audience: payload.audience } : {}),
         ...(payload.expiresIn != null
             ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
             : {}),
     });
     // The only moment the plaintext exists outside the caller's own machine.
     return { token: minted.token, record: view(record) };
+};
+export const listAccessTokens = (protocol) => handlers().request(protocol, async (req, context) => {
+    const ctx = context;
+    const entityId = requireEntityKey(req);
+    const profileId = req.auth?.profileId;
+    if (profileId == null)
+        throw new AuthForbidden('profile');
+    const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 });
+    return {
+        items: result.items
+            .map(view)
+            .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
+    };
+});
+export const createAccessToken = (protocol) => handlers().body(protocol, async (payload, context, req) => {
+    const ctx = context;
+    refuseTokenAuth(req, 'token-mint');
+    const entityId = requireEntityKey(req);
+    const profileId = req.auth?.profileId;
+    const userId = req.auth?.userId;
+    if (profileId == null || userId == null)
+        throw new AuthForbidden('profile');
+    return issueAccessToken(ctx, {
+        entityId, profileId, userId, role: req.auth?.role ?? AuthRole.User, scopes: req.auth?.scopes ?? [],
+    }, payload);
 });
 export const revokeAccessToken = (protocol) => handlers().params(protocol, async (payload, context, req) => {
     const ctx = context;

package/build/handlers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,kBAAkB,EAAE,mBAAmB,EACxC,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAItC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAEhC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IAChF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAsC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAChJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,8FAA8F;IAC9F,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;YACjG,CAAC,CAAC,EAAE,CAAC;KACa,CAAC,CAAA;IAEvB,yEAAyE;IACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;AAClF,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC3J,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,kBAAkB,EAAE,mBAAmB,EACxC,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAItC,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IAEhC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;AAExD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IACvF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AAoBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,GAAqB,EAAE,OAAgC,EAAE,OAAgC,EAC7D,EAAE;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,8FAA8F;IAC9F,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;YACjG,CAAC,CAAC,EAAE,CAAC;KACa,CAAC,CAAA;IAEvB,yEAAyE;IACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAsC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAChJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3E,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACzJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAA;IAC/B,IAAI,SAAS,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAE3E,OAAO,gBAAgB,CAAC,GAAG,EAAE;QAC3B,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE;KACnG,EAAE,OAAO,CAAC,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAwC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IAC3J,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}

package/build/types.d.ts

@@ -26,6 +26,21 @@ export interface AuthTokenGuardOptions {
     resourceAlias?: string;
     /** Resource alias holding the identity profiles a token is bound to. */
     profileAlias?: string;
+    /**
+     * The resource(s) this guard speaks for, opting it into audience admission.
+     *
+     * Left unset (the default), the guard admits every token whatever its `audience` — full
+     * backward compatibility for a deployment that never mints an audience-restricted token. Set
+     * it to the canonical resource URI(s) this route surface serves, and a token issued FOR a
+     * different resource (an OAuth-issued, MCP-only token, say) is refused here rather than
+     * quietly working everywhere the profile's scopes would otherwise reach.
+     *
+     * A function is resolved with the live context on every request rather than once at
+     * registration time — `appendAuthTokenGuard` runs from `makeContext`, before a hostname a
+     * Kubernetes secret mount populates is necessarily readable yet, and this guard's `handle`
+     * already runs per-request regardless.
+     */
+    resources?: string[] | ((context: AuthTokenContext) => string[]);
 }
 export interface AuthTokenConfig extends ServerConfig {
     authToken?: {

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,EAAE,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.3",
+  "version": "0.1.18-rc.30",
   "license": "MIT",
   "description": "The server half of OwlMeans access tokens — the store, the guard that verifies a presented token, the management handlers and the coguard that admits one on an existing route.",
   "type": "module",
@@ -24,16 +24,17 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.12",
-    "@owlmeans/auth-common": "^0.1.18-rc.16",
-    "@owlmeans/auth-token": "^0.1.18-rc.3",
-    "@owlmeans/context": "^0.1.18-rc.11",
-    "@owlmeans/entrypoint": "^0.1.18-rc.14",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.15",
-    "@owlmeans/resource": "^0.1.18-rc.12",
-    "@owlmeans/server-api": "^0.1.18-rc.20",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.16",
-    "@owlmeans/server-context": "^0.1.18-rc.15",
+    "@owlmeans/auth": "^0.1.18-rc.38",
+    "@owlmeans/auth-common": "^0.1.18-rc.45",
+    "@owlmeans/auth-token": "^0.1.18-rc.30",
+    "@owlmeans/context": "^0.1.18-rc.32",
+    "@owlmeans/entrypoint": "^0.1.18-rc.39",
+    "@owlmeans/log": "^0.1.18-rc.0",
+    "@owlmeans/mongo-resource": "^0.1.18-rc.41",
+    "@owlmeans/resource": "^0.1.18-rc.38",
+    "@owlmeans/server-api": "^0.1.18-rc.49",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.45",
+    "@owlmeans/server-context": "^0.1.18-rc.41",
     "@scure/base": "^1.1.9"
   },
   "devDependencies": {

package/src/coguard.ts

@@ -1,6 +1,6 @@
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
-import { decorateEntrypoint } from '@owlmeans/entrypoint'
-import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
+import { decorateEntrypoint, mapProtocols } from '@owlmeans/entrypoint'
+import type { EntrypointTree } from '@owlmeans/entrypoint'
 
 /**
  * Let an access token authenticate every route that already has a guard.
@@ -14,9 +14,9 @@ import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export const withAuthTokenCoguard = <Protocol extends EntrypointProtocolDeclaration>(
-  declarations: readonly Protocol[], guard: string = GUARD_AUTH_TOKEN,
-): Protocol[] => declarations.map(declaration => {
+export const withAuthTokenCoguard = <Tree extends EntrypointTree>(
+  tree: Tree, guard: string = GUARD_AUTH_TOKEN,
+): Tree => mapProtocols(tree, declaration => {
   if (declaration.guards.length < 1 || declaration.guards.includes(guard)) return declaration
 
   return decorateEntrypoint(declaration, { guards: [...declaration.guards, guard] })

package/src/guard.ts

@@ -13,6 +13,7 @@ import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
 import type { IdentityProfile, IdentityProfileResource } from '@owlmeans/server-auth-identity'
 import { hashAccessToken } from './hash.js'
 import type { AccessTokenResource, AuthTokenConfig, AuthTokenContext, AuthTokenGuardOptions } from './types.js'
+import { logger, logThrottle } from '@owlmeans/log'
 
 /** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
 export const prefixOf = (context: AuthTokenContext, opts?: AuthTokenGuardOptions): string =>
@@ -36,6 +37,21 @@ export const prefixOf = (context: AuthTokenContext, opts?: AuthTokenGuardOptions
  * - it intersects the token's scopes with its profile's on every request, so a token can never
  *   outlive or outrank the person who minted it.
  */
+const log = logger('server-auth-token')
+
+/**
+ * A presented access token the guard did not accept. Never the token, not even its display form:
+ * its record id only. Once a minute per token and reason — a client retrying a revoked token calls every second.
+ */
+const refuse = (reason: string, record?: { id?: string, entityId?: string }): false => {
+  if (logThrottle(`auth-token:${reason}:${record?.id ?? ''}`, 60_000)) {
+    log.warn('Access token refused', {
+      reason, tokenId: record?.id, entityId: record?.entityId,
+    }, { event: 'auth.refused' })
+  }
+  return false
+}
+
 export const makeAuthTokenGuard = (
   alias: string = GUARD_AUTH_TOKEN, opts: AuthTokenGuardOptions = {}
 ): GuardService => {
@@ -72,9 +88,19 @@ export const makeAuthTokenGuard = (
 
       const tokens = context.resource<AccessTokenResource>(opts.resourceAlias ?? AUTH_TOKEN_RESOURCE)
       const record = await tokens.load({ hash: hashAccessToken(presented) })
-      if (record == null) return false as T
-      if (record.revokedAt != null) return false as T
-      if (record.expiresAt != null && new Date(record.expiresAt) < new Date()) return false as T
+      if (record == null) return refuse('unknown') as T
+      if (record.revokedAt != null) return refuse('revoked', record) as T
+      if (record.expiresAt != null && new Date(record.expiresAt) < new Date()) return refuse('expired', record) as T
+      // A token minted through an OAuth grant carries the resource(s) it was issued FOR. A token
+      // with no audience is the ordinary hand-minted kind and is admitted everywhere its scopes
+      // reach, exactly as before this check existed — the guard has to OPT IN with `resources` to
+      // narrow anything, so a deployment that never touches this option sees no change at all.
+      const resources = typeof opts.resources === 'function' ? opts.resources(context) : opts.resources
+      if (record.audience != null && record.audience.length > 0
+        && resources != null && resources.length > 0
+        && !record.audience.some(resource => resources.includes(resource))) {
+        return refuse('audience', record) as T
+      }
 
       // A token is only ever as good as the profile behind it. Reading the profile per request is
       // what makes revoking a person's access revoke every token they ever minted, without any
@@ -86,10 +112,10 @@ export const makeAuthTokenGuard = (
       try {
         profile = await profiles.load({ entityId: record.entityId, profileId: record.profileId })
       } catch {
-        return false as T
+        return refuse('profile-unreadable', record) as T
       }
-      if (profile == null) return false as T
-      if (profile.expiresAt != null && new Date(profile.expiresAt) < new Date()) return false as T
+      if (profile == null) return refuse('profile', record) as T
+      if (profile.expiresAt != null && new Date(profile.expiresAt) < new Date()) return refuse('profile-expired', record) as T
 
       const profileScopes = profile.scopes ?? []
       const scopes = profileScopes.includes(ALL_SCOPES)
@@ -129,7 +155,7 @@ export const makeAuthTokenGuard = (
         // Fire and forget: a usage timestamp is never a reason to fail a request, and awaiting it
         // would put a database write on the critical path of every authenticated call.
         void tokens.save({ ...record, lastUsedAt: new Date() })
-          .catch((e: unknown) => console.error('auth-token: lastUsedAt', e))
+          .catch((e: unknown) => { log.warn('Access token lastUsedAt not saved', { tokenId: record.id, error: e }) })
       }
 
       return true as T

package/src/handlers/index.ts

@@ -3,7 +3,7 @@ import {
   AUTH_TOKEN_MAX_TTL, AUTH_TOKEN_RESOURCE
 } from '@owlmeans/auth-token'
 import type {
-  AccessTokenList, AccessTokenRecord, AccessTokenView, IssuedAccessToken
+  AccessTokenList, AccessTokenRecord, AccessTokenView, CreateAccessToken, IssuedAccessToken
 } from '@owlmeans/auth-token'
 import { requireEntityKey } from '@owlmeans/auth-common'
 import { handlers } from '@owlmeans/server-api'
@@ -29,38 +29,45 @@ const tokens = (ctx: AuthTokenContext): AccessTokenResource =>
  * therefore require a credential a person produced in a browser — which is also why the deployment
  * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
  * a check every future handler has to remember.
+ *
+ * Exported because an OAuth authorization server's consent-approval handler
+ * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
+ * verified itself rather than a route this package bound.
  */
-const refuseTokenAuth = (req: { auth?: { type?: string } }, what: string): void => {
+export const refuseTokenAuth = (req: { auth?: { type?: string } }, what: string): void => {
   if (req.auth?.type === AuthroizationType.AuthToken) {
     throw new AuthForbidden(what)
   }
 }
 
-export const listAccessTokens = (protocol: AuthTokenEntrypoints['list']) => handlers<AuthTokenContext>().request(protocol, async (req, context) => {
-  const ctx = context as AuthTokenContext
-  const entityId = requireEntityKey(req)
-  const profileId = req.auth?.profileId
-  if (profileId == null) throw new AuthForbidden('profile')
-
-  const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 })
-
-  return {
-    items: result.items
-      .map(view)
-      .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
-  } satisfies AccessTokenList
-})
-
-export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => handlers<AuthTokenContext>().body(protocol, async (payload, context, req) => {
-  const ctx = context as AuthTokenContext
-  refuseTokenAuth(req, 'token-mint')
+/** Whoever is minting the token — read once, by whichever caller resolved the session. */
+export interface IssueAccessTokenSubject {
+  entityId: string
+  userId: string
+  profileId: string
+  role: AuthRole
+  /** The subject's OWN scopes — minting can only narrow, never widen, this set. */
+  scopes: string[]
+}
 
-  const entityId = requireEntityKey(req)
-  const profileId = req.auth?.profileId
-  const userId = req.auth?.userId
-  if (profileId == null || userId == null) throw new AuthForbidden('profile')
+export interface IssueAccessTokenRequest extends CreateAccessToken {
+  /**
+   * The resource(s) this token is FOR (RFC 8707), when it is minted through an OAuth grant.
+   * Absent for a token minted by hand — the ordinary, unrestricted kind.
+   */
+  audience?: string[]
+}
 
-  const own = req.auth?.scopes ?? []
+/**
+ * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
+ * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
+ * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
+ * TTL clamp silently drifting from this one.
+ */
+export const issueAccessToken = async (
+  ctx: AuthTokenContext, subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest
+): Promise<IssuedAccessToken> => {
+  const own = subject.scopes
   const scopes = payload.scopes ?? own
   // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
   // hold is refused rather than silently dropped: a token that quietly grants less than it was
@@ -76,12 +83,13 @@ export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => h
     hash: minted.hash,
     display: minted.display,
     name: payload.name,
-    userId,
-    profileId,
-    entityId,
+    userId: subject.userId,
+    profileId: subject.profileId,
+    entityId: subject.entityId,
     scopes,
-    role: req.auth?.role ?? AuthRole.User,
+    role: subject.role,
     createdAt: now,
+    ...(payload.audience != null ? { audience: payload.audience } : {}),
     ...(payload.expiresIn != null
       ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
       : {}),
@@ -89,6 +97,35 @@ export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => h
 
   // The only moment the plaintext exists outside the caller's own machine.
   return { token: minted.token, record: view(record) } satisfies IssuedAccessToken
+}
+
+export const listAccessTokens = (protocol: AuthTokenEntrypoints['list']) => handlers<AuthTokenContext>().request(protocol, async (req, context) => {
+  const ctx = context as AuthTokenContext
+  const entityId = requireEntityKey(req)
+  const profileId = req.auth?.profileId
+  if (profileId == null) throw new AuthForbidden('profile')
+
+  const result = await tokens(ctx).list({ entityId, profileId }, { size: 0 })
+
+  return {
+    items: result.items
+      .map(view)
+      .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
+  } satisfies AccessTokenList
+})
+
+export const createAccessToken = (protocol: AuthTokenEntrypoints['create']) => handlers<AuthTokenContext>().body(protocol, async (payload, context, req) => {
+  const ctx = context as AuthTokenContext
+  refuseTokenAuth(req, 'token-mint')
+
+  const entityId = requireEntityKey(req)
+  const profileId = req.auth?.profileId
+  const userId = req.auth?.userId
+  if (profileId == null || userId == null) throw new AuthForbidden('profile')
+
+  return issueAccessToken(ctx, {
+    entityId, profileId, userId, role: req.auth?.role ?? AuthRole.User, scopes: req.auth?.scopes ?? [],
+  }, payload)
 })
 
 export const revokeAccessToken = (protocol: AuthTokenEntrypoints['revoke']) => handlers<AuthTokenContext>().params(protocol, async (payload, context, req) => {

package/src/types.ts

@@ -28,6 +28,21 @@ export interface AuthTokenGuardOptions {
   resourceAlias?: string
   /** Resource alias holding the identity profiles a token is bound to. */
   profileAlias?: string
+  /**
+   * The resource(s) this guard speaks for, opting it into audience admission.
+   *
+   * Left unset (the default), the guard admits every token whatever its `audience` — full
+   * backward compatibility for a deployment that never mints an audience-restricted token. Set
+   * it to the canonical resource URI(s) this route surface serves, and a token issued FOR a
+   * different resource (an OAuth-issued, MCP-only token, say) is refused here rather than
+   * quietly working everywhere the profile's scopes would otherwise reach.
+   *
+   * A function is resolved with the live context on every request rather than once at
+   * registration time — `appendAuthTokenGuard` runs from `makeContext`, before a hostname a
+   * Kubernetes secret mount populates is necessarily readable yet, and this guard's `handle`
+   * already runs per-request regardless.
+   */
+  resources?: string[] | ((context: AuthTokenContext) => string[])
 }
 
 export interface AuthTokenConfig extends ServerConfig {

package/tests/coguard.spec.ts

@@ -1,13 +1,13 @@
 import { describe, expect, test } from 'bun:test'
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
-import { openProtocol } from '@owlmeans/entrypoint'
+import { openProtocol, protocols } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { withAuthTokenCoguard } from '../src/coguard.js'
 
 describe('@owlmeans/server-auth-token — the coguard', () => {
   test('decorates a guarded protocol and leaves the primary guard first', () => {
     const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
-    const [decorated] = withAuthTokenCoguard([guarded])
+    const [decorated] = protocols(withAuthTokenCoguard({ guarded }))
 
     expect(decorated.guards).toEqual(['auth', GUARD_AUTH_TOKEN])
     expect(guarded.guards).toEqual(['auth'])
@@ -15,20 +15,20 @@ describe('@owlmeans/server-auth-token — the coguard', () => {
 
   test('leaves an unguarded protocol unchanged', () => {
     const open = openProtocol(route('open', '/open'))
-    expect(withAuthTokenCoguard([open])[0]).toBe(open)
+    expect(protocols(withAuthTokenCoguard({ open }))[0]).toBe(open)
   })
 
   test('is idempotent', () => {
     const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
-    const [once] = withAuthTokenCoguard([guarded])
-    const [twice] = withAuthTokenCoguard([once])
+    const [once] = protocols(withAuthTokenCoguard({ guarded }))
+    const [twice] = protocols(withAuthTokenCoguard({ once }))
 
     expect(twice.guards).toEqual(['auth', GUARD_AUTH_TOKEN])
   })
 
   test('honours a custom guard alias', () => {
     const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
-    expect(withAuthTokenCoguard([guarded], 'other-guard')[0].guards)
+    expect(protocols(withAuthTokenCoguard({ guarded }, 'other-guard'))[0].guards)
       .toEqual(['auth', 'other-guard'])
   })
 })

package/tests/guard.spec.ts

@@ -116,6 +116,50 @@ describe('@owlmeans/server-auth-token — what the guard resolves', () => {
   })
 })
 
+describe('@owlmeans/server-auth-token — audience admission', () => {
+  test('a token with no audience is admitted by a guard that opted into resource checking', async () => {
+    const { guard } = await armed({ resources: ['https://api.example.com'] })
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('a token scoped to a resource is refused by a guard for a different one', async () => {
+    const context = await makeTestContext({ resources: ['https://api.example.com'] })
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
+  })
+
+  test('a token scoped to a resource is admitted by a guard configured for it', async () => {
+    const context = await makeTestContext({ resources: ['https://api.example.com/mcp', 'https://api.example.com'] })
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('a guard that never opted in ignores audience entirely — full backward compatibility', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com/mcp'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('a function `resources` option is resolved with the live context, not cached from registration', async () => {
+    const context = await makeTestContext({ resources: () => ['https://api.example.com'] })
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken(TOKEN), { audience: ['https://api.example.com'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+})
+
 describe('@owlmeans/server-auth-token — the hash at rest', () => {
   test('the stored value is not the token', () => {
     const hash = hashAccessToken(TOKEN)

package/tests/handlers.spec.ts

@@ -8,6 +8,7 @@ import {
   revokeAccessToken as bindRevokeAccessToken,
 } from '../src/handlers/index.js'
 import { hashAccessToken } from '../src/hash.js'
+import { issueAccessToken } from '../src/handlers/index.js'
 import { makeTestContext, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE, TEST_USER } from './context.js'
 
 /**
@@ -104,6 +105,30 @@ describe('@owlmeans/server-auth-token — minting', () => {
   })
 })
 
+describe('@owlmeans/server-auth-token — issueAccessToken (the OAuth server\'s entry point)', () => {
+  test('stores the audience it was given, and omits the field when there is none', async () => {
+    const context = await makeTestContext()
+    const subject = { entityId: TEST_ENTITY, profileId: TEST_PROFILE, userId: TEST_USER, role: AuthRole.User, scopes: ['*'] }
+
+    const withAudience = await issueAccessToken(context, subject, { name: 'mcp', audience: ['https://api.example.com/mcp'] })
+    expect(withAudience.record.audience).toEqual(['https://api.example.com/mcp'])
+
+    const withoutAudience = await issueAccessToken(context, subject, { name: 'hand-minted' })
+    expect(withoutAudience.record.audience).toBeUndefined()
+  })
+
+  test('still narrows scopes and clamps the TTL the same way the HTTP handler does', async () => {
+    const context = await makeTestContext()
+    const subject = { entityId: TEST_ENTITY, profileId: TEST_PROFILE, userId: TEST_USER, role: AuthRole.User, scopes: ['projects:read'] }
+
+    await expect(issueAccessToken(context, subject, { name: 'x', scopes: ['projects:write'] })).rejects.toThrow()
+
+    const issued = await issueAccessToken(context, subject, { name: 'x', expiresIn: 60 * 60 * 24 * 400 })
+    const ttlMs = new Date(issued.record.expiresAt!).getTime() - Date.now()
+    expect(ttlMs).toBeLessThanOrEqual(366 * 24 * 60 * 60 * 1000)
+  })
+})
+
 describe('@owlmeans/server-auth-token — listing and revoking', () => {
   test('a list shows the caller\'s own tokens and never a hash', async () => {
     const context = await makeTestContext()