@owlmeans/server-auth-token 0.1.18-rc.8 → 0.1.18

package/build/handlers/issue.d.ts

@@ -0,0 +1,6 @@
+import type { AuthTokenContext } from '../types.js';
+import type { AccessTokenIssuer } from './types.js';
+export declare const makeAccessTokenIssuer: (ctx: AuthTokenContext) => AccessTokenIssuer;
+/** The token issuer of a context — one per context. */
+export declare const accessTokenIssuerOf: (target: AuthTokenContext) => AccessTokenIssuer;
+//# sourceMappingURL=issue.d.ts.map

package/build/handlers/issue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../src/handlers/issue.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAoD,MAAM,YAAY,CAAA;AAGrG,eAAO,MAAM,qBAAqB,QAAS,gBAAgB,KAAG,iBAqC7D,CAAA;AAED,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,iDAA4C,CAAA"}

package/build/handlers/issue.js

@@ -0,0 +1,42 @@
+import { AuthForbidden, ALL_SCOPES } from '@owlmeans/auth';
+import { AUTH_TOKEN_MAX_TTL } from '@owlmeans/auth-token';
+import { memoHelper } from '@owlmeans/context';
+import { tokenHashHelper } from '../hash.js';
+import { prefixOf } from '../prefix.js';
+import { tokenRecordUtils } from './utils.js';
+export const makeAccessTokenIssuer = (ctx) => {
+    const issueAccessToken = async (subject, payload) => {
+        const own = subject.scopes;
+        const scopes = payload.scopes ?? own;
+        // A token is a delegation, so it can only ever narrow. Asking for a scope the caller does not
+        // hold is refused rather than silently dropped: a token that quietly grants less than it was
+        // asked for fails later, somewhere else, with an error about the wrong thing.
+        if (!own.includes(ALL_SCOPES) && scopes.some(scope => !own.includes(scope))) {
+            throw new AuthForbidden('scope');
+        }
+        // The SAME resolver the guard uses, so a minted token is one this deployment's guard claims.
+        const minted = tokenHashHelper.mintAccessToken(prefixOf(ctx));
+        const now = new Date();
+        const record = await tokenRecordUtils.tokens(ctx).create({
+            hash: minted.hash,
+            display: minted.display,
+            name: payload.name,
+            userId: subject.userId,
+            profileId: subject.profileId,
+            entityId: subject.entityId,
+            scopes,
+            role: subject.role,
+            createdAt: now,
+            ...(payload.audience != null ? { audience: payload.audience } : {}),
+            ...(payload.expiresIn != null
+                ? { expiresAt: new Date(now.getTime() + Math.min(payload.expiresIn * 1000, AUTH_TOKEN_MAX_TTL)) }
+                : {}),
+        });
+        // The only moment the plaintext exists outside the caller's own machine.
+        return { token: minted.token, record: tokenRecordUtils.view(record) };
+    };
+    return { issueAccessToken };
+};
+/** The token issuer of a context — one per context. */
+export const accessTokenIssuerOf = memoHelper.oncePer(makeAccessTokenIssuer);
+//# sourceMappingURL=issue.js.map

package/build/handlers/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../src/handlers/issue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAkD,MAAM,sBAAsB,CAAA;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAGvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAqB,EAAqB,EAAE;IAChF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,OAAgC,EAAE,OAAgC,EACtC,EAAE;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAA;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;QACpC,8FAA8F;QAC9F,6FAA6F;QAC7F,8EAA8E;QAC9E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,6FAA6F;QAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACvD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI;gBAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE;gBACjG,CAAC,CAAC,EAAE,CAAC;SACa,CAAC,CAAA;QAEvB,yEAAyE;QACzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAA8B,CAAA;IACnG,CAAC,CAAA;IAED,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC7B,CAAC,CAAA;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA"}

package/build/handlers/list.d.ts

@@ -0,0 +1,3 @@
+import type { AccessTokenList, AuthTokenEntrypoints } from '@owlmeans/auth-token';
+export declare const listAccessTokens: (protocol: AuthTokenEntrypoints['list']) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<import("@owlmeans/entrypoint").OpenRequest, AccessTokenList>>;
+//# sourceMappingURL=list.d.ts.map

package/build/handlers/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/handlers/list.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAMjF,eAAO,MAAM,gBAAgB,aAAc,oBAAoB,CAAC,MAAM,CAAC,iLAarE,CAAA"}

package/build/handlers/list.js

@@ -0,0 +1,18 @@
+import { AuthForbidden } from '@owlmeans/auth';
+import { makeEntityScope } from '@owlmeans/auth-common';
+import { handlers } from '@owlmeans/server-api';
+import { tokenRecordUtils } from './utils.js';
+export const listAccessTokens = (protocol) => handlers().request(protocol, async (req, context) => {
+    const ctx = context;
+    const entityId = makeEntityScope(req).requireEntityKey();
+    const profileId = req.auth?.profileId;
+    if (profileId == null)
+        throw new AuthForbidden('profile');
+    const result = await tokenRecordUtils.tokens(ctx).list({ entityId, profileId }, { size: 0 });
+    return {
+        items: result.items
+            .map(tokenRecordUtils.view)
+            .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()),
+    };
+});
+//# sourceMappingURL=list.js.map

package/build/handlers/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/handlers/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAsC,EAAE,EAAE,CAAC,QAAQ,EAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAChJ,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAA;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAE5F,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;aAChB,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;aAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;KAC3D,CAAA;AAC7B,CAAC,CAAC,CAAA"}

package/build/handlers/refuse.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A token may never mint another token.
+ *
+ * Minting is the one operation that turns a stolen credential into a permanent one: a token that
+ * can create tokens survives the revocation of the token that leaked. Creating and revoking
+ * therefore require a credential a person produced in a browser — which is also why the deployment
+ * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
+ * a check every future handler has to remember.
+ *
+ * Exported because an OAuth authorization server's consent-approval handler
+ * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
+ * verified itself rather than a route this package bound.
+ */
+export declare const refuseTokenAuth: (req: {
+    auth?: {
+        type?: string;
+    };
+}, what: string) => void;
+//# sourceMappingURL=refuse.d.ts.map

package/build/handlers/refuse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refuse.d.ts","sourceRoot":"","sources":["../../src/handlers/refuse.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,QAAS;IAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,QAAQ,MAAM,KAAG,IAIjF,CAAA"}

package/build/handlers/refuse.js

@@ -0,0 +1,20 @@
+import { AuthForbidden, AuthroizationType } from '@owlmeans/auth';
+/**
+ * A token may never mint another token.
+ *
+ * Minting is the one operation that turns a stolen credential into a permanent one: a token that
+ * can create tokens survives the revocation of the token that leaked. Creating and revoking
+ * therefore require a credential a person produced in a browser — which is also why the deployment
+ * names these routes in the guard's deny list, so the refusal is a 401 at the boundary rather than
+ * a check every future handler has to remember.
+ *
+ * Exported because an OAuth authorization server's consent-approval handler
+ * (`@owlmeans/server-oauth`) mints tokens too and needs the exact same guard, over a session it
+ * verified itself rather than a route this package bound.
+ */
+export const refuseTokenAuth = (req, what) => {
+    if (req.auth?.type === AuthroizationType.AuthToken) {
+        throw new AuthForbidden(what);
+    }
+};
+//# sourceMappingURL=refuse.js.map

package/build/handlers/refuse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refuse.js","sourceRoot":"","sources":["../../src/handlers/refuse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAiC,EAAE,IAAY,EAAQ,EAAE;IACvF,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA"}

package/build/handlers/revoke.d.ts

@@ -0,0 +1,17 @@
+import type { AuthTokenEntrypoints } from '@owlmeans/auth-token';
+import type { RevokeAccessTokenOptions } from './types.js';
+/**
+ * Revoke one of the caller's own tokens.
+ *
+ * By default only a credential a person produced in a browser may revoke. `allowAccessTokens`
+ * admits an access token too — a deployment's coding-agent surface that lets the person clean up
+ * their own tokens — and changes nothing else: still the caller's OWN profile in their OWN
+ * organization, and a foreign token still answers exactly as an unknown id does. Revoking never
+ * mints, so it cannot turn a stolen token into a lasting one; minting stays refused regardless.
+ */
+export declare const revokeAccessToken: (protocol: AuthTokenEntrypoints['revoke'], opts?: RevokeAccessTokenOptions) => import("@owlmeans/server-entrypoint").BoundEntrypointHandler<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    params: import("@owlmeans/auth-token").AccessTokenParams;
+}, {
+    id: string;
+}>>;
+//# sourceMappingURL=revoke.d.ts.map

package/build/handlers/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/handlers/revoke.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAKhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAG1D;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,aAClB,oBAAoB,CAAC,QAAQ,CAAC,SAAQ,wBAAwB;;;;GAsBxE,CAAA"}

package/build/handlers/revoke.js

@@ -0,0 +1,35 @@
+import { AuthForbidden } from '@owlmeans/auth';
+import { makeEntityScope } from '@owlmeans/auth-common';
+import { handlers } from '@owlmeans/server-api';
+import { refuseTokenAuth } from './refuse.js';
+import { tokenRecordUtils } from './utils.js';
+/**
+ * Revoke one of the caller's own tokens.
+ *
+ * By default only a credential a person produced in a browser may revoke. `allowAccessTokens`
+ * admits an access token too — a deployment's coding-agent surface that lets the person clean up
+ * their own tokens — and changes nothing else: still the caller's OWN profile in their OWN
+ * organization, and a foreign token still answers exactly as an unknown id does. Revoking never
+ * mints, so it cannot turn a stolen token into a lasting one; minting stays refused regardless.
+ */
+export const revokeAccessToken = (protocol, opts = {}) => handlers().params(protocol, async (payload, context, req) => {
+    const ctx = context;
+    if (opts.allowAccessTokens !== true)
+        refuseTokenAuth(req, 'token-revoke');
+    const entityId = makeEntityScope(req).requireEntityKey();
+    const profileId = req.auth?.profileId;
+    if (profileId == null)
+        throw new AuthForbidden('profile');
+    const record = await tokenRecordUtils.tokens(ctx).load(payload.id);
+    // A token of another profile answers exactly as an unknown id does — an owner learns nothing
+    // about tokens that are not theirs, not even that one exists.
+    if (record == null || record.entityId !== entityId || record.profileId !== profileId) {
+        throw new AuthForbidden('token');
+    }
+    // Idempotent: revoking twice is what a retry looks like.
+    if (record.revokedAt == null) {
+        await tokenRecordUtils.tokens(ctx).save({ ...record, revokedAt: new Date(), updatedAt: new Date() });
+    }
+    return { id: payload.id };
+});
+//# sourceMappingURL=revoke.js.map

package/build/handlers/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/handlers/revoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,QAAwC,EAAE,IAAI,GAA6B,EAAE,EAC7E,EAAE,CAAC,QAAQ,EAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;IACjF,MAAM,GAAG,GAAG,OAA2B,CAAA;IACvC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;QAAE,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAEzE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAA;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAA;IACrC,IAAI,SAAS,IAAI,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACtG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;AAC3B,CAAC,CAAC,CAAA"}

package/build/handlers/types.d.ts

@@ -0,0 +1,37 @@
+import { AuthRole } from '@owlmeans/auth';
+import type { CreateAccessToken, IssuedAccessToken } from '@owlmeans/auth-token';
+/** Whoever is minting the token — read once, by whichever caller resolved the session. */
+export interface IssueAccessTokenSubject {
+    entityId: string;
+    userId: string;
+    profileId: string;
+    role: AuthRole;
+    /** The subject's OWN scopes — minting can only narrow, never widen, this set. */
+    scopes: string[];
+}
+export interface IssueAccessTokenRequest extends CreateAccessToken {
+    /**
+     * The resource(s) this token is FOR (RFC 8707), when it is minted through an OAuth grant.
+     * Absent for a token minted by hand — the ordinary, unrestricted kind.
+     */
+    audience?: string[];
+}
+/** Token issuance over one context's store — the one path every minting caller goes through. */
+export interface AccessTokenIssuer {
+    /**
+     * Mint one token for `subject`, exactly what `createAccessToken` does over an HTTP body — pulled
+     * out so a second caller (an OAuth token endpoint) can mint the SAME shape of record over a
+     * session it authenticated its own way, without a duplicate copy of the narrowing rule or the
+     * TTL clamp silently drifting from this one.
+     */
+    issueAccessToken: (subject: IssueAccessTokenSubject, payload: IssueAccessTokenRequest) => Promise<IssuedAccessToken>;
+}
+/** How a deployment binds `revokeAccessToken`. */
+export interface RevokeAccessTokenOptions {
+    /**
+     * Let an access token revoke one of its own person's tokens (itself included). Defaults to
+     * `false`: only an interactive session revokes. Ownership is checked the same either way.
+     */
+    allowAccessTokens?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/handlers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/handlers/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;IACd,iFAAiF;IACjF,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACrH;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B"}

package/build/handlers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/handlers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/handlers/types.ts"],"names":[],"mappings":""}

package/build/handlers/utils/types.d.ts

@@ -0,0 +1,10 @@
+import type { AccessTokenRecord, AccessTokenView } from '@owlmeans/auth-token';
+import type { AccessTokenResource, AuthTokenContext } from '../../types.js';
+/** What every token handler shares: the store and the view a caller may see. */
+export interface TokenRecordUtils {
+    /** A record without its hash — the hash never leaves the server. */
+    view: (record: AccessTokenRecord) => AccessTokenView;
+    /** The token store of a context. */
+    tokens: (ctx: AuthTokenContext) => AccessTokenResource;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/handlers/utils/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/handlers/utils/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,eAAe,CAAA;IACpD,oCAAoC;IACpC,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,mBAAmB,CAAA;CACvD"}

package/build/handlers/utils/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/handlers/utils/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/handlers/utils/types.ts"],"names":[],"mappings":""}

package/build/handlers/utils.d.ts

@@ -0,0 +1,4 @@
+import type { TokenRecordUtils } from './utils/types.js';
+export declare const createTokenRecordUtils: () => TokenRecordUtils;
+export declare const tokenRecordUtils: TokenRecordUtils;
+//# sourceMappingURL=utils.d.ts.map

package/build/handlers/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/handlers/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,eAAO,MAAM,sBAAsB,QAAO,gBAWzC,CAAA;AAED,eAAO,MAAM,gBAAgB,kBAA2B,CAAA"}

package/build/handlers/utils.js

@@ -0,0 +1,11 @@
+import { AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token';
+export const createTokenRecordUtils = () => {
+    const view = (record) => {
+        const { hash, ...rest } = record;
+        return rest;
+    };
+    const tokens = (ctx) => ctx.resource(AUTH_TOKEN_RESOURCE);
+    return { view, tokens };
+};
+export const tokenRecordUtils = createTokenRecordUtils();
+//# sourceMappingURL=utils.js.map

package/build/handlers/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/handlers/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAgD,MAAM,sBAAsB,CAAA;AAIxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAqB,EAAE;IAC3D,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAmB,EAAE;QAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAEhC,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAuB,EAAE,CAC5D,GAAG,CAAC,QAAQ,CAAsB,mBAAmB,CAAC,CAAA;IAExD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAA"}

package/build/hash/types.d.ts

@@ -0,0 +1,16 @@
+import type { MintedToken } from '../types.js';
+/** Access tokens minted and stored: the plaintext once, the hash forever. */
+export interface TokenHashHelper {
+    /**
+     * The stored form of a token.
+     *
+     * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
+     * randomness, so there is no dictionary to slow down, and the hash is computed on every single
+     * API request — a deliberately slow function here would be a deliberate rate limit on the
+     * deployment's whole authenticated surface.
+     */
+    hashAccessToken: (token: string) => string;
+    /** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
+    mintAccessToken: (prefix: string) => MintedToken;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/hash/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/hash/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1C,6FAA6F;IAC7F,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,CAAA;CACjD"}

package/build/hash/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/hash/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/hash/types.ts"],"names":[],"mappings":""}

package/build/hash.d.ts

@@ -1,17 +1,6 @@
-/**
- * The stored form of a token.
- *
- * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
- * randomness, so there is no dictionary to slow down, and the hash is computed on every single
- * API request — a deliberately slow function here would be a deliberate rate limit on the
- * deployment's whole authenticated surface.
- */
+import type { TokenHashHelper } from './hash/types.js';
+export declare const createTokenHashHelper: () => TokenHashHelper;
+export declare const tokenHashHelper: TokenHashHelper;
+/** @deprecated compat:factory-refactor — use `tokenHashHelper.hashAccessToken(…)` */
 export declare const hashAccessToken: (token: string) => string;
-export interface MintedToken {
-    token: string;
-    hash: string;
-    display: string;
-}
-/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
-export declare const mintAccessToken: (prefix: string) => MintedToken;
 //# sourceMappingURL=hash.d.ts.map

package/build/hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAA6D,CAAA;AAE7G,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,6FAA6F;AAC7F,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,WAIhD,CAAA"}
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEtD,eAAO,MAAM,qBAAqB,QAAO,eAUxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,qFAAqF;AACrF,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAAgD,CAAA"}

package/build/hash.js

@@ -1,19 +1,16 @@
-import { AUTH_TOKEN_SECRET_BYTES, displayOf } from '@owlmeans/auth-token';
+import { AUTH_TOKEN_SECRET_BYTES, tokenFormatHelper } from '@owlmeans/auth-token';
 import { base58 } from '@scure/base';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, randomBytes } from '@noble/hashes/utils';
-/**
- * The stored form of a token.
- *
- * SHA-256 rather than a password hash on purpose: the input is 192 bits of machine-generated
- * randomness, so there is no dictionary to slow down, and the hash is computed on every single
- * API request — a deliberately slow function here would be a deliberate rate limit on the
- * deployment's whole authenticated surface.
- */
-export const hashAccessToken = (token) => bytesToHex(sha256(new TextEncoder().encode(token)));
-/** Mint one token: the plaintext (returned once), its hash (stored) and its display form. */
-export const mintAccessToken = (prefix) => {
-    const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`;
-    return { token, hash: hashAccessToken(token), display: displayOf(token, prefix) };
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, randomBytes } from '@noble/hashes/utils.js';
+export const createTokenHashHelper = () => {
+    const hashAccessToken = (token) => bytesToHex(sha256(new TextEncoder().encode(token)));
+    const mintAccessToken = (prefix) => {
+        const token = `${prefix}${base58.encode(randomBytes(AUTH_TOKEN_SECRET_BYTES))}`;
+        return { token, hash: hashAccessToken(token), display: tokenFormatHelper.displayOf(token, prefix) };
+    };
+    return { hashAccessToken, mintAccessToken };
 };
+export const tokenHashHelper = createTokenHashHelper();
+/** @deprecated compat:factory-refactor — use `tokenHashHelper.hashAccessToken(…)` */
+export const hashAccessToken = (token) => tokenHashHelper.hashAccessToken(token);
 //# sourceMappingURL=hash.js.map

package/build/hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAQ7G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAe,EAAE;IAC7D,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAA;IAE/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;AACnF,CAAC,CAAA"}
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAIhE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoB,EAAE;IACzD,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEtG,MAAM,eAAe,GAAG,CAAC,MAAc,EAAe,EAAE;QACtD,MAAM,KAAK,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAA;QAE/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAA;IACrG,CAAC,CAAA;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAA;AAEtD,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA"}

package/build/index.d.ts

@@ -1,9 +1,12 @@
 export * from './consts.js';
 export * from './resource.js';
+export * from './prefix.js';
 export * from './guard.js';
 export * from './hash.js';
 export * from './coguard.js';
 export * from './append.js';
 export * from './handlers/index.js';
+export type * from './handlers/types.js';
 export type * from './types.js';
+export type * from './hash/types.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,mBAAmB,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA;AACnC,mBAAmB,qBAAqB,CAAA;AACxC,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,iBAAiB,CAAA"}

package/build/index.js

@@ -1,5 +1,6 @@
 export * from './consts.js';
 export * from './resource.js';
+export * from './prefix.js';
 export * from './guard.js';
 export * from './hash.js';
 export * from './coguard.js';

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,qBAAqB,CAAA"}

package/build/prefix.d.ts

@@ -0,0 +1,4 @@
+import type { AuthTokenContext, AuthTokenGuardOptions } from './types.js';
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export declare const prefixOf: (context: AuthTokenContext, opts?: AuthTokenGuardOptions) => string;
+//# sourceMappingURL=prefix.d.ts.map

package/build/prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.d.ts","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAE1F,oGAAoG;AACpG,eAAO,MAAM,QAAQ,YAAa,gBAAgB,SAAS,qBAAqB,KAAG,MACc,CAAA"}

package/build/prefix.js

@@ -0,0 +1,4 @@
+import { AUTH_TOKEN_DEFAULT_PREFIX } from '@owlmeans/auth-token';
+/** Where the deployment's prefix comes from: the guard's own options, then config, then default. */
+export const prefixOf = (context, opts) => opts?.prefix ?? context.cfg.authToken?.prefix ?? AUTH_TOKEN_DEFAULT_PREFIX;
+//# sourceMappingURL=prefix.js.map

package/build/prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.js","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAGhE,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAyB,EAAE,IAA4B,EAAU,EAAE,CAC1F,IAAI,EAAE,MAAM,IAAK,OAAO,CAAC,GAAuB,CAAC,SAAS,EAAE,MAAM,IAAI,yBAAyB,CAAA"}

package/build/types.d.ts

@@ -26,6 +26,21 @@ export interface AuthTokenGuardOptions {
     resourceAlias?: string;
     /** Resource alias holding the identity profiles a token is bound to. */
     profileAlias?: string;
+    /**
+     * The resource(s) this guard speaks for, opting it into audience admission.
+     *
+     * Left unset (the default), the guard admits every token whatever its `audience` — full
+     * backward compatibility for a deployment that never mints an audience-restricted token. Set
+     * it to the canonical resource URI(s) this route surface serves, and a token issued FOR a
+     * different resource (an OAuth-issued, MCP-only token, say) is refused here rather than
+     * quietly working everywhere the profile's scopes would otherwise reach.
+     *
+     * A function is resolved with the live context on every request rather than once at
+     * registration time — `appendAuthTokenGuard` runs from `makeContext`, before a hostname a
+     * Kubernetes secret mount populates is necessarily readable yet, and this guard's `handle`
+     * already runs per-request regardless.
+     */
+    resources?: string[] | ((context: AuthTokenContext) => string[]);
 }
 export interface AuthTokenConfig extends ServerConfig {
     authToken?: {
@@ -33,4 +48,9 @@ export interface AuthTokenConfig extends ServerConfig {
     };
 }
 export type AuthTokenContext<C extends AuthTokenConfig = AuthTokenConfig> = ServerContext<C>;
+export interface MintedToken {
+    token: string;
+    hash: string;
+    display: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,EAAE,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA;AAE5F,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@owlmeans/server-auth-token",
-  "version": "0.1.18-rc.8",
+  "version": "0.1.18",
   "license": "MIT",
-  "description": "The server half of OwlMeans access tokens — the store, the guard that verifies a presented token, the management handlers and the coguard that admits one on an existing route.",
+  "description": "The server half of OwlMeans access tokens \u2014 the store, the guard that verifies a presented token, the management handlers and the coguard that admits one on an existing route.",
   "type": "module",
   "scripts": {
     "build": "tsc -b",
@@ -23,22 +23,23 @@
     }
   },
   "dependencies": {
-    "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.17",
-    "@owlmeans/auth-common": "^0.1.18-rc.21",
-    "@owlmeans/auth-token": "^0.1.18-rc.8",
-    "@owlmeans/context": "^0.1.18-rc.16",
-    "@owlmeans/entrypoint": "^0.1.18-rc.19",
-    "@owlmeans/mongo-resource": "^0.1.18-rc.20",
-    "@owlmeans/resource": "^0.1.18-rc.17",
-    "@owlmeans/server-api": "^0.1.18-rc.25",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.21",
-    "@owlmeans/server-context": "^0.1.18-rc.20",
-    "@scure/base": "^1.1.9"
+    "@noble/hashes": "^2.4.0",
+    "@owlmeans/auth": "^0.1.18",
+    "@owlmeans/auth-common": "^0.1.18",
+    "@owlmeans/auth-token": "^0.1.18",
+    "@owlmeans/context": "^0.1.18",
+    "@owlmeans/entrypoint": "^0.1.18",
+    "@owlmeans/log": "^0.1.18",
+    "@owlmeans/mongo-resource": "^0.1.18",
+    "@owlmeans/resource": "^0.1.18",
+    "@owlmeans/server-api": "^0.1.18",
+    "@owlmeans/server-auth-identity": "^0.1.18",
+    "@owlmeans/server-context": "^0.1.18",
+    "@scure/base": "^2.4.0"
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.4.0",
+    "@owlmeans/dep-config": "^0.1.18",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },