@owlmeans/server-auth-token 0.1.18-rc.4 → 0.1.18-rc.6

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.16
+npx @owlmeans/agent-skills@^0.1.18-rc.18
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.4",
-  "generatedAt": "2026-09-12T12:32:46.383Z",
+  "version": "0.1.18-rc.6",
+  "generatedAt": "2026-09-12T13:35:38.922Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth-token/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth-token
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.4"` in `dependencies`
+**Install:** `"@owlmeans/server-auth-token": "^0.1.18-rc.6"` in `dependencies`
 **Contracts:** `@owlmeans/auth-token` — the record, the routes, the format helpers
 
 ## Key Exports
@@ -21,7 +21,7 @@ user-invocable: false
 | `makeAccessTokenResource(dbAlias?)` | The Mongo resource, with its three indexes |
 | `prefixOf(context, opts?)` | The deployment's prefix: guard options → config → default |
 | `hashAccessToken(token)` · `mintAccessToken(prefix)` | The stored form; one minted `{ token, hash, display }` |
-| `setupAuthTokenCoguard(entrypoints, guard?)` | Append the guard to every entrypoint that already has one |
+| `withAuthTokenCoguard(protocolTree, guard?)` | Return the same-shaped immutable tree with the guard appended to every already-guarded protocol |
 | `listAccessTokens` · `createAccessToken` · `revokeAccessToken` | The three handlers |
 | `AuthTokenGuardOptions` (`prefix`, `denyAliases`, `touchInterval`, `resourceAlias`, `profileAlias`) · `AuthTokenConfig` · `AccessTokenResource` | Types |
 
@@ -99,7 +99,7 @@ tokens that are not theirs.
 ## The coguard admits a token everywhere, and the deny list lives in the GUARD
 
 ```typescript
-setupAuthTokenCoguard(managerEntrypoints as Array<{ guards?: string[] }>)
+const guardedManagerProtocols = withAuthTokenCoguard(managerProtocols)
 ```
 
 An API client drives the same surface a browser does — projects, stories, files — so admitting the
@@ -108,8 +108,8 @@ never substitutes: the primary guard stays first and still claims its own creden
 matches only a value carrying the prefix. It skips entrypoints that have no guard, and it is
 idempotent.
 
-**Run it after the final binding**, because it reads the guard list each entrypoint actually ended
-up with.
+Decorate the declaration tree before bindings are created. The helper preserves the input tree's
+shape, leaves unguarded protocols unchanged, and is idempotent.
 
 Routes that must stay behind an interactive session — opening a checkout, starting an OAuth flow,
 minting another token — are named in `AuthTokenGuardOptions.denyAliases` rather than skipped here.

package/build/coguard.d.ts

@@ -1,4 +1,4 @@
-import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint';
+import type { EntrypointTree } from '@owlmeans/entrypoint';
 /**
  * Let an access token authenticate every route that already has a guard.
  *
@@ -11,5 +11,5 @@ import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint';
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export declare const withAuthTokenCoguard: <Protocol extends EntrypointProtocolDeclaration>(declarations: readonly Protocol[], guard?: string) => Protocol[];
+export declare const withAuthTokenCoguard: <Tree extends EntrypointTree>(tree: Tree, guard?: string) => Tree;
 //# sourceMappingURL=coguard.d.ts.map

package/build/coguard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,SAAS,6BAA6B,gBACnE,SAAS,QAAQ,EAAE,UAAS,MAAM,KAC/C,QAAQ,EAIT,CAAA"}
+{"version":3,"file":"coguard.d.ts","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAAI,IAAI,SAAS,cAAc,QACxD,IAAI,UAAS,MAAM,KACxB,IAID,CAAA"}

package/build/coguard.js

@@ -1,5 +1,5 @@
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token';
-import { decorateEntrypoint } from '@owlmeans/entrypoint';
+import { decorateEntrypoint, mapProtocols } from '@owlmeans/entrypoint';
 /**
  * Let an access token authenticate every route that already has a guard.
  *
@@ -12,7 +12,7 @@ import { decorateEntrypoint } from '@owlmeans/entrypoint';
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export const withAuthTokenCoguard = (declarations, guard = GUARD_AUTH_TOKEN) => declarations.map(declaration => {
+export const withAuthTokenCoguard = (tree, guard = GUARD_AUTH_TOKEN) => mapProtocols(tree, declaration => {
     if (declaration.guards.length < 1 || declaration.guards.includes(guard))
         return declaration;
     return decorateEntrypoint(declaration, { guards: [...declaration.guards, guard] });

package/build/coguard.js.map

@@ -1 +1 @@
-{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,YAAiC,EAAE,KAAK,GAAW,gBAAgB,EACvD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;IAC9C,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAE3F,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA"}
+{"version":3,"file":"coguard.js","sourceRoot":"","sources":["../src/coguard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGvE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAU,EAAE,KAAK,GAAW,gBAAgB,EACtC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;IAC1C,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAA;IAE3F,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.4",
+  "version": "0.1.18-rc.6",
   "license": "MIT",
   "description": "The server half of OwlMeans access tokens — the store, the guard that verifies a presented token, the management handlers and the coguard that admits one on an existing route.",
   "type": "module",
@@ -24,16 +24,16 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.13",
-    "@owlmeans/auth-common": "^0.1.18-rc.17",
-    "@owlmeans/auth-token": "^0.1.18-rc.4",
-    "@owlmeans/context": "^0.1.18-rc.12",
-    "@owlmeans/entrypoint": "^0.1.18-rc.15",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.16",
-    "@owlmeans/resource": "^0.1.18-rc.13",
-    "@owlmeans/server-api": "^0.1.18-rc.21",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.17",
-    "@owlmeans/server-context": "^0.1.18-rc.16",
+    "@owlmeans/auth": "^0.1.18-rc.15",
+    "@owlmeans/auth-common": "^0.1.18-rc.19",
+    "@owlmeans/auth-token": "^0.1.18-rc.6",
+    "@owlmeans/context": "^0.1.18-rc.14",
+    "@owlmeans/entrypoint": "^0.1.18-rc.17",
+    "@owlmeans/mongo-resource": "^0.1.18-rc.18",
+    "@owlmeans/resource": "^0.1.18-rc.15",
+    "@owlmeans/server-api": "^0.1.18-rc.23",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.19",
+    "@owlmeans/server-context": "^0.1.18-rc.18",
     "@scure/base": "^1.1.9"
   },
   "devDependencies": {

package/src/coguard.ts

@@ -1,6 +1,6 @@
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
-import { decorateEntrypoint } from '@owlmeans/entrypoint'
-import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
+import { decorateEntrypoint, mapProtocols } from '@owlmeans/entrypoint'
+import type { EntrypointTree } from '@owlmeans/entrypoint'
 
 /**
  * Let an access token authenticate every route that already has a guard.
@@ -14,9 +14,9 @@ import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
  * than skipped here — a child entrypoint inherits every guard its ancestors declare and cannot
  * drop one, so the refusal has to live where the credential is inspected.
  */
-export const withAuthTokenCoguard = <Protocol extends EntrypointProtocolDeclaration>(
-  declarations: readonly Protocol[], guard: string = GUARD_AUTH_TOKEN,
-): Protocol[] => declarations.map(declaration => {
+export const withAuthTokenCoguard = <Tree extends EntrypointTree>(
+  tree: Tree, guard: string = GUARD_AUTH_TOKEN,
+): Tree => mapProtocols(tree, declaration => {
   if (declaration.guards.length < 1 || declaration.guards.includes(guard)) return declaration
 
   return decorateEntrypoint(declaration, { guards: [...declaration.guards, guard] })

package/tests/coguard.spec.ts

@@ -1,13 +1,13 @@
 import { describe, expect, test } from 'bun:test'
 import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
-import { openProtocol } from '@owlmeans/entrypoint'
+import { openProtocol, protocols } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { withAuthTokenCoguard } from '../src/coguard.js'
 
 describe('@owlmeans/server-auth-token — the coguard', () => {
   test('decorates a guarded protocol and leaves the primary guard first', () => {
     const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
-    const [decorated] = withAuthTokenCoguard([guarded])
+    const [decorated] = protocols(withAuthTokenCoguard({ guarded }))
 
     expect(decorated.guards).toEqual(['auth', GUARD_AUTH_TOKEN])
     expect(guarded.guards).toEqual(['auth'])
@@ -15,20 +15,20 @@ describe('@owlmeans/server-auth-token — the coguard', () => {
 
   test('leaves an unguarded protocol unchanged', () => {
     const open = openProtocol(route('open', '/open'))
-    expect(withAuthTokenCoguard([open])[0]).toBe(open)
+    expect(protocols(withAuthTokenCoguard({ open }))[0]).toBe(open)
   })
 
   test('is idempotent', () => {
     const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
-    const [once] = withAuthTokenCoguard([guarded])
-    const [twice] = withAuthTokenCoguard([once])
+    const [once] = protocols(withAuthTokenCoguard({ guarded }))
+    const [twice] = protocols(withAuthTokenCoguard({ once }))
 
     expect(twice.guards).toEqual(['auth', GUARD_AUTH_TOKEN])
   })
 
   test('honours a custom guard alias', () => {
     const guarded = openProtocol(route('guarded', '/guarded'), { guards: 'auth' })
-    expect(withAuthTokenCoguard([guarded], 'other-guard')[0].guards)
+    expect(protocols(withAuthTokenCoguard({ guarded }, 'other-guard'))[0].guards)
       .toEqual(['auth', 'other-guard'])
   })
 })