@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/core/oauth2/openid/claims.mjs

@@ -0,0 +1,75 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { hasOwnProperty } from "@authup/kit";
+import { OAuth2SubKind } from "@authup/specs";
+//#region src/core/oauth2/openid/claims.ts
+var OAuth2OpenIDClaimsBuilder = class {
+	clientMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			return value;
+		}]
+	};
+	robotMap = {
+		name: "name",
+		nickname: "name",
+		preferred_username: "name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			return value;
+		}]
+	};
+	userMap = {
+		name: "name",
+		family_name: "last_name",
+		given_name: "first_name",
+		nickname: "display_name",
+		preferred_username: "display_name",
+		updated_at: ["updated_at", (value) => {
+			if (typeof value === "string") return Math.floor(new Date(value).getTime() / 1e3);
+			return value;
+		}],
+		email: "email",
+		email_verified: "active"
+	};
+	/**
+	* Build OpenID Claims form Oauth2 Identity.
+	*
+	* @param identity
+	*/ fromIdentity(identity) {
+		if (identity.type === OAuth2SubKind.CLIENT) return this.fromClient(identity.data);
+		if (identity.type === OAuth2SubKind.ROBOT) return this.fromRobot(identity.data);
+		return this.fromUser(identity.data);
+	}
+	fromClient(input) {
+		return this.extract(this.clientMap, input);
+	}
+	fromRobot(input) {
+		return this.extract(this.robotMap, input);
+	}
+	fromUser(input) {
+		return this.extract(this.userMap, input);
+	}
+	extract(attributeMap, attributes) {
+		const result = {};
+		const keys = Object.keys(attributeMap);
+		for (const key_ of keys) {
+			const attribute = attributeMap[key_];
+			if (typeof attribute === "string") {
+				if (hasOwnProperty(attributes, attribute)) result[key_] = attributes[attribute];
+			} else {
+				const [key, transformer] = attribute;
+				if (hasOwnProperty(attributes, key)) result[key_] = transformer(attributes[key]);
+			}
+		}
+		return result;
+	}
+};
+//#endregion
+export { OAuth2OpenIDClaimsBuilder };
+
+//# sourceMappingURL=claims.mjs.map

package/dist/core/oauth2/openid/claims.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","robotMap","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","ROBOT","fromRobot","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    Robot, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected robotMap : AttributeMap<Robot> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'last_name',\n        given_name: 'first_name',\n        nickname: 'display_name',\n        preferred_username: 'display_name',\n        updated_at: [\n            'updated_at',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        if (identity.type === OAuth2SubKind.ROBOT) {\n            return this.fromRobot(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromRobot(input: Robot): OpenIDTokenPayload {\n        return this.extract(this.robotMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA2BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUK,WAAiC;EACvCT,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;CAER;CAEUM,UAA+B;EACrCV,MAAM;EACNW,aAAa;EACbC,YAAY;EACZX,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,eACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CAAA;EAGJS,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASpB,cAAcqB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,IAAIJ,SAASC,SAASpB,cAAcwB,OAChC,OAAO,KAAKC,UAAUN,SAASI,IAAI;EAGvC,OAAO,KAAKG,SAASP,SAASI,IAAI;CACtC;CAEAD,WAAWK,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAK1B,WAAWyB,KAAAA;CACxC;CAEAF,UAAUE,OAAkC;EACxC,OAAO,KAAKC,QAAQ,KAAKhB,UAAUe,KAAAA;CACvC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKf,SAASc,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc;QACjBpC,eAAe+B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIpC,eAAe+B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}

package/dist/core/oauth2/openid/index.d.ts

@@ -0,0 +1,2 @@
+export * from './claims.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/openid/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/openid/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2OpenIDClaimsBuilder } from "./claims.mjs";
+export { OAuth2OpenIDClaimsBuilder };

package/dist/core/oauth2/response/bearer.d.ts

@@ -0,0 +1,4 @@
+import type { OAuth2TokenGrantResponse } from '@authup/specs';
+import type { OAuth2BearerResponseBuildContext } from './type.ts';
+export declare function buildOAuth2BearerTokenResponse(context: OAuth2BearerResponseBuildContext): OAuth2TokenGrantResponse;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/core/oauth2/response/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/response/bearer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAsB,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAC;AAUlE,wBAAgB,8BAA8B,CAC1C,OAAO,EAAE,gCAAgC,GACzC,wBAAwB,CAuB3B"}

package/dist/core/oauth2/response/bearer.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/response/bearer.ts
+function resolveExpiresIn(payload, fallbackValue) {
+	if (payload && payload.exp) return payload.exp - Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+	return fallbackValue || 3600;
+}
+function buildOAuth2BearerTokenResponse(context) {
+	const response = {
+		access_token: context.accessToken,
+		expires_in: resolveExpiresIn(context.accessTokenPayload),
+		token_type: "Bearer"
+	};
+	if (context.accessTokenPayload) response.scope = context.accessTokenPayload.scope;
+	else if (context.scope) response.scope = context.scope;
+	if (context.refreshToken) {
+		response.refresh_token = context.refreshToken;
+		response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);
+	}
+	if (context.idToken) response.id_token = context.idToken;
+	return response;
+}
+//#endregion
+export { buildOAuth2BearerTokenResponse };
+
+//# sourceMappingURL=bearer.mjs.map

package/dist/core/oauth2/response/bearer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.mjs","names":["resolveExpiresIn","payload","fallbackValue","exp","Math","floor","Date","getTime","buildOAuth2BearerTokenResponse","context","response","access_token","accessToken","expires_in","accessTokenPayload","token_type","scope","refreshToken","refresh_token","refresh_token_expires_in","refreshTokenPayload","idToken","id_token"],"sources":["../../../../src/core/oauth2/response/bearer.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport type { OAuth2BearerResponseBuildContext } from './type.ts';\n\nfunction resolveExpiresIn(payload?: OAuth2TokenPayload, fallbackValue?: number) : number {\n    if (payload && payload.exp) {\n        return payload.exp - Math.floor(new Date().getTime() / 1000);\n    }\n\n    return fallbackValue || 3_600;\n}\n\nexport function buildOAuth2BearerTokenResponse(\n    context: OAuth2BearerResponseBuildContext,\n) : OAuth2TokenGrantResponse {\n    const response : OAuth2TokenGrantResponse = {\n        access_token: context.accessToken,\n        expires_in: resolveExpiresIn(context.accessTokenPayload),\n        token_type: 'Bearer',\n    };\n\n    if (context.accessTokenPayload) {\n        response.scope = context.accessTokenPayload.scope;\n    } else if (context.scope) {\n        response.scope = context.scope;\n    }\n\n    if (context.refreshToken) {\n        response.refresh_token = context.refreshToken;\n        response.refresh_token_expires_in = resolveExpiresIn(context.refreshTokenPayload);\n    }\n\n    if (context.idToken) {\n        response.id_token = context.idToken;\n    }\n\n    return response;\n}\n"],"mappings":";;;;AAUA,SAASA,iBAAiBC,SAA8BC,eAAsB;CAC1E,IAAID,WAAWA,QAAQE,KACnB,OAAOF,QAAQE,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;CAG3D,OAAOL,iBAAiB;AAC5B;AAEA,SAAgBM,+BACZC,SAAyC;CAEzC,MAAMC,WAAsC;EACxCC,cAAcF,QAAQG;EACtBC,YAAYb,iBAAiBS,QAAQK,kBAAkB;EACvDC,YAAY;CAChB;CAEA,IAAIN,QAAQK,oBACRJ,SAASM,QAAQP,QAAQK,mBAAmBE;MACzC,IAAIP,QAAQO,OACfN,SAASM,QAAQP,QAAQO;CAG7B,IAAIP,QAAQQ,cAAc;EACtBP,SAASQ,gBAAgBT,QAAQQ;EACjCP,SAASS,2BAA2BnB,iBAAiBS,QAAQW,mBAAmB;CACpF;CAEA,IAAIX,QAAQY,SACRX,SAASY,WAAWb,QAAQY;CAGhC,OAAOX;AACX"}

package/dist/core/oauth2/response/index.d.ts

@@ -0,0 +1,3 @@
+export * from './bearer.ts';
+export * from './type.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/response/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/response/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}

package/dist/core/oauth2/response/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildOAuth2BearerTokenResponse } from "./bearer.mjs";
+export { buildOAuth2BearerTokenResponse };

package/dist/core/oauth2/response/type.d.ts

@@ -0,0 +1,10 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+export type OAuth2BearerResponseBuildContext = {
+    accessToken: string;
+    accessTokenPayload?: OAuth2TokenPayload;
+    refreshToken?: string;
+    refreshTokenPayload?: OAuth2TokenPayload;
+    idToken?: string;
+    scope?: string;
+};
+//# sourceMappingURL=type.d.ts.map

package/dist/core/oauth2/response/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/response/type.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,MAAM,gCAAgC,GAAG;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAExC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IAEzC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAC"}

package/dist/core/oauth2/response/type.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/scope/index.d.ts

@@ -0,0 +1,3 @@
+export * from './resolver.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/scope/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/scope/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2ScopeAttributesResolver } from "./resolver.mjs";
+export { OAuth2ScopeAttributesResolver };

package/dist/core/oauth2/scope/resolver.d.ts

@@ -0,0 +1,23 @@
+import type { Client, Robot, User } from '@authup/core-kit';
+import { OAuth2SubKind } from '@authup/specs';
+import type { ObjectLiteral } from 'validup';
+type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
+    [key: string]: (keyof T & string)[];
+};
+export declare class OAuth2ScopeAttributesResolver {
+    protected clientAttributes: ScopeFields<Client>;
+    protected robotAttributes: ScopeFields<Robot>;
+    protected userAttributes: ScopeFields<User>;
+    /**
+     * Resolve attributes for sub kind.
+     *
+     * @param type
+     * @param scope
+     */
+    resolveFor(type: OAuth2SubKind, scope: string | string[]): string[];
+    resolveForClient(scope: string | string[]): string[];
+    resolveForRobot(scope: string | string[]): string[];
+    resolveForUser(scope: string | string[]): string[];
+}
+export {};
+//# sourceMappingURL=resolver.d.ts.map

package/dist/core/oauth2/scope/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,eAAe,EAAG,WAAW,CAAC,KAAK,CAAC,CAG5C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAYxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}

package/dist/core/oauth2/scope/resolver.mjs

@@ -0,0 +1,96 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { hasOwnProperty } from "@authup/kit";
+import { ScopeName } from "@authup/core-kit";
+import { OAuth2SubKind, unwrapOAuth2Scope } from "@authup/specs";
+import { distinctArray } from "smob";
+//#region src/core/oauth2/scope/resolver.ts
+var OAuth2ScopeAttributesResolver = class {
+	clientAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	robotAttributes = {
+		[ScopeName.IDENTITY]: ["name"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"display_name",
+			"updated_at",
+			"active"
+		]
+	};
+	userAttributes = {
+		[ScopeName.IDENTITY]: [
+			"name",
+			"display_name",
+			"last_name",
+			"first_name"
+		],
+		[ScopeName.EMAIL]: ["email"],
+		[ScopeName.OPEN_ID]: [
+			"name",
+			"updated_at",
+			"first_name",
+			"last_name",
+			"display_name",
+			"active",
+			"email"
+		]
+	};
+	/**
+	* Resolve attributes for sub kind.
+	*
+	* @param type
+	* @param scope
+	*/ resolveFor(type, scope) {
+		if (type === OAuth2SubKind.CLIENT) return this.resolveForClient(scope);
+		if (type === OAuth2SubKind.ROBOT) return this.resolveForRobot(scope);
+		return this.resolveForUser(scope);
+	}
+	resolveForClient(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.clientAttributes, scope)) attributes.push(...this.clientAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.clientAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForRobot(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.robotAttributes, scope)) attributes.push(...this.robotAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.robotAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+	resolveForUser(scope) {
+		const attributes = [];
+		const scopes = unwrapOAuth2Scope(scope);
+		for (const scope of scopes) {
+			if (hasOwnProperty(this.userAttributes, scope)) attributes.push(...this.userAttributes[scope]);
+			if (scope === ScopeName.GLOBAL) {
+				attributes.push(...Object.values(this.userAttributes).flat());
+				break;
+			}
+		}
+		return distinctArray(attributes);
+	}
+};
+//#endregion
+export { OAuth2ScopeAttributesResolver };
+
+//# sourceMappingURL=resolver.mjs.map

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;;GAC3DP,UAAUW,QAAQ,CAAC,OAAA;GACnBX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;;CACrG;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;EACtD,IAAID,SAASX,cAAca,QACvB,OAAO,KAAKC,iBAAiBF,KAAAA;EAGjC,IAAID,SAASX,cAAce,OACvB,OAAO,KAAKC,gBAAgBJ,KAAAA;EAGhC,OAAO,KAAKK,eAAeL,KAAAA;CAC/B;CAEAE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKK,kBAAkBQ,KAAAA,GACtCM,WAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,MAAM;GAGnD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,gBAAgB,CAAA,CAAEoB,KAAI,CAAA;IAC5D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKQ,iBAAiBK,KAAAA,GACrCM,WAAWE,KAAI,GAAI,KAAKb,gBAAgBK,MAAM;GAGlD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,eAAe,CAAA,CAAEiB,KAAI,CAAA;IAC3D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKS,gBAAgBI,KAAAA,GACpCM,WAAWE,KAAI,GAAI,KAAKZ,eAAeI,MAAM;GAGjD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,cAAc,CAAA,CAAEgB,KAAI,CAAA;IAC1D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;AACJ"}

package/dist/core/oauth2/scope/types.d.ts

@@ -0,0 +1,5 @@
+import type { Scope } from '@authup/core-kit';
+export interface IOAuth2ScopeRepository {
+    findByClientId(clientId: string): Promise<Scope[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/scope/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACnC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;CACvD"}

package/dist/core/oauth2/scope/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/token/index.d.ts

@@ -0,0 +1,6 @@
+export * from './issuer/index.ts';
+export * from './revoker/index.ts';
+export * from './signer/index.ts';
+export * from './verifier/index.ts';
+export * from './repository/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/token/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}

package/dist/core/oauth2/token/index.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessTokenIssuer } from "./issuer/access/module.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./issuer/open-id/module.mjs";
+import { OAuth2RefreshTokenIssuer } from "./issuer/refresh/module.mjs";
+import "./issuer/index.mjs";
+import { OAuth2TokenRevoker } from "./revoker/module.mjs";
+import "./revoker/index.mjs";
+import { OAuth2TokenSigner } from "./signer/module.mjs";
+import "./signer/index.mjs";
+import { OAuth2TokenVerifier } from "./verifier/module.mjs";
+import "./verifier/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier };

package/dist/core/oauth2/token/issuer/access/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/access/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/token/issuer/access/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessTokenIssuer } from "./module.mjs";
+export { OAuth2AccessTokenIssuer };

package/dist/core/oauth2/token/issuer/access/module.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenSigner } from '../../signer/index.ts';
+import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import { OAuth2BaseTokenIssuer } from '../base.ts';
+import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IIdentityRoleProvider } from '../../../../identity/index.ts';
+export declare class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
+    protected repository: IOAuth2TokenRepository;
+    protected signer: IOAuth2TokenSigner;
+    protected identityRoleProvider?: IIdentityRoleProvider;
+    constructor(repository: IOAuth2TokenRepository, signer: IOAuth2TokenSigner, options?: OAuth2TokenIssuerOptions, identityRoleProvider?: IIdentityRoleProvider);
+    issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    protected buildAccessClaims(input: OAuth2TokenPayload): Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;gBAGnD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB;IAS1C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAoBhE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -0,0 +1,53 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2BaseTokenIssuer } from "../base.mjs";
+import { OAuth2TokenKind } from "@authup/specs";
+//#region src/core/oauth2/token/issuer/access/module.ts
+var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
+	repository;
+	signer;
+	identityRoleProvider;
+	constructor(repository, signer, options = {}, identityRoleProvider) {
+		super(options);
+		this.repository = repository;
+		this.signer = signer;
+		this.identityRoleProvider = identityRoleProvider;
+	}
+	async issue(input = {}) {
+		const iss = this.buildIss(input);
+		const accessClaims = await this.buildAccessClaims(input);
+		const data = await this.repository.insert({
+			...input,
+			kind: OAuth2TokenKind.ACCESS,
+			exp: this.buildExp(input),
+			...iss ? { iss } : {},
+			...accessClaims
+		});
+		const token = await this.signer.sign(data);
+		await this.repository.saveWithSignature(data, token);
+		return [token, data];
+	}
+	async buildAccessClaims(input) {
+		if (!this.identityRoleProvider || !input.sub || !input.sub_kind) return {};
+		const roles = await this.identityRoleProvider.getRolesFor({
+			type: input.sub_kind,
+			id: input.sub,
+			clientId: input.client_id,
+			realmId: input.realm_id,
+			realmName: input.realm_name
+		});
+		const realmRoles = [];
+		const globalRoles = [];
+		for (const role of roles) if (!role.realm_id) globalRoles.push(role.name);
+		else if (input.realm_id && role.realm_id === input.realm_id) realmRoles.push(role.name);
+		return {
+			realm_access: { roles: realmRoles },
+			global_access: { roles: globalRoles }
+		};
+	}
+};
+//#endregion
+export { OAuth2AccessTokenIssuer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","sub","sub_kind","roles","getRolesFor","type","id","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,sBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;CAChC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKV,WAAWW,OAAO;GACtC,GAAGN;GACHO,MAAMf,gBAAgBgB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKf,OAAOgB,KAAKP,IAAAA;EAErC,MAAM,KAAKV,WAAWkB,kBAAkBR,MAAMM,KAAAA;EAE9C,OAAO,CAACA,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKH,wBAAwB,CAACG,MAAMc,OAAO,CAACd,MAAMe,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKnB,qBAAqBoB,YAAY;GACtDC,MAAMlB,MAAMe;GACZI,IAAInB,MAAMc;GACVM,UAAUpB,MAAMqB;GAChBC,SAAStB,MAAMuB;GACfC,WAAWxB,MAAMyB;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQZ,OACf,IAAI,CAACY,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI9B,MAAMuB,YAAYK,KAAKL,aAAavB,MAAMuB,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEf,OAAOU,WAAW;GAClCM,eAAe,EAAEhB,OAAOW,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/base.d.ts

@@ -0,0 +1,15 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';
+export declare abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
+    protected options: OAuth2TokenIssuerOptions;
+    protected constructor(options?: OAuth2TokenIssuerOptions);
+    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;
+    buildIss(input?: OAuth2TokenPayload): string | undefined;
+    /**
+     * Build utc expire time (in seconds).
+     *
+     * @param input
+     */
+    buildExp(input?: OAuth2TokenPayload): number;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/core/oauth2/token/issuer/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE1G,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}

package/dist/core/oauth2/token/issuer/base.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/token/issuer/base.ts
+var OAuth2BaseTokenIssuer = class {
+	options;
+	constructor(options) {
+		this.options = options || {};
+	}
+	buildIss(input = {}) {
+		if (!this.options.issuer) return;
+		const base = this.options.issuer.replace(/\/+$/, "");
+		if (input.realm_name) return `${base}/realms/${input.realm_name}`;
+		return base;
+	}
+	/**
+	* Build utc expire time (in seconds).
+	*
+	* @param input
+	*/ buildExp(input = {}) {
+		if (input.exp) return input.exp;
+		const utc = Math.floor((/* @__PURE__ */ new Date()).getTime() / 1e3);
+		if (this.options.maxAge) return utc + this.options.maxAge;
+		return utc + 3600;
+	}
+};
+//#endregion
+export { OAuth2BaseTokenIssuer };
+
+//# sourceMappingURL=base.mjs.map

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";;;;AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;EACtD,KAAKA,UAAUA,WAAW,CAAC;CAC/B;CAQAC,SAASC,QAA4B,CAAC,GAAwB;EAC1D,IAAI,CAAC,KAAKF,QAAQG,QACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,EAAA;EAEjD,IAAIJ,MAAMK,YACN,OAAO,GAAGF,KAAK,UAAUH,MAAMK;EAGnC,OAAOF;CACX;;;;;IAOAG,SAASN,QAA4B,CAAC,GAAY;EAC9C,IAAIA,MAAMO,KACN,OAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAC9C,IAAI,KAAKd,QAAQe,QACb,OAAOL,MAAM,KAAKV,QAAQe;EAG9B,OAAOL,MAAM;CACjB;AACJ"}

package/dist/core/oauth2/token/issuer/index.d.ts

@@ -0,0 +1,5 @@
+export * from './access/index.ts';
+export * from './open-id/index.ts';
+export * from './refresh/index.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/issuer/index.mjs

@@ -0,0 +1,10 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessTokenIssuer } from "./access/module.mjs";
+import "./access/index.mjs";
+import { OAuth2OpenIDTokenIssuer } from "./open-id/module.mjs";
+import "./open-id/index.mjs";
+import { OAuth2RefreshTokenIssuer } from "./refresh/module.mjs";
+import "./refresh/index.mjs";
+export { OAuth2AccessTokenIssuer, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/token/issuer/open-id/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/token/issuer/open-id/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2OpenIDTokenIssuer } from "./module.mjs";
+export { OAuth2OpenIDTokenIssuer };

package/dist/core/oauth2/token/issuer/open-id/module.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { Identity } from '@authup/core-kit';
+import { OAuth2OpenIDClaimsBuilder } from '../../../openid/index.ts';
+import type { IOAuth2TokenSigner } from '../../signer/index.ts';
+import type { IOAuth2TokenRepository } from '../../repository/index.ts';
+import { OAuth2BaseTokenIssuer } from '../base.ts';
+import type { OAuth2TokenIssuerResponse } from '../types.ts';
+import type { IOAuth2OpenIDTokenIssuer, OAuth2OpenIDTokenIssuerContext } from './types.ts';
+import type { IIdentityResolver } from '../../../../identity/index.ts';
+export declare class OAuth2OpenIDTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2OpenIDTokenIssuer {
+    protected repository: IOAuth2TokenRepository;
+    protected signer: IOAuth2TokenSigner;
+    protected identityResolver: IIdentityResolver;
+    protected claimsBuilder: OAuth2OpenIDClaimsBuilder;
+    constructor(ctx: OAuth2OpenIDTokenIssuerContext);
+    issue(input?: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
+    issueWithIdentity(input: OAuth2TokenPayload, identity: Identity): Promise<OAuth2TokenIssuerResponse>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/token/issuer/open-id/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/open-id/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,wBAAwB;IAClG,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,gBAAgB,EAAG,iBAAiB,CAAC;IAE/C,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,GAAG,EAAE,8BAA8B;IAUzC,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;IAqB1E,iBAAiB,CACnB,KAAK,EAAE,kBAAkB,EACzB,QAAQ,EAAE,QAAQ,GACnB,OAAO,CAAC,yBAAyB,CAAC;CAwBxC"}