@authup/server-core 1.0.0-beta.40 → 1.0.0-beta.42

package/dist/adapters/http/adapters/oauth2/grant-types/refresh_token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh_token.mjs","names":["OAuth2Error","useRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","extractClientCredentialsFromRequest","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","ctx","tokenVerifier","runWithRequest","req","refreshToken","length","requestInvalid","clientId","clientSecret","realmId","payload","verify","client","authenticate","undefined","client_id","id","grantInvalid","clientInvalid","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const refreshToken = useRequestBody(req, 'refresh_token');\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2Error.requestInvalid();\n        }\n\n        const { clientId, clientSecret } = extractClientCredentialsFromRequest(req);\n        const realmId = useRequestBody(req, 'realm_id');\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken);\n\n        if (clientId) {\n            const client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2Error.grantInvalid();\n            }\n        } else if (payload.client_id) {\n            // Token was issued to a specific client — that client MUST\n            // re-authenticate (RFC 6749 §6 binding requirement).\n            throw OAuth2Error.clientInvalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(req, { trustProxy: true }),\n            userAgent: getRequestHeader(req, 'user-agent'),\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaM,8BAAb,cAAiDF,wBAAAA;CACnCG;CAEAC;CAEV,YAAYC,KAAyC;AACjD,QAAMA,IAAAA;AAEN,OAAKF,sBAAsBE,IAAIF;AAC/B,OAAKC,uBAAuBC,IAAIC;;CAGpC,MAAMC,eAAeC,KAAiD;EAClE,MAAMC,eAAeZ,eAAeW,KAAK,gBAAA;AACzC,MAAI,OAAOC,iBAAiB,YAAYA,aAAaC,WAAW,EAC5D,OAAMd,YAAYe,gBAAc;EAGpC,MAAM,EAAEC,UAAUC,iBAAiBZ,oCAAoCO,IAAAA;EACvE,MAAMM,UAAUjB,eAAeW,KAAK,WAAA;EAMpC,MAAMO,UAAU,MAAM,KAAKX,qBAAqBY,OAAOP,aAAAA;AAEvD,MAAIG,UAAU;GACV,MAAMK,SAAS,MAAM,KAAKd,oBAAoBe,aAC1CN,UACAC,cACA,OAAOC,YAAY,WAAWA,UAAUK,KAAAA,EAAAA;AAG5C,OAAIJ,QAAQK,aAAaL,QAAQK,cAAcH,OAAOI,GAClD,OAAMzB,YAAY0B,cAAY;aAE3BP,QAAQK,UAGf,OAAMxB,YAAY2B,eAAa;AAGnC,SAAO,KAAKC,QAAQT,SAAS;GACzBU,WAAW1B,aAAaS,KAAK,EAAEkB,YAAY,MAAK,CAAA;GAChDC,WAAW7B,iBAAiBU,KAAK,aAAA;GACrC,CAAA"}
+{"version":3,"file":"refresh_token.mjs","names":["OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","readRequestBody","getRequestHeader","getRequestIP","OAuth2RefreshTokenGrant","extractClientCredentialsFromRequest","HTTPOAuth2RefreshTokenGrant","clientAuthenticator","refreshTokenVerifier","ctx","tokenVerifier","runWithRequest","event","body","refreshToken","refresh_token","length","malformed","clientId","clientSecret","realmId","realm_id","payload","verify","client","authenticate","undefined","client_id","id","invalid","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/refresh_token.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport { OAuth2RefreshTokenGrant } from '../../../../../core/index.ts';\nimport type {\n    IOAuth2TokenVerifier,\n    OAuth2ClientAuthenticator,\n} from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RefreshTokenGrantContext, IHTTPOAuth2Grant } from './types.ts';\nimport { extractClientCredentialsFromRequest } from './utils/index.ts';\n\nexport class HTTPOAuth2RefreshTokenGrant extends OAuth2RefreshTokenGrant implements IHTTPOAuth2Grant {\n    protected clientAuthenticator : OAuth2ClientAuthenticator;\n\n    protected refreshTokenVerifier : IOAuth2TokenVerifier;\n\n    constructor(ctx: HTTPOAuth2RefreshTokenGrantContext) {\n        super(ctx);\n\n        this.clientAuthenticator = ctx.clientAuthenticator;\n        this.refreshTokenVerifier = ctx.tokenVerifier;\n    }\n\n    async runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const refreshToken = body?.refresh_token;\n        if (typeof refreshToken !== 'string' || refreshToken.length === 0) {\n            throw OAuth2RequestError.malformed();\n        }\n\n        const { clientId, clientSecret } = await extractClientCredentialsFromRequest(event);\n        const realmId = body?.realm_id;\n\n        // RFC 6749 §6: verify the refresh token first to learn its bound\n        // client (if any), then enforce binding. Authenticate the requesting\n        // client when credentials are present, or when the token requires\n        // a client binding.\n        const payload = await this.refreshTokenVerifier.verify(refreshToken);\n\n        if (clientId) {\n            const client = await this.clientAuthenticator.authenticate(\n                clientId,\n                clientSecret,\n                typeof realmId === 'string' ? realmId : undefined,\n            );\n\n            if (payload.client_id && payload.client_id !== client.id) {\n                throw OAuth2GrantError.invalid();\n            }\n        } else if (payload.client_id) {\n            // Token was issued to a specific client — that client MUST\n            // re-authenticate (RFC 6749 §6 binding requirement).\n            throw OAuth2ClientError.invalid();\n        }\n\n        return this.runWith(payload, {\n            ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n            userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAoBA,IAAaQ,8BAAb,cAAiDF,wBAAAA;CACnCG;CAEAC;CAEV,YAAYC,KAAyC;EACjD,MAAMA,GAAAA;EAEN,KAAKF,sBAAsBE,IAAIF;EAC/B,KAAKC,uBAAuBC,IAAIC;CACpC;CAEA,MAAMC,eAAeC,OAAwD;EACzE,MAAMC,OAAO,MAAMZ,gBAAgBW,KAAAA;EACnC,MAAME,eAAeD,MAAME;EAC3B,IAAI,OAAOD,iBAAiB,YAAYA,aAAaE,WAAW,GAC5D,MAAMhB,mBAAmBiB,UAAS;EAGtC,MAAM,EAAEC,UAAUC,iBAAiB,MAAMd,oCAAoCO,KAAAA;EAC7E,MAAMQ,UAAUP,MAAMQ;EAMtB,MAAMC,UAAU,MAAM,KAAKd,qBAAqBe,OAAOT,YAAAA;EAEvD,IAAII,UAAU;GACV,MAAMM,SAAS,MAAM,KAAKjB,oBAAoBkB,aAC1CP,UACAC,cACA,OAAOC,YAAY,WAAWA,UAAUM,KAAAA,CAAAA;GAG5C,IAAIJ,QAAQK,aAAaL,QAAQK,cAAcH,OAAOI,IAClD,MAAM7B,iBAAiB8B,QAAO;EAEtC,OAAO,IAAIP,QAAQK,WAGf,MAAM7B,kBAAkB+B,QAAO;EAGnC,OAAO,KAAKC,QAAQR,SAAS;GACzBS,WAAW5B,aAAaS,OAAO,EAAEoB,YAAY,KAAK,CAAA,KAAMN,KAAAA;GACxDO,WAAW/B,iBAAiBU,OAAO,YAAA,KAAiBc,KAAAA;EACxD,CAAA;CACJ;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.d.ts

@@ -1,5 +1,5 @@
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
-import type { Request } from 'routup';
+import type { IRoutupEvent } from 'routup';
 import type { Robot } from '@authup/core-kit';
 import type { ICredentialsAuthenticator } from '../../../../../core/index.ts';
 import { RobotCredentialsGrant } from '../../../../../core/index.ts';
@@ -7,6 +7,6 @@ import type { HTTPOAuth2RobotCredentialsGrantContext, IHTTPOAuth2Grant } from '.
 export declare class HTTPRobotCredentialsGrant extends RobotCredentialsGrant implements IHTTPOAuth2Grant {
     protected authenticator: ICredentialsAuthenticator<Robot>;
     constructor(ctx: HTTPOAuth2RobotCredentialsGrantContext);
-    runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse>;
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
 }
 //# sourceMappingURL=robot-credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"robot-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,sCAAsC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE3F,qBAAa,yBAA0B,SAAQ,qBAAsB,YAAW,gBAAgB;IAC5F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;gBAE/C,GAAG,EAAE,sCAAsC;IAMjD,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAgBxE"}
+{"version":3,"file":"robot-credentials.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,sCAAsC,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE3F,qBAAa,yBAA0B,SAAQ,qBAAsB,YAAW,gBAAgB;IAC5F,SAAS,CAAC,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;gBAE/C,GAAG,EAAE,sCAAsC;IAMjD,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAiB/E"}

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs

@@ -1,7 +1,7 @@
 import { RobotCredentialsGrant } from "../../../../../core/oauth2/grant-types/robot-credentials.mjs";
 import "../../../../../core/index.mjs";
 import { getRequestHeader, getRequestIP } from "routup";
-import { useRequestBody } from "@routup/basic/body";
+import { readRequestBody } from "@routup/basic/body";
 //#region src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts
 var HTTPRobotCredentialsGrant = class extends RobotCredentialsGrant {
 	authenticator;
@@ -9,12 +9,12 @@ var HTTPRobotCredentialsGrant = class extends RobotCredentialsGrant {
 		super(ctx);
 		this.authenticator = ctx.authenticator;
 	}
-	async runWithRequest(req) {
-		const { id, secret, realm_id: realmId } = useRequestBody(req);
+	async runWithRequest(event) {
+		const { id, secret, realm_id: realmId } = await readRequestBody(event) || {};
 		const entity = await this.authenticator.authenticate(id, secret, realmId);
 		return this.runWith(entity, {
-			ipAddress: getRequestIP(req, { trustProxy: true }),
-			userAgent: getRequestHeader(req, "user-agent")
+			ipAddress: getRequestIP(event, { trustProxy: true }) ?? void 0,
+			userAgent: getRequestHeader(event, "user-agent") ?? void 0
 		});
 	}
 };

package/dist/adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"robot-credentials.mjs","names":["useRequestBody","getRequestHeader","getRequestIP","RobotCredentialsGrant","HTTPRobotCredentialsGrant","authenticator","ctx","runWithRequest","req","id","secret","realm_id","realmId","entity","authenticate","runWith","ipAddress","trustProxy","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport type { Request } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { Robot } from '@authup/core-kit';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { RobotCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RobotCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPRobotCredentialsGrant extends RobotCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Robot>;\n\n    constructor(ctx: HTTPOAuth2RobotCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse> {\n        const {\n            id,\n            secret,\n            realm_id: realmId,\n        } = useRequestBody(req);\n        const entity = await this.authenticator.authenticate(id, secret, realmId);\n\n        return this.runWith(\n            entity,\n            {\n                ipAddress: getRequestIP(req, { trustProxy: true }),\n                userAgent: getRequestHeader(req, 'user-agent'),\n            },\n        );\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaI,4BAAb,cAA+CD,sBAAAA;CACjCE;CAEV,YAAYC,KAA6C;AACrD,QAAMA,IAAAA;AAEN,OAAKD,gBAAgBC,IAAID;;CAG7B,MAAME,eAAeC,KAAiD;EAClE,MAAM,EACFC,IACAC,QACAC,UAAUC,YACVZ,eAAeQ,IAAAA;EACnB,MAAMK,SAAS,MAAM,KAAKR,cAAcS,aAAaL,IAAIC,QAAQE,QAAAA;AAEjE,SAAO,KAAKG,QACRF,QACA;GACIG,WAAWd,aAAaM,KAAK,EAAES,YAAY,MAAK,CAAA;GAChDC,WAAWjB,iBAAiBO,KAAK,aAAA;GACrC,CAAA"}
+{"version":3,"file":"robot-credentials.mjs","names":["readRequestBody","getRequestHeader","getRequestIP","RobotCredentialsGrant","HTTPRobotCredentialsGrant","authenticator","ctx","runWithRequest","event","body","id","secret","realm_id","realmId","entity","authenticate","runWith","ipAddress","trustProxy","undefined","userAgent"],"sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/robot-credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport type { IRoutupEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type { Robot } from '@authup/core-kit';\nimport type { ICredentialsAuthenticator } from '../../../../../core/index.ts';\nimport { RobotCredentialsGrant } from '../../../../../core/index.ts';\nimport type { HTTPOAuth2RobotCredentialsGrantContext, IHTTPOAuth2Grant } from './types.ts';\n\nexport class HTTPRobotCredentialsGrant extends RobotCredentialsGrant implements IHTTPOAuth2Grant {\n    protected authenticator : ICredentialsAuthenticator<Robot>;\n\n    constructor(ctx: HTTPOAuth2RobotCredentialsGrantContext) {\n        super(ctx);\n\n        this.authenticator = ctx.authenticator;\n    }\n\n    async runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse> {\n        const body = await readRequestBody(event);\n        const {\n            id,\n            secret,\n            realm_id: realmId,\n        } = body || {};\n        const entity = await this.authenticator.authenticate(id, secret, realmId);\n\n        return this.runWith(\n            entity,\n            {\n                ipAddress: getRequestIP(event, { trustProxy: true }) ?? undefined,\n                userAgent: getRequestHeader(event, 'user-agent') ?? undefined,\n            },\n        );\n    }\n}\n"],"mappings":";;;;;AAgBA,IAAaI,4BAAb,cAA+CD,sBAAAA;CACjCE;CAEV,YAAYC,KAA6C;EACrD,MAAMA,GAAAA;EAEN,KAAKD,gBAAgBC,IAAID;CAC7B;CAEA,MAAME,eAAeC,OAAwD;EAEzE,MAAM,EACFE,IACAC,QACAC,UAAUC,YACVJ,MALeT,gBAAgBQ,KAAAA,KAKvB,CAAC;EACb,MAAMM,SAAS,MAAM,KAAKT,cAAcU,aAAaL,IAAIC,QAAQE,OAAAA;EAEjE,OAAO,KAAKG,QACRF,QACA;GACIG,WAAWf,aAAaM,OAAO,EAAEU,YAAY,KAAK,CAAA,KAAMC,KAAAA;GACxDC,WAAWnB,iBAAiBO,OAAO,YAAA,KAAiBW,KAAAA;EACxD,CAAA;CAER;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts

@@ -1,13 +1,13 @@
 import type { Client, Robot, User } from '@authup/core-kit';
 import type { OAuth2TokenGrantResponse } from '@authup/specs';
-import type { Request } from 'routup';
+import type { IRoutupEvent } from 'routup';
 import type { BaseGrantContext, ICredentialsAuthenticator, IOAuth2AuthorizationCodeVerifier, OAuth2AuthorizeGrantContext, OAuth2ClientAuthenticator, OAuth2PasswordGrantContext, OAuth2RefreshTokenGrantContext } from '../../../../../core/index.ts';
 export type HTTPOAuth2AuthorizeGrantContext = OAuth2AuthorizeGrantContext & {
     codeVerifier: IOAuth2AuthorizationCodeVerifier;
     clientAuthenticator: OAuth2ClientAuthenticator;
 };
 export interface IHTTPOAuth2Grant {
-    runWithRequest(req: Request): Promise<OAuth2TokenGrantResponse>;
+    runWithRequest(event: IRoutupEvent): Promise<OAuth2TokenGrantResponse>;
 }
 export type HTTPOAuth2PasswordGrantContext = OAuth2PasswordGrantContext & {
     authenticator: ICredentialsAuthenticator<User>;

package/dist/adapters/http/adapters/oauth2/grant-types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,GAAG,EAAE,OAAO,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACnE;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/adapters/oauth2/grant-types/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EACR,gBAAgB,EAChB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,8BAA8B,EACjC,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,+BAA+B,GAAG,2BAA2B,GAAG;IACxE,YAAY,EAAE,gCAAgC,CAAC;IAC/C,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,cAAc,CAAC,KAAK,EAAE,YAAY,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAC1E;AAED,MAAM,MAAM,8BAA8B,GAAG,0BAA0B,GAAG;IACtE,aAAa,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG,8BAA8B,GAAG;IAC9E,mBAAmB,EAAE,yBAAyB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,uCAAuC,GAAG,gBAAgB,GAAG;IACrE,aAAa,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG,gBAAgB,GAAG;IACpE,aAAa,EAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;CACnD,CAAC"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts

@@ -1,4 +1,4 @@
-import type { Request } from 'routup';
+import type { IRoutupEvent } from 'routup';
 export type ExtractedClientCredentials = {
     clientId?: string;
     clientSecret?: string;
@@ -11,5 +11,5 @@ export type ExtractedClientCredentials = {
  * that present credentials in BOTH the Basic Authorization header and the
  * request body.
  */
-export declare function extractClientCredentialsFromRequest(req: Request): ExtractedClientCredentials;
+export declare function extractClientCredentialsFromRequest(event: IRoutupEvent): Promise<ExtractedClientCredentials>;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,OAAO,GAAG,0BAA0B,CA4B5F"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,mCAAmC,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA6BlH"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs

@@ -1,5 +1,5 @@
-import { OAuth2Error } from "@authup/specs";
-import { useRequestBody } from "@routup/basic/body";
+import { OAuth2RequestError } from "@authup/specs";
+import { readRequestBody } from "@routup/basic/body";
 import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts
 /**
@@ -9,14 +9,15 @@ import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 * authentication methods in a single request. This helper rejects requests
 * that present credentials in BOTH the Basic Authorization header and the
 * request body.
-*/ function extractClientCredentialsFromRequest(req) {
-	const bodyClientId = readStringBody(req, "client_id");
-	const bodyClientSecret = readStringBody(req, "client_secret");
+*/ async function extractClientCredentialsFromRequest(event) {
+	const body = await readRequestBody(event);
+	const bodyClientId = readStringField(body, "client_id");
+	const bodyClientSecret = readStringField(body, "client_secret");
 	const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;
-	const basicCredentials = parseBasicCredentials(req);
-	if (hasBodyCredentials && basicCredentials) throw OAuth2Error.requestInvalid("Client credentials must be provided either via Basic Authorization header or request body, not both.");
+	const basicCredentials = parseBasicCredentials(event);
+	if (hasBodyCredentials && basicCredentials) throw OAuth2RequestError.malformed("Client credentials must be provided either via Basic Authorization header or request body, not both.");
 	if (hasBodyCredentials) {
-		if (!bodyClientId) throw OAuth2Error.requestInvalid("client_secret was provided without client_id.");
+		if (!bodyClientId) throw OAuth2RequestError.malformed("client_secret was provided without client_id.");
 		return {
 			clientId: bodyClientId,
 			clientSecret: bodyClientSecret
@@ -25,18 +26,18 @@ import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 	if (basicCredentials) return basicCredentials;
 	return {};
 }
-function readStringBody(req, key) {
-	const value = useRequestBody(req, key);
+function readStringField(body, key) {
+	const value = body?.[key];
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function parseBasicCredentials(req) {
-	const headerValue = req.headers.authorization;
-	if (typeof headerValue !== "string") return;
+function parseBasicCredentials(event) {
+	const headerValue = event.headers.get("authorization");
+	if (!headerValue) return;
 	let header;
 	try {
 		header = parseAuthorizationHeader(headerValue);
 	} catch {
-		throw OAuth2Error.requestInvalid("Malformed Authorization header.");
+		throw OAuth2RequestError.malformed("Malformed Authorization header.");
 	}
 	if (header.type !== AuthorizationHeaderType.BASIC) return;
 	return {

package/dist/adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.mjs","names":["OAuth2Error","useRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","req","bodyClientId","readStringBody","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","requestInvalid","clientId","clientSecret","key","value","length","undefined","headerValue","headers","authorization","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2Error } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { Request } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport function extractClientCredentialsFromRequest(req: Request): ExtractedClientCredentials {\n    const bodyClientId = readStringBody(req, 'client_id');\n    const bodyClientSecret = readStringBody(req, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(req);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2Error.requestInvalid(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2Error.requestInvalid('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nfunction readStringBody(req: Request, key: string): string | undefined {\n    const value = useRequestBody(req, key);\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(req: Request): ExtractedClientCredentials | undefined {\n    const headerValue = req.headers.authorization;\n    if (typeof headerValue !== 'string') {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2Error.requestInvalid('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAyBA,SAAgBI,oCAAoCC,KAAY;CAC5D,MAAMC,eAAeC,eAAeF,KAAK,YAAA;CACzC,MAAMG,mBAAmBD,eAAeF,KAAK,gBAAA;CAC7C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBN,IAAAA;AAE/C,KAAII,sBAAsBC,iBACtB,OAAMV,YAAYY,eACd,uGAAA;AAIR,KAAIH,oBAAoB;AAIpB,MAAI,CAACH,aACD,OAAMN,YAAYY,eAAe,gDAAA;AAErC,SAAO;GAAEC,UAAUP;GAAcQ,cAAcN;GAAiB;;AAGpE,KAAIE,iBACA,QAAOA;AAGX,QAAO,EAAC;;AAGZ,SAASH,eAAeF,KAAcU,KAAW;CAC7C,MAAMC,QAAQf,eAAeI,KAAKU,IAAAA;AAClC,QAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;;AAGnE,SAASP,sBAAsBN,KAAY;CACvC,MAAMc,cAAcd,IAAIe,QAAQC;AAChC,KAAI,OAAOF,gBAAgB,SACvB;CAGJ,IAAIG;AACJ,KAAI;AACAA,WAASnB,yBAAyBgB,YAAAA;SAC9B;AAGJ,QAAMnB,YAAYY,eAAe,kCAAA;;AAGrC,KAAIU,OAAOC,SAASrB,wBAAwBsB,MACxC;AAQJ,QAAO;EACHX,UAAUY,WAAWH,OAAOI,SAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,SAAQ;EAC5C;;AAGJ,SAASF,WAAWT,OAAa;AAC7B,KAAI;AAGA,SAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,IAAA,CAAA;SAC3C;AAGJ,SAAOb"}
+{"version":3,"file":"credentials.mjs","names":["OAuth2RequestError","readRequestBody","AuthorizationHeaderType","parseAuthorizationHeader","extractClientCredentialsFromRequest","event","body","bodyClientId","readStringField","bodyClientSecret","hasBodyCredentials","basicCredentials","parseBasicCredentials","malformed","clientId","clientSecret","key","value","length","undefined","headerValue","headers","get","header","type","BASIC","formDecode","username","password","decodeURIComponent","replace"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/credentials.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2RequestError } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IRoutupEvent } from 'routup';\n\nexport type ExtractedClientCredentials = {\n    clientId?: string,\n    clientSecret?: string,\n};\n\n/**\n * Extract client credentials from an OAuth2 token endpoint request.\n *\n * Per RFC 6749 §2.3.1, the server MUST NOT support multiple client\n * authentication methods in a single request. This helper rejects requests\n * that present credentials in BOTH the Basic Authorization header and the\n * request body.\n */\nexport async function extractClientCredentialsFromRequest(event: IRoutupEvent): Promise<ExtractedClientCredentials> {\n    const body = await readRequestBody(event);\n    const bodyClientId = readStringField(body, 'client_id');\n    const bodyClientSecret = readStringField(body, 'client_secret');\n    const hasBodyCredentials = !!bodyClientId || !!bodyClientSecret;\n\n    const basicCredentials = parseBasicCredentials(event);\n\n    if (hasBodyCredentials && basicCredentials) {\n        throw OAuth2RequestError.malformed(\n            'Client credentials must be provided either via Basic Authorization header or request body, not both.',\n        );\n    }\n\n    if (hasBodyCredentials) {\n        // Reject stray client_secret without client_id — otherwise grants\n        // that gate auth on `if (clientId)` would silently skip\n        // authentication and leak through with the secret discarded.\n        if (!bodyClientId) {\n            throw OAuth2RequestError.malformed('client_secret was provided without client_id.');\n        }\n        return { clientId: bodyClientId, clientSecret: bodyClientSecret };\n    }\n\n    if (basicCredentials) {\n        return basicCredentials;\n    }\n\n    return {};\n}\n\nfunction readStringField(body: Record<string, any> | undefined, key: string): string | undefined {\n    const value = body?.[key];\n    return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction parseBasicCredentials(event: IRoutupEvent): ExtractedClientCredentials | undefined {\n    const headerValue = event.headers.get('authorization');\n    if (!headerValue) {\n        return undefined;\n    }\n\n    let header;\n    try {\n        header = parseAuthorizationHeader(headerValue);\n    } catch {\n        // Malformed Authorization header — surface as 400 invalid_request\n        // rather than letting hapic's error propagate as 500.\n        throw OAuth2RequestError.malformed('Malformed Authorization header.');\n    }\n\n    if (header.type !== AuthorizationHeaderType.BASIC) {\n        return undefined;\n    }\n\n    // RFC 6749 §2.3.1 + Appendix B: client_id and client_secret are\n    // application/x-www-form-urlencoded BEFORE base64 encoding in the\n    // Authorization header. hapic only base64-decodes; we form-decode here\n    // so credentials containing reserved characters (`:`, `+`, `%`, `&`,\n    // `=`, etc.) round-trip correctly.\n    return {\n        clientId: formDecode(header.username),\n        clientSecret: formDecode(header.password),\n    };\n}\n\nfunction formDecode(value: string): string {\n    try {\n        // application/x-www-form-urlencoded: '+' represents space; %XX is\n        // percent-encoded UTF-8.\n        return decodeURIComponent(value.replace(/\\+/g, ' '));\n    } catch {\n        // Malformed percent-encoding — return raw value rather than\n        // throwing; the caller will still validate via authentication.\n        return value;\n    }\n}\n"],"mappings":";;;;;;;;;;;GAyBA,eAAsBI,oCAAoCC,OAAmB;CACzE,MAAMC,OAAO,MAAML,gBAAgBI,KAAAA;CACnC,MAAME,eAAeC,gBAAgBF,MAAM,WAAA;CAC3C,MAAMG,mBAAmBD,gBAAgBF,MAAM,eAAA;CAC/C,MAAMI,qBAAqB,CAAC,CAACH,gBAAgB,CAAC,CAACE;CAE/C,MAAME,mBAAmBC,sBAAsBP,KAAAA;CAE/C,IAAIK,sBAAsBC,kBACtB,MAAMX,mBAAmBa,UACrB,sGAAA;CAIR,IAAIH,oBAAoB;EAIpB,IAAI,CAACH,cACD,MAAMP,mBAAmBa,UAAU,+CAAA;EAEvC,OAAO;GAAEC,UAAUP;GAAcQ,cAAcN;EAAiB;CACpE;CAEA,IAAIE,kBACA,OAAOA;CAGX,OAAO,CAAC;AACZ;AAEA,SAASH,gBAAgBF,MAAuCU,KAAW;CACvE,MAAMC,QAAQX,OAAOU;CACrB,OAAO,OAAOC,UAAU,YAAYA,MAAMC,SAAS,IAAID,QAAQE,KAAAA;AACnE;AAEA,SAASP,sBAAsBP,OAAmB;CAC9C,MAAMe,cAAcf,MAAMgB,QAAQC,IAAI,eAAA;CACtC,IAAI,CAACF,aACD;CAGJ,IAAIG;CACJ,IAAI;EACAA,SAASpB,yBAAyBiB,WAAAA;CACtC,QAAQ;EAGJ,MAAMpB,mBAAmBa,UAAU,iCAAA;CACvC;CAEA,IAAIU,OAAOC,SAAStB,wBAAwBuB,OACxC;CAQJ,OAAO;EACHX,UAAUY,WAAWH,OAAOI,QAAQ;EACpCZ,cAAcW,WAAWH,OAAOK,QAAQ;CAC5C;AACJ;AAEA,SAASF,WAAWT,OAAa;CAC7B,IAAI;EAGA,OAAOY,mBAAmBZ,MAAMa,QAAQ,OAAO,GAAA,CAAA;CACnD,QAAQ;EAGJ,OAAOb;CACX;AACJ"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.d.ts

@@ -1,4 +1,4 @@
 import { OAuth2TokenGrant } from '@authup/specs';
-import type { Request } from 'routup';
-export declare function guessOauth2GrantTypeByRequest(request: Request): `${OAuth2TokenGrant}` | undefined;
+import type { IRoutupEvent } from 'routup';
+export declare function guessOauth2GrantTypeByRequest(event: IRoutupEvent): Promise<`${OAuth2TokenGrant}` | undefined>;
 //# sourceMappingURL=guess.d.ts.map

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,wBAAgB,6BAA6B,CACzC,OAAO,EAAE,OAAO,GAChB,GAAG,gBAAgB,EAAE,GAAG,SAAS,CA6DpC"}
+{"version":3,"file":"guess.d.ts","sourceRoot":"","sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,wBAAsB,6BAA6B,CAC/C,KAAK,EAAE,YAAY,GACnB,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAkE7C"}

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs

@@ -1,23 +1,26 @@
 import { OAuth2TokenGrant } from "@authup/specs";
-import { useRequestBody } from "@routup/basic/body";
-import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
+import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
+import { AuthorizationHeaderType, parseAuthorizationHeader } from "hapic";
 //#region src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts
-function guessOauth2GrantTypeByRequest(request) {
-	const grantType = useRequestBody(request, "grant_type") || useRequestQuery(request, "grant_type");
+async function guessOauth2GrantTypeByRequest(event) {
+	const body = await readRequestBody(event);
+	const query = useRequestQuery(event);
+	const pick = (key) => body?.[key] ?? query?.[key];
+	const grantType = pick("grant_type");
 	if (Object.values(OAuth2TokenGrant).includes(grantType)) return grantType;
-	const username = useRequestBody(request, "username") || useRequestQuery(request, "username");
-	const password = useRequestBody(request, "password") || useRequestQuery(request, "password");
+	const username = pick("username");
+	const password = pick("password");
 	if (username && password) return OAuth2TokenGrant.PASSWORD;
-	const robotId = useRequestBody(request, "id") || useRequestQuery(request, "id");
-	const robotSecret = useRequestBody(request, "secret") || useRequestQuery(request, "secret");
+	const robotId = pick("id");
+	const robotSecret = pick("secret");
 	if (robotId && robotSecret) return OAuth2TokenGrant.ROBOT_CREDENTIALS;
-	if (useRequestBody(request, "refresh_token") || useRequestQuery(request, "refresh_token")) return OAuth2TokenGrant.REFRESH_TOKEN;
-	if (useRequestBody(request, "code") || useRequestQuery(request, "code")) return OAuth2TokenGrant.AUTHORIZATION_CODE;
-	let clientId = useRequestBody(request, "client_id") || useRequestQuery(request, "client_id");
-	let clientSecret = useRequestBody(request, "client_secret") || useRequestQuery(request, "client_secret");
+	if (pick("refresh_token")) return OAuth2TokenGrant.REFRESH_TOKEN;
+	if (pick("code")) return OAuth2TokenGrant.AUTHORIZATION_CODE;
+	let clientId = pick("client_id");
+	let clientSecret = pick("client_secret");
 	if (!clientId && !clientSecret) {
-		const { authorization: headerValue } = request.headers;
+		const headerValue = event.headers.get("authorization");
 		if (headerValue) {
 			const header = parseAuthorizationHeader(headerValue);
 			if (header.type === AuthorizationHeaderType.BASIC) {

package/dist/adapters/http/adapters/oauth2/grant-types/utils/guess.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","useRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","request","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","robotId","robotSecret","ROBOT_CREDENTIALS","refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","authorization","headerValue","headers","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { useRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { Request } from 'routup';\n\nexport function guessOauth2GrantTypeByRequest(\n    request: Request,\n) : `${OAuth2TokenGrant}` | undefined {\n    const grantType = useRequestBody(request, 'grant_type') || useRequestQuery(request, 'grant_type');\n\n    const validGrantTypes = Object.values(OAuth2TokenGrant);\n    if (validGrantTypes.includes(grantType)) {\n        return grantType;\n    }\n\n    const username = useRequestBody(request, 'username') || useRequestQuery(request, 'username');\n    const password = useRequestBody(request, 'password') || useRequestQuery(request, 'password');\n\n    if (username && password) {\n        return OAuth2TokenGrant.PASSWORD;\n    }\n\n    // ------------------------------------------------------------------\n\n    const robotId = useRequestBody(request, 'id') || useRequestQuery(request, 'id');\n    const robotSecret = useRequestBody(request, 'secret') || useRequestQuery(request, 'secret');\n\n    if (robotId && robotSecret) {\n        return OAuth2TokenGrant.ROBOT_CREDENTIALS;\n    }\n\n    // ------------------------------------------------------------------\n\n    const refreshToken = useRequestBody(request, 'refresh_token') || useRequestQuery(request, 'refresh_token');\n    if (refreshToken) {\n        return OAuth2TokenGrant.REFRESH_TOKEN;\n    }\n\n    // ------------------------------------------------------------------\n\n    const code = useRequestBody(request, 'code') || useRequestQuery(request, 'code');\n    if (code) {\n        return OAuth2TokenGrant.AUTHORIZATION_CODE;\n    }\n\n    // ------------------------------------------------------------------\n\n    let clientId = useRequestBody(request, 'client_id') || useRequestQuery(request, 'client_id');\n    let clientSecret = useRequestBody(request, 'client_secret') || useRequestQuery(request, 'client_secret');\n\n    if (!clientId && !clientSecret) {\n        const { authorization: headerValue } = request.headers;\n\n        if (headerValue) {\n            const header = parseAuthorizationHeader(headerValue);\n\n            if (header.type === AuthorizationHeaderType.BASIC) {\n                clientId = header.username;\n                clientSecret = header.password;\n            }\n        }\n    }\n\n    if (clientId && clientSecret) {\n        return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;AAaA,SAAgBK,8BACZC,SAAgB;CAEhB,MAAMC,YAAYN,eAAeK,SAAS,aAAA,IAAiBJ,gBAAgBI,SAAS,aAAA;AAGpF,KADwBG,OAAOC,OAAOV,iBAClCQ,CAAgBG,SAASJ,UAAAA,CACzB,QAAOA;CAGX,MAAMK,WAAWX,eAAeK,SAAS,WAAA,IAAeJ,gBAAgBI,SAAS,WAAA;CACjF,MAAMO,WAAWZ,eAAeK,SAAS,WAAA,IAAeJ,gBAAgBI,SAAS,WAAA;AAEjF,KAAIM,YAAYC,SACZ,QAAOb,iBAAiBc;CAK5B,MAAMC,UAAUd,eAAeK,SAAS,KAAA,IAASJ,gBAAgBI,SAAS,KAAA;CAC1E,MAAMU,cAAcf,eAAeK,SAAS,SAAA,IAAaJ,gBAAgBI,SAAS,SAAA;AAElF,KAAIS,WAAWC,YACX,QAAOhB,iBAAiBiB;AAM5B,KADqBhB,eAAeK,SAAS,gBAAA,IAAoBJ,gBAAgBI,SAAS,gBAAA,CAEtF,QAAON,iBAAiBmB;AAM5B,KADalB,eAAeK,SAAS,OAAA,IAAWJ,gBAAgBI,SAAS,OAAA,CAErE,QAAON,iBAAiBqB;CAK5B,IAAIC,WAAWrB,eAAeK,SAAS,YAAA,IAAgBJ,gBAAgBI,SAAS,YAAA;CAChF,IAAIiB,eAAetB,eAAeK,SAAS,gBAAA,IAAoBJ,gBAAgBI,SAAS,gBAAA;AAExF,KAAI,CAACgB,YAAY,CAACC,cAAc;EAC5B,MAAM,EAAEC,eAAeC,gBAAgBnB,QAAQoB;AAE/C,MAAID,aAAa;GACb,MAAME,SAASvB,yBAAyBqB,YAAAA;AAExC,OAAIE,OAAOC,SAASzB,wBAAwB0B,OAAO;AAC/CP,eAAWK,OAAOf;AAClBW,mBAAeI,OAAOd;;;;AAKlC,KAAIS,YAAYC,aACZ,QAAOvB,iBAAiB8B"}
+{"version":3,"file":"guess.mjs","names":["OAuth2TokenGrant","readRequestBody","useRequestQuery","AuthorizationHeaderType","parseAuthorizationHeader","guessOauth2GrantTypeByRequest","event","body","query","pick","key","grantType","validGrantTypes","Object","values","includes","username","password","PASSWORD","robotId","robotSecret","ROBOT_CREDENTIALS","refreshToken","REFRESH_TOKEN","code","AUTHORIZATION_CODE","clientId","clientSecret","headerValue","headers","get","header","type","BASIC","CLIENT_CREDENTIALS","undefined"],"sources":["../../../../../../../src/adapters/http/adapters/oauth2/grant-types/utils/guess.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { OAuth2TokenGrant } from '@authup/specs';\nimport { readRequestBody } from '@routup/basic/body';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { AuthorizationHeaderType, parseAuthorizationHeader } from 'hapic';\nimport type { IRoutupEvent } from 'routup';\n\nexport async function guessOauth2GrantTypeByRequest(\n    event: IRoutupEvent,\n) : Promise<`${OAuth2TokenGrant}` | undefined> {\n    const body = await readRequestBody(event);\n    const query = useRequestQuery(event);\n\n    const pick = (key: string): any => body?.[key] ?? query?.[key];\n\n    const grantType = pick('grant_type');\n\n    const validGrantTypes = Object.values(OAuth2TokenGrant);\n    if (validGrantTypes.includes(grantType)) {\n        return grantType;\n    }\n\n    const username = pick('username');\n    const password = pick('password');\n\n    if (username && password) {\n        return OAuth2TokenGrant.PASSWORD;\n    }\n\n    // ------------------------------------------------------------------\n\n    const robotId = pick('id');\n    const robotSecret = pick('secret');\n\n    if (robotId && robotSecret) {\n        return OAuth2TokenGrant.ROBOT_CREDENTIALS;\n    }\n\n    // ------------------------------------------------------------------\n\n    const refreshToken = pick('refresh_token');\n    if (refreshToken) {\n        return OAuth2TokenGrant.REFRESH_TOKEN;\n    }\n\n    // ------------------------------------------------------------------\n\n    const code = pick('code');\n    if (code) {\n        return OAuth2TokenGrant.AUTHORIZATION_CODE;\n    }\n\n    // ------------------------------------------------------------------\n\n    let clientId = pick('client_id');\n    let clientSecret = pick('client_secret');\n\n    if (!clientId && !clientSecret) {\n        const headerValue = event.headers.get('authorization');\n\n        if (headerValue) {\n            const header = parseAuthorizationHeader(headerValue);\n\n            if (header.type === AuthorizationHeaderType.BASIC) {\n                clientId = header.username;\n                clientSecret = header.password;\n            }\n        }\n    }\n\n    if (clientId && clientSecret) {\n        return OAuth2TokenGrant.CLIENT_CREDENTIALS;\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;AAaA,eAAsBK,8BAClBC,OAAmB;CAEnB,MAAMC,OAAO,MAAMN,gBAAgBK,KAAAA;CACnC,MAAME,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,QAAQC,QAAqBH,OAAOG,QAAQF,QAAQE;CAE1D,MAAMC,YAAYF,KAAK,YAAA;CAGvB,IADwBI,OAAOC,OAAOd,gBAClCY,EAAgBG,SAASJ,SAAAA,GACzB,OAAOA;CAGX,MAAMK,WAAWP,KAAK,UAAA;CACtB,MAAMQ,WAAWR,KAAK,UAAA;CAEtB,IAAIO,YAAYC,UACZ,OAAOjB,iBAAiBkB;CAK5B,MAAMC,UAAUV,KAAK,IAAA;CACrB,MAAMW,cAAcX,KAAK,QAAA;CAEzB,IAAIU,WAAWC,aACX,OAAOpB,iBAAiBqB;CAM5B,IADqBZ,KAAK,eACtBa,GACA,OAAOtB,iBAAiBuB;CAM5B,IADad,KAAK,MACde,GACA,OAAOxB,iBAAiByB;CAK5B,IAAIC,WAAWjB,KAAK,WAAA;CACpB,IAAIkB,eAAelB,KAAK,eAAA;CAExB,IAAI,CAACiB,YAAY,CAACC,cAAc;EAC5B,MAAMC,cAActB,MAAMuB,QAAQC,IAAI,eAAA;EAEtC,IAAIF,aAAa;GACb,MAAMG,SAAS3B,yBAAyBwB,WAAAA;GAExC,IAAIG,OAAOC,SAAS7B,wBAAwB8B,OAAO;IAC/CP,WAAWK,OAAOf;IAClBW,eAAeI,OAAOd;GAC1B;EACJ;CACJ;CAEA,IAAIS,YAAYC,cACZ,OAAO3B,iBAAiBkC;AAIhC"}

package/dist/adapters/http/controllers/entities/client/module.d.ts

@@ -1,3 +1,6 @@
+import type { Client } from '@authup/core-kit';
+import type { IRoutupEvent } from 'routup';
+import type { ClientCreatePayload, ClientSavePayload, ClientUpdatePayload, EntityCollectionResponse } from '@authup/core-http-kit';
 import type { IClientRepository, IClientService } from '../../../../../core/index.ts';
 export type ClientControllerContext = {
     service: IClientService;
@@ -7,11 +10,11 @@ export declare class ClientController {
     protected service: IClientService;
     protected repository: IClientRepository;
     constructor(ctx: ClientControllerContext);
-    getMany(req: any, res: any): Promise<any>;
-    get(id: string, req: any, res: any): Promise<any>;
-    add(data: any, req: any, res: any): Promise<any>;
-    edit(id: string, data: any, req: any, res: any): Promise<any>;
-    put(id: string, data: any, req: any, res: any): Promise<any>;
-    drop(id: string, req: any, res: any): Promise<any>;
+    getMany(event: IRoutupEvent): Promise<EntityCollectionResponse<Client>>;
+    get(id: string, event: IRoutupEvent): Promise<Client>;
+    add(data: ClientCreatePayload, event: IRoutupEvent): Promise<Client>;
+    edit(id: string, data: ClientUpdatePayload, event: IRoutupEvent): Promise<Client>;
+    put(id: string, data: ClientSavePayload, event: IRoutupEvent): Promise<Client>;
+    drop(id: string, event: IRoutupEvent): Promise<Client>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAUtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAcT,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAiDT,GAAG,CACI,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAQT,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAQT,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,GAAG,EACN,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;IAmBT,IAAI,CACO,EAAE,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACP,GAAG,EAAE,GAAG,GACtB,OAAO,CAAC,GAAG,CAAC;CAMlB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/client/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,EACR,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAWtF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;CACjC,CAAC;AAEF,qBAEa,gBAAgB;IACzB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE5B,GAAG,EAAE,uBAAuB;IAMlC,OAAO,CACG,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IActC,GAAG,CACQ,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAiDZ,GAAG,CACI,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAWZ,IAAI,CACO,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,mBAAmB,EACtB,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAWZ,GAAG,CACQ,EAAE,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACpB,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAiBZ,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;CAQrB"}

package/dist/adapters/http/controllers/entities/client/module.mjs

@@ -2,17 +2,17 @@ import { OAuth2ScopeAttributesResolver } from "../../../../../core/oauth2/scope/
 import "../../../../../core/index.mjs";
 import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
 import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { applyRouteRealmIDToBody, getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
 import { useRequestScopes } from "../../../request/helpers/scopes.mjs";
 import "../../../request/index.mjs";
-import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
+import { EntityNotFoundError } from "@authup/errors";
 import { OAuth2SubKind } from "@authup/specs";
-import { NotFoundError } from "@ebec/http";
-import { send, sendAccepted, sendCreated, useRequestParam } from "routup";
+import { DBody, DContext, DController, DDelete, DGet, DPath, DPost, DPut, DTags } from "@routup/decorators";
 import { useRequestQuery } from "@routup/basic/query";
-import { DBody, DController, DDelete, DGet, DPath, DPost, DPut, DRequest, DResponse, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/client/module.ts
 function _ts_decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -35,96 +35,92 @@ var ClientController = class {
 		this.service = ctx.service;
 		this.repository = ctx.repository;
 	}
-	async getMany(req, res) {
-		const actor = buildActorContext(req);
-		const { data, meta } = await this.service.getMany(useRequestQuery(req), actor);
-		return send(res, {
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);
+		return {
 			data,
 			meta
-		});
+		};
 	}
-	async get(id, req, res) {
-		const identity = useRequestIdentity(req);
+	async get(id, event) {
+		const identity = useRequestIdentity(event);
 		let isMe = false;
 		if (identity && identity.type === "client") isMe = isSelfToken(id) || identity.id === id;
 		if (isMe) {
-			const attributes = new OAuth2ScopeAttributesResolver().resolveFor(OAuth2SubKind.CLIENT, useRequestScopes(req));
-			const entity = await this.repository.findOneByIdOrName(identity.id, useRequestParam(req, "realmId"));
-			if (!entity) throw new NotFoundError();
+			const attributes = new OAuth2ScopeAttributesResolver().resolveFor(OAuth2SubKind.CLIENT, useRequestScopes(event));
+			const entity = await this.repository.findOneByIdOrName(identity.id, getRequestRealmID(event));
+			if (!entity) throw new EntityNotFoundError();
 			for (const attribute of attributes) if (attribute === "secret") {
 				const withSecret = await this.repository.findOneWithSecret({ id: entity.id });
 				if (withSecret) entity.secret = withSecret.secret;
 			}
-			return send(res, entity);
+			return entity;
 		}
-		const actor = buildActorContext(req);
-		return send(res, await this.service.getOne(id, actor, useRequestQuery(req), useRequestParam(req, "realmId")));
+		const actor = buildActorContext(event);
+		return await this.service.getOne(id, actor, useRequestQuery(event), getRequestRealmID(event));
 	}
-	async add(data, req, res) {
-		const actor = buildActorContext(req);
-		return sendCreated(res, await this.service.create(data, actor));
+	async add(data, event) {
+		applyRouteRealmIDToBody(event, data);
+		const actor = buildActorContext(event);
+		const entity = await this.service.create(data, actor);
+		event.response.status = 201;
+		return entity;
 	}
-	async edit(id, data, req, res) {
-		const actor = buildActorContext(req);
-		return sendAccepted(res, await this.service.update(id, data, actor));
+	async edit(id, data, event) {
+		applyRouteRealmIDToBody(event, data);
+		const actor = buildActorContext(event);
+		const entity = await this.service.update(id, data, actor);
+		event.response.status = 202;
+		return entity;
 	}
-	async put(id, data, req, res) {
-		const actor = buildActorContext(req);
+	async put(id, data, event) {
+		applyRouteRealmIDToBody(event, data);
+		const actor = buildActorContext(event);
 		const { entity, created } = await this.service.save(id || void 0, data, actor);
-		if (created) return sendCreated(res, entity);
-		return sendAccepted(res, entity);
+		event.response.status = created ? 201 : 202;
+		return entity;
 	}
-	async drop(id, req, res) {
-		const actor = buildActorContext(req);
-		return sendAccepted(res, await this.service.delete(id, actor));
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor);
+		event.response.status = 202;
+		return entity;
 	}
 };
 _ts_decorate([
 	DGet("", []),
-	_ts_param(0, DRequest()),
-	_ts_param(1, DResponse()),
+	_ts_param(0, DContext()),
 	_ts_metadata("design:type", Function),
-	_ts_metadata("design:paramtypes", [Object, Object]),
+	_ts_metadata("design:paramtypes", [typeof IRoutupEvent === "undefined" ? Object : IRoutupEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], ClientController.prototype, "getMany", null);
 _ts_decorate([
 	DGet("/:id", []),
 	_ts_param(0, DPath("id")),
-	_ts_param(1, DRequest()),
-	_ts_param(2, DResponse()),
+	_ts_param(1, DContext()),
 	_ts_metadata("design:type", Function),
-	_ts_metadata("design:paramtypes", [
-		String,
-		Object,
-		Object
-	]),
+	_ts_metadata("design:paramtypes", [String, typeof IRoutupEvent === "undefined" ? Object : IRoutupEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], ClientController.prototype, "get", null);
 _ts_decorate([
 	DPost("", [ForceLoggedInMiddleware]),
 	_ts_param(0, DBody()),
-	_ts_param(1, DRequest()),
-	_ts_param(2, DResponse()),
+	_ts_param(1, DContext()),
 	_ts_metadata("design:type", Function),
-	_ts_metadata("design:paramtypes", [
-		Object,
-		Object,
-		Object
-	]),
+	_ts_metadata("design:paramtypes", [typeof ClientCreatePayload === "undefined" ? Object : ClientCreatePayload, typeof IRoutupEvent === "undefined" ? Object : IRoutupEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], ClientController.prototype, "add", null);
 _ts_decorate([
 	DPost("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
 	_ts_param(1, DBody()),
-	_ts_param(2, DRequest()),
-	_ts_param(3, DResponse()),
+	_ts_param(2, DContext()),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [
 		String,
-		Object,
-		Object,
-		Object
+		typeof ClientUpdatePayload === "undefined" ? Object : ClientUpdatePayload,
+		typeof IRoutupEvent === "undefined" ? Object : IRoutupEvent
 	]),
 	_ts_metadata("design:returntype", Promise)
 ], ClientController.prototype, "edit", null);
@@ -132,33 +128,26 @@ _ts_decorate([
 	DPut("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
 	_ts_param(1, DBody()),
-	_ts_param(2, DRequest()),
-	_ts_param(3, DResponse()),
+	_ts_param(2, DContext()),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [
 		String,
-		Object,
-		Object,
-		Object
+		typeof ClientSavePayload === "undefined" ? Object : ClientSavePayload,
+		typeof IRoutupEvent === "undefined" ? Object : IRoutupEvent
 	]),
 	_ts_metadata("design:returntype", Promise)
 ], ClientController.prototype, "put", null);
 _ts_decorate([
 	DDelete("/:id", [ForceLoggedInMiddleware]),
 	_ts_param(0, DPath("id")),
-	_ts_param(1, DRequest()),
-	_ts_param(2, DResponse()),
+	_ts_param(1, DContext()),
 	_ts_metadata("design:type", Function),
-	_ts_metadata("design:paramtypes", [
-		String,
-		Object,
-		Object
-	]),
+	_ts_metadata("design:paramtypes", [String, typeof IRoutupEvent === "undefined" ? Object : IRoutupEvent]),
 	_ts_metadata("design:returntype", Promise)
 ], ClientController.prototype, "drop", null);
 ClientController = _ts_decorate([
 	DTags("oauth2"),
-	DController("/clients"),
+	DController(["/clients", "/realms/:realmId/clients"]),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof ClientControllerContext === "undefined" ? Object : ClientControllerContext])
 ], ClientController);