@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,sBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;CAChC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,IAAAA;EAErC,MAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQZ,OACf,IAAI,CAACY,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEf,OAAOU,WAAW;GAClCM,eAAe,EAAEhB,OAAOW,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/base.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';
+export declare abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
+    protected options: OAuth2TokenIssuerOptions;
+    protected constructor(options?: OAuth2TokenIssuerOptions);
+    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;
+    buildIss(input?: OAuth2TokenPayload): string | undefined;
+    /**
+     * Build utc expire time (in seconds).
+     *
+     * @param input
+     */
+    buildExp(input?: OAuth2TokenPayload): number;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/core/oauth2/token/issuer/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE1G,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}

package/dist/core/oauth2/token/issuer/base.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/token/issuer/base.ts
+var OAuth2BaseTokenIssuer = class {
+	options;
+	constructor(options) {
+		this.options = options || {};
+	}
+	buildIss(input = {}) {
+		if (!this.options.issuer) return;
+		const base = this.options.issuer.replace(/\/+$/, "");
+		if (input.realm_name) return `${base}/realms/${input.realm_name}`;
+		return base;
+	}
+	/**
+	* Build utc expire time (in seconds).
+	*
+	* @param input
+	*/ buildExp(input = {}) {
+		if (input.exp) return input.exp;
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		if (this.options.maxAge) return utc + this.options.maxAge;
+		return utc + 3600;
+	}
+};
+//#endregion
+export { OAuth2BaseTokenIssuer };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";;;;AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;EACtD,KAAKA,UAAUA,WAAW,CAAC;CAC/B;CAQAC,SAASC,QAA4B,CAAC,GAAwB;EAC1D,IAAI,CAAC,KAAKF,QAAQG,QACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,EAAA;EAEjD,IAAIJ,MAAMK,YACN,OAAO,GAAGF,KAAK,UAAUH,MAAMK;EAGnC,OAAOF;CACX;;;;;IAOAG,SAASN,QAA4B,CAAC,GAAY;EAC9C,IAAIA,MAAMO,KACN,OAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAC9C,IAAI,KAAKd,QAAQe,QACb,OAAOL,MAAM,KAAKV,QAAQe;EAG9B,OAAOL,MAAM;CACjB;AACJ"}

package/dist/core/oauth2/token/issuer/index.d.ts

@@ -0,0 +1,5 @@
+export * from './access/index.ts';
+export * from './open-id/index.ts';
+export * from './refresh/index.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/issuer/index.mjs

@@ -0,0 +1,10 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessTokenIssuer } from "./access/module.mjs";
+import "./access/index.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+import { OAuth2RefreshTokenIssuer } from "./refresh/module.mjs";
+import "./refresh/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/open-id/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/issuer/open-id/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2OpenIDTokenIssuer } from "./module.mjs";
+export { OAuth2OpenIDTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/module.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { Identity } from '@authup/core-kit';
+import { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';
+import type { IOAuth2TokenSigner } from '../../signer/index.ts';
+import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import { OAuth2BaseTokenIssuer } from '../base.ts';
+import type { OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';
+import type { IIdentityResolver } from '../../../../identity/index.ts';
+export declare class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {
+    protected repository: IOAuth2TokenRepository;
+    protected signer: IOAuth2TokenSigner;
+    protected identityResolver: IIdentityResolver;
+    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;
+    constructor(ctx: OAuth2OpenIDTokenIssuerContext);
+    issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    issueWithIdentity(input: OAuth2TokenPayload, identity: Identity): Promise<OAuth2TokenIssuerResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/open-id/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,GAAG,EAAE,8BAA8B;IAUzC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAqB1E,iBAAiB,CACnB,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,GACnB,OAAO,CAAC,yBAAyB,CAAC;CAwBxC"}

package/dist/core/oauth2/token/issuer/open-id/module.mjs

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2OpenIDClaimsBuilder } from "../../../openid/claims.mjs";
+import "../../../openid/index.mjs";
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { JWTError, OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/open-id/module.ts
+var OAuth2OpenIDTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	identityResolver;
+	claimsBuilder;
+	constructor(ctx) {
+		super(ctx.options);
+		this.repository = ctx.repository;
+		this.signer = ctx.signer;
+		this.identityResolver = ctx.identityResolver;
+		this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();
+	}
+	async issue(input = {}) {
+		if (!input.sub_kind) throw JWTError.payloadPropertyInvalid("sub_kind");
+		if (!input.sub) throw JWTError.payloadPropertyInvalid("sub");
+		const identity = await this.identityResolver.resolve(input.sub_kind, input.sub);
+		if (!identity) throw JWTError.payloadInvalid();
+		return this.issueWithIdentity(input, identity);
+	}
+	async issueWithIdentity(input, identity) {
+		const claims = this.claimsBuilder.fromIdentity(identity);
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			...claims,
+			kind: OAuth2TokenKind.ID_TOKEN,
+			auth_time: utc,
+			exp: this.buildExp(input),
+			updated_at: utc,
+			...iss ? { iss } : {},
+			...input.client_id ? { aud: input.client_id } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2OpenIDTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/open-id/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenKind","OAuth2OpenIDClaimsBuilder","OAuth2BaseTokenIssuer","OAuth2OpenIDTokenIssuer","repository","signer","identityResolver","claimsBuilder","ctx","options","issue","input","sub_kind","payloadPropertyInvalid","sub","identity","resolve","payloadInvalid","issueWithIdentity","claims","fromIdentity","utc","Math","floor","Date","getTime","iss","buildIss","data","insert","kind","ID_TOKEN","auth_time","exp","buildExp","updated_at","client_id","aud","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError, OAuth2TokenKind } from '@authup/specs';\nimport type { Identity } from '@authup/core-kit';\nimport { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';\nimport type { IIdentityResolver } from '../../../../identity/index.ts';\n\nexport class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityResolver : IIdentityResolver;\n\n    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;\n\n    constructor(ctx: OAuth2OpenIDTokenIssuerContext) {\n        super(ctx.options);\n\n        this.repository = ctx.repository;\n        this.signer = ctx.signer;\n\n        this.identityResolver = ctx.identityResolver;\n        this.claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        if (!input.sub_kind) {\n            throw JWTError.payloadPropertyInvalid('sub_kind');\n        }\n\n        if (!input.sub) {\n            throw JWTError.payloadPropertyInvalid('sub');\n        }\n\n        const identity = await this.identityResolver.resolve(\n            input.sub_kind,\n            input.sub,\n        );\n\n        if (!identity) {\n            throw JWTError.payloadInvalid();\n        }\n\n        return this.issueWithIdentity(input, identity);\n    }\n\n    async issueWithIdentity(\n        input: OAuth2TokenPayload,\n        identity: Identity,\n    ): Promise<OAuth2TokenIssuerResponse> {\n        const claims = this.claimsBuilder.fromIdentity(identity);\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            ...claims,\n            kind: OAuth2TokenKind.ID_TOKEN,\n            auth_time: utc,\n            exp: this.buildExp(input),\n            updated_at: utc,\n            ...(iss ? { iss } : {}),\n            ...(input.client_id ? { aud: input.client_id } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaI,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,MAAMA,IAAIC,OAAO;EAEjB,KAAKL,aAAaI,IAAIJ;EACtB,KAAKC,SAASG,IAAIH;EAElB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMS,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,IAAI,CAACA,MAAMC,UACP,MAAMb,SAASc,uBAAuB,UAAA;EAG1C,IAAI,CAACF,MAAMG,KACP,MAAMf,SAASc,uBAAuB,KAAA;EAG1C,MAAME,WAAW,MAAM,KAAKT,iBAAiBU,QACzCL,MAAMC,UACND,MAAMG,GAAG;EAGb,IAAI,CAACC,UACD,MAAMhB,SAASkB,eAAc;EAGjC,OAAO,KAAKC,kBAAkBP,OAAOI,QAAAA;CACzC;CAEA,MAAMG,kBACFP,OACAI,UACkC;EAClC,MAAMI,SAAS,KAAKZ,cAAca,aAAaL,QAAAA;EAE/C,MAAMM,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAE9C,MAAMC,MAAM,KAAKC,SAAShB,KAAAA;EAE1B,MAAMiB,OAAO,MAAM,KAAKxB,WAAWyB,OAAO;GACtC,GAAGlB;GACH,GAAGQ;GACHW,MAAM9B,gBAAgB+B;GACtBC,WAAWX;GACXY,KAAK,KAAKC,SAASvB,KAAAA;GACnBwB,YAAYd;GACZ,GAAIK,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAIf,MAAMyB,YAAY,EAAEC,KAAK1B,MAAMyB,UAAU,IAAI,CAAC;EACtD,CAAA;EAEA,MAAME,QAAQ,MAAM,KAAKjC,OAAOkC,KAAKX,IAAAA;EAErC,MAAM,KAAKxB,WAAWoC,kBAAkBZ,MAAMU,KAAAA;EAE9C,OAAO,CAACA,OAAOV,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/issuer/open-id/types.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { Identity } from '@authup/core-kit';
+import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import type { IOAuth2TokenSigner } from '../../signer/index.ts';
+import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IIdentityResolver } from '../../../../identity/index.ts';
+export type OAuth2OpenIDTokenIssuerContext = {
+    options?: OAuth2TokenIssuerOptions;
+    repository: IOAuth2TokenRepository;
+    signer: IOAuth2TokenSigner;
+    identityResolver: IIdentityResolver;
+};
+export interface IOAuth2OpenIDTokenIssuer extends IOAuth2TokenIssuer {
+    issueWithIdentity(input: OAuth2TokenPayload, identity: Identity, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/token/issuer/open-id/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,MAAM,MAAM,8BAA8B,GAAG;IACzC,OAAO,CAAC,EAAE,wBAAwB,CAAC;IAEnC,UAAU,EAAE,sBAAsB,CAAC;IACnC,MAAM,EAAE,kBAAkB,CAAC;IAE3B,gBAAgB,EAAE,iBAAiB,CAAA;CACtC,CAAC;AAEF,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAChE,iBAAiB,CACb,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAAC;CAC1C"}

package/dist/core/oauth2/token/issuer/open-id/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/issuer/refresh/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/refresh/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/token/issuer/refresh/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2RefreshTokenIssuer } from "./module.mjs";
+export { OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/refresh/module.d.ts

@@ -0,0 +1,12 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenSigner } from '../../signer/index.ts';
+import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import { OAuth2BaseTokenIssuer } from '../base.ts';
+import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+export declare class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
+    protected repository: IOAuth2TokenRepository;
+    protected signer: IOAuth2TokenSigner;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions);
+    issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/refresh/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;gBAGlC,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B;IAQpC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CAgBnF"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -0,0 +1,31 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/refresh/module.ts
+var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	constructor(repository, signer, options = {}) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.REFRESH,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {}
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+};
+//#endregion
+export { OAuth2RefreshTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEV,YACID,YACAC,QACAC,UAAoC,CAAC,GACvC;EACE,MAAMA,OAAAA;EAEN,KAAKF,aAAaA;EAClB,KAAKC,SAASA;CAClB;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKP,WAAWQ,OAAO;GACtC,GAAGJ;GACHK,MAAMZ,gBAAgBa;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKZ,OAAOa,KAAKP,IAAAA;EAErC,MAAM,KAAKP,WAAWe,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/issuer/types.d.ts

@@ -0,0 +1,27 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+export type OAuth2TokenIssuerResponse = [string, OAuth2TokenPayload];
+export type OAuth2TokenIssuerOptions = {
+    /**
+     * Max duration in seconds
+     */
+    maxAge?: number;
+    /**
+     * Token issuer name.
+     */
+    issuer?: string;
+};
+export interface IOAuth2TokenIssuer {
+    /**
+     * Issue new token.
+     *
+     * @param input
+     */
+    issue(input: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    /**
+     * Build expiration time in seconds (utc).
+     *
+     * @param input
+     */
+    buildExp(input?: OAuth2TokenPayload): number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/token/issuer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACrE,MAAM,MAAM,wBAAwB,GAAG;IACnC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtE;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAI,MAAM,CAAC;CACjD"}

package/dist/core/oauth2/token/issuer/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/repository/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/repository/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/repository/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/repository/index.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/repository/types.d.ts

@@ -0,0 +1,53 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+export interface IOAuth2TokenRepository {
+    /**
+     * Set a token inactive.
+     *
+     * @param id JTI
+     * @param exp Expiration date in unix timestamp
+     */
+    setInactive(id: string, exp?: number): Promise<void>;
+    /**
+     * Check if a token by its jti is active.
+     *
+     * @param id JTI
+     */
+    isInactive(id: string): Promise<boolean>;
+    /**
+     * Find refresh token by jti.
+     *
+     * @param id JTI
+     */
+    findOneById(id: string): Promise<OAuth2TokenPayload | null>;
+    /**
+     * Find token by signature (JWS).
+     * @param token JWS
+     */
+    findOneBySignature(token: string): Promise<OAuth2TokenPayload | null>;
+    /**
+     * Remove refresh token by jti.
+     *
+     * @param id JTI
+     */
+    removeById(id: string): Promise<void>;
+    /**
+     * Insert token.
+     *
+     * @param payload
+     */
+    insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload>;
+    /**
+     * Create or update token.
+     *
+     * @param payload
+     */
+    save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload>;
+    /**
+     * Save token payload with signature (JWS).
+     *
+     * @param payload
+     * @param signature
+     */
+    saveWithSignature(payload: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/token/repository/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/repository/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAIzC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAE7D;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAIvE;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAIvC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAElE;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnG"}

package/dist/core/oauth2/token/repository/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/revoker/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/revoker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/revoker/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2TokenRevoker } from "./module.mjs";
+export { OAuth2TokenRevoker };

package/dist/core/oauth2/token/revoker/module.d.ts

@@ -0,0 +1,9 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenRepository } from '../repository/index.ts';
+import type { IOAuth2TokenRevoker } from './types.ts';
+export declare class OAuth2TokenRevoker implements IOAuth2TokenRevoker {
+    protected repository: IOAuth2TokenRepository;
+    constructor(repository: IOAuth2TokenRepository);
+    revoke(input: OAuth2TokenPayload): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/revoker/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,UAAU,EAAG,sBAAsB,CAAC;gBAElC,UAAU,EAAG,sBAAsB;IAIzC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC;CAO1D"}

package/dist/core/oauth2/token/revoker/module.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { JWTError } from "@authup/specs";
+//#region src/core/oauth2/token/revoker/module.ts
+var OAuth2TokenRevoker = class {
+	repository;
+	constructor(repository) {
+		this.repository = repository;
+	}
+	async revoke(input) {
+		if (!input.jti) throw JWTError.payloadPropertyInvalid("jti");
+		await this.repository.removeById(input.jti);
+	}
+};
+//#endregion
+export { OAuth2TokenRevoker };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/revoker/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["JWTError","OAuth2TokenRevoker","repository","revoke","input","jti","payloadPropertyInvalid","removeById"],"sources":["../../../../../src/core/oauth2/token/revoker/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWTError } from '@authup/specs';\nimport type { IOAuth2TokenRepository } from '../repository/index.ts';\nimport type { IOAuth2TokenRevoker } from './types.ts';\n\nexport class OAuth2TokenRevoker implements IOAuth2TokenRevoker {\n    protected repository : IOAuth2TokenRepository;\n\n    constructor(repository : IOAuth2TokenRepository) {\n        this.repository = repository;\n    }\n\n    async revoke(input: OAuth2TokenPayload) : Promise<void> {\n        if (!input.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        await this.repository.removeById(input.jti);\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,qBAAb,MAAaA;CACCC;CAEV,YAAYA,YAAqC;EAC7C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,OAA2C;EACpD,IAAI,CAACA,MAAMC,KACP,MAAML,SAASM,uBAAuB,KAAA;EAG1C,MAAM,KAAKJ,WAAWK,WAAWH,MAAMC,GAAG;CAC9C;AACJ"}

package/dist/core/oauth2/token/revoker/types.d.ts

@@ -0,0 +1,5 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+export interface IOAuth2TokenRevoker {
+    revoke(payload: OAuth2TokenPayload): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/token/revoker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/revoker/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAChC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD"}

package/dist/core/oauth2/token/revoker/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/signer/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/signer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/signer/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/signer/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2TokenSigner } from "./module.mjs";
+export { OAuth2TokenSigner };

package/dist/core/oauth2/token/signer/module.d.ts

@@ -0,0 +1,9 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2KeyRepository } from '../../key/index.ts';
+import type { IOAuth2TokenSigner } from './types.ts';
+export declare class OAuth2TokenSigner implements IOAuth2TokenSigner {
+    protected keyRepository: IOAuth2KeyRepository;
+    constructor(keyRepository: IOAuth2KeyRepository);
+    sign<T extends OAuth2TokenPayload>(payload: T): Promise<string>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/signer/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,aAAa,EAAG,oBAAoB,CAAC;gBAEnC,aAAa,EAAG,oBAAoB;IAI1C,IAAI,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAI,OAAO,CAAC,MAAM,CAAC;CAgDzE"}

package/dist/core/oauth2/token/signer/module.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { signToken } from "@authup/server-kit";
+import { JWKError, JWKType } from "@authup/specs";
+//#region src/core/oauth2/token/signer/module.ts
+var OAuth2TokenSigner = class {
+	keyRepository;
+	constructor(keyRepository) {
+		this.keyRepository = keyRepository;
+	}
+	async sign(payload) {
+		if (!payload.realm_id) throw JWKError.invalidRealm();
+		const key = await this.keyRepository.findByRealmId(payload.realm_id);
+		if (!key) throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);
+		if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+		let token;
+		if (key.type === JWKType.OCT) token = await signToken(payload, {
+			type: JWKType.OCT,
+			key: key.decryption_key,
+			keyId: key.id
+		});
+		else if (key.type === JWKType.EC) token = await signToken(payload, {
+			type: key.type,
+			key: key.decryption_key,
+			algorithm: key.signature_algorithm,
+			keyId: key.id
+		});
+		else token = await signToken(payload, {
+			type: key.type,
+			key: key.decryption_key,
+			algorithm: key.signature_algorithm,
+			keyId: key.id
+		});
+		return token;
+	}
+};
+//#endregion
+export { OAuth2TokenSigner };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/signer/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","OAuth2TokenSigner","keyRepository","sign","payload","realm_id","invalidRealm","key","findByRealmId","notFoundForRealm","realm_name","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType } from '@authup/specs';\nimport type { IOAuth2KeyRepository } from '../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyRepository : IOAuth2KeyRepository;\n\n    constructor(keyRepository : IOAuth2KeyRepository) {\n        this.keyRepository = keyRepository;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        const key = await this.keyRepository.findByRealmId(payload.realm_id);\n        if (!key) {\n            throw JWKError.notFoundForRealm(payload.realm_id, payload.realm_name);\n        }\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaG,oBAAb,MAAaA;CACCC;CAEV,YAAYA,eAAsC;EAC9C,KAAKA,gBAAgBA;CACzB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMN,SAASO,aAAY;EAG/B,MAAMC,MAAM,MAAM,KAAKL,cAAcM,cAAcJ,QAAQC,QAAQ;EACnE,IAAI,CAACE,KACD,MAAMR,SAASU,iBAAiBL,QAAQC,UAAUD,QAAQM,UAAU;EAGxE,IAAI,CAACH,IAAII,gBACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIN,IAAIO,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVM,SACA;GACIU,MAAMd,QAAQe;GACdR,KAAKA,IAAII;GACTK,OAAOT,IAAIU;EACf,CAAA;OAED,IAAIV,IAAIO,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVM,SACA;GACIU,MAAMP,IAAIO;GACVP,KAAKA,IAAII;GACTQ,WAAWZ,IAAIa;GACfJ,OAAOT,IAAIU;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}

package/dist/core/oauth2/token/signer/types.d.ts

@@ -0,0 +1,5 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+export interface IOAuth2TokenSigner {
+    sign<T extends OAuth2TokenPayload>(payload: T): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/token/signer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/signer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,WAAW,kBAAkB;IAC/B,IAAI,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACnE"}

package/dist/core/oauth2/token/signer/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/verifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/verifier/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/verifier/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/verifier/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2TokenVerifier } from "./module.mjs";
+export { OAuth2TokenVerifier };