@authup/errors 1.0.0-beta.62 → 1.0.0-beta.63

package/dist/index.d.mts

@@ -266,6 +266,18 @@ declare function serializeError(input: Error): Record<string, any>;
  * - `OAUTH_CLIENT_INVALID`: 400 → **401**, per RFC 6749 §5.2 (`invalid_client`
  *   responses should use 401). Surfaces as a behavior change in HTTP-level
  *   tests asserting `status: 400, code: OAUTH_CLIENT_INVALID`.
+ * - The three `JWT_*` codes: 400 (the unlisted fallback) → **401**, per
+ *   RFC 6750 §3.1, which is the status for a resource request carrying an
+ *   expired or otherwise unusable bearer. They had never been listed, so a
+ *   dead bearer answered 400 while a MISSING one answered 401, and no
+ *   client could tell "your credential died" from "your request was
+ *   malformed" by status alone. The token endpoint is where RFC 6749 §5.2
+ *   and RFC 7662/7009 want something else, and each of its handlers says so
+ *   at its own call site rather than here: the refresh grant re-throws a
+ *   verification failure as `invalid_grant`, introspection reports one as
+ *   `active: false`, and revocation answers its ordinary success. A new
+ *   token-endpoint path that verifies a JWT has to do the same - this map
+ *   cannot know which surface it is on.
  */
 declare const ERROR_CODE_TO_STATUS: Readonly<Partial<Record<`${ErrorCode}`, number>>>;
 /**

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/module.ts","../src/built-in/unauthorized.ts","../src/built-in/auth-header.ts","../src/built-in/bad-request.ts","../src/built-in/bearer-token.ts","../src/built-in/validation.ts","../src/built-in/entity-conflict.ts","../src/built-in/entity-credentials-invalid.ts","../src/built-in/entity-inactive.ts","../src/built-in/entity-not-found.ts","../src/built-in/internal.ts","../src/built-in/login-throttled.ts","../src/built-in/mfa-throttled.ts","../src/built-in/check.ts","../src/check.ts","../src/constants.ts","../src/normalize.ts","../src/serialize.ts","../src/status.ts"],"mappings":";;KASY,qBAAqB;EAC7B,OAAO;;KAGC,4BAA4B;KAE5B,2BAA2B;EACnC;;KAGQ,kCAAkC;;;cCJjC;cAEA,oBAAoB;WACb,OAAO;EAEX,YAAA,QAAQ;;;;;;EAcX;;;;;;;;;;;;cCtBA;cAEA,0BAA0B;EACvB,YAAA,iBAAiB;;;;cCJpB;cAEA,wBAAwB;EACrB,YAAA;SAQL,gBAAgB,eAAY;;;;cCV1B;cAEA,wBAAwB;EACrB,YAAA,iBAAiB;;;;cCJpB;cAEA,kCAAkC;EAC/B,YAAA;;;;cCFH;;;;;;;cAQA,wBAAwB;EACrB,YAAA,iBAAiB;;;;cCTpB;cAEA,4BAA4B;EACzB,YAAA,iBAAiB;;;;cCHpB;cAEA,sCAAsC;EACnC,YAAA,iBAAiB;;;;cCHpB;cAEA,4BAA4B;EACzB,YAAA,iBAAiB;;;;cCHpB;cAEA,4BAA4B;EACzB,YAAA,iBAAiB;;;;cCHpB;cAEA,sBAAsB;EACnB,YAAA,iBAAiB;;;;cCHpB;KAED,6BAA6B;;;;EAIrC;;cAGS,4BAA4B;EACzB,YAAA,QAAQ;;;;cCVX;KAED,2BAA2B;;;;EAInC;;cAGS,0BAA0B;EACvB,YAAA,QAAQ;;;;iBCCR,kBAAkB,iBAAiB,SAAS;iBAM5C,4BAA4B,iBAAiB,SAAS;iBAMtD,kBAAkB,iBAAiB,SAAS;iBAM5C,kBAAkB,iBAAiB,SAAS;iBAM5C,oBAAoB,iBAAiB,SAAS;iBAM9C,sBAAsB,iBAAiB,SAAS;iBAMhD,sBAAsB,iBAAiB,SAAS;iBAMhD,sBAAsB,iBAAiB,SAAS;iBAMhD,gCAAgC,iBAAiB,SAAS;iBAM1D,gBAAgB,iBAAiB,SAAS;iBAM1C,sBAAsB,iBAAiB,SAAS;iBAMhD,oBAAoB,iBAAiB,SAAS;;;;;;;;;;;;iBChE9C,QAAQ,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;iBAuBlC,cAAc,iBAAiB,SAAS;;;aCzC5C;EAER;EACA;;;;;;;;EASA;EAGA;EACA;EAGA;EAGA;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EAGA;EACA;EACA;;;;;;;;;;;;;iBCjEY,eAAe,iBAAiB;;;;;;;;;;;;;;;;iBCIhC,eAAe,OAAO,QAAQ;;;;;;;;;;;;;;;;cCAjC,sBAAsB,SAAS,QAAQ,UAAU;;;;;iBAqC9C,mBAAmB,cAAc;;;;;;;;;;;iBAcjC,mBAAmB,iBAAiB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/module.ts","../src/built-in/unauthorized.ts","../src/built-in/auth-header.ts","../src/built-in/bad-request.ts","../src/built-in/bearer-token.ts","../src/built-in/validation.ts","../src/built-in/entity-conflict.ts","../src/built-in/entity-credentials-invalid.ts","../src/built-in/entity-inactive.ts","../src/built-in/entity-not-found.ts","../src/built-in/internal.ts","../src/built-in/login-throttled.ts","../src/built-in/mfa-throttled.ts","../src/built-in/check.ts","../src/check.ts","../src/constants.ts","../src/normalize.ts","../src/serialize.ts","../src/status.ts"],"mappings":";;KASY,qBAAqB;EAC7B,OAAO;;KAGC,4BAA4B;KAE5B,2BAA2B;EACnC;;KAGQ,kCAAkC;;;cCJjC;cAEA,oBAAoB;WACb,OAAO;EAEX,YAAA,QAAQ;;;;;;EAcX;;;;;;;;;;;;cCtBA;cAEA,0BAA0B;EACvB,YAAA,iBAAiB;;;;cCJpB;cAEA,wBAAwB;EACrB,YAAA;SAQL,gBAAgB,eAAY;;;;cCV1B;cAEA,wBAAwB;EACrB,YAAA,iBAAiB;;;;cCJpB;cAEA,kCAAkC;EAC/B,YAAA;;;;cCFH;;;;;;;cAQA,wBAAwB;EACrB,YAAA,iBAAiB;;;;cCTpB;cAEA,4BAA4B;EACzB,YAAA,iBAAiB;;;;cCHpB;cAEA,sCAAsC;EACnC,YAAA,iBAAiB;;;;cCHpB;cAEA,4BAA4B;EACzB,YAAA,iBAAiB;;;;cCHpB;cAEA,4BAA4B;EACzB,YAAA,iBAAiB;;;;cCHpB;cAEA,sBAAsB;EACnB,YAAA,iBAAiB;;;;cCHpB;KAED,6BAA6B;;;;EAIrC;;cAGS,4BAA4B;EACzB,YAAA,QAAQ;;;;cCVX;KAED,2BAA2B;;;;EAInC;;cAGS,0BAA0B;EACvB,YAAA,QAAQ;;;;iBCCR,kBAAkB,iBAAiB,SAAS;iBAM5C,4BAA4B,iBAAiB,SAAS;iBAMtD,kBAAkB,iBAAiB,SAAS;iBAM5C,kBAAkB,iBAAiB,SAAS;iBAM5C,oBAAoB,iBAAiB,SAAS;iBAM9C,sBAAsB,iBAAiB,SAAS;iBAMhD,sBAAsB,iBAAiB,SAAS;iBAMhD,sBAAsB,iBAAiB,SAAS;iBAMhD,gCAAgC,iBAAiB,SAAS;iBAM1D,gBAAgB,iBAAiB,SAAS;iBAM1C,sBAAsB,iBAAiB,SAAS;iBAMhD,oBAAoB,iBAAiB,SAAS;;;;;;;;;;;;iBChE9C,QAAQ,iBAAiB,SAAS;;;;;;;;;;;;;;;;;;;;iBAuBlC,cAAc,iBAAiB,SAAS;;;aCzC5C;EAER;EACA;;;;;;;;EASA;EAGA;EACA;EAGA;EAGA;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAGA;EACA;EACA;EAGA;EACA;EACA;;;;;;;;;;;;;iBCjEY,eAAe,iBAAiB;;;;;;;;;;;;;;;;iBCIhC,eAAe,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCYjC,sBAAsB,SAAS,QAAQ,UAAU;;;;;iBAwC9C,mBAAmB,cAAc;;;;;;;;;;;iBAcjC,mBAAmB,iBAAiB"}

package/dist/index.mjs

@@ -411,12 +411,27 @@ function serializeError(input) {
 * - `OAUTH_CLIENT_INVALID`: 400 → **401**, per RFC 6749 §5.2 (`invalid_client`
 *   responses should use 401). Surfaces as a behavior change in HTTP-level
 *   tests asserting `status: 400, code: OAUTH_CLIENT_INVALID`.
+* - The three `JWT_*` codes: 400 (the unlisted fallback) → **401**, per
+*   RFC 6750 §3.1, which is the status for a resource request carrying an
+*   expired or otherwise unusable bearer. They had never been listed, so a
+*   dead bearer answered 400 while a MISSING one answered 401, and no
+*   client could tell "your credential died" from "your request was
+*   malformed" by status alone. The token endpoint is where RFC 6749 §5.2
+*   and RFC 7662/7009 want something else, and each of its handlers says so
+*   at its own call site rather than here: the refresh grant re-throws a
+*   verification failure as `invalid_grant`, introspection reports one as
+*   `active: false`, and revocation answers its ordinary success. A new
+*   token-endpoint path that verifies a JWT has to do the same - this map
+*   cannot know which surface it is on.
 */
 const ERROR_CODE_TO_STATUS = {
 	["invalid_client"]: 401,
 	["bearer_token_malformed"]: 401,
 	["unsupported_auth_header_type"]: 401,
 	["identity_unauthorized"]: 401,
+	["expired_token"]: 401,
+	["inactive_token"]: 401,
+	["invalid_token"]: 401,
 	["permission_not_found"]: 403,
 	["permission_denied"]: 403,
 	["permission_evaluation_failed"]: 403,

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["INSTANCEOF_PROPERTY","serializeInstanceofChain","isRawError","INSTANCEOF_PROPERTY","matchesInstanceof","matchesInstanceof"],"sources":["../src/constants.ts","../src/module.ts","../src/built-in/unauthorized.ts","../src/built-in/auth-header.ts","../src/built-in/bad-request.ts","../src/built-in/bearer-token.ts","../src/check.ts","../src/built-in/validation.ts","../src/built-in/entity-conflict.ts","../src/built-in/entity-credentials-invalid.ts","../src/built-in/entity-inactive.ts","../src/built-in/entity-not-found.ts","../src/built-in/internal.ts","../src/built-in/login-throttled.ts","../src/built-in/mfa-throttled.ts","../src/built-in/check.ts","../src/normalize.ts","../src/serialize.ts","../src/status.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum ErrorCode {\n    // Generic\n    BAD_REQUEST = 'bad_request',\n    INTERNAL_ERROR = 'internal_error',\n\n    /**\n     * An outbound call to a service this server depends on failed, either\n     * as a transport failure or as an error answer. Distinct from\n     * INTERNAL_ERROR so a caller can tell \"authup is broken\" from \"authup\n     * could not reach a dependency\", and so the upstream status is never\n     * mirrored onto authup's own response.\n     */\n    UPSTREAM_ERROR = 'upstream_error',\n\n    // HTTP Codes\n    HTTP_HEADER_AUTH_TYPE_UNSUPPORTED = 'unsupported_auth_header_type',\n    HTTP_BEARER_TOKEN_MALFORMED = 'bearer_token_malformed',\n\n    // Identity Auth\n    IDENTITY_UNAUTHORIZED = 'identity_unauthorized',\n\n    // Entity Codes\n    ENTITY_CREDENTIALS_INVALID = 'invalid_credentials',\n    ENTITY_INACTIVE = 'entity_inactive',\n    ENTITY_NOT_FOUND = 'entity_not_found',\n    ENTITY_CONFLICT = 'entity_conflict',\n    ENTITY_RELATION_INVALID = 'entity_relation_invalid',\n\n    // Identity Codes\n    REGISTRATION_DISABLED = 'registration_disabled',\n    PASSWORD_RECOVERY_DISABLED = 'password_recovery_disabled',\n    EMAIL_VERIFICATION_REQUIRED = 'email_verification_required',\n    RESET_TOKEN_EXPIRED = 'reset_token_expired',\n    LOGIN_ATTEMPT_THROTTLED = 'login_attempt_throttled',\n    MFA_ATTEMPT_THROTTLED = 'mfa_attempt_throttled',\n    MFA_NOT_CONFIGURABLE = 'mfa_not_configurable',\n    IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED = 'identity_provider_account_already_linked',\n    IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED = 'identity_provider_account_unlink_blocked',\n\n    // Storage Codes\n    STORAGE_INSUFFICIENT = 'storage_insufficient',\n\n    // JWK Codes\n    JWK_INVALID = 'jwk_invalid',\n    JWK_NOT_FOUND = 'jwk_not_found',\n\n    // JWT Codes\n    JWT_INVALID = 'invalid_token',\n    JWT_INACTIVE = 'inactive_token',\n    JWT_EXPIRED = 'expired_token',\n\n    // Oauth2 Codes\n    OAUTH_REDIRECT_URI_MISMATCH = 'redirect_uri_mismatch',\n    OAUTH_CLIENT_INVALID = 'invalid_client',\n    OAUTH_CLIENT_UNAUTHORIZED = 'unauthorized_client',\n    OAUTH_GRANT_INVALID = 'invalid_grant',\n    OAUTH_GRANT_TYPE_UNSUPPORTED = 'unsupported_token_grant_type',\n    OAUTH_REQUEST_INVALID = 'invalid_request',\n    OAUTH_LOGIN_REQUIRED = 'login_required',\n    OAUTH_MFA_REQUIRED = 'mfa_required',\n    OAUTH_ACCESS_DENIED = 'access_denied',\n    OAUTH_INTERACTION_REQUIRED = 'interaction_required',\n    OAUTH_ACCOUNT_SELECTION_REQUIRED = 'account_selection_required',\n    OAUTH_CONSENT_REQUIRED = 'consent_required',\n    OAUTH_RESPONSE_TYPE_UNSUPPORTED = 'unsupported_response_type',\n    OAUTH_SCOPE_INVALID = 'invalid_scope',\n    OAUTH_SCOPE_INSUFFICIENT = 'insufficient_scope',\n\n    // Permission Codes\n    PERMISSION_NOT_FOUND = 'permission_not_found',\n    PERMISSION_DENIED = 'permission_denied',\n    PERMISSION_EVALUATION_FAILED = 'permission_evaluation_failed',\n\n    // Policy Codes\n    POLICY_EVALUATOR_NOT_FOUND = 'policy_evaluator_not_found',\n    POLICY_EVALUATOR_NOT_PROCESSABLE = 'policy_evaluator_not_processable',\n    POLICY_EVALUATOR_CONTEXT_INVALID = 'policy_evaluator_context_invalid',\n}\n","/*\n * Copyright (c) 2024-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthupErrorInput } from './types.ts';\nimport {\n    BaseError,\n    INSTANCEOF_PROPERTY,\n    markInstanceof,\n    serializeInstanceofChain,\n} from '@ebec/core';\n\nexport const AUTHUP_ERROR_INSTANCE = Symbol.for('@authup/errors/AuthupError');\n\nexport class AuthupError extends BaseError {\n    public readonly data?: Record<string, any>;\n\n    constructor(input?: AuthupErrorInput) {\n        super(input);\n        markInstanceof(this, AUTHUP_ERROR_INSTANCE);\n\n        if (input && typeof input !== 'string' && input.data) {\n            this.data = input.data;\n        }\n    }\n\n    /**\n     * `super.toJSON()` already emits the serialized marker chain, but the\n     * `data` spread runs after it — re-stamped last so a `data` key cannot\n     * displace the genuine chain.\n     */\n    override toJSON() {\n        return {\n            ...super.toJSON(),\n            ...(this.data ?? {}),\n            [INSTANCEOF_PROPERTY]: serializeInstanceofChain(this),\n        };\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const UNAUTHORIZED_ERROR_INSTANCE = Symbol.for('@authup/errors/UnauthorizedError');\n\nexport class UnauthorizedError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.IDENTITY_UNAUTHORIZED,\n            message: 'Authentication required.',\n            ...options,\n        });\n        markInstanceof(this, UNAUTHORIZED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { UnauthorizedError } from './unauthorized.ts';\n\nexport const AUTH_HEADER_ERROR_INSTANCE = Symbol.for('@authup/errors/AuthHeaderError');\n\nexport class AuthHeaderError extends UnauthorizedError {\n    constructor(message: string) {\n        super({\n            code: ErrorCode.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED,\n            message,\n        });\n        markInstanceof(this, AUTH_HEADER_ERROR_INSTANCE);\n    }\n\n    static unsupportedType(type: string) {\n        return new AuthHeaderError(`The authorization header type ${type} is not supported.`);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const BAD_REQUEST_ERROR_INSTANCE = Symbol.for('@authup/errors/BadRequestError');\n\nexport class BadRequestError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.BAD_REQUEST,\n            ...options,\n        });\n        markInstanceof(this, BAD_REQUEST_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { UnauthorizedError } from './unauthorized.ts';\n\nexport const BEARER_TOKEN_MALFORMED_ERROR_INSTANCE = Symbol.for('@authup/errors/BearerTokenMalformedError');\n\nexport class BearerTokenMalformedError extends UnauthorizedError {\n    constructor(message?: string) {\n        super({\n            code: ErrorCode.HTTP_BEARER_TOKEN_MALFORMED,\n            message: message ?? 'The Authorization header is malformed.',\n        });\n        markInstanceof(this, BEARER_TOKEN_MALFORMED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    INSTANCEOF_PROPERTY,\n    isObject,\n    isError as isRawError,\n    matchesInstanceof,\n} from '@ebec/core';\nimport type { AuthupError } from './module.ts';\nimport { AUTHUP_ERROR_INSTANCE } from './module.ts';\n\n/**\n * Duck-type guard for `Error`.\n *\n * Re-exports `@ebec/core`'s shape-based check: `input` matches when it\n * carries the standard `name` / `message` / `stack` triplet, regardless\n * of which realm or class hierarchy produced it. Use this instead of\n * `instanceof Error` for cross-realm boundaries (worker threads,\n * duplicate-module copies) where `instanceof` can yield false negatives.\n */\nexport function isError(input: unknown): input is Error {\n    return isRawError(input);\n}\n\n/**\n * Duck-type guard for AuthupError.\n *\n * The chain decides, and only the chain: it matches when the AuthupError\n * marker is in it, as the native symbol (in-process) or its serialized\n * string form (JSON-rehydrated). Subclass instances accumulate this\n * marker, so any AuthupError subclass (`OAuth2Error`, `JWTError`, ...)\n * matches too, while a foreign `@ebec/core` error (rapiq's ParseError,\n * which since 2.2 also carries an `issues` array) does not: it announced\n * its ancestry and AuthupError is not in it.\n *\n * Chain-less input never matches. A shape-based fallback for pre-chain\n * JSON (`BaseError` + `issues: Issue[]`) used to cover that case, but\n * `@ebec/core`'s `isBaseError` became chain-only, so that fallback could\n * never fire — and now that every `BaseError` carries an `issues` array,\n * the shape it checked for would no longer distinguish an AuthupError\n * from any other ebec-derived error anyway. There is no reliable way left\n * to recognise a chain-less legacy payload as specifically an AuthupError.\n */\nexport function isAuthupError(input: unknown): input is AuthupError {\n    if (!isObject(input)) {\n        return false;\n    }\n\n    if (!Array.isArray(input[INSTANCEOF_PROPERTY])) {\n        return false;\n    }\n\n    return matchesInstanceof(input, AUTHUP_ERROR_INSTANCE);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const VALIDATION_ERROR_INSTANCE = Symbol.for('@authup/errors/ValidationError');\n\n/**\n * A domain/business-rule violation raised by core logic. Deliberately NOT\n * named after an HTTP status: core code stays transport-agnostic, and the HTTP\n * adapter maps its `ErrorCode.BAD_REQUEST` to a 400 response\n * (`httpStatusFromCode`). Prefer this over `BadRequestError` in `core/**`.\n */\nexport class ValidationError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.BAD_REQUEST,\n            ...options,\n        });\n        markInstanceof(this, VALIDATION_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_CONFLICT_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityConflictError');\n\nexport class EntityConflictError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_CONFLICT,\n            message: entity ? `The ${entity} already exists.` : 'Entity already exists.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_CONFLICT_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityCredentialsInvalidError');\n\nexport class EntityCredentialsInvalidError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_CREDENTIALS_INVALID,\n            message: entity ? `The ${entity} credentials are invalid.` : 'Credentials are invalid.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_INACTIVE_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityInactiveError');\n\nexport class EntityInactiveError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_INACTIVE,\n            message: entity ? `The ${entity} is inactive.` : 'Entity is inactive.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_INACTIVE_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_NOT_FOUND_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityNotFoundError');\n\nexport class EntityNotFoundError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_NOT_FOUND,\n            message: entity ? `The ${entity} was not found.` : 'Entity not found.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_NOT_FOUND_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const INTERNAL_ERROR_INSTANCE = Symbol.for('@authup/errors/InternalError');\n\nexport class InternalError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: 'An internal error occurred.',\n            ...options,\n        });\n        markInstanceof(this, INTERNAL_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const LOGIN_THROTTLED_ERROR_INSTANCE = Symbol.for('@authup/errors/LoginThrottledError');\n\nexport type LoginThrottledErrorOptions = AuthupErrorOptions & {\n    /**\n     * Seconds until the sliding throttle window can release the pair.\n     */\n    retryAfter?: number,\n};\n\nexport class LoginThrottledError extends AuthupError {\n    constructor(input?: LoginThrottledErrorOptions) {\n        const { retryAfter, ...rest } = input ?? {};\n        super({\n            code: ErrorCode.LOGIN_ATTEMPT_THROTTLED,\n            message: 'Too many failed login attempts. Please try again later.',\n            ...rest,\n            data: {\n                ...(typeof retryAfter === 'number' ? { retryAfter } : {}),\n                ...(rest.data ?? {}),\n            },\n        });\n        markInstanceof(this, LOGIN_THROTTLED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const MFA_THROTTLED_ERROR_INSTANCE = Symbol.for('@authup/errors/MfaThrottledError');\n\nexport type MfaThrottledErrorOptions = AuthupErrorOptions & {\n    /**\n     * Seconds until the exponential backoff releases the account.\n     */\n    retryAfter?: number,\n};\n\nexport class MfaThrottledError extends AuthupError {\n    constructor(input?: MfaThrottledErrorOptions) {\n        const { retryAfter, ...rest } = input ?? {};\n        super({\n            code: ErrorCode.MFA_ATTEMPT_THROTTLED,\n            message: 'Too many failed verification attempts. Please try again later.',\n            ...rest,\n            data: {\n                ...(typeof retryAfter === 'number' ? { retryAfter } : {}),\n                ...(rest.data ?? {}),\n            },\n        });\n        markInstanceof(this, MFA_THROTTLED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isAuthupError } from '../check.ts';\nimport { ErrorCode } from '../constants.ts';\nimport { matchesInstanceof } from '@ebec/core';\nimport { AUTH_HEADER_ERROR_INSTANCE, type AuthHeaderError } from './auth-header.ts';\nimport { BAD_REQUEST_ERROR_INSTANCE, type BadRequestError } from './bad-request.ts';\nimport { VALIDATION_ERROR_INSTANCE, type ValidationError } from './validation.ts';\nimport { BEARER_TOKEN_MALFORMED_ERROR_INSTANCE, type BearerTokenMalformedError } from './bearer-token.ts';\nimport { ENTITY_CONFLICT_ERROR_INSTANCE, type EntityConflictError } from './entity-conflict.ts';\nimport { ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE, type EntityCredentialsInvalidError } from './entity-credentials-invalid.ts';\nimport { ENTITY_INACTIVE_ERROR_INSTANCE, type EntityInactiveError } from './entity-inactive.ts';\nimport { ENTITY_NOT_FOUND_ERROR_INSTANCE, type EntityNotFoundError } from './entity-not-found.ts';\nimport { INTERNAL_ERROR_INSTANCE, type InternalError } from './internal.ts';\nimport { LOGIN_THROTTLED_ERROR_INSTANCE, type LoginThrottledError } from './login-throttled.ts';\nimport { MFA_THROTTLED_ERROR_INSTANCE, type MfaThrottledError } from './mfa-throttled.ts';\nimport { UNAUTHORIZED_ERROR_INSTANCE, type UnauthorizedError } from './unauthorized.ts';\n\nexport function isAuthHeaderError(input: unknown): input is AuthHeaderError {\n    if (matchesInstanceof(input, AUTH_HEADER_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED;\n}\n\nexport function isBearerTokenMalformedError(input: unknown): input is BearerTokenMalformedError {\n    if (matchesInstanceof(input, BEARER_TOKEN_MALFORMED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.HTTP_BEARER_TOKEN_MALFORMED;\n}\n\nexport function isBadRequestError(input: unknown): input is BadRequestError {\n    if (matchesInstanceof(input, BAD_REQUEST_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.BAD_REQUEST;\n}\n\nexport function isValidationError(input: unknown): input is ValidationError {\n    if (matchesInstanceof(input, VALIDATION_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.BAD_REQUEST;\n}\n\nexport function isUnauthorizedError(input: unknown): input is UnauthorizedError {\n    if (matchesInstanceof(input, UNAUTHORIZED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.IDENTITY_UNAUTHORIZED;\n}\n\nexport function isEntityNotFoundError(input: unknown): input is EntityNotFoundError {\n    if (matchesInstanceof(input, ENTITY_NOT_FOUND_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_NOT_FOUND;\n}\n\nexport function isEntityConflictError(input: unknown): input is EntityConflictError {\n    if (matchesInstanceof(input, ENTITY_CONFLICT_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_CONFLICT;\n}\n\nexport function isEntityInactiveError(input: unknown): input is EntityInactiveError {\n    if (matchesInstanceof(input, ENTITY_INACTIVE_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_INACTIVE;\n}\n\nexport function isEntityCredentialsInvalidError(input: unknown): input is EntityCredentialsInvalidError {\n    if (matchesInstanceof(input, ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_CREDENTIALS_INVALID;\n}\n\nexport function isInternalError(input: unknown): input is InternalError {\n    if (matchesInstanceof(input, INTERNAL_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.INTERNAL_ERROR;\n}\n\nexport function isLoginThrottledError(input: unknown): input is LoginThrottledError {\n    if (matchesInstanceof(input, LOGIN_THROTTLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.LOGIN_ATTEMPT_THROTTLED;\n}\n\nexport function isMfaThrottledError(input: unknown): input is MfaThrottledError {\n    if (matchesInstanceof(input, MFA_THROTTLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.MFA_ATTEMPT_THROTTLED;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isError } from './check.ts';\n\n/**\n * Normalize an arbitrary thrown value into an `Error` instance.\n *\n * Useful at error-pipeline boundaries (catch blocks, error middleware,\n * fallbacks) where TypeScript hands you `unknown` but downstream code\n * wants a real `Error` to inspect or rethrow. Duck-typed: any value\n * passing `isError` is returned as-is. Strings become `new Error(str)`;\n * any other value is stringified.\n */\nexport function normalizeError(input: unknown): Error {\n    if (isError(input)) {\n        return input;\n    }\n\n    if (typeof input === 'string') {\n        return new Error(input);\n    }\n\n    return new Error(String(input));\n}\n\n","/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@ebec/core';\n\n/**\n * Convert an `Error` (or any value with a `toJSON()` method) into a\n * plain object suitable for embedding in a JSON response body.\n *\n * Calls `input.toJSON()` if present — preserves every attribute the\n * error chose to surface (`code`, `cause`, `errors`, `issues`, `data`,\n * AuthupError sub-class fields, ...). Falls back to spreading the\n * Error's enumerable own properties alongside the standard\n * `name` / `message` pair, so caller-attached fields survive.\n *\n * Pair with `normalizeError` to handle arbitrary thrown values:\n * `serializeError(normalizeError(e))`.\n */\nexport function serializeError(input: Error): Record<string, any> {\n    if ('toJSON' in input && typeof input.toJSON === 'function') {\n        const output = input.toJSON();\n        if (isObject(output)) {\n            return output;\n        }\n    }\n\n    return {\n        ...input,\n        name: input.name,\n        message: input.message,\n    };\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from './constants.ts';\n\n/**\n * Default mapping from `ErrorCode` to HTTP status. Adapters apply this and\n * may layer their own overrides on top. Codes not listed here fall back\n * to 400 (Bad Request) — which is the right default for \"validation /\n * malformed-request\" style errors.\n *\n * The mapping mirrors the HTTP statuses produced by the pre-refactor\n * `@ebec/http`-coupled error classes, with one intentional change:\n *\n * - `OAUTH_CLIENT_INVALID`: 400 → **401**, per RFC 6749 §5.2 (`invalid_client`\n *   responses should use 401). Surfaces as a behavior change in HTTP-level\n *   tests asserting `status: 400, code: OAUTH_CLIENT_INVALID`.\n */\nexport const ERROR_CODE_TO_STATUS: Readonly<Partial<Record<`${ErrorCode}`, number>>> = {\n    // 401\n    [ErrorCode.OAUTH_CLIENT_INVALID]: 401,\n    [ErrorCode.HTTP_BEARER_TOKEN_MALFORMED]: 401,\n    [ErrorCode.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED]: 401,\n    [ErrorCode.IDENTITY_UNAUTHORIZED]: 401,\n\n    // 403\n    [ErrorCode.PERMISSION_NOT_FOUND]: 403,\n    [ErrorCode.PERMISSION_DENIED]: 403,\n    [ErrorCode.PERMISSION_EVALUATION_FAILED]: 403,\n\n    // 404\n    [ErrorCode.ENTITY_NOT_FOUND]: 404,\n    [ErrorCode.JWK_NOT_FOUND]: 404,\n\n    // 409\n    [ErrorCode.ENTITY_CONFLICT]: 409,\n\n    // 429\n    [ErrorCode.LOGIN_ATTEMPT_THROTTLED]: 429,\n    [ErrorCode.MFA_ATTEMPT_THROTTLED]: 429,\n\n    // 500\n    [ErrorCode.INTERNAL_ERROR]: 500,\n\n    // 502\n    [ErrorCode.UPSTREAM_ERROR]: 502,\n\n    // 507\n    [ErrorCode.STORAGE_INSUFFICIENT]: 507,\n};\n\n/**\n * Resolve an HTTP status for a given error code. Unknown codes fall back\n * to `fallback` (default 400).\n */\nexport function httpStatusFromCode(code: string, fallback = 400): number {\n    return ERROR_CODE_TO_STATUS[code as `${ErrorCode}`] ?? fallback;\n}\n\n/**\n * Resolve a semantic `ErrorCode` for a foreign HTTP status. Used at the\n * boundary where a non-AuthupError (e.g. `@ebec/http` HTTPError thrown by\n * the framework, or a foreign service response) enters our system and\n * needs to be normalized into an `AuthupError` with an authup-vocabulary\n * code. Status is the only stable handshake across the two vocabularies.\n *\n * Default mapping covers the common HTTP statuses. Anything 5xx\n * collapses to `INTERNAL_ERROR`; unknown 4xx collapses to `BAD_REQUEST`.\n */\nexport function codeFromHttpStatus(status: number): ErrorCode {\n    if (status === 404) return ErrorCode.ENTITY_NOT_FOUND;\n    if (status === 409) return ErrorCode.ENTITY_CONFLICT;\n    if (status === 401) return ErrorCode.IDENTITY_UNAUTHORIZED;\n    if (status === 403) return ErrorCode.PERMISSION_DENIED;\n    if (status === 429) return ErrorCode.LOGIN_ATTEMPT_THROTTLED;\n    if (status === 507) return ErrorCode.STORAGE_INSUFFICIENT;\n    if (status >= 500) return ErrorCode.INTERNAL_ERROR;\n    return ErrorCode.BAD_REQUEST;\n}\n"],"mappings":";;AAOA,IAAY,YAAL,yBAAA,WAAA;CAEH,UAAA,iBAAA;CACA,UAAA,oBAAA;;;;;;;;CASA,UAAA,oBAAA;CAGA,UAAA,uCAAA;CACA,UAAA,iCAAA;CAGA,UAAA,2BAAA;CAGA,UAAA,gCAAA;CACA,UAAA,qBAAA;CACA,UAAA,sBAAA;CACA,UAAA,qBAAA;CACA,UAAA,6BAAA;CAGA,UAAA,2BAAA;CACA,UAAA,gCAAA;CACA,UAAA,iCAAA;CACA,UAAA,yBAAA;CACA,UAAA,6BAAA;CACA,UAAA,2BAAA;CACA,UAAA,0BAAA;CACA,UAAA,8CAAA;CACA,UAAA,8CAAA;CAGA,UAAA,0BAAA;CAGA,UAAA,iBAAA;CACA,UAAA,mBAAA;CAGA,UAAA,iBAAA;CACA,UAAA,kBAAA;CACA,UAAA,iBAAA;CAGA,UAAA,iCAAA;CACA,UAAA,0BAAA;CACA,UAAA,+BAAA;CACA,UAAA,yBAAA;CACA,UAAA,kCAAA;CACA,UAAA,2BAAA;CACA,UAAA,0BAAA;CACA,UAAA,wBAAA;CACA,UAAA,yBAAA;CACA,UAAA,gCAAA;CACA,UAAA,sCAAA;CACA,UAAA,4BAAA;CACA,UAAA,qCAAA;CACA,UAAA,yBAAA;CACA,UAAA,8BAAA;CAGA,UAAA,0BAAA;CACA,UAAA,uBAAA;CACA,UAAA,kCAAA;CAGA,UAAA,gCAAA;CACA,UAAA,sCAAA;CACA,UAAA,sCAAA;;AACJ,EAAA,CAAA,CAAA;;;ACrEA,MAAa,wBAAwB,OAAO,IAAI,4BAA4B;AAE5E,IAAa,cAAb,cAAiC,UAAU;CACvC;CAEA,YAAY,OAA0B;EAClC,MAAM,KAAK;EACX,iBAAe,MAAM,qBAAqB;EAE1C,IAAI,SAAS,OAAO,UAAU,YAAY,MAAM,MAC5C,KAAK,OAAO,MAAM;CAE1B;;;;;;CAOA,SAAkB;EACd,OAAO;GACH,GAAG,MAAM,OAAO;GAChB,GAAI,KAAK,QAAQ,CAAC;IACjBA,wBAAsBC,2BAAyB,IAAI;EACxD;CACJ;AACJ;;;AC7BA,MAAa,8BAA8B,OAAO,IAAI,kCAAkC;AAExF,IAAa,oBAAb,cAAuC,YAAY;CAC/C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAJgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAKhG,CAAC;EACD,iBAAe,MAAM,2BAA2B;CACpD;AACJ;;;ACbA,MAAa,6BAA6B,OAAO,IAAI,gCAAgC;AAErF,IAAa,kBAAb,MAAa,wBAAwB,kBAAkB;CACnD,YAAY,SAAiB;EACzB,MAAM;GACF,MAAA;GACA;EACJ,CAAC;EACD,iBAAe,MAAM,0BAA0B;CACnD;CAEA,OAAO,gBAAgB,MAAc;EACjC,OAAO,IAAI,gBAAgB,iCAAiC,KAAK,mBAAmB;CACxF;AACJ;;;ACbA,MAAa,6BAA6B,OAAO,IAAI,gCAAgC;AAErF,IAAa,kBAAb,cAAqC,YAAY;CAC7C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,GAHgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAIhG,CAAC;EACD,iBAAe,MAAM,0BAA0B;CACnD;AACJ;;;ACZA,MAAa,wCAAwC,OAAO,IAAI,0CAA0C;AAE1G,IAAa,4BAAb,cAA+C,kBAAkB;CAC7D,YAAY,SAAkB;EAC1B,MAAM;GACF,MAAA;GACA,SAAS,WAAW;EACxB,CAAC;EACD,iBAAe,MAAM,qCAAqC;CAC9D;AACJ;;;;;;;;;;;;ACIA,SAAgB,QAAQ,OAAgC;CACpD,OAAOC,UAAW,KAAK;AAC3B;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cAAc,OAAsC;CAChE,IAAI,CAAC,SAAS,KAAK,GACf,OAAO;CAGX,IAAI,CAAC,MAAM,QAAQ,MAAMC,sBAAoB,GACzC,OAAO;CAGX,OAAOC,oBAAkB,OAAO,qBAAqB;AACzD;;;AC9CA,MAAa,4BAA4B,OAAO,IAAI,gCAAgC;;;;;;;AAQpF,IAAa,kBAAb,cAAqC,YAAY;CAC7C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,GAHgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAIhG,CAAC;EACD,iBAAe,MAAM,yBAAyB;CAClD;AACJ;;;ACjBA,MAAa,iCAAiC,OAAO,IAAI,oCAAoC;AAE7F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,oBAAoB;GACpD,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,8BAA8B;CACvD;AACJ;;;ACbA,MAAa,4CAA4C,OAAO,IAAI,8CAA8C;AAElH,IAAa,gCAAb,cAAmD,YAAY;CAC3D,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,6BAA6B;GAC7D,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,yCAAyC;CAClE;AACJ;;;ACbA,MAAa,iCAAiC,OAAO,IAAI,oCAAoC;AAE7F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,iBAAiB;GACjD,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,8BAA8B;CACvD;AACJ;;;ACbA,MAAa,kCAAkC,OAAO,IAAI,oCAAoC;AAE9F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,mBAAmB;GACnD,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,+BAA+B;CACxD;AACJ;;;ACbA,MAAa,0BAA0B,OAAO,IAAI,8BAA8B;AAEhF,IAAa,gBAAb,cAAmC,YAAY;CAC3C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAJgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAKhG,CAAC;EACD,iBAAe,MAAM,uBAAuB;CAChD;AACJ;;;ACZA,MAAa,iCAAiC,OAAO,IAAI,oCAAoC;AAS7F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAAoC;EAC5C,MAAM,EAAE,YAAY,GAAG,SAAS,SAAS,CAAC;EAC1C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAAG;GACH,MAAM;IACF,GAAI,OAAO,eAAe,WAAW,EAAE,WAAW,IAAI,CAAC;IACvD,GAAI,KAAK,QAAQ,CAAC;GACtB;EACJ,CAAC;EACD,iBAAe,MAAM,8BAA8B;CACvD;AACJ;;;ACvBA,MAAa,+BAA+B,OAAO,IAAI,kCAAkC;AASzF,IAAa,oBAAb,cAAuC,YAAY;CAC/C,YAAY,OAAkC;EAC1C,MAAM,EAAE,YAAY,GAAG,SAAS,SAAS,CAAC;EAC1C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAAG;GACH,MAAM;IACF,GAAI,OAAO,eAAe,WAAW,EAAE,WAAW,IAAI,CAAC;IACvD,GAAI,KAAK,QAAQ,CAAC;GACtB;EACJ,CAAC;EACD,iBAAe,MAAM,4BAA4B;CACrD;AACJ;;;ACZA,SAAgB,kBAAkB,OAA0C;CACxE,IAAIC,oBAAkB,OAAO,0BAA0B,GAAG,OAAO;CACjE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,4BAA4B,OAAoD;CAC5F,IAAIA,oBAAkB,OAAO,qCAAqC,GAAG,OAAO;CAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,kBAAkB,OAA0C;CACxE,IAAIA,oBAAkB,OAAO,0BAA0B,GAAG,OAAO;CACjE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,kBAAkB,OAA0C;CACxE,IAAIA,oBAAkB,OAAO,yBAAyB,GAAG,OAAO;CAChE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,oBAAoB,OAA4C;CAC5E,IAAIA,oBAAkB,OAAO,2BAA2B,GAAG,OAAO;CAClE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,+BAA+B,GAAG,OAAO;CACtE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,8BAA8B,GAAG,OAAO;CACrE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,8BAA8B,GAAG,OAAO;CACrE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,gCAAgC,OAAwD;CACpG,IAAIA,oBAAkB,OAAO,yCAAyC,GAAG,OAAO;CAChF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,gBAAgB,OAAwC;CACpE,IAAIA,oBAAkB,OAAO,uBAAuB,GAAG,OAAO;CAC9D,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,8BAA8B,GAAG,OAAO;CACrE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,oBAAoB,OAA4C;CAC5E,IAAIA,oBAAkB,OAAO,4BAA4B,GAAG,OAAO;CACnE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;;;;;;;;;;;;AC3EA,SAAgB,eAAe,OAAuB;CAClD,IAAI,QAAQ,KAAK,GACb,OAAO;CAGX,IAAI,OAAO,UAAU,UACjB,OAAO,IAAI,MAAM,KAAK;CAG1B,OAAO,IAAI,MAAM,OAAO,KAAK,CAAC;AAClC;;;;;;;;;;;;;;;;ACNA,SAAgB,eAAe,OAAmC;CAC9D,IAAI,YAAY,SAAS,OAAO,MAAM,WAAW,YAAY;EACzD,MAAM,SAAS,MAAM,OAAO;EAC5B,IAAI,SAAS,MAAM,GACf,OAAO;CAEf;CAEA,OAAO;EACH,GAAG;EACH,MAAM,MAAM;EACZ,SAAS,MAAM;CACnB;AACJ;;;;;;;;;;;;;;;;ACbA,MAAa,uBAA0E;EAEjD,mBAAA;EACO,2BAAA;EACM,iCAAA;EACZ,0BAAA;EAGD,yBAAA;EACH,sBAAA;EACW,iCAAA;EAGZ,qBAAA;EACH,kBAAA;EAGE,oBAAA;EAGQ,4BAAA;EACF,0BAAA;EAGP,mBAAA;EAGA,mBAAA;EAGM,yBAAA;AACtC;;;;;AAMA,SAAgB,mBAAmB,MAAc,WAAW,KAAa;CACrE,OAAO,qBAAqB,SAA2B;AAC3D;;;;;;;;;;;AAYA,SAAgB,mBAAmB,QAA2B;CAC1D,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,UAAU,KAAK,OAAA;CACnB,OAAA;AACJ"}
+{"version":3,"file":"index.mjs","names":["INSTANCEOF_PROPERTY","serializeInstanceofChain","isRawError","INSTANCEOF_PROPERTY","matchesInstanceof","matchesInstanceof"],"sources":["../src/constants.ts","../src/module.ts","../src/built-in/unauthorized.ts","../src/built-in/auth-header.ts","../src/built-in/bad-request.ts","../src/built-in/bearer-token.ts","../src/check.ts","../src/built-in/validation.ts","../src/built-in/entity-conflict.ts","../src/built-in/entity-credentials-invalid.ts","../src/built-in/entity-inactive.ts","../src/built-in/entity-not-found.ts","../src/built-in/internal.ts","../src/built-in/login-throttled.ts","../src/built-in/mfa-throttled.ts","../src/built-in/check.ts","../src/normalize.ts","../src/serialize.ts","../src/status.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum ErrorCode {\n    // Generic\n    BAD_REQUEST = 'bad_request',\n    INTERNAL_ERROR = 'internal_error',\n\n    /**\n     * An outbound call to a service this server depends on failed, either\n     * as a transport failure or as an error answer. Distinct from\n     * INTERNAL_ERROR so a caller can tell \"authup is broken\" from \"authup\n     * could not reach a dependency\", and so the upstream status is never\n     * mirrored onto authup's own response.\n     */\n    UPSTREAM_ERROR = 'upstream_error',\n\n    // HTTP Codes\n    HTTP_HEADER_AUTH_TYPE_UNSUPPORTED = 'unsupported_auth_header_type',\n    HTTP_BEARER_TOKEN_MALFORMED = 'bearer_token_malformed',\n\n    // Identity Auth\n    IDENTITY_UNAUTHORIZED = 'identity_unauthorized',\n\n    // Entity Codes\n    ENTITY_CREDENTIALS_INVALID = 'invalid_credentials',\n    ENTITY_INACTIVE = 'entity_inactive',\n    ENTITY_NOT_FOUND = 'entity_not_found',\n    ENTITY_CONFLICT = 'entity_conflict',\n    ENTITY_RELATION_INVALID = 'entity_relation_invalid',\n\n    // Identity Codes\n    REGISTRATION_DISABLED = 'registration_disabled',\n    PASSWORD_RECOVERY_DISABLED = 'password_recovery_disabled',\n    EMAIL_VERIFICATION_REQUIRED = 'email_verification_required',\n    RESET_TOKEN_EXPIRED = 'reset_token_expired',\n    LOGIN_ATTEMPT_THROTTLED = 'login_attempt_throttled',\n    MFA_ATTEMPT_THROTTLED = 'mfa_attempt_throttled',\n    MFA_NOT_CONFIGURABLE = 'mfa_not_configurable',\n    IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED = 'identity_provider_account_already_linked',\n    IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED = 'identity_provider_account_unlink_blocked',\n\n    // Storage Codes\n    STORAGE_INSUFFICIENT = 'storage_insufficient',\n\n    // JWK Codes\n    JWK_INVALID = 'jwk_invalid',\n    JWK_NOT_FOUND = 'jwk_not_found',\n\n    // JWT Codes\n    JWT_INVALID = 'invalid_token',\n    JWT_INACTIVE = 'inactive_token',\n    JWT_EXPIRED = 'expired_token',\n\n    // Oauth2 Codes\n    OAUTH_REDIRECT_URI_MISMATCH = 'redirect_uri_mismatch',\n    OAUTH_CLIENT_INVALID = 'invalid_client',\n    OAUTH_CLIENT_UNAUTHORIZED = 'unauthorized_client',\n    OAUTH_GRANT_INVALID = 'invalid_grant',\n    OAUTH_GRANT_TYPE_UNSUPPORTED = 'unsupported_token_grant_type',\n    OAUTH_REQUEST_INVALID = 'invalid_request',\n    OAUTH_LOGIN_REQUIRED = 'login_required',\n    OAUTH_MFA_REQUIRED = 'mfa_required',\n    OAUTH_ACCESS_DENIED = 'access_denied',\n    OAUTH_INTERACTION_REQUIRED = 'interaction_required',\n    OAUTH_ACCOUNT_SELECTION_REQUIRED = 'account_selection_required',\n    OAUTH_CONSENT_REQUIRED = 'consent_required',\n    OAUTH_RESPONSE_TYPE_UNSUPPORTED = 'unsupported_response_type',\n    OAUTH_SCOPE_INVALID = 'invalid_scope',\n    OAUTH_SCOPE_INSUFFICIENT = 'insufficient_scope',\n\n    // Permission Codes\n    PERMISSION_NOT_FOUND = 'permission_not_found',\n    PERMISSION_DENIED = 'permission_denied',\n    PERMISSION_EVALUATION_FAILED = 'permission_evaluation_failed',\n\n    // Policy Codes\n    POLICY_EVALUATOR_NOT_FOUND = 'policy_evaluator_not_found',\n    POLICY_EVALUATOR_NOT_PROCESSABLE = 'policy_evaluator_not_processable',\n    POLICY_EVALUATOR_CONTEXT_INVALID = 'policy_evaluator_context_invalid',\n}\n","/*\n * Copyright (c) 2024-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthupErrorInput } from './types.ts';\nimport {\n    BaseError,\n    INSTANCEOF_PROPERTY,\n    markInstanceof,\n    serializeInstanceofChain,\n} from '@ebec/core';\n\nexport const AUTHUP_ERROR_INSTANCE = Symbol.for('@authup/errors/AuthupError');\n\nexport class AuthupError extends BaseError {\n    public readonly data?: Record<string, any>;\n\n    constructor(input?: AuthupErrorInput) {\n        super(input);\n        markInstanceof(this, AUTHUP_ERROR_INSTANCE);\n\n        if (input && typeof input !== 'string' && input.data) {\n            this.data = input.data;\n        }\n    }\n\n    /**\n     * `super.toJSON()` already emits the serialized marker chain, but the\n     * `data` spread runs after it — re-stamped last so a `data` key cannot\n     * displace the genuine chain.\n     */\n    override toJSON() {\n        return {\n            ...super.toJSON(),\n            ...(this.data ?? {}),\n            [INSTANCEOF_PROPERTY]: serializeInstanceofChain(this),\n        };\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const UNAUTHORIZED_ERROR_INSTANCE = Symbol.for('@authup/errors/UnauthorizedError');\n\nexport class UnauthorizedError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.IDENTITY_UNAUTHORIZED,\n            message: 'Authentication required.',\n            ...options,\n        });\n        markInstanceof(this, UNAUTHORIZED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { UnauthorizedError } from './unauthorized.ts';\n\nexport const AUTH_HEADER_ERROR_INSTANCE = Symbol.for('@authup/errors/AuthHeaderError');\n\nexport class AuthHeaderError extends UnauthorizedError {\n    constructor(message: string) {\n        super({\n            code: ErrorCode.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED,\n            message,\n        });\n        markInstanceof(this, AUTH_HEADER_ERROR_INSTANCE);\n    }\n\n    static unsupportedType(type: string) {\n        return new AuthHeaderError(`The authorization header type ${type} is not supported.`);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const BAD_REQUEST_ERROR_INSTANCE = Symbol.for('@authup/errors/BadRequestError');\n\nexport class BadRequestError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.BAD_REQUEST,\n            ...options,\n        });\n        markInstanceof(this, BAD_REQUEST_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2022-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { UnauthorizedError } from './unauthorized.ts';\n\nexport const BEARER_TOKEN_MALFORMED_ERROR_INSTANCE = Symbol.for('@authup/errors/BearerTokenMalformedError');\n\nexport class BearerTokenMalformedError extends UnauthorizedError {\n    constructor(message?: string) {\n        super({\n            code: ErrorCode.HTTP_BEARER_TOKEN_MALFORMED,\n            message: message ?? 'The Authorization header is malformed.',\n        });\n        markInstanceof(this, BEARER_TOKEN_MALFORMED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    INSTANCEOF_PROPERTY,\n    isObject,\n    isError as isRawError,\n    matchesInstanceof,\n} from '@ebec/core';\nimport type { AuthupError } from './module.ts';\nimport { AUTHUP_ERROR_INSTANCE } from './module.ts';\n\n/**\n * Duck-type guard for `Error`.\n *\n * Re-exports `@ebec/core`'s shape-based check: `input` matches when it\n * carries the standard `name` / `message` / `stack` triplet, regardless\n * of which realm or class hierarchy produced it. Use this instead of\n * `instanceof Error` for cross-realm boundaries (worker threads,\n * duplicate-module copies) where `instanceof` can yield false negatives.\n */\nexport function isError(input: unknown): input is Error {\n    return isRawError(input);\n}\n\n/**\n * Duck-type guard for AuthupError.\n *\n * The chain decides, and only the chain: it matches when the AuthupError\n * marker is in it, as the native symbol (in-process) or its serialized\n * string form (JSON-rehydrated). Subclass instances accumulate this\n * marker, so any AuthupError subclass (`OAuth2Error`, `JWTError`, ...)\n * matches too, while a foreign `@ebec/core` error (rapiq's ParseError,\n * which since 2.2 also carries an `issues` array) does not: it announced\n * its ancestry and AuthupError is not in it.\n *\n * Chain-less input never matches. A shape-based fallback for pre-chain\n * JSON (`BaseError` + `issues: Issue[]`) used to cover that case, but\n * `@ebec/core`'s `isBaseError` became chain-only, so that fallback could\n * never fire — and now that every `BaseError` carries an `issues` array,\n * the shape it checked for would no longer distinguish an AuthupError\n * from any other ebec-derived error anyway. There is no reliable way left\n * to recognise a chain-less legacy payload as specifically an AuthupError.\n */\nexport function isAuthupError(input: unknown): input is AuthupError {\n    if (!isObject(input)) {\n        return false;\n    }\n\n    if (!Array.isArray(input[INSTANCEOF_PROPERTY])) {\n        return false;\n    }\n\n    return matchesInstanceof(input, AUTHUP_ERROR_INSTANCE);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const VALIDATION_ERROR_INSTANCE = Symbol.for('@authup/errors/ValidationError');\n\n/**\n * A domain/business-rule violation raised by core logic. Deliberately NOT\n * named after an HTTP status: core code stays transport-agnostic, and the HTTP\n * adapter maps its `ErrorCode.BAD_REQUEST` to a 400 response\n * (`httpStatusFromCode`). Prefer this over `BadRequestError` in `core/**`.\n */\nexport class ValidationError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.BAD_REQUEST,\n            ...options,\n        });\n        markInstanceof(this, VALIDATION_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_CONFLICT_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityConflictError');\n\nexport class EntityConflictError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_CONFLICT,\n            message: entity ? `The ${entity} already exists.` : 'Entity already exists.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_CONFLICT_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityCredentialsInvalidError');\n\nexport class EntityCredentialsInvalidError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_CREDENTIALS_INVALID,\n            message: entity ? `The ${entity} credentials are invalid.` : 'Credentials are invalid.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_INACTIVE_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityInactiveError');\n\nexport class EntityInactiveError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_INACTIVE,\n            message: entity ? `The ${entity} is inactive.` : 'Entity is inactive.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_INACTIVE_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupEntityErrorOptions } from '../types.ts';\n\nexport const ENTITY_NOT_FOUND_ERROR_INSTANCE = Symbol.for('@authup/errors/EntityNotFoundError');\n\nexport class EntityNotFoundError extends AuthupError {\n    constructor(input?: string | AuthupEntityErrorOptions) {\n        const options: AuthupEntityErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        const { entity, ...rest } = options;\n        super({\n            code: ErrorCode.ENTITY_NOT_FOUND,\n            message: entity ? `The ${entity} was not found.` : 'Entity not found.',\n            ...rest,\n        });\n        markInstanceof(this, ENTITY_NOT_FOUND_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from '../constants.ts';\nimport { markInstanceof } from '@ebec/core';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const INTERNAL_ERROR_INSTANCE = Symbol.for('@authup/errors/InternalError');\n\nexport class InternalError extends AuthupError {\n    constructor(input?: string | AuthupErrorOptions) {\n        const options: AuthupErrorOptions = typeof input === 'string' ? { message: input } : (input ?? {});\n        super({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: 'An internal error occurred.',\n            ...options,\n        });\n        markInstanceof(this, INTERNAL_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const LOGIN_THROTTLED_ERROR_INSTANCE = Symbol.for('@authup/errors/LoginThrottledError');\n\nexport type LoginThrottledErrorOptions = AuthupErrorOptions & {\n    /**\n     * Seconds until the sliding throttle window can release the pair.\n     */\n    retryAfter?: number,\n};\n\nexport class LoginThrottledError extends AuthupError {\n    constructor(input?: LoginThrottledErrorOptions) {\n        const { retryAfter, ...rest } = input ?? {};\n        super({\n            code: ErrorCode.LOGIN_ATTEMPT_THROTTLED,\n            message: 'Too many failed login attempts. Please try again later.',\n            ...rest,\n            data: {\n                ...(typeof retryAfter === 'number' ? { retryAfter } : {}),\n                ...(rest.data ?? {}),\n            },\n        });\n        markInstanceof(this, LOGIN_THROTTLED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { markInstanceof } from '@ebec/core';\nimport { ErrorCode } from '../constants.ts';\nimport { AuthupError } from '../module.ts';\nimport type { AuthupErrorOptions } from '../types.ts';\n\nexport const MFA_THROTTLED_ERROR_INSTANCE = Symbol.for('@authup/errors/MfaThrottledError');\n\nexport type MfaThrottledErrorOptions = AuthupErrorOptions & {\n    /**\n     * Seconds until the exponential backoff releases the account.\n     */\n    retryAfter?: number,\n};\n\nexport class MfaThrottledError extends AuthupError {\n    constructor(input?: MfaThrottledErrorOptions) {\n        const { retryAfter, ...rest } = input ?? {};\n        super({\n            code: ErrorCode.MFA_ATTEMPT_THROTTLED,\n            message: 'Too many failed verification attempts. Please try again later.',\n            ...rest,\n            data: {\n                ...(typeof retryAfter === 'number' ? { retryAfter } : {}),\n                ...(rest.data ?? {}),\n            },\n        });\n        markInstanceof(this, MFA_THROTTLED_ERROR_INSTANCE);\n    }\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isAuthupError } from '../check.ts';\nimport { ErrorCode } from '../constants.ts';\nimport { matchesInstanceof } from '@ebec/core';\nimport { AUTH_HEADER_ERROR_INSTANCE, type AuthHeaderError } from './auth-header.ts';\nimport { BAD_REQUEST_ERROR_INSTANCE, type BadRequestError } from './bad-request.ts';\nimport { VALIDATION_ERROR_INSTANCE, type ValidationError } from './validation.ts';\nimport { BEARER_TOKEN_MALFORMED_ERROR_INSTANCE, type BearerTokenMalformedError } from './bearer-token.ts';\nimport { ENTITY_CONFLICT_ERROR_INSTANCE, type EntityConflictError } from './entity-conflict.ts';\nimport { ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE, type EntityCredentialsInvalidError } from './entity-credentials-invalid.ts';\nimport { ENTITY_INACTIVE_ERROR_INSTANCE, type EntityInactiveError } from './entity-inactive.ts';\nimport { ENTITY_NOT_FOUND_ERROR_INSTANCE, type EntityNotFoundError } from './entity-not-found.ts';\nimport { INTERNAL_ERROR_INSTANCE, type InternalError } from './internal.ts';\nimport { LOGIN_THROTTLED_ERROR_INSTANCE, type LoginThrottledError } from './login-throttled.ts';\nimport { MFA_THROTTLED_ERROR_INSTANCE, type MfaThrottledError } from './mfa-throttled.ts';\nimport { UNAUTHORIZED_ERROR_INSTANCE, type UnauthorizedError } from './unauthorized.ts';\n\nexport function isAuthHeaderError(input: unknown): input is AuthHeaderError {\n    if (matchesInstanceof(input, AUTH_HEADER_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED;\n}\n\nexport function isBearerTokenMalformedError(input: unknown): input is BearerTokenMalformedError {\n    if (matchesInstanceof(input, BEARER_TOKEN_MALFORMED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.HTTP_BEARER_TOKEN_MALFORMED;\n}\n\nexport function isBadRequestError(input: unknown): input is BadRequestError {\n    if (matchesInstanceof(input, BAD_REQUEST_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.BAD_REQUEST;\n}\n\nexport function isValidationError(input: unknown): input is ValidationError {\n    if (matchesInstanceof(input, VALIDATION_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.BAD_REQUEST;\n}\n\nexport function isUnauthorizedError(input: unknown): input is UnauthorizedError {\n    if (matchesInstanceof(input, UNAUTHORIZED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.IDENTITY_UNAUTHORIZED;\n}\n\nexport function isEntityNotFoundError(input: unknown): input is EntityNotFoundError {\n    if (matchesInstanceof(input, ENTITY_NOT_FOUND_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_NOT_FOUND;\n}\n\nexport function isEntityConflictError(input: unknown): input is EntityConflictError {\n    if (matchesInstanceof(input, ENTITY_CONFLICT_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_CONFLICT;\n}\n\nexport function isEntityInactiveError(input: unknown): input is EntityInactiveError {\n    if (matchesInstanceof(input, ENTITY_INACTIVE_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_INACTIVE;\n}\n\nexport function isEntityCredentialsInvalidError(input: unknown): input is EntityCredentialsInvalidError {\n    if (matchesInstanceof(input, ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.ENTITY_CREDENTIALS_INVALID;\n}\n\nexport function isInternalError(input: unknown): input is InternalError {\n    if (matchesInstanceof(input, INTERNAL_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.INTERNAL_ERROR;\n}\n\nexport function isLoginThrottledError(input: unknown): input is LoginThrottledError {\n    if (matchesInstanceof(input, LOGIN_THROTTLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.LOGIN_ATTEMPT_THROTTLED;\n}\n\nexport function isMfaThrottledError(input: unknown): input is MfaThrottledError {\n    if (matchesInstanceof(input, MFA_THROTTLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.MFA_ATTEMPT_THROTTLED;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isError } from './check.ts';\n\n/**\n * Normalize an arbitrary thrown value into an `Error` instance.\n *\n * Useful at error-pipeline boundaries (catch blocks, error middleware,\n * fallbacks) where TypeScript hands you `unknown` but downstream code\n * wants a real `Error` to inspect or rethrow. Duck-typed: any value\n * passing `isError` is returned as-is. Strings become `new Error(str)`;\n * any other value is stringified.\n */\nexport function normalizeError(input: unknown): Error {\n    if (isError(input)) {\n        return input;\n    }\n\n    if (typeof input === 'string') {\n        return new Error(input);\n    }\n\n    return new Error(String(input));\n}\n\n","/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@ebec/core';\n\n/**\n * Convert an `Error` (or any value with a `toJSON()` method) into a\n * plain object suitable for embedding in a JSON response body.\n *\n * Calls `input.toJSON()` if present — preserves every attribute the\n * error chose to surface (`code`, `cause`, `errors`, `issues`, `data`,\n * AuthupError sub-class fields, ...). Falls back to spreading the\n * Error's enumerable own properties alongside the standard\n * `name` / `message` pair, so caller-attached fields survive.\n *\n * Pair with `normalizeError` to handle arbitrary thrown values:\n * `serializeError(normalizeError(e))`.\n */\nexport function serializeError(input: Error): Record<string, any> {\n    if ('toJSON' in input && typeof input.toJSON === 'function') {\n        const output = input.toJSON();\n        if (isObject(output)) {\n            return output;\n        }\n    }\n\n    return {\n        ...input,\n        name: input.name,\n        message: input.message,\n    };\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode } from './constants.ts';\n\n/**\n * Default mapping from `ErrorCode` to HTTP status. Adapters apply this and\n * may layer their own overrides on top. Codes not listed here fall back\n * to 400 (Bad Request) — which is the right default for \"validation /\n * malformed-request\" style errors.\n *\n * The mapping mirrors the HTTP statuses produced by the pre-refactor\n * `@ebec/http`-coupled error classes, with one intentional change:\n *\n * - `OAUTH_CLIENT_INVALID`: 400 → **401**, per RFC 6749 §5.2 (`invalid_client`\n *   responses should use 401). Surfaces as a behavior change in HTTP-level\n *   tests asserting `status: 400, code: OAUTH_CLIENT_INVALID`.\n * - The three `JWT_*` codes: 400 (the unlisted fallback) → **401**, per\n *   RFC 6750 §3.1, which is the status for a resource request carrying an\n *   expired or otherwise unusable bearer. They had never been listed, so a\n *   dead bearer answered 400 while a MISSING one answered 401, and no\n *   client could tell \"your credential died\" from \"your request was\n *   malformed\" by status alone. The token endpoint is where RFC 6749 §5.2\n *   and RFC 7662/7009 want something else, and each of its handlers says so\n *   at its own call site rather than here: the refresh grant re-throws a\n *   verification failure as `invalid_grant`, introspection reports one as\n *   `active: false`, and revocation answers its ordinary success. A new\n *   token-endpoint path that verifies a JWT has to do the same - this map\n *   cannot know which surface it is on.\n */\nexport const ERROR_CODE_TO_STATUS: Readonly<Partial<Record<`${ErrorCode}`, number>>> = {\n    // 401\n    [ErrorCode.OAUTH_CLIENT_INVALID]: 401,\n    [ErrorCode.HTTP_BEARER_TOKEN_MALFORMED]: 401,\n    [ErrorCode.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED]: 401,\n    [ErrorCode.IDENTITY_UNAUTHORIZED]: 401,\n    [ErrorCode.JWT_EXPIRED]: 401,\n    [ErrorCode.JWT_INACTIVE]: 401,\n    [ErrorCode.JWT_INVALID]: 401,\n\n    // 403\n    [ErrorCode.PERMISSION_NOT_FOUND]: 403,\n    [ErrorCode.PERMISSION_DENIED]: 403,\n    [ErrorCode.PERMISSION_EVALUATION_FAILED]: 403,\n\n    // 404\n    [ErrorCode.ENTITY_NOT_FOUND]: 404,\n    [ErrorCode.JWK_NOT_FOUND]: 404,\n\n    // 409\n    [ErrorCode.ENTITY_CONFLICT]: 409,\n\n    // 429\n    [ErrorCode.LOGIN_ATTEMPT_THROTTLED]: 429,\n    [ErrorCode.MFA_ATTEMPT_THROTTLED]: 429,\n\n    // 500\n    [ErrorCode.INTERNAL_ERROR]: 500,\n\n    // 502\n    [ErrorCode.UPSTREAM_ERROR]: 502,\n\n    // 507\n    [ErrorCode.STORAGE_INSUFFICIENT]: 507,\n};\n\n/**\n * Resolve an HTTP status for a given error code. Unknown codes fall back\n * to `fallback` (default 400).\n */\nexport function httpStatusFromCode(code: string, fallback = 400): number {\n    return ERROR_CODE_TO_STATUS[code as `${ErrorCode}`] ?? fallback;\n}\n\n/**\n * Resolve a semantic `ErrorCode` for a foreign HTTP status. Used at the\n * boundary where a non-AuthupError (e.g. `@ebec/http` HTTPError thrown by\n * the framework, or a foreign service response) enters our system and\n * needs to be normalized into an `AuthupError` with an authup-vocabulary\n * code. Status is the only stable handshake across the two vocabularies.\n *\n * Default mapping covers the common HTTP statuses. Anything 5xx\n * collapses to `INTERNAL_ERROR`; unknown 4xx collapses to `BAD_REQUEST`.\n */\nexport function codeFromHttpStatus(status: number): ErrorCode {\n    if (status === 404) return ErrorCode.ENTITY_NOT_FOUND;\n    if (status === 409) return ErrorCode.ENTITY_CONFLICT;\n    if (status === 401) return ErrorCode.IDENTITY_UNAUTHORIZED;\n    if (status === 403) return ErrorCode.PERMISSION_DENIED;\n    if (status === 429) return ErrorCode.LOGIN_ATTEMPT_THROTTLED;\n    if (status === 507) return ErrorCode.STORAGE_INSUFFICIENT;\n    if (status >= 500) return ErrorCode.INTERNAL_ERROR;\n    return ErrorCode.BAD_REQUEST;\n}\n"],"mappings":";;AAOA,IAAY,YAAL,yBAAA,WAAA;CAEH,UAAA,iBAAA;CACA,UAAA,oBAAA;;;;;;;;CASA,UAAA,oBAAA;CAGA,UAAA,uCAAA;CACA,UAAA,iCAAA;CAGA,UAAA,2BAAA;CAGA,UAAA,gCAAA;CACA,UAAA,qBAAA;CACA,UAAA,sBAAA;CACA,UAAA,qBAAA;CACA,UAAA,6BAAA;CAGA,UAAA,2BAAA;CACA,UAAA,gCAAA;CACA,UAAA,iCAAA;CACA,UAAA,yBAAA;CACA,UAAA,6BAAA;CACA,UAAA,2BAAA;CACA,UAAA,0BAAA;CACA,UAAA,8CAAA;CACA,UAAA,8CAAA;CAGA,UAAA,0BAAA;CAGA,UAAA,iBAAA;CACA,UAAA,mBAAA;CAGA,UAAA,iBAAA;CACA,UAAA,kBAAA;CACA,UAAA,iBAAA;CAGA,UAAA,iCAAA;CACA,UAAA,0BAAA;CACA,UAAA,+BAAA;CACA,UAAA,yBAAA;CACA,UAAA,kCAAA;CACA,UAAA,2BAAA;CACA,UAAA,0BAAA;CACA,UAAA,wBAAA;CACA,UAAA,yBAAA;CACA,UAAA,gCAAA;CACA,UAAA,sCAAA;CACA,UAAA,4BAAA;CACA,UAAA,qCAAA;CACA,UAAA,yBAAA;CACA,UAAA,8BAAA;CAGA,UAAA,0BAAA;CACA,UAAA,uBAAA;CACA,UAAA,kCAAA;CAGA,UAAA,gCAAA;CACA,UAAA,sCAAA;CACA,UAAA,sCAAA;;AACJ,EAAA,CAAA,CAAA;;;ACrEA,MAAa,wBAAwB,OAAO,IAAI,4BAA4B;AAE5E,IAAa,cAAb,cAAiC,UAAU;CACvC;CAEA,YAAY,OAA0B;EAClC,MAAM,KAAK;EACX,iBAAe,MAAM,qBAAqB;EAE1C,IAAI,SAAS,OAAO,UAAU,YAAY,MAAM,MAC5C,KAAK,OAAO,MAAM;CAE1B;;;;;;CAOA,SAAkB;EACd,OAAO;GACH,GAAG,MAAM,OAAO;GAChB,GAAI,KAAK,QAAQ,CAAC;IACjBA,wBAAsBC,2BAAyB,IAAI;EACxD;CACJ;AACJ;;;AC7BA,MAAa,8BAA8B,OAAO,IAAI,kCAAkC;AAExF,IAAa,oBAAb,cAAuC,YAAY;CAC/C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAJgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAKhG,CAAC;EACD,iBAAe,MAAM,2BAA2B;CACpD;AACJ;;;ACbA,MAAa,6BAA6B,OAAO,IAAI,gCAAgC;AAErF,IAAa,kBAAb,MAAa,wBAAwB,kBAAkB;CACnD,YAAY,SAAiB;EACzB,MAAM;GACF,MAAA;GACA;EACJ,CAAC;EACD,iBAAe,MAAM,0BAA0B;CACnD;CAEA,OAAO,gBAAgB,MAAc;EACjC,OAAO,IAAI,gBAAgB,iCAAiC,KAAK,mBAAmB;CACxF;AACJ;;;ACbA,MAAa,6BAA6B,OAAO,IAAI,gCAAgC;AAErF,IAAa,kBAAb,cAAqC,YAAY;CAC7C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,GAHgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAIhG,CAAC;EACD,iBAAe,MAAM,0BAA0B;CACnD;AACJ;;;ACZA,MAAa,wCAAwC,OAAO,IAAI,0CAA0C;AAE1G,IAAa,4BAAb,cAA+C,kBAAkB;CAC7D,YAAY,SAAkB;EAC1B,MAAM;GACF,MAAA;GACA,SAAS,WAAW;EACxB,CAAC;EACD,iBAAe,MAAM,qCAAqC;CAC9D;AACJ;;;;;;;;;;;;ACIA,SAAgB,QAAQ,OAAgC;CACpD,OAAOC,UAAW,KAAK;AAC3B;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,cAAc,OAAsC;CAChE,IAAI,CAAC,SAAS,KAAK,GACf,OAAO;CAGX,IAAI,CAAC,MAAM,QAAQ,MAAMC,sBAAoB,GACzC,OAAO;CAGX,OAAOC,oBAAkB,OAAO,qBAAqB;AACzD;;;AC9CA,MAAa,4BAA4B,OAAO,IAAI,gCAAgC;;;;;;;AAQpF,IAAa,kBAAb,cAAqC,YAAY;CAC7C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,GAHgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAIhG,CAAC;EACD,iBAAe,MAAM,yBAAyB;CAClD;AACJ;;;ACjBA,MAAa,iCAAiC,OAAO,IAAI,oCAAoC;AAE7F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,oBAAoB;GACpD,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,8BAA8B;CACvD;AACJ;;;ACbA,MAAa,4CAA4C,OAAO,IAAI,8CAA8C;AAElH,IAAa,gCAAb,cAAmD,YAAY;CAC3D,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,6BAA6B;GAC7D,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,yCAAyC;CAClE;AACJ;;;ACbA,MAAa,iCAAiC,OAAO,IAAI,oCAAoC;AAE7F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,iBAAiB;GACjD,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,8BAA8B;CACvD;AACJ;;;ACbA,MAAa,kCAAkC,OAAO,IAAI,oCAAoC;AAE9F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAA2C;EAEnD,MAAM,EAAE,QAAQ,GAAG,SADuB,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAEtG,MAAM;GACF,MAAA;GACA,SAAS,SAAS,OAAO,OAAO,mBAAmB;GACnD,GAAG;EACP,CAAC;EACD,iBAAe,MAAM,+BAA+B;CACxD;AACJ;;;ACbA,MAAa,0BAA0B,OAAO,IAAI,8BAA8B;AAEhF,IAAa,gBAAb,cAAmC,YAAY;CAC3C,YAAY,OAAqC;EAE7C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAJgC,OAAO,UAAU,WAAW,EAAE,SAAS,MAAM,IAAK,SAAS,CAAC;EAKhG,CAAC;EACD,iBAAe,MAAM,uBAAuB;CAChD;AACJ;;;ACZA,MAAa,iCAAiC,OAAO,IAAI,oCAAoC;AAS7F,IAAa,sBAAb,cAAyC,YAAY;CACjD,YAAY,OAAoC;EAC5C,MAAM,EAAE,YAAY,GAAG,SAAS,SAAS,CAAC;EAC1C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAAG;GACH,MAAM;IACF,GAAI,OAAO,eAAe,WAAW,EAAE,WAAW,IAAI,CAAC;IACvD,GAAI,KAAK,QAAQ,CAAC;GACtB;EACJ,CAAC;EACD,iBAAe,MAAM,8BAA8B;CACvD;AACJ;;;ACvBA,MAAa,+BAA+B,OAAO,IAAI,kCAAkC;AASzF,IAAa,oBAAb,cAAuC,YAAY;CAC/C,YAAY,OAAkC;EAC1C,MAAM,EAAE,YAAY,GAAG,SAAS,SAAS,CAAC;EAC1C,MAAM;GACF,MAAA;GACA,SAAS;GACT,GAAG;GACH,MAAM;IACF,GAAI,OAAO,eAAe,WAAW,EAAE,WAAW,IAAI,CAAC;IACvD,GAAI,KAAK,QAAQ,CAAC;GACtB;EACJ,CAAC;EACD,iBAAe,MAAM,4BAA4B;CACrD;AACJ;;;ACZA,SAAgB,kBAAkB,OAA0C;CACxE,IAAIC,oBAAkB,OAAO,0BAA0B,GAAG,OAAO;CACjE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,4BAA4B,OAAoD;CAC5F,IAAIA,oBAAkB,OAAO,qCAAqC,GAAG,OAAO;CAC5E,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,kBAAkB,OAA0C;CACxE,IAAIA,oBAAkB,OAAO,0BAA0B,GAAG,OAAO;CACjE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,kBAAkB,OAA0C;CACxE,IAAIA,oBAAkB,OAAO,yBAAyB,GAAG,OAAO;CAChE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,oBAAoB,OAA4C;CAC5E,IAAIA,oBAAkB,OAAO,2BAA2B,GAAG,OAAO;CAClE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,+BAA+B,GAAG,OAAO;CACtE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,8BAA8B,GAAG,OAAO;CACrE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,8BAA8B,GAAG,OAAO;CACrE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,gCAAgC,OAAwD;CACpG,IAAIA,oBAAkB,OAAO,yCAAyC,GAAG,OAAO;CAChF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,gBAAgB,OAAwC;CACpE,IAAIA,oBAAkB,OAAO,uBAAuB,GAAG,OAAO;CAC9D,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,sBAAsB,OAA8C;CAChF,IAAIA,oBAAkB,OAAO,8BAA8B,GAAG,OAAO;CACrE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;AAEA,SAAgB,oBAAoB,OAA4C;CAC5E,IAAIA,oBAAkB,OAAO,4BAA4B,GAAG,OAAO;CACnE,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO;CAClC,OAAO,MAAM,SAAA;AACjB;;;;;;;;;;;;AC3EA,SAAgB,eAAe,OAAuB;CAClD,IAAI,QAAQ,KAAK,GACb,OAAO;CAGX,IAAI,OAAO,UAAU,UACjB,OAAO,IAAI,MAAM,KAAK;CAG1B,OAAO,IAAI,MAAM,OAAO,KAAK,CAAC;AAClC;;;;;;;;;;;;;;;;ACNA,SAAgB,eAAe,OAAmC;CAC9D,IAAI,YAAY,SAAS,OAAO,MAAM,WAAW,YAAY;EACzD,MAAM,SAAS,MAAM,OAAO;EAC5B,IAAI,SAAS,MAAM,GACf,OAAO;CAEf;CAEA,OAAO;EACH,GAAG;EACH,MAAM,MAAM;EACZ,SAAS,MAAM;CACnB;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACDA,MAAa,uBAA0E;EAEjD,mBAAA;EACO,2BAAA;EACM,iCAAA;EACZ,0BAAA;EACV,kBAAA;EACC,mBAAA;EACD,kBAAA;EAGS,yBAAA;EACH,sBAAA;EACW,iCAAA;EAGZ,qBAAA;EACH,kBAAA;EAGE,oBAAA;EAGQ,4BAAA;EACF,0BAAA;EAGP,mBAAA;EAGA,mBAAA;EAGM,yBAAA;AACtC;;;;;AAMA,SAAgB,mBAAmB,MAAc,WAAW,KAAa;CACrE,OAAO,qBAAqB,SAA2B;AAC3D;;;;;;;;;;;AAYA,SAAgB,mBAAmB,QAA2B;CAC1D,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,WAAW,KAAK,OAAA;CACpB,IAAI,UAAU,KAAK,OAAA;CACnB,OAAA;AACJ"}

package/dist/status.d.ts

@@ -11,6 +11,18 @@ import { ErrorCode } from './constants.ts';
  * - `OAUTH_CLIENT_INVALID`: 400 → **401**, per RFC 6749 §5.2 (`invalid_client`
  *   responses should use 401). Surfaces as a behavior change in HTTP-level
  *   tests asserting `status: 400, code: OAUTH_CLIENT_INVALID`.
+ * - The three `JWT_*` codes: 400 (the unlisted fallback) → **401**, per
+ *   RFC 6750 §3.1, which is the status for a resource request carrying an
+ *   expired or otherwise unusable bearer. They had never been listed, so a
+ *   dead bearer answered 400 while a MISSING one answered 401, and no
+ *   client could tell "your credential died" from "your request was
+ *   malformed" by status alone. The token endpoint is where RFC 6749 §5.2
+ *   and RFC 7662/7009 want something else, and each of its handlers says so
+ *   at its own call site rather than here: the refresh grant re-throws a
+ *   verification failure as `invalid_grant`, introspection reports one as
+ *   `active: false`, and revocation answers its ordinary success. A new
+ *   token-endpoint path that verifies a JWT has to do the same - this map
+ *   cannot know which surface it is on.
  */
 export declare const ERROR_CODE_TO_STATUS: Readonly<Partial<Record<`${ErrorCode}`, number>>>;
 /**

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CA+BlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAS5D"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,CAkClF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAS5D"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/errors",
     "type": "module",
-    "version": "1.0.0-beta.62",
+    "version": "1.0.0-beta.63",
     "description": "Package containing error codes and basic error classes.",
     "license": "Apache-2.0",
     "exports": {