@authup/server-core 1.0.0-beta.35 → 1.0.0-beta.37

package/dist/core/oauth2/grant-types/refresh-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.mjs","names":["JWTError","buildOAuth2BearerTokenResponse","OAuth2BaseGrant","OAuth2RefreshTokenGrant","refreshTokenIssuer","tokenVerifier","tokenRevoker","ctx","accessTokenIssuer","sessionManager","runWith","input","options","payload","verify","revoke","session_id","payloadPropertyInvalid","session","findOneById","userAgent","user_agent","ipAddress","ip_address","refresh","accessToken","accessTokenPayload","issue","remote_address","exp","buildExp","refreshToken","refreshTokenPayload"],"sources":["../../../../src/core/oauth2/grant-types/refresh-token.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRevoker, IOAuth2TokenVerifier } from '../token/index.ts';\nimport { OAuth2BaseGrant } from './base.ts';\nimport type { IOAuth2Grant, OAuth2GrantRunWIthOptions, OAuth2RefreshTokenGrantContext } from './types.ts';\n\nexport class OAuth2RefreshTokenGrant extends OAuth2BaseGrant<string | OAuth2TokenPayload> implements IOAuth2Grant {\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenVerifier : IOAuth2TokenVerifier;\n\n    protected tokenRevoker : IOAuth2TokenRevoker;\n\n    constructor(ctx: OAuth2RefreshTokenGrantContext) {\n        super({\n            accessTokenIssuer: ctx.accessTokenIssuer,\n            sessionManager: ctx.sessionManager,\n        });\n\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.tokenRevoker = ctx.tokenRevoker;\n    }\n\n    async runWith(\n        input: string | OAuth2TokenPayload,\n        options: OAuth2GrantRunWIthOptions = {},\n    ) : Promise<OAuth2TokenGrantResponse> {\n        let payload : OAuth2TokenPayload;\n        if (typeof input === 'string') {\n            payload = await this.tokenVerifier.verify(input);\n        } else {\n            payload = input;\n        }\n\n        await this.tokenRevoker.revoke(payload);\n\n        if (!payload.session_id) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        const session = await this.sessionManager.findOneById(payload.session_id);\n        if (!session) {\n            throw JWTError.payloadPropertyInvalid('session_id');\n        }\n\n        await this.sessionManager.verify(session);\n\n        if (options.userAgent) {\n            session.user_agent = options.userAgent;\n        }\n        if (options.ipAddress) {\n            session.ip_address = options.ipAddress;\n        }\n        await this.sessionManager.refresh(session);\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.accessTokenIssuer.buildExp(),\n        });\n\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue({\n            ...payload,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            exp: this.refreshTokenIssuer.buildExp(),\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;AAcA,IAAaG,0BAAb,cAA6CD,gBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAM;GACFC,mBAAmBD,IAAIC;GACvBC,gBAAgBF,IAAIE;GACxB,CAAA;AAEA,OAAKL,qBAAqBG,IAAIH;AAE9B,OAAKC,gBAAgBE,IAAIF;AACzB,OAAKC,eAAeC,IAAID;;CAG5B,MAAMI,QACFC,OACAC,UAAqC,EAAE,EACL;EAClC,IAAIC;AACJ,MAAI,OAAOF,UAAU,SACjBE,WAAU,MAAM,KAAKR,cAAcS,OAAOH,MAAAA;MAE1CE,WAAUF;AAGd,QAAM,KAAKL,aAAaS,OAAOF,QAAAA;AAE/B,MAAI,CAACA,QAAQG,WACT,OAAMhB,SAASiB,uBAAuB,aAAA;EAG1C,MAAMC,UAAU,MAAM,KAAKT,eAAeU,YAAYN,QAAQG,WAAU;AACxE,MAAI,CAACE,QACD,OAAMlB,SAASiB,uBAAuB,aAAA;AAG1C,QAAM,KAAKR,eAAeK,OAAOI,QAAAA;AAEjC,MAAIN,QAAQQ,UACRF,SAAQG,aAAaT,QAAQQ;AAEjC,MAAIR,QAAQU,UACRJ,SAAQK,aAAaX,QAAQU;AAEjC,QAAM,KAAKb,eAAee,QAAQN,QAAAA;EAElC,MAAM,CAACO,aAAaC,sBAAsB,MAAM,KAAKlB,kBAAkBmB,MAAM;GACzE,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKrB,kBAAkBsB,UAAQ;GACxC,CAAA;EAEA,MAAM,CAACC,cAAcC,uBAAuB,MAAM,KAAK5B,mBAAmBuB,MAAM;GAC5E,GAAGd;GACHQ,YAAYH,QAAQG;GACpBO,gBAAgBV,QAAQK;GACxBM,KAAK,KAAKzB,mBAAmB0B,UAAQ;GACzC,CAAA;AAEA,SAAO7B,+BAA+B;GAClCwB;GACAC;GACAK;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/robot-credentials.mjs

@@ -0,0 +1,35 @@
+import { OAuth2BaseGrant } from "./base.mjs";
+import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { IdentityType, ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/grant-types/robot-credentials.ts
+var RobotCredentialsGrant = class extends OAuth2BaseGrant {
+	async runWith(input, options = {}) {
+		const session = await this.sessionManager.create({
+			user_agent: options.userAgent,
+			ip_address: options.ipAddress,
+			realm_id: input.realm_id,
+			sub: input.id,
+			sub_kind: IdentityType.ROBOT
+		});
+		const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({
+			session_id: session.id,
+			user_agent: session.user_agent,
+			remote_address: session.ip_address,
+			scope: ScopeName.GLOBAL,
+			sub: input.id,
+			sub_kind: OAuth2SubKind.ROBOT,
+			realm_id: input.realm.id,
+			realm_name: input.realm?.id,
+			client_id: input.client_id || void 0
+		});
+		return buildOAuth2BearerTokenResponse({
+			accessToken,
+			accessTokenPayload
+		});
+	}
+};
+//#endregion
+export { RobotCredentialsGrant };
+
+//# sourceMappingURL=robot-credentials.mjs.map

package/dist/core/oauth2/grant-types/robot-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"robot-credentials.mjs","names":["OAuth2SubKind","IdentityType","ScopeName","OAuth2BaseGrant","buildOAuth2BearerTokenResponse","RobotCredentialsGrant","runWith","input","options","session","sessionManager","create","user_agent","userAgent","ip_address","ipAddress","realm_id","sub","id","sub_kind","ROBOT","accessToken","accessTokenPayload","accessTokenIssuer","issue","session_id","remote_address","scope","GLOBAL","realm","realm_name","client_id","undefined"],"sources":["../../../../src/core/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { Robot } from '@authup/core-kit';\nimport {\n    IdentityType,\n    ScopeName,\n} from '@authup/core-kit';\nimport { OAuth2BaseGrant } from './base.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { OAuth2GrantRunWIthOptions } from './types.ts';\n\nexport class RobotCredentialsGrant extends OAuth2BaseGrant<Robot> {\n    async runWith(input: Robot, options: OAuth2GrantRunWIthOptions = {}) : Promise<OAuth2TokenGrantResponse> {\n        const session = await this.sessionManager.create({\n            user_agent: options.userAgent,\n            ip_address: options.ipAddress,\n            realm_id: input.realm_id,\n            sub: input.id,\n            sub_kind: IdentityType.ROBOT,\n        });\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue({\n            session_id: session.id,\n            user_agent: session.user_agent,\n            remote_address: session.ip_address,\n            scope: ScopeName.GLOBAL,\n            sub: input.id,\n            sub_kind: OAuth2SubKind.ROBOT,\n            realm_id: input.realm.id,\n            realm_name: input.realm?.id,\n            client_id: input.client_id || undefined,\n        });\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,wBAAb,cAA2CF,gBAAAA;CACvC,MAAMG,QAAQC,OAAcC,UAAqC,EAAE,EAAsC;EACrG,MAAMC,UAAU,MAAM,KAAKC,eAAeC,OAAO;GAC7CC,YAAYJ,QAAQK;GACpBC,YAAYN,QAAQO;GACpBC,UAAUT,MAAMS;GAChBC,KAAKV,MAAMW;GACXC,UAAUlB,aAAamB;GAC3B,CAAA;EAEA,MAAM,CAACC,aAAaC,sBAAsB,MAAM,KAAKC,kBAAkBC,MAAM;GACzEC,YAAYhB,QAAQS;GACpBN,YAAYH,QAAQG;GACpBc,gBAAgBjB,QAAQK;GACxBa,OAAOzB,UAAU0B;GACjBX,KAAKV,MAAMW;GACXC,UAAUnB,cAAcoB;GACxBJ,UAAUT,MAAMsB,MAAMX;GACtBY,YAAYvB,MAAMsB,OAAOX;GACzBa,WAAWxB,MAAMwB,aAAaC,KAAAA;GAClC,CAAA;AAEA,SAAO5B,+BAA+B;GAClCiB;GACAC;GACJ,CAAA"}

package/dist/core/oauth2/grant-types/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/helpers/erorr.mjs

@@ -0,0 +1,26 @@
+import { sanitizeError } from "../../../utils/error.mjs";
+import "../../../utils/index.mjs";
+import { isObject } from "@authup/kit";
+import { OAuth2Error, OAuth2ErrorCode } from "@authup/specs";
+import { AuthupError } from "@authup/errors";
+//#region src/core/oauth2/helpers/erorr.ts
+/**
+* Transforms an unknown error to an OAuth2Error.
+*
+* @param err
+*/ function toOAuth2Error(err) {
+	if (err instanceof OAuth2Error) return err;
+	let next;
+	if (err instanceof AuthupError) next = err;
+	else next = sanitizeError(err);
+	next.data = {
+		error: OAuth2ErrorCode.INVALID_REQUEST,
+		error_description: next.message,
+		...isObject(next.data) ? next.data : {}
+	};
+	return next;
+}
+//#endregion
+export { toOAuth2Error };
+
+//# sourceMappingURL=erorr.mjs.map

package/dist/core/oauth2/helpers/erorr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"erorr.mjs","names":["OAuth2Error","OAuth2ErrorCode","AuthupError","isObject","sanitizeError","toOAuth2Error","err","next","data","error","INVALID_REQUEST","error_description","message"],"sources":["../../../../src/core/oauth2/helpers/erorr.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error, OAuth2ErrorCode } from '@authup/specs';\nimport { AuthupError } from '@authup/errors';\nimport { isObject } from '@authup/kit';\nimport { sanitizeError } from '../../../utils/index.ts';\n\n/**\n * Transforms an unknown error to an OAuth2Error.\n *\n * @param err\n */\nexport function toOAuth2Error(err: unknown) : AuthupError | OAuth2Error {\n    if (err instanceof OAuth2Error) {\n        return err;\n    }\n\n    let next : AuthupError;\n    if (err instanceof AuthupError) {\n        next = err;\n    } else {\n        next = sanitizeError(err);\n    }\n\n    next.data = {\n        error: OAuth2ErrorCode.INVALID_REQUEST,\n        error_description: next.message,\n        ...(isObject(next.data) ? next.data : {}),\n    };\n\n    return next;\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBK,cAAcC,KAAY;AACtC,KAAIA,eAAeN,YACf,QAAOM;CAGX,IAAIC;AACJ,KAAID,eAAeJ,YACfK,QAAOD;KAEPC,QAAOH,cAAcE,IAAAA;AAGzBC,MAAKC,OAAO;EACRC,OAAOR,gBAAgBS;EACvBC,mBAAmBJ,KAAKK;EACxB,GAAIT,SAASI,KAAKC,KAAI,GAAID,KAAKC,OAAO,EAAE;EAC5C;AAEA,QAAOD"}

package/dist/core/oauth2/helpers/index.mjs

@@ -0,0 +1,2 @@
+import { toOAuth2Error } from "./erorr.mjs";
+export { toOAuth2Error };

package/dist/core/oauth2/index.mjs

@@ -0,0 +1,28 @@
+import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
+import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestVerifier } from "./authorization/code-request/verifier/module.mjs";
+import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-request/validator.mjs";
+import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
+import { OAuth2Authorization } from "./authorization/module.mjs";
+import "./authorization/index.mjs";
+import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
+import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
+import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
+import { IdentityGrantType } from "./grant-types/identity.mjs";
+import { PasswordGrantType } from "./grant-types/password.mjs";
+import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
+import { RobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
+import "./grant-types/index.mjs";
+import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
+import "./openid/index.mjs";
+import { OAuth2ScopeAttributesResolver } from "./scope/resolver.mjs";
+import "./scope/index.mjs";
+import { OAuth2AccessTokenIssuer } from "./token/issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./token/issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./token/issuer/refresh/module.mjs";
+import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
+import { OAuth2TokenSigner } from "./token/signer/module.mjs";
+import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
+import "./token/index.mjs";
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, RobotCredentialsGrant, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier };

package/dist/core/oauth2/key/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/key/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/openid/claims.mjs

@@ -0,0 +1,75 @@
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/openid/claims.ts
+var OAuth2OpenIDClaimsBuilder = class {
+	clientMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}]
+	};
+	robotMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}]
+	};
+	userMap = {
+		name: "name",
+		family_name: "last_name",
+		given_name: "first_name",
+		nickname: "display_name",
+		preferred_username: "display_name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			if (value instanceof Date) return Math.floor(value.getTime() / 1e3);
+			return value;
+		}],
+		email: "email",
+		email_verified: "active"
+	};
+	/**
+	* Build OpenID Claims form Oauth2 Identity.
+	*
+	* @param identity
+	*/ fromIdentity(identity) {
+		if (identity.type === OAuth2SubKind.CLIENT) return this.fromClient(identity.data);
+		if (identity.type === OAuth2SubKind.ROBOT) return this.fromRobot(identity.data);
+		return this.fromUser(identity.data);
+	}
+	fromClient(input) {
+		return this.extract(this.clientMap, input);
+	}
+	fromRobot(input) {
+		return this.extract(this.robotMap, input);
+	}
+	fromUser(input) {
+		return this.extract(this.userMap, input);
+	}
+	extract(attributeMap, attributes) {
+		const result = {};
+		const keys = Object.keys(attributeMap);
+		for (const key_ of keys) {
+			const attribute = attributeMap[key_];
+			if (typeof attribute === "string") {
+				if (hasOwnProperty(attributes, attribute)) result[key_] = attributes[attribute];
+			} else {
+				const [key, transformer] = attribute;
+				if (hasOwnProperty(attributes, key)) result[key_] = transformer(attributes[key]);
+			}
+		}
+		return result;
+	}
+};
+//#endregion
+export { OAuth2OpenIDClaimsBuilder };
+
+//# sourceMappingURL=claims.mjs.map

package/dist/core/oauth2/openid/claims.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                if (value instanceof Date) {\n                    return Math.floor(value.getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EACL;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;AACG,OAAI,OAAOA,UAAU,SACjB,QAAOC,KAAKC,MAAM,IAAIC,KAAKH,MAAAA,CAAOI,SAAO,GAAK,IAAA;AAGlD,OAAIJ,iBAAiBG,KACjB,QAAOF,KAAKC,MAAMF,MAAMI,SAAO,GAAK,IAAA;AAGxC,UAAOJ;IAEd;EAEDS,OAAO;EACPC,gBAAgB;EACpB;;;;;IAOAC,aAAaC,UAAyC;AAClD,MAAIA,SAASC,SAASpB,cAAcqB,OAChC,QAAO,KAAKC,WAAWH,SAASI,KAAI;AAGxC,MAAIJ,SAASC,SAASpB,cAAcwB,MAChC,QAAO,KAAKC,UAAUN,SAASI,KAAI;AAGvC,SAAO,KAAKG,SAASP,SAASI,KAAI;;CAGtCD,WAAWK,OAAoC;AAC3C,SAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,MAAAA;;CAGxCF,UAAUE,OAAkC;AACxC,SAAO,KAAKC,QAAQ,KAAKhB,UAAUe,MAAAA;;CAGvCD,SAASC,OAAkC;AACvC,SAAO,KAAKC,QAAQ,KAAKf,SAASc,MAAAA;;CAG5BC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,EAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,aAAAA;AACzB,OAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;AAC/B,OAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,UAAAA,CAC3BJ,QAAOG,QAAQJ,WAAWK;UAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;AAE3B,QAAIpC,eAAe+B,YAAYM,IAAAA,CAC3BL,QAAOG,QAAQG,YAAYP,WAAWM,KAAI;;;AAKtD,SAAOL"}

package/dist/core/oauth2/openid/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2OpenIDClaimsBuilder } from "./claims.mjs";
+export { OAuth2OpenIDClaimsBuilder };

package/dist/core/oauth2/response/bearer.mjs

@@ -0,0 +1,24 @@
+//#region src/core/oauth2/response/bearer.ts
+function resolveExpiresIn(payload, fallbackValue) {
+	if (payload && payload.exp) return payload.exp - Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+	return fallbackValue || 3600;
+}
+function buildOAuth2BearerTokenResponse(context) {
+	const response = {
+		access_token: context.accessToken,
+		expires_in: resolveExpiresIn(context.accessTokenPayload),
+		token_type: "Bearer"
+	};
+	if (context.accessTokenPayload) response.scope = context.accessTokenPayload.scope;
+	else if (context.scope) response.scope = context.scope;
+	if (context.refreshToken) {
+		response.refresh_token = context.refreshToken;
+		response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);
+	}
+	if (context.idToken) response.id_token = context.idToken;
+	return response;
+}
+//#endregion
+export { buildOAuth2BearerTokenResponse };
+
+//# sourceMappingURL=bearer.mjs.map

package/dist/core/oauth2/response/bearer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.mjs","names":["resolveExpiresIn","payload","fallbackValue","exp","Math","floor","Date","getTime","buildOAuth2BearerTokenResponse","context","response","access_token","accessToken","expires_in","accessTokenPayload","token_type","scope","refreshToken","refresh_token","refresh_token_expires_in","refreshTokenPayload","idToken","id_token"],"sources":["../../../../src/core/oauth2/response/bearer.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { OAuth2BearerResponseBuildContext } from './type.ts';\n\nfunction resolveExpiresIn(payload?: OAuth2TokenPayload, fallbackValue?: number) : number {\n    if (payload && payload.exp) {\n        return payload.exp - Math.floor(new Date().getTime() / 1000);\n    }\n\n    return fallbackValue || 3_600;\n}\n\nexport function buildOAuth2BearerTokenResponse(\n    context: OAuth2BearerResponseBuildContext,\n) : OAuth2TokenGrantResponse {\n    const response : OAuth2TokenGrantResponse = {\n        access_token: context.accessToken,\n        expires_in: resolveExpiresIn(context.accessTokenPayload),\n        token_type: 'Bearer',\n    };\n\n    if (context.accessTokenPayload) {\n        response.scope = context.accessTokenPayload.scope;\n    } else if (context.scope) {\n        response.scope = context.scope;\n    }\n\n    if (context.refreshToken) {\n        response.refresh_token = context.refreshToken;\n        response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);\n    }\n\n    if (context.idToken) {\n        response.id_token = context.idToken;\n    }\n\n    return response;\n}\n"],"mappings":";AAUA,SAASA,iBAAiBC,SAA8BC,eAAsB;AAC1E,KAAID,WAAWA,QAAQE,IACnB,QAAOF,QAAQE,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAG3D,QAAOL,iBAAiB;;AAG5B,SAAgBM,+BACZC,SAAyC;CAEzC,MAAMC,WAAsC;EACxCC,cAAcF,QAAQG;EACtBC,YAAYb,iBAAiBS,QAAQK,mBAAkB;EACvDC,YAAY;EAChB;AAEA,KAAIN,QAAQK,mBACRJ,UAASM,QAAQP,QAAQK,mBAAmBE;UACrCP,QAAQO,MACfN,UAASM,QAAQP,QAAQO;AAG7B,KAAIP,QAAQQ,cAAc;AACtBP,WAASQ,gBAAgBT,QAAQQ;AACjCP,WAASS,2BAA2BnB,iBAAiBS,QAAQW,oBAAmB;;AAGpF,KAAIX,QAAQY,QACRX,UAASY,WAAWb,QAAQY;AAGhC,QAAOX"}

package/dist/core/oauth2/response/index.mjs

@@ -0,0 +1,2 @@
+import { buildOAuth2BearerTokenResponse } from "./bearer.mjs";
+export { buildOAuth2BearerTokenResponse };

package/dist/core/oauth2/response/type.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/scope/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2ScopeAttributesResolver } from "./resolver.mjs";
+export { OAuth2ScopeAttributesResolver };

package/dist/core/oauth2/scope/resolver.mjs

@@ -0,0 +1,93 @@
+import { ScopeName } from "@authup/core-kit";
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind, unwrapOAuth2Scope } from "@authup/specs";
+import { distinctArray } from "smob";
+//#region src/core/oauth2/scope/resolver.ts
+var OAuth2ScopeAttributesResolver = class {
+	clientAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	robotAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	userAttributes = {
+		[ScopeName.IDENTITY]: [
+			"name",
+			"display_name",
+			"last_name",
+			"first_name"
+		],
+		[ScopeName.EMAIL]: ["email"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"updated_at",
+			"first_name",
+			"last_name",
+			"display_name",
+			"active",
+			"email"
+		]
+	};
+	/**
+	* Resolve attributes for sub kind.
+	*
+	* @param type
+	* @param scope
+	*/ resolveFor(type, scope) {
+		if (type === OAuth2SubKind.CLIENT) return this.resolveForClient(scope);
+		if (type === OAuth2SubKind.ROBOT) return this.resolveForRobot(scope);
+		return this.resolveForUser(scope);
+	}
+	resolveForClient(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.clientAttributes, scope)) attributes.push(...this.clientAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.clientAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForRobot(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.robotAttributes, scope)) attributes.push(...this.robotAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.robotAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForUser(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.userAttributes, scope)) attributes.push(...this.userAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.userAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+};
+//#endregion
+export { OAuth2ScopeAttributesResolver };
+
+//# sourceMappingURL=resolver.mjs.map

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,OAAO;GAC7BP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;GAAS;EACzE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;GAAa;GACxEP,UAAUW,QAAQ,CAAC,QAAQ;GAC3BX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;GAAQ;EAC7G;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;AACtD,MAAID,SAASX,cAAca,OACvB,QAAO,KAAKC,iBAAiBF,MAAAA;AAGjC,MAAID,SAASX,cAAce,MACvB,QAAO,KAAKC,gBAAgBJ,MAAAA;AAGhC,SAAO,KAAKK,eAAeL,MAAAA;;CAG/BE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKK,kBAAkBQ,MAAAA,CACtCM,YAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,OAAM;AAGnD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,iBAAgB,CAAEoB,MAAI,CAAA;AAC5D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKQ,iBAAiBK,MAAAA,CACrCM,YAAWE,KAAI,GAAI,KAAKb,gBAAgBK,OAAM;AAGlD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,gBAAe,CAAEiB,MAAI,CAAA;AAC3D;;;AAIR,SAAOtB,cAAcgB,WAAAA;;CAGzBD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,EAAE;EAChC,MAAMC,SAASlB,kBAAkBW,MAAAA;AAEjC,OAAK,MAAMA,SAASO,QAAQ;AACxB,OAAIpB,eAAe,KAAKS,gBAAgBI,MAAAA,CACpCM,YAAWE,KAAI,GAAI,KAAKZ,eAAeI,OAAM;AAGjD,OAAIA,UAAUd,UAAUuB,QAAQ;AAC5BH,eAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,eAAc,CAAEgB,MAAI,CAAA;AAC1D;;;AAIR,SAAOtB,cAAcgB,WAAAA"}

package/dist/core/oauth2/scope/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/index.mjs

@@ -0,0 +1,11 @@
+import { OAuth2AccessTokenIssuer } from "./issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./issuer/refresh/module.mjs";
+import "./issuer/index.mjs";
+import { OAuth2TokenRevoker } from "./revoker/module.mjs";
+import "./revoker/index.mjs";
+import { OAuth2TokenSigner } from "./signer/module.mjs";
+import "./signer/index.mjs";
+import { OAuth2TokenVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier };

package/dist/core/oauth2/token/issuer/access/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2AccessTokenIssuer } from "./module.mjs";
+export { OAuth2AccessTokenIssuer };

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -0,0 +1,28 @@
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/access/module.ts
+var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.ACCESS,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2AccessTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}

package/dist/core/oauth2/token/issuer/base.mjs

@@ -0,0 +1,26 @@
+//#region src/core/oauth2/token/issuer/base.ts
+var OAuth2BaseTokenIssuer = class {
+	options;
+	constructor(options) {
+		this.options = options || {};
+	}
+	buildIss(input = {}) {
+		if (!this.options.issuer) return;
+		if (input.realm_name) return `${this.options.issuer}/realms/${input.realm_name}`;
+		return this.options.issuer;
+	}
+	/**
+	* Build utc expire time (in seconds).
+	*
+	* @param input
+	*/ buildExp(input = {}) {
+		if (input.exp) return input.exp;
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		if (this.options.maxAge) return utc + this.options.maxAge;
+		return utc + 3600;
+	}
+};
+//#endregion
+export { OAuth2BaseTokenIssuer };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        if (input.realm_name) {\n            return `${this.options.issuer}/realms/${input.realm_name}`;\n        }\n\n        return this.options.issuer;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;AACtD,OAAKA,UAAUA,WAAW,EAAC;;CAS/BC,SAASC,QAA4B,EAAE,EAAuB;AAC1D,MAAI,CAAC,KAAKF,QAAQG,OACd;AAGJ,MAAID,MAAMG,WACN,QAAO,GAAG,KAAKL,QAAQG,OAAO,UAAUD,MAAMG;AAGlD,SAAO,KAAKL,QAAQG;;;;;;IAQxBG,SAASJ,QAA4B,EAAE,EAAW;AAC9C,MAAIA,MAAMK,IACN,QAAOL,MAAMK;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;AAC9C,MAAI,KAAKZ,QAAQa,OACb,QAAOL,MAAM,KAAKR,QAAQa;AAG9B,SAAOL,MAAM"}

package/dist/core/oauth2/token/issuer/index.mjs

@@ -0,0 +1,7 @@
+import { OAuth2AccessTokenIssuer } from "./access/module.mjs";
+import "./access/index.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+import { OAuth2RefreshTokenIssuer } from "./refresh/module.mjs";
+import "./refresh/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2OpenIDTokenIssuer } from "./module.mjs";
+export { OAuth2OpenIDTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/module.mjs

@@ -0,0 +1,47 @@
+import { OAuth2OpenIDClaimsBuilder } from "../../../openid/claims.mjs";
+import "../../../openid/index.mjs";
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { JWTError, OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/open-id/module.ts
+var OAuth2OpenIDTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	identityResolver;
+	claimsBuilder;
+	constructor(ctx) {
+		super(ctx.options);
+		this.repository = ctx.repository;
+		this.signer = ctx.signer;
+		this.identityResolver = ctx.identityResolver;
+		this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();
+	}
+	async issue(input = {}) {
+		if (!input.sub_kind) throw JWTError.payloadPropertyInvalid("sub_kind");
+		if (!input.sub) throw JWTError.payloadPropertyInvalid("sub");
+		const identity = await this.identityResolver.resolve(input.sub_kind, input.sub);
+		if (!identity) throw JWTError.payloadInvalid();
+		return this.issueWithIdentity(input, identity);
+	}
+	async issueWithIdentity(input, identity) {
+		const claims = this.claimsBuilder.fromIdentity(identity);
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			...claims,
+			kind: OAuth2TokenKind.ID_TOKEN,
+			auth_time: utc,
+			exp: this.buildExp(input),
+			updated_at: utc,
+			...iss ? { iss } : {},
+			...input.client_id ? { aud: input.client_id } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2OpenIDTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            auth_time: utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAMA,IAAIC,QAAO;AAEjB,OAAKL,aAAaI,IAAIJ;AACtB,OAAKC,SAASG,IAAIH;AAElB,OAAKC,mBAAmBE,IAAIF;AAC5B,OAAKC,gBAAgB,IAAIN,2BAAAA;;CAG7B,MAAMS,MAAMC,QAA4B,EAAE,EAAuC;AAC7E,MAAI,CAACA,MAAMC,SACP,OAAMb,SAASc,uBAAuB,WAAA;AAG1C,MAAI,CAACF,MAAMG,IACP,OAAMf,SAASc,uBAAuB,MAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,IAAG;AAGb,MAAI,CAACC,SACD,OAAMhB,SAASkB,gBAAc;AAGjC,SAAO,KAAKC,kBAAkBP,OAAOI,SAAAA;;CAGzC,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,SAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,MAAAA,EAAOC,SAAO,GAAK,IAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,MAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GACtBC,WAAWX;GACXY,KAAK,KAAKC,SAASvB,MAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,KAAI,GAAI,EAAE;GACtB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,WAAU,GAAI,EAAE;GACvD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,KAAAA;AAErC,QAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,MAAAA;AAE9C,SAAO,CAACA,OAAOV,KAAK"}

package/dist/core/oauth2/token/issuer/open-id/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/issuer/refresh/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2RefreshTokenIssuer } from "./module.mjs";
+export { OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -0,0 +1,28 @@
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/refresh/module.ts
+var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.REFRESH,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;AAcA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,EAAE,EACxC;AACE,QAAMA,QAAAA;AAEN,OAAKF,aAAaA;AAClB,OAAKC,SAASA;;CAGlB,MAAME,MAAMC,QAA4B,EAAE,EAAuC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,MAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,MAAAA;GACnB,GAAIC,MAAM,EAAEA,KAAI,GAAI,EAAE;GAC1B,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,KAAAA;AAErC,QAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,MAAAA;AAE9C,SAAO,CAACA,OAAON,KAAK"}

package/dist/core/oauth2/token/issuer/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/repository/index.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/repository/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/core/oauth2/token/revoker/index.mjs

@@ -0,0 +1,2 @@
+import { OAuth2TokenRevoker } from "./module.mjs";
+export { OAuth2TokenRevoker };