@authup/server-core 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs

@@ -0,0 +1,29 @@
+import { ClientCredentialsGrant } from "../../../../../core/oauth2/grant-types/client-credentials.mjs";
+import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
+import { ClientError } from "@authup/core-kit";
+import { getRequestHeader, getRequestIP } from "routup";
+import { readRequestBody } from "@routup/basic/body";
+//#region src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts
+var HTTPClientCredentialsGrant = class extends ClientCredentialsGrant {
+	authenticator;
+	constructor(ctx) {
+		super(ctx);
+		this.authenticator = ctx.authenticator;
+	}
+	async runWithRequest(event) {
+		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
+		const realmId = (await readRequestBody(event))?.realm_id;
+		if (!clientId) throw ClientError.credentialsInvalid();
+		const client = await this.authenticator.authenticate(clientId, clientSecret ?? "", realmId);
+		return this.runWith(client, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+		});
+	}
+};
+//#endregion
+export { HTTPClientCredentialsGrant };
+
+//# sourceMappingURL=client-credentials.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/client-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.mjs","names":["readRequestBody","ClientError","getRequestHeader","getRequestIP","ClientCredentialsGrant","extractClientCredentialsFromRequest","HTTPClientCredentialsGrant","authenticator","ctx","runWithRequest","event","clientId","clientSecret","body","realmId","realm_id","credentialsInvalid","client","authenticate","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/client-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { Client } from '@authup/core-kit';\nimport { ClientError } from '@authup/core-kit';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { ClientCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2ClientCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPClientCredentialsGrant extends ClientCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Client>;\n\n    constructor(ctx: HTTPOAuth2ClientCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const body = await readRequestBody(event);\n        const realmId = body?.realm_id;\n\n        if (!clientId) {\n            throw ClientError.credentialsInvalid();\n        }\n\n        const client = await this.authenticator.authenticate(clientId, clientSecret ?? '', realmId);\n\n        return this.runWith(client, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaM,6BAAb,cAAgDF,uBAAAA;CAClCG;CAEV,YAAYC,KAA8C;AACtD,QAAMA,IAAAA;AAEN,OAAKD,gBAAgBC,IAAID;;CAG7B,MAAME,eAAeC,OAAwD;EACzE,MAAM,EAAEC,UAAUC,iBAAiB,MAAMP,oCAAoCK,MAAAA;EAE7E,MAAMI,WAAUD,MADGb,gBAAgBU,MAAAA,GACbK;AAEtB,MAAI,CAACJ,SACD,OAAMV,YAAYe,oBAAkB;EAGxC,MAAMC,SAAS,MAAM,KAAKV,cAAcW,aAAaP,UAAUC,gBAAgB,IAAIE,QAAAA;AAEnF,SAAO,KAAKK,QAAQF,QAAQ;GACxBG,WAAWjB,aAAaO,OAAO,EAAEW,YAAY,MAAK,CAAA,IAAMC,KAAAA;GACxDC,WAAWrB,iBAAiBQ,OAAO,aAAA,IAAiBY,KAAAA;GACxD,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/identity.d.ts

@@ -0,0 +1,8 @@
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IRoutupEvent } from 'routup';
+import { IdentityGrantType } from '../../../../../core/index.ts';
+import type { IHTTPOAuth2Grant } from './types.ts';
+export declare class HTTPOAuth2IdentityGrantType extends IdentityGrantType implements IHTTPOAuth2Grant {
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,2BAA4B,SAAQ,iBAAkB,YAAW,gBAAgB;IAC1F,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAWzE"}

package/dist/adapters/http/adapters/oauth2/grant-types/identity.mjs

@@ -0,0 +1,19 @@
+import { IdentityGrantType } from "../../../../../core/oauth2/grant-types/identity.mjs";
+import "../../../../../core/index.mjs";
+import { useRequestIdentityOrFail } from "../../../request/helpers/identity.mjs";
+import "../../../request/index.mjs";
+import { getRequestHeader, getRequestIP } from "routup";
+//#region src/adapters/http/adapters/oauth2/grant-types/identity.ts
+var HTTPOAuth2IdentityGrantType = class extends IdentityGrantType {
+	runWithRequest(event) {
+		const identity = useRequestIdentityOrFail(event);
+		return this.runWith(identity.raw, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+		});
+	}
+};
+//#endregion
+export { HTTPOAuth2IdentityGrantType };
+
+//# sourceMappingURL=identity.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/identity.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.mjs","names":["getRequestHeader","getRequestIP","IdentityGrantType","useRequestIdentityOrFail","HTTPOAuth2IdentityGrantType","runWithRequest","event","identity","runWith","raw","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { IdentityGrantType } from '../../../../../core/index.ts';\nimport { useRequestIdentityOrFail } from '../../../request/index.ts';\nimport type { IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPOAuth2IdentityGrantType extends IdentityGrantType implements IHTTPOAuth2Grant {\n    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const identity = useRequestIdentityOrFail(event);\n\n        return this.runWith(\n            identity.raw,\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaI,8BAAb,cAAiDF,kBAAAA;CAC7CG,eAAeC,OAAwD;EACnE,MAAMC,WAAWJ,yBAAyBG,MAAAA;AAE1C,SAAO,KAAKE,QACRD,SAASE,KACT;GACIC,WAAWT,aAAaK,OAAO,EAAEK,YAAY,MAAK,CAAA,IAAMC,KAAAA;GACxDC,WAAWb,iBAAiBM,OAAO,aAAA,IAAiBM,KAAAA;GACxD,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.d.ts

@@ -0,0 +1,9 @@
+export * from './utils/index.ts';
+export * from './authorize.ts';
+export * from './client-credentials.ts';
+export * from './identity.ts';
+export * from './password.ts';
+export * from './refresh_token.ts';
+export * from './robot-credentials.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AAEvC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/index.mjs

@@ -0,0 +1,10 @@
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./utils/guess.mjs";
+import "./utils/index.mjs";
+import { HTTPOAuth2AuthorizeGrant } from "./authorize.mjs";
+import { HTTPClientCredentialsGrant } from "./client-credentials.mjs";
+import { HTTPOAuth2IdentityGrantType } from "./identity.mjs";
+import { HTTPPasswordGrant } from "./password.mjs";
+import { HTTPOAuth2RefreshTokenGrant } from "./refresh_token.mjs";
+import { HTTPRobotCredentialsGrant } from "./robot-credentials.mjs";
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts

@@ -0,0 +1,13 @@
+import type { User } from '@authup/core-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IRoutupEvent } from 'routup';
+import type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import { PasswordGrantType } from '../../../../../core/index.ts';
+import type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';
+export declare class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {
+    protected authenticator: ICredentialsAuthenticator<User>;
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
+    constructor(ctx: HTTPOAuth2PasswordGrantContext);
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=password.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnF,qBAAa,iBAAkB,SAAQ,iBAAkB,YAAW,gBAAgB;IAChF,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAE1D,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;gBAE9C,GAAG,EAAE,8BAA8B;IAOzC,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA4B/E"}

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs

@@ -0,0 +1,33 @@
+import { PasswordGrantType } from "../../../../../core/oauth2/grant-types/password.mjs";
+import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
+import { getRequestHeader, getRequestIP } from "routup";
+import { readRequestBody } from "@routup/basic/body";
+//#region src/adapters/http/adapters/oauth2/grant-types/password.ts
+var HTTPPasswordGrant = class extends PasswordGrantType {
+	authenticator;
+	clientAuthenticator;
+	constructor(ctx) {
+		super(ctx);
+		this.authenticator = ctx.authenticator;
+		this.clientAuthenticator = ctx.clientAuthenticator;
+	}
+	async runWithRequest(event) {
+		const { username, password, realm_id: realmId } = await readRequestBody(event) || {};
+		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
+		const client = clientId ? await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0) : void 0;
+		const user = await this.authenticator.authenticate(username, password, realmId);
+		return this.runWith({
+			user,
+			client
+		}, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+		});
+	}
+};
+//#endregion
+export { HTTPPasswordGrant };
+
+//# sourceMappingURL=password.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.mjs","names":["readRequestBody","getRequestHeader","getRequestIP","PasswordGrantType","extractClientCredentialsFromRequest","HTTPPasswordGrant","authenticator","clientAuthenticator","ctx","runWithRequest","event","body","username","password","realm_id","realmId","clientId","clientSecret","client","authenticate","undefined","user","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/password.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { User } from '@authup/core-kit';\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { ICredentialsAuthenticator, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';\nimport { PasswordGrantType } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2PasswordGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPPasswordGrant extends PasswordGrantType implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<User>;\n\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    constructor(ctx: HTTPOAuth2PasswordGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n        this.clientAuthenticator = ctx.clientAuthenticator;\n    }\n\n    async runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const {\n            username,\n            password,\n            realm_id: realmId,\n        } = body || {};\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n\n        const client = clientId ?\n            await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            ) :\n            undefined;\n\n        const user = await this.authenticator.authenticate(username, password, realmId);\n\n        return this.runWith(\n            { user, client },\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaK,oBAAb,cAAuCF,kBAAAA;CACzBG;CAEAC;CAEV,YAAYC,KAAqC;AAC7C,QAAMA,IAAAA;AAEN,OAAKF,gBAAgBE,IAAIF;AACzB,OAAKC,sBAAsBC,IAAID;;CAGnC,MAAME,eAAeC,OAAwD;EAEzE,MAAM,EACFE,UACAC,UACAC,UAAUC,YACVJ,MALeX,gBAAgBU,MAAAA,IAKvB,EAAC;EAEb,MAAM,EAAEM,UAAUC,iBAAiB,MAAMb,oCAAoCM,MAAAA;EAE7E,MAAMQ,SAASF,WACX,MAAM,KAAKT,oBAAoBY,aAC3BH,UACAC,cACA,OAAOF,YAAY,WAAWA,UAAUK,KAAAA,EAAAA,GAE5CA,KAAAA;EAEJ,MAAMC,OAAO,MAAM,KAAKf,cAAca,aAAaP,UAAUC,UAAUE,QAAAA;AAEvE,SAAO,KAAKO,QACR;GAAED;GAAMH;GAAO,EACf;GACIK,WAAWrB,aAAaQ,OAAO,EAAEc,YAAY,MAAK,CAAA,IAAMJ,KAAAA;GACxDK,WAAWxB,iBAAiBS,OAAO,aAAA,IAAiBU,KAAAA;GACxD,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts

@@ -0,0 +1,12 @@
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IRoutupEvent } from 'routup';
+import { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';
+import type { IOAuth2TokenVerifier, OAuth2ClientAuthenticator } from '../../../../../core/index.ts';
+import type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';
+export declare class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {
+    protected clientAuthenticator: OAuth2ClientAuthenticator;
+    protected refreshTokenVerifier: IOAuth2TokenVerifier;
+    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext);
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=refresh_token.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh_token.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EACR,oBAAoB,EACpB,yBAAyB,EAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGvF,qBAAa,2BAA4B,SAAQ,uBAAwB,YAAW,gBAAgB;IAChG,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,oBAAoB,EAAG,oBAAoB,CAAC;gBAE1C,GAAG,EAAE,kCAAkC;IAO7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAqC/E"}

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs

@@ -0,0 +1,37 @@
+import { OAuth2RefreshTokenGrant } from "../../../../../core/oauth2/grant-types/refresh-token.mjs";
+import "../../../../../core/index.mjs";
+import { extractClientCredentialsFromRequest } from "./utils/credentials.mjs";
+import "./utils/index.mjs";
+import { OAuth2Error } from "@authup/specs";
+import { getRequestHeader, getRequestIP } from "routup";
+import { readRequestBody } from "@routup/basic/body";
+//#region src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts
+var HTTPOAuth2RefreshTokenGrant = class extends OAuth2RefreshTokenGrant {
+	clientAuthenticator;
+	refreshTokenVerifier;
+	constructor(ctx) {
+		super(ctx);
+		this.clientAuthenticator = ctx.clientAuthenticator;
+		this.refreshTokenVerifier = ctx.tokenVerifier;
+	}
+	async runWithRequest(event) {
+		const body = await readRequestBody(event);
+		const refreshToken = body?.refresh_token;
+		if (typeof refreshToken !== "string" || refreshToken.length === 0) throw OAuth2Error.requestInvalid();
+		const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);
+		const realmId = body?.realm_id;
+		const payload = await this.refreshTokenVerifier.verify(refreshToken);
+		if (clientId) {
+			const client = await this.clientAuthenticator.authenticate(clientId, clientSecret, typeof realmId === "string" ? realmId : void 0);
+			if (payload.client_id && payload.client_id !== client.id) throw OAuth2Error.grantInvalid();
+		} else if (payload.client_id) throw OAuth2Error.clientInvalid();
+		return this.runWith(payload, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+		});
+	}
+};
+//#endregion
+export { HTTPOAuth2RefreshTokenGrant };
+
+//# sourceMappingURL=refresh_token.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh_token.mjs","names":["OAuth2Error","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","extractClientCredentialsFromRequest","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","requestInvalid","clientId","clientSecret","realmId","realm_id","payload","verify","client","authenticate","undefined","client_id","id","grantInvalid","clientInvalid","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2Error } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n    }\n\n    async runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2Error.requestInvalid();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realmId = body?.realm_id;\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken);\n\n        if (clientId) {\n            const client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2Error.grantInvalid();\n            }\n        } else if (payload.client_id) {\n            // Token was issued to a specific client — that client MUST\n            // re-authenticate (RFC 6749 §6 binding requirement).\n            throw OAuth2Error.clientInvalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaM,8BAAb,cAAiDF,wBAAAA;CACnCG;CAEAC;CAEV,YAAYC,KAAyC;AACjD,QAAMA,IAAAA;AAEN,OAAKF,sBAAsBE,IAAIF;AAC/B,OAAKC,uBAAuBC,IAAIC;;CAGpC,MAAMC,eAAeC,OAAwD;EACzE,MAAMC,OAAO,MAAMZ,gBAAgBW,MAAAA;EACnC,MAAME,eAAeD,MAAME;AAC3B,MAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,EAC5D,OAAMhB,YAAYiB,gBAAc;EAGpC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCO,MAAAA;EAC7E,MAAMQ,UAAUP,MAAMQ;EAMtB,MAAMC,UAAU,MAAM,KAAKd,qBAAqBe,OAAOT,aAAAA;AAEvD,MAAII,UAAU;GACV,MAAMM,SAAS,MAAM,KAAKjB,oBAAoBkB,aAC1CP,UACAC,cACA,OAAOC,YAAY,WAAWA,UAAUM,KAAAA,EAAAA;AAG5C,OAAIJ,QAAQK,aAAaL,QAAQK,cAAcH,OAAOI,GAClD,OAAM5B,YAAY6B,cAAY;aAE3BP,QAAQK,UAGf,OAAM3B,YAAY8B,eAAa;AAGnC,SAAO,KAAKC,QAAQT,SAAS;GACzBU,WAAW7B,aAAaS,OAAO,EAAEqB,YAAY,MAAK,CAAA,IAAMP,KAAAA;GACxDQ,WAAWhC,iBAAiBU,OAAO,aAAA,IAAiBc,KAAAA;GACxD,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.d.ts

@@ -0,0 +1,12 @@
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IRoutupEvent } from 'routup';
+import type { Robot } from '@authup/core-kit';
+import type { ICredentialsAuthenticator } from '../../../../../core/index.ts';
+import { RobotCredentialsGrant } from '../../../../../core/index.ts';
+import type { HTTPOAuth2RobotCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';
+export declare class HTTPRobotCredentialsGrant extends RobotCredentialsGrant implements IHTTPOAuth2Grant {
+    protected authenticator: ICredentialsAuthenticator<Robot>;
+    constructor(ctx: HTTPOAuth2RobotCredentialsGrantContext);
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
+}
+//# sourceMappingURL=robot-credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"robot-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,sCAAsC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE3F,qBAAa,yBAA0B,SAAQ,qBAAsB,YAAW,gBAAgB;IAC5F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;gBAE/C,GAAG,EAAE,sCAAsC;IAMjD,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiB/E"}

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs

@@ -0,0 +1,24 @@
+import { RobotCredentialsGrant } from "../../../../../core/oauth2/grant-types/robot-credentials.mjs";
+import "../../../../../core/index.mjs";
+import { getRequestHeader, getRequestIP } from "routup";
+import { readRequestBody } from "@routup/basic/body";
+//#region src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts
+var HTTPRobotCredentialsGrant = class extends RobotCredentialsGrant {
+	authenticator;
+	constructor(ctx) {
+		super(ctx);
+		this.authenticator = ctx.authenticator;
+	}
+	async runWithRequest(event) {
+		const { id, secret, realm_id: realmId } = await readRequestBody(event) || {};
+		const entity = await this.authenticator.authenticate(id, secret, realmId);
+		return this.runWith(entity, {
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			userAgent: getRequestHeader(event, "user-agent") ?? void 0
+		});
+	}
+};
+//#endregion
+export { HTTPRobotCredentialsGrant };
+
+//# sourceMappingURL=robot-credentials.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"robot-credentials.mjs","names":["readRequestBody","getRequestHeader","getRequestIP","RobotCredentialsGrant","HTTPRobotCredentialsGrant","authenticator","ctx","runWithRequest","event","body","id","secret","realm_id","realmId","entity","authenticate","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { Robot } from '@authup/core-kit';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { RobotCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RobotCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPRobotCredentialsGrant extends RobotCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Robot>;\n\n    constructor(ctx: HTTPOAuth2RobotCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const {\n            id,\n            secret,\n            realm_id: realmId,\n        } = body || {};\n        const entity = await this.authenticator.authenticate(id, secret, realmId);\n\n        return this.runWith(\n            entity,\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaI,4BAAb,cAA+CD,sBAAAA;CACjCE;CAEV,YAAYC,KAA6C;AACrD,QAAMA,IAAAA;AAEN,OAAKD,gBAAgBC,IAAID;;CAG7B,MAAME,eAAeC,OAAwD;EAEzE,MAAM,EACFE,IACAC,QACAC,UAAUC,YACVJ,MALeT,gBAAgBQ,MAAAA,IAKvB,EAAC;EACb,MAAMM,SAAS,MAAM,KAAKT,cAAcU,aAAaL,IAAIC,QAAQE,QAAAA;AAEjE,SAAO,KAAKG,QACRF,QACA;GACIG,WAAWf,aAAaM,OAAO,EAAEU,YAAY,MAAK,CAAA,IAAMC,KAAAA;GACxDC,WAAWnB,iBAAiBO,OAAO,aAAA,IAAiBW,KAAAA;GACxD,CAAA"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -0,0 +1,25 @@
+import type { Client, Robot, User } from '@authup/core-kit';
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { IRoutupEvent } from 'routup';
+import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
+export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
+    codeVerifier: IOAuth2AuthorizationCodeVerifier;
+    clientAuthenticator: OAuth2ClientAuthenticator;
+};
+export interface IHTTPOAuth2Grant {
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
+}
+export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
+    authenticator: ICredentialsAuthenticator<User>;
+    clientAuthenticator: OAuth2ClientAuthenticator;
+};
+export type HTTPOAuth2RefreshTokenGrantContext = OAuth2RefreshTokenGrantContext & {
+    clientAuthenticator: OAuth2ClientAuthenticator;
+};
+export type HTTPOAuth2ClientCredentialsGrantContext = BaseGrantContext & {
+    authenticator: ICredentialsAuthenticator<Client>;
+};
+export type HTTPOAuth2RobotCredentialsGrantContext = BaseGrantContext & {
+    authenticator: ICredentialsAuthenticator<Robot>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,YAAY,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAC1E;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts

@@ -0,0 +1,15 @@
+import type { IRoutupEvent } from 'routup';
+export type ExtractedClientCredentials = {
+    clientId?: string;
+    clientSecret?: string;
+};
+/**
+ * Extract client credentials from an OAuth2 token endpoint request.
+ *
+ * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client
+ * authentication methods in a single request. This helper rejects requests
+ * that present credentials in BOTH the Basic Authorization header and the
+ * request body.
+ */
+export declare function extractClientCredentialsFromRequest(event: IRoutupEvent): Promise<ExtractedClientCredentials>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6BlH"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -0,0 +1,58 @@
+import { OAuth2Error } from "@authup/specs";
+import { readRequestBody } from "@routup/basic/body";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts
+/**
+* Extract client credentials from an OAuth2 token endpoint request.
+*
+* Per RFC 6749 §2.3.1, the server MUST NOT support multiple client
+* authentication methods in a single request. This helper rejects requests
+* that present credentials in BOTH the Basic Authorization header and the
+* request body.
+*/ async function extractClientCredentialsFromRequest(event) {
+	const body = await readRequestBody(event);
+	const bodyClientId = readStringField(body, "client_id");
+	const bodyClientSecret = readStringField(body, "client_secret");
+	const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;
+	const basicCredentials = parseBasicCredentials(event);
+	if (hasBodyCredentials && basicCredentials) throw OAuth2Error.requestInvalid("Client credentials must be provided either via Basic Authorization header or request body, not both.");
+	if (hasBodyCredentials) {
+		if (!bodyClientId) throw OAuth2Error.requestInvalid("client_secret was provided without client_id.");
+		return {
+			clientId: bodyClientId,
+			clientSecret: bodyClientSecret
+		};
+	}
+	if (basicCredentials) return basicCredentials;
+	return {};
+}
+function readStringField(body, key) {
+	const value = body?.[key];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseBasicCredentials(event) {
+	const headerValue = event.headers.get("authorization");
+	if (!headerValue) return;
+	let header;
+	try {
+		header = parseAuthorizationHeader(headerValue);
+	} catch {
+		throw OAuth2Error.requestInvalid("Malformed Authorization header.");
+	}
+	if (header.type !== AuthorizationHeaderType.BASIC) return;
+	return {
+		clientId: formDecode(header.username),
+		clientSecret: formDecode(header.password)
+	};
+}
+function formDecode(value) {
+	try {
+		return decodeURIComponent(value.replace(/\+/g, " "));
+	} catch {
+		return value;
+	}
+}
+//#endregion
+export { extractClientCredentialsFromRequest };
+
+//# sourceMappingURL=credentials.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.mjs","names":["OAuth2Error","readRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","event","body","bodyClientId","readStringField","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","requestInvalid","clientId","clientSecret","key","value","length","undefined","headerValue","headers","get","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IRoutupEvent } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport async function extractClientCredentialsFromRequest(event: IRoutupEvent): Promise<ExtractedClientCredentials> {\n    const body = await readRequestBody(event);\n    const bodyClientId = readStringField(body, 'client_id');\n    const bodyClientSecret = readStringField(body, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(event);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2Error.requestInvalid(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2Error.requestInvalid('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nfunction readStringField(body: Record<string, any> | undefined, key: string): string | undefined {\n    const value = body?.[key];\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(event: IRoutupEvent): ExtractedClientCredentials | undefined {\n    const headerValue = event.headers.get('authorization');\n    if (!headerValue) {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2Error.requestInvalid('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAyBA,eAAsBI,oCAAoCC,OAAmB;CACzE,MAAMC,OAAO,MAAML,gBAAgBI,MAAAA;CACnC,MAAME,eAAeC,gBAAgBF,MAAM,YAAA;CAC3C,MAAMG,mBAAmBD,gBAAgBF,MAAM,gBAAA;CAC/C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBP,MAAAA;AAE/C,KAAIK,sBAAsBC,iBACtB,OAAMX,YAAYa,eACd,uGAAA;AAIR,KAAIH,oBAAoB;AAIpB,MAAI,CAACH,aACD,OAAMP,YAAYa,eAAe,gDAAA;AAErC,SAAO;GAAEC,UAAUP;GAAcQ,cAAcN;GAAiB;;AAGpE,KAAIE,iBACA,QAAOA;AAGX,QAAO,EAAC;;AAGZ,SAASH,gBAAgBF,MAAuCU,KAAW;CACvE,MAAMC,QAAQX,OAAOU;AACrB,QAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;;AAGnE,SAASP,sBAAsBP,OAAmB;CAC9C,MAAMe,cAAcf,MAAMgB,QAAQC,IAAI,gBAAA;AACtC,KAAI,CAACF,YACD;CAGJ,IAAIG;AACJ,KAAI;AACAA,WAASpB,yBAAyBiB,YAAAA;SAC9B;AAGJ,QAAMpB,YAAYa,eAAe,kCAAA;;AAGrC,KAAIU,OAAOC,SAAStB,wBAAwBuB,MACxC;AAQJ,QAAO;EACHX,UAAUY,WAAWH,OAAOI,SAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,SAAQ;EAC5C;;AAGJ,SAASF,WAAWT,OAAa;AAC7B,KAAI;AAGA,SAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,IAAA,CAAA;SAC3C;AAGJ,SAAOb"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.d.ts

@@ -0,0 +1,4 @@
+import { OAuth2TokenGrant } from '@authup/specs';
+import type { IRoutupEvent } from 'routup';
+export declare function guessOauth2GrantTypeByRequest(event: IRoutupEvent): Promise<`${OAuth2TokenGrant}` | undefined>;
+//# sourceMappingURL=guess.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,wBAAsB,6BAA6B,CAC/C,KAAK,EAAE,YAAY,GACnB,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAkE7C"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs

@@ -0,0 +1,37 @@
+import { OAuth2TokenGrant } from "@authup/specs";
+import { readRequestBody } from "@routup/basic/body";
+import { useRequestQuery } from "@routup/basic/query";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+//#region src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts
+async function guessOauth2GrantTypeByRequest(event) {
+	const body = await readRequestBody(event);
+	const query = useRequestQuery(event);
+	const pick = (key) => body?.[key] ?? query?.[key];
+	const grantType = pick("grant_type");
+	if (Object.values(OAuth2TokenGrant).includes(grantType)) return grantType;
+	const username = pick("username");
+	const password = pick("password");
+	if (username && password) return OAuth2TokenGrant.PASSWORD;
+	const robotId = pick("id");
+	const robotSecret = pick("secret");
+	if (robotId && robotSecret) return OAuth2TokenGrant.ROBOT_CREDENTIALS;
+	if (pick("refresh_token")) return OAuth2TokenGrant.REFRESH_TOKEN;
+	if (pick("code")) return OAuth2TokenGrant.AUTHORIZATION_CODE;
+	let clientId = pick("client_id");
+	let clientSecret = pick("client_secret");
+	if (!clientId && !clientSecret) {
+		const headerValue = event.headers.get("authorization");
+		if (headerValue) {
+			const header = parseAuthorizationHeader(headerValue);
+			if (header.type === AuthorizationHeaderType.BASIC) {
+				clientId = header.username;
+				clientSecret = header.password;
+			}
+		}
+	}
+	if (clientId && clientSecret) return OAuth2TokenGrant.CLIENT_CREDENTIALS;
+}
+//#endregion
+export { guessOauth2GrantTypeByRequest };
+
+//# sourceMappingURL=guess.mjs.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","readRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","event","body","query","pick","key","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","robotId","robotSecret","ROBOT_CREDENTIALS","refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","headerValue","headers","get","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IRoutupEvent } from 'routup';\n\nexport async function guessOauth2GrantTypeByRequest(\n    event: IRoutupEvent,\n) : Promise<`${OAuth2TokenGrant}` | undefined> {\n    const body = await readRequestBody(event);\n    const query = useRequestQuery(event);\n\n    const pick = (key: string): any => body?.[key] ?? query?.[key];\n\n    const grantType = pick('grant_type');\n\n    const validGrantTypes = Object.values(OAuth2TokenGrant);\n    if (validGrantTypes.includes(grantType)) {\n        return grantType;\n    }\n\n    const username = pick('username');\n    const password = pick('password');\n\n    if (username && password) {\n        return OAuth2TokenGrant.PASSWORD;\n    }\n\n    // ------------------------------------------------------------------\n\n    const robotId = pick('id');\n    const robotSecret = pick('secret');\n\n    if (robotId && robotSecret) {\n        return OAuth2TokenGrant.ROBOT_CREDENTIALS;\n    }\n\n    // ------------------------------------------------------------------\n\n    const refreshToken = pick('refresh_token');\n    if (refreshToken) {\n        return OAuth2TokenGrant.REFRESH_TOKEN;\n    }\n\n    // ------------------------------------------------------------------\n\n    const code = pick('code');\n    if (code) {\n        return OAuth2TokenGrant.AUTHORIZATION_CODE;\n    }\n\n    // ------------------------------------------------------------------\n\n    let clientId = pick('client_id');\n    let clientSecret = pick('client_secret');\n\n    if (!clientId && !clientSecret) {\n        const headerValue = event.headers.get('authorization');\n\n        if (headerValue) {\n            const header = parseAuthorizationHeader(headerValue);\n\n            if (header.type === AuthorizationHeaderType.BASIC) {\n                clientId = header.username;\n                clientSecret = header.password;\n            }\n        }\n    }\n\n    if (clientId && clientSecret) {\n        return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;AAaA,eAAsBK,8BAClBC,OAAmB;CAEnB,MAAMC,OAAO,MAAMN,gBAAgBK,MAAAA;CACnC,MAAME,QAAQN,gBAAgBI,MAAAA;CAE9B,MAAMG,QAAQC,QAAqBH,OAAOG,QAAQF,QAAQE;CAE1D,MAAMC,YAAYF,KAAK,aAAA;AAGvB,KADwBI,OAAOC,OAAOd,iBAClCY,CAAgBG,SAASJ,UAAAA,CACzB,QAAOA;CAGX,MAAMK,WAAWP,KAAK,WAAA;CACtB,MAAMQ,WAAWR,KAAK,WAAA;AAEtB,KAAIO,YAAYC,SACZ,QAAOjB,iBAAiBkB;CAK5B,MAAMC,UAAUV,KAAK,KAAA;CACrB,MAAMW,cAAcX,KAAK,SAAA;AAEzB,KAAIU,WAAWC,YACX,QAAOpB,iBAAiBqB;AAM5B,KADqBZ,KAAK,gBACtBa,CACA,QAAOtB,iBAAiBuB;AAM5B,KADad,KAAK,OACde,CACA,QAAOxB,iBAAiByB;CAK5B,IAAIC,WAAWjB,KAAK,YAAA;CACpB,IAAIkB,eAAelB,KAAK,gBAAA;AAExB,KAAI,CAACiB,YAAY,CAACC,cAAc;EAC5B,MAAMC,cAActB,MAAMuB,QAAQC,IAAI,gBAAA;AAEtC,MAAIF,aAAa;GACb,MAAMG,SAAS3B,yBAAyBwB,YAAAA;AAExC,OAAIG,OAAOC,SAAS7B,wBAAwB8B,OAAO;AAC/CP,eAAWK,OAAOf;AAClBW,mBAAeI,OAAOd;;;;AAKlC,KAAIS,YAAYC,aACZ,QAAO3B,iBAAiBkC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts

@@ -0,0 +1,3 @@
+export * from './credentials.ts';
+export * from './guess.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/index.mjs

@@ -0,0 +1,3 @@
+import { extractClientCredentialsFromRequest } from "./credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./guess.mjs";
+export { extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/adapters/oauth2/index.d.ts

@@ -0,0 +1,3 @@
+export * from './authorization/index.ts';
+export * from './grant-types/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/adapters/oauth2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/adapters/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC"}

package/dist/adapters/http/adapters/oauth2/index.mjs

@@ -0,0 +1,12 @@
+import { HTTPOAuth2Authorizer } from "./authorization/module.mjs";
+import "./authorization/index.mjs";
+import { extractClientCredentialsFromRequest } from "./grant-types/utils/credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./grant-types/utils/guess.mjs";
+import { HTTPOAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
+import { HTTPClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
+import { HTTPOAuth2IdentityGrantType } from "./grant-types/identity.mjs";
+import { HTTPPasswordGrant } from "./grant-types/password.mjs";
+import { HTTPOAuth2RefreshTokenGrant } from "./grant-types/refresh_token.mjs";
+import { HTTPRobotCredentialsGrant } from "./grant-types/robot-credentials.mjs";
+import "./grant-types/index.mjs";
+export { HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, extractClientCredentialsFromRequest, guessOauth2GrantTypeByRequest };

package/dist/adapters/http/controllers/entities/client/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/client/index.mjs

@@ -0,0 +1,2 @@
+import { ClientController } from "./module.mjs";
+export { ClientController };

package/dist/adapters/http/controllers/entities/client/module.d.ts

@@ -0,0 +1,20 @@
+import type { Client } from '@authup/core-kit';
+import type { IRoutupEvent } from 'routup';
+import type { ClientCreatePayload, ClientSavePayload, ClientUpdatePayload, EntityCollectionResponse } from '@authup/core-http-kit';
+import type { IClientRepository, IClientService } from '../../../../../core/index.ts';
+export type ClientControllerContext = {
+    service: IClientService;
+    repository: IClientRepository;
+};
+export declare class ClientController {
+    protected service: IClientService;
+    protected repository: IClientRepository;
+    constructor(ctx: ClientControllerContext);
+    getMany(event: IRoutupEvent): Promise<EntityCollectionResponse<Client>>;
+    get(id: string, event: IRoutupEvent): Promise<Client>;
+    add(data: ClientCreatePayload, event: IRoutupEvent): Promise<Client>;
+    edit(id: string, data: ClientUpdatePayload, event: IRoutupEvent): Promise<Client>;
+    put(id: string, data: ClientSavePayload, event: IRoutupEvent): Promise<Client>;
+    drop(id: string, event: IRoutupEvent): Promise<Client>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/client/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAUtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IActC,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAiDZ,GAAG,CACI,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAUZ,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAUZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACpB,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAgBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;CAQrB"}