@udibo/oauth2 0.14.0 → 0.15.0

package/{esm → dist}/react/components/use-auth-form.js

@@ -5,8 +5,8 @@
  * It owns field values, per-field and form-level errors, and the submit
  * lifecycle, and stays entirely presentation-free: no markup, no styling, no
  * router or network assumptions. The action is injected as `onSubmit`, so the
- * same hook drives a client-side `fetch` in a plain React Router app or a
- * router-action submit in Juniper. Reach for it directly when you want to own
+ * same hook drives a client-side `fetch` or a React Router action submit.
+ * Reach for it directly when you want to own
  * the markup completely (the "eject to headless" path); otherwise use a
  * default component, which is built on this hook.
  *
@@ -100,8 +100,7 @@ export function useAuthForm(options) {
                 return;
             }
             const fieldErrors = result?.fieldErrors;
-            const hasFieldErrors = fieldErrors &&
-                Object.keys(fieldErrors).length > 0;
+            const hasFieldErrors = fieldErrors && Object.keys(fieldErrors).length > 0;
             if (result?.error || hasFieldErrors) {
                 if (result?.error)
                     setFormError(result.error);
@@ -134,9 +133,7 @@ export function useAuthForm(options) {
             value: typeof raw === "boolean" ? "" : String(raw ?? ""),
             onChange: (event) => {
                 const target = event.target;
-                const next = target.type === "checkbox"
-                    ? target.checked
-                    : target.value;
+                const next = target.type === "checkbox" ? target.checked : target.value;
                 setValue(name, next);
             },
             "aria-invalid": hasError ? true : undefined,

package/{esm → dist}/react/components/user-menu.d.ts

@@ -14,8 +14,8 @@
  * @module
  */
 import { type ReactNode } from "react";
-import type { UserInfoClaims } from "../../client/mod.js";
-import type { BaseClassNames } from "./types.js";
+import type { UserInfoClaims } from "../../client/mod.ts";
+import type { BaseClassNames } from "./types.ts";
 /**
  * Per-slot class hooks for {@link UserMenu}: the shared {@link BaseClassNames}
  * `root` plus the menu's own slots.

package/{esm → dist}/react/components/user-menu.js

@@ -54,20 +54,15 @@ export function UserMenu(props) {
     }, [open]);
     if (!user)
         return _jsx(_Fragment, { children: signedOut });
-    const runLogout = onLogout ?? (async () => {
-        await logout();
-    });
+    const runLogout = onLogout ??
+        (async () => {
+            await logout();
+        });
     if (children)
         return _jsx(_Fragment, { children: children({ user, logout: runLogout }) });
-    return (_jsxs("div", { ref: rootRef, "data-oauth2-user-menu": "", className: combineClassNames(className, classNames?.root), children: [_jsx("button", { type: "button", "aria-expanded": open, "aria-controls": panelId, onClick: () => setOpen((value) => !value), "data-oauth2-user-trigger": "", className: classNames?.trigger, children: renderUser
-                    ? renderUser(user)
-                    : (_jsx("span", { "data-oauth2-user-name": "", className: classNames?.name, children: displayName(user) })) }), open
-                ? (_jsxs("div", { id: panelId, "data-oauth2-user-panel": "", className: classNames?.menu, children: [items
-                            ? (_jsx("div", { "data-oauth2-user-items": "", className: classNames?.menuItem, children: items }))
-                            : null, _jsx("button", { type: "button", onClick: () => {
-                                void Promise.resolve(runLogout()).catch((error) => {
-                                    console.error("[@udibo/oauth2] logout failed:", error);
-                                });
-                            }, "data-oauth2-logout": "", className: classNames?.logout, children: labels?.logout ?? "Sign out" })] }))
-                : null] }));
+    return (_jsxs("div", { ref: rootRef, "data-oauth2-user-menu": "", className: combineClassNames(className, classNames?.root), children: [_jsx("button", { type: "button", "aria-expanded": open, "aria-controls": panelId, onClick: () => setOpen((value) => !value), "data-oauth2-user-trigger": "", className: classNames?.trigger, children: renderUser ? (renderUser(user)) : (_jsx("span", { "data-oauth2-user-name": "", className: classNames?.name, children: displayName(user) })) }), open ? (_jsxs("div", { id: panelId, "data-oauth2-user-panel": "", className: classNames?.menu, children: [items ? (_jsx("div", { "data-oauth2-user-items": "", className: classNames?.menuItem, children: items })) : null, _jsx("button", { type: "button", onClick: () => {
+                            void Promise.resolve(runLogout()).catch((error) => {
+                                console.error("[@udibo/oauth2] logout failed:", error);
+                            });
+                        }, "data-oauth2-logout": "", className: classNames?.logout, children: labels?.logout ?? "Sign out" })] })) : null] }));
 }

package/{esm → dist}/react/context.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import { type Context } from "react";
-import type { OAuth2ClientBase, OAuth2Error, UserInfoClaims } from "../client/mod.js";
+import type { OAuth2ClientBase, OAuth2Error, UserInfoClaims } from "../client/mod.ts";
 /** Shape exposed by `useOAuth2()`. */
 export interface OAuth2State {
     /** Whether a user is currently authenticated. */

package/{esm → dist}/react/mod.d.ts

@@ -17,10 +17,9 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
-export { OAuth2Context, type OAuth2ContextValue, type OAuth2State, } from "./context.js";
-export { OAuth2Provider, type OAuth2ProviderProps } from "./provider.js";
-export { useBffClient, useDirectClient, useOAuth2, type UseOAuth2Result, } from "./use-oauth2.js";
-export { useAuthorization } from "./use-authorization.js";
-export { RequireAuth, type RequireAuthProps } from "./require-auth.js";
-export { OAuth2Callback, type OAuth2CallbackProps } from "./callback.js";
+export { OAuth2Context, type OAuth2ContextValue, type OAuth2State, } from "./context.ts";
+export { OAuth2Provider, type OAuth2ProviderProps } from "./provider.tsx";
+export { useBffClient, useDirectClient, useOAuth2, type UseOAuth2Result, } from "./use-oauth2.ts";
+export { useAuthorization } from "./use-authorization.ts";
+export { RequireAuth, type RequireAuthProps } from "./require-auth.tsx";
+export { OAuth2Callback, type OAuth2CallbackProps } from "./callback.tsx";

package/{esm → dist}/react/mod.js

@@ -17,7 +17,6 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 export { OAuth2Context, } from "./context.js";
 export { OAuth2Provider } from "./provider.js";
 export { useBffClient, useDirectClient, useOAuth2, } from "./use-oauth2.js";

package/{esm → dist}/react/provider.d.ts

@@ -6,8 +6,8 @@
  * @module
  */
 import { type ReactNode } from "react";
-import type { OAuth2ClientBase } from "../client/mod.js";
-import { type OAuth2State } from "./context.js";
+import type { OAuth2ClientBase } from "../client/mod.ts";
+import { type OAuth2State } from "./context.ts";
 /** Props for {@link OAuth2Provider}. */
 export interface OAuth2ProviderProps {
     /**

package/{esm → dist}/react/require-auth.js

@@ -1,4 +1,3 @@
-// deno-lint-ignore-file no-window -- browser-only; `window` used only after isBrowser() guards
 /**
  * `<RequireAuth>` — gate a subtree behind authentication. If the user is
  * not authenticated, calls `login({ returnTo })` (the {@link useOAuth2}
@@ -24,8 +23,7 @@ export function RequireAuth(props) {
             return;
         if (!isBrowser())
             return;
-        const target = returnTo ??
-            `${window.location.pathname}${window.location.search}`;
+        const target = returnTo ?? `${window.location.pathname}${window.location.search}`;
         login({ returnTo: target }).catch(() => { });
     }, [isLoading, isAuthenticated, login, returnTo]);
     if (isLoading || !isAuthenticated)

package/{esm → dist}/react/testing.d.ts

@@ -42,10 +42,9 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 import { type ReactNode } from "react";
-import { type AuthorizationRedirect, type BaseLoginOptions, BffClient, DirectClient, type LoginRedirect, type LogoutRedirect, OAuth2ClientBase, type OAuth2Error, type SessionState, type UserInfoClaims } from "../client/mod.js";
-import { type OAuth2State } from "./context.js";
+import { type AuthorizationRedirect, type BaseLoginOptions, BffClient, DirectClient, type LoginRedirect, type LogoutRedirect, OAuth2ClientBase, type OAuth2Error, type SessionState, type UserInfoClaims } from "../client/mod.ts";
+import { type OAuth2State } from "./context.ts";
 /** Where a mock client starts. */
 export interface MockOAuth2ClientState {
     /** Whether the mock starts signed in. Defaults to `user !== null`. */

package/{esm → dist}/react/testing.js

@@ -43,7 +43,6 @@ import { jsx as _jsx } from "react/jsx-runtime";
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 import { useMemo } from "react";
 import { BffClient, DirectClient, OAuth2ClientBase, } from "../client/mod.js";
 import { OAuth2Context } from "./context.js";
@@ -450,7 +449,7 @@ export function MockOAuth2Provider(props) {
                 : client.initialState.isAuthenticated,
             isLoading: override.isLoading ?? false,
             user: overrides("user")
-                ? override.user ?? null
+                ? (override.user ?? null)
                 : client.initialState.user,
             error: override.error ?? null,
             sessionExpiresIn: override.sessionExpiresIn ?? null,

package/{esm → dist}/react/use-authorization.d.ts

@@ -5,7 +5,7 @@
  *
  * @module
  */
-import { type Authorization } from "../models/authorization.js";
+import { type Authorization } from "../models/authorization.ts";
 /**
  * The signed-in user's authorization, derived from the session's claims.
  *

package/{esm → dist}/react/use-oauth2.d.ts

@@ -1,4 +1,11 @@
-import { type BaseLoginOptions, BffClient, DirectClient, type LogoutOptions, type OAuth2ClientBase, type OAuth2Error, type UserInfoClaims } from "../client/mod.js";
+/**
+ * `useOAuth2()` — the primary React hook for consuming OAuth2 state and
+ * driving auth actions, plus the two hooks that narrow the context's client
+ * to a concrete transport.
+ *
+ * @module
+ */
+import { type BaseLoginOptions, BffClient, DirectClient, type LogoutOptions, type OAuth2ClientBase, type OAuth2Error, type UserInfoClaims } from "../client/mod.ts";
 /** Return value of {@link useOAuth2}. */
 export interface UseOAuth2Result {
     /** True iff a user is authenticated. */

package/{esm → dist}/react/use-oauth2.js

@@ -1,4 +1,3 @@
-// deno-lint-ignore-file no-window -- `login`/`logout` touch `window` only after an isBrowser() guard
 /**
  * `useOAuth2()` — the primary React hook for consuming OAuth2 state and
  * driving auth actions, plus the two hooks that narrow the context's client

package/{esm → dist}/server/_clock-skew.js

@@ -6,7 +6,8 @@
  */
 /** Throws `RangeError` unless the leeway is non-negative, finite seconds whose millisecond conversion is finite. */
 export function assertClockSkewSeconds(clockSkewSeconds) {
-    if (!Number.isFinite(clockSkewSeconds) || clockSkewSeconds < 0 ||
+    if (!Number.isFinite(clockSkewSeconds) ||
+        clockSkewSeconds < 0 ||
         !Number.isFinite(clockSkewSeconds * 1000)) {
         throw new RangeError("clockSkewSeconds must be non-negative finite seconds with a finite millisecond conversion");
     }

package/{esm → dist}/server/authorization-server.d.ts

@@ -19,19 +19,18 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749
  * @module
  */
-import "../_dnt.polyfills.js";
-import type { AuthorizeParameters } from "../models/authorization-code.js";
-import type { AuthenticationContext } from "../models/authentication.js";
-import type { ClientInterface } from "../models/client.js";
-import type { Token, TokenResponse } from "../models/token.js";
-import type { AuthorizationServerMetadata } from "../models/responses.js";
-import type { AbstractScope, BasicScope } from "../models/scope.js";
-import type { IsPublicSuffix } from "./redirect-uri.js";
-import type { DispatchableGrant } from "./grants/grant.js";
-import type { ClientServiceInterface } from "./services/client.js";
-import type { TokenServiceInterface } from "./services/token.js";
-import { ResourceServer, type ResourceServerOptions, type ResourceServerServices } from "./resource-server.js";
-import { type SigningKeyProvider } from "./signing-keys.js";
+import type { AuthorizeParameters } from "../models/authorization-code.ts";
+import type { AuthenticationContext } from "../models/authentication.ts";
+import type { ClientInterface } from "../models/client.ts";
+import type { Token, TokenResponse } from "../models/token.ts";
+import type { AuthorizationServerMetadata } from "../models/responses.ts";
+import type { AbstractScope, BasicScope } from "../models/scope.ts";
+import type { IsPublicSuffix } from "./redirect-uri.ts";
+import type { DispatchableGrant } from "./grants/grant.ts";
+import type { ClientServiceInterface } from "./services/client.ts";
+import type { TokenServiceInterface } from "./services/token.ts";
+import { ResourceServer, type ResourceServerOptions, type ResourceServerServices } from "./resource-server.ts";
+import { type SigningKeyProvider } from "./signing-keys.ts";
 /** What {@link AuthorizationServer.handleEndSessionRequest} tells the app. */
 export interface EndSessionContext<Client extends ClientInterface> {
     /** The logout request itself. */
@@ -784,31 +783,31 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
  * silently forwarding.
  */
 export declare function localAuthServerFetch<Client extends ClientInterface, User, S extends AbstractScope>(authServer: AuthorizationServer<Client, User, S>): typeof fetch;
-export { AbstractGrant } from "./grants/grant.js";
-export type { DispatchableGrant, GrantOptions, GrantServices, } from "./grants/grant.js";
-export { AuthorizationCodeGrant } from "./grants/authorization-code.js";
-export type { PKCEClientCredentials } from "./grants/authorization-code.js";
-export type { AuthorizationCodeGrantOptions, AuthorizationCodeGrantServices, GenerateAuthorizationCodeOptions, } from "./grants/authorization-code.js";
-export { ClientCredentialsGrant } from "./grants/client-credentials.js";
-export type { ClientCredentialsGrantOptions, ClientCredentialsGrantServices, } from "./grants/client-credentials.js";
-export { createJwtAccessTokenGenerator, exportSigningKeyJwk, generateSigningKey, importSigningKeyJwk, RotatingSigningKeyProvider, type RotatingSigningKeyProviderOptions, type SigningKey, type SigningKeyProvider, signJwt, StaticSigningKeyProvider, verifyJwt, type VerifyJwtOptions, } from "./signing-keys.js";
-export { RefreshTokenGrant } from "./grants/refresh-token.js";
-export type { RefreshTokenGrantOptions, RefreshTokenGrantServices, TokenReuseEvent, } from "./grants/refresh-token.js";
-export { PasswordGrant } from "./grants/password.js";
-export type { PasswordGrantOptions, PasswordGrantServices, } from "./grants/password.js";
-export { DeviceAuthorizationGrant } from "./grants/device-authorization.js";
-export type { DeviceAuthorizationGrantOptions, DeviceAuthorizationGrantServices, } from "./grants/device-authorization.js";
-export { AbstractTokenService, type AbstractTokenServiceOptions, type TokenServiceInterface, } from "./services/token.js";
-export type { ClientServiceInterface } from "./services/client.js";
-export { AbstractAuthorizationCodeService, type AbstractAuthorizationCodeServiceOptions, type AuthorizationCodeServiceInterface, } from "./services/authorization-code.js";
-export type { DeviceAuthorizationServiceInterface } from "./services/device-authorization.js";
-export type { UserServiceInterface } from "./services/user.js";
-export type { AuthorizationCode, AuthorizeParameters, } from "../models/authorization-code.js";
-export type { DeviceAuthorization } from "../models/device-authorization.js";
-export type { AuthorizationServerMetadata, DeviceAuthorizationResponse, ErrorResponse, OAuth2ErrorCode, } from "../models/responses.js";
-export { challengeMethods, CODE_VERIFIER_MAX_LENGTH, CODE_VERIFIER_MIN_LENGTH, CODE_VERIFIER_PATTERN, generateCodeChallenge, generateCodeVerifier, generateState, getChallengeMethod, validateCodeChallenge, validateCodeVerifier, verifyCodeChallenge, } from "../utils/pkce.js";
-export type { ChallengeMethod, ChallengeMethods } from "../utils/pkce.js";
-export { encodeBasicAuth, parseBasicAuth, tryParseBasicAuth, } from "../utils/basic-auth.js";
-export type { BasicAuth } from "../utils/basic-auth.js";
-export { checkRedirectUriPattern, isRedirectUriPattern, matchRedirectUri, } from "./redirect-uri.js";
-export type { IsPublicSuffix, RedirectUriPatternRule, RedirectUriPatternViolation, } from "./redirect-uri.js";
+export { AbstractGrant } from "./grants/grant.ts";
+export type { DispatchableGrant, GrantOptions, GrantServices, } from "./grants/grant.ts";
+export { AuthorizationCodeGrant } from "./grants/authorization-code.ts";
+export type { PKCEClientCredentials } from "./grants/authorization-code.ts";
+export type { AuthorizationCodeGrantOptions, AuthorizationCodeGrantServices, GenerateAuthorizationCodeOptions, } from "./grants/authorization-code.ts";
+export { ClientCredentialsGrant } from "./grants/client-credentials.ts";
+export type { ClientCredentialsGrantOptions, ClientCredentialsGrantServices, } from "./grants/client-credentials.ts";
+export { createJwtAccessTokenGenerator, exportSigningKeyJwk, generateSigningKey, importSigningKeyJwk, RotatingSigningKeyProvider, type RotatingSigningKeyProviderOptions, type SigningKey, type SigningKeyProvider, signJwt, StaticSigningKeyProvider, verifyJwt, type VerifyJwtOptions, } from "./signing-keys.ts";
+export { RefreshTokenGrant } from "./grants/refresh-token.ts";
+export type { RefreshTokenGrantOptions, RefreshTokenGrantServices, TokenReuseEvent, } from "./grants/refresh-token.ts";
+export { PasswordGrant } from "./grants/password.ts";
+export type { PasswordGrantOptions, PasswordGrantServices, } from "./grants/password.ts";
+export { DeviceAuthorizationGrant } from "./grants/device-authorization.ts";
+export type { DeviceAuthorizationGrantOptions, DeviceAuthorizationGrantServices, } from "./grants/device-authorization.ts";
+export { AbstractTokenService, type AbstractTokenServiceOptions, type TokenServiceInterface, } from "./services/token.ts";
+export type { ClientServiceInterface } from "./services/client.ts";
+export { AbstractAuthorizationCodeService, type AbstractAuthorizationCodeServiceOptions, type AuthorizationCodeServiceInterface, } from "./services/authorization-code.ts";
+export type { DeviceAuthorizationServiceInterface } from "./services/device-authorization.ts";
+export type { UserServiceInterface } from "./services/user.ts";
+export type { AuthorizationCode, AuthorizeParameters, } from "../models/authorization-code.ts";
+export type { DeviceAuthorization } from "../models/device-authorization.ts";
+export type { AuthorizationServerMetadata, DeviceAuthorizationResponse, ErrorResponse, OAuth2ErrorCode, } from "../models/responses.ts";
+export { challengeMethods, CODE_VERIFIER_MAX_LENGTH, CODE_VERIFIER_MIN_LENGTH, CODE_VERIFIER_PATTERN, generateCodeChallenge, generateCodeVerifier, generateState, getChallengeMethod, validateCodeChallenge, validateCodeVerifier, verifyCodeChallenge, } from "../utils/pkce.ts";
+export type { ChallengeMethod, ChallengeMethods } from "../utils/pkce.ts";
+export { encodeBasicAuth, parseBasicAuth, tryParseBasicAuth, } from "../utils/basic-auth.ts";
+export type { BasicAuth } from "../utils/basic-auth.ts";
+export { checkRedirectUriPattern, isRedirectUriPattern, matchRedirectUri, } from "./redirect-uri.ts";
+export type { IsPublicSuffix, RedirectUriPatternRule, RedirectUriPatternViolation, } from "./redirect-uri.ts";

package/{esm → dist}/server/authorization-server.js

@@ -19,7 +19,6 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749
  * @module
  */
-import "../_dnt.polyfills.js";
 import { snapshotAuthenticationContext } from "../utils/authentication-context.js";
 import { AccessDeniedError, InvalidRequestError, InvalidTokenError, isOAuth2Error, OAuth2Error, ServerError, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, } from "../errors.js";
 import { authenticateClientCredentials, extractClientCredentials, } from "./client-authentication.js";
@@ -119,8 +118,7 @@ const AUTHORIZATION_CODE_GRANT_TYPE = "authorization_code";
  * }
  * ```
  */
-export const ENDPOINT_PATHS = Object
-    .fromEntries(ENDPOINT_ENTRIES.map(([key, { path }]) => [key, path]));
+export const ENDPOINT_PATHS = Object.fromEntries(ENDPOINT_ENTRIES.map(([key, { path }]) => [key, path]));
 /**
  * The HTTP methods each endpoint in {@link ENDPOINT_PATHS} answers — `POST` for
  * the token-style endpoints, `GET` for authorize/JWKS/discovery, both for
@@ -261,8 +259,8 @@ export class AuthorizationServer extends ResourceServer {
         const { issuer } = context;
         const endpoints = {};
         for (const [key, { option, path }] of ADVERTISED_ENTRIES) {
-            endpoints[key] = context[option] ??
-                (issuer ? `${issuer}${path}` : undefined);
+            endpoints[key] =
+                context[option] ?? (issuer ? `${issuer}${path}` : undefined);
         }
         return endpoints;
     }
@@ -310,7 +308,7 @@ export class AuthorizationServer extends ResourceServer {
             headers: {
                 "Content-Type": "application/json;charset=UTF-8",
                 "Cache-Control": "no-store",
-                "Pragma": "no-cache",
+                Pragma: "no-cache",
             },
         });
     }
@@ -380,8 +378,7 @@ export class AuthorizationServer extends ResourceServer {
         this.#assertSingletonParameters(body, parameters);
     }
     async #readBody(request, options = {}) {
-        const bytes = await readBoundedBody(request, this.#maxBodyBytes, options)
-            .catch((cause) => {
+        const bytes = await readBoundedBody(request, this.#maxBodyBytes, options).catch((cause) => {
             throw new InvalidRequestError("request body could not be read", {
                 cause,
             });
@@ -402,7 +399,9 @@ export class AuthorizationServer extends ResourceServer {
         const bytes = await this.#readBody(request, { keepReadable: true });
         const body = await new Response(bytes, {
             headers: { "content-type": contentType },
-        }).formData().catch(() => {
+        })
+            .formData()
+            .catch(() => {
             throw new InvalidRequestError("body must be application/x-www-form-urlencoded");
         });
         this.#assertSingletonParameters(body, ["client_id", "client_secret"]);
@@ -432,8 +431,7 @@ export class AuthorizationServer extends ResourceServer {
      */
     async handleTokenRequest(request) {
         try {
-            const { context, body, client, grant } = await this
-                .#beginClientAuthenticatedRequest(request, {
+            const { context, body, client, grant } = await this.#beginClientAuthenticatedRequest(request, {
                 grantFromBody: (body) => this.#grantFromBody(body),
                 validateBody: (body) => this.#assertTokenSingletonParameters(body),
             });
@@ -473,7 +471,7 @@ export class AuthorizationServer extends ResourceServer {
     }
     async #oidcClaims(user, scope, authenticationContext) {
         return {
-            ...(await this.#userClaims?.(user, scope, snapshotAuthenticationContext(authenticationContext)) ?? {}),
+            ...((await this.#userClaims?.(user, scope, snapshotAuthenticationContext(authenticationContext))) ?? {}),
             sub: this.#subjectOf(user),
         };
     }
@@ -609,12 +607,12 @@ export class AuthorizationServer extends ResourceServer {
         try {
             const params = await this.#endSessionParameters(request);
             const client = await this.#resolveEndSessionClient(request, params);
-            const result = await endSession({
+            const result = (await endSession({
                 request,
                 client,
                 subject: params.subject,
                 logoutHint: params.logoutHint,
-            }) ?? {};
+            })) ?? {};
             const headers = new Headers(result.refused ? undefined : result.headers);
             const authorized = result.refused
                 ? undefined
@@ -638,7 +636,9 @@ export class AuthorizationServer extends ResourceServer {
         const idTokenHint = params.get("id_token_hint");
         const hint = idTokenHint ? await this.#readIdTokenHint(idTokenHint) : null;
         const clientId = params.get("client_id");
-        if (clientId && hint && hint.audiences.length > 0 &&
+        if (clientId &&
+            hint &&
+            hint.audiences.length > 0 &&
             !hint.audiences.includes(clientId)) {
             throw new InvalidRequestError("client_id does not match the audience of id_token_hint");
         }
@@ -675,7 +675,7 @@ export class AuthorizationServer extends ResourceServer {
             return null;
         const { services } = await this.authorizationContext(request);
         try {
-            return await services.clientService.get(params.clientId) ?? null;
+            return (await services.clientService.get(params.clientId)) ?? null;
         }
         catch {
             return null;
@@ -802,8 +802,7 @@ export class AuthorizationServer extends ResourceServer {
         const { searchParams } = redirectUrl;
         searchParams.set("error", error.extensions.error ?? "server_error");
         // Use exposedMessage, never raw error.message, so 5xx server_error detail isn't leaked into the redirect.
-        const description = error.extensions.error_description ??
-            error.exposedMessage;
+        const description = error.extensions.error_description ?? error.exposedMessage;
         if (description) {
             searchParams.set("error_description", description);
         }
@@ -884,8 +883,7 @@ export class AuthorizationServer extends ResourceServer {
         const { grant, client, user, requestedScope, authorizedScope, services, handleConsent, } = options;
         const acceptedScope = await grant.acceptedScope(client, user, requestedScope, services.tokenService);
         let scope = acceptedScope ?? undefined;
-        const needsConsent = scope !== undefined &&
-            !(authorizedScope && authorizedScope.has(scope));
+        const needsConsent = scope !== undefined && !(authorizedScope && authorizedScope.has(scope));
         if (needsConsent && handleConsent) {
             const consent = await handleConsent(client, scope, user);
             if (consent instanceof Response)
@@ -940,12 +938,8 @@ export class AuthorizationServer extends ResourceServer {
      */
     async handleRevocationRequest(request) {
         try {
-            const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request, {
-                validateBody: (body) => this.#assertSingletonParameters(body, [
-                    "token",
-                    "token_type_hint",
-                ]),
+            const { context, body, client } = await this.#beginClientAuthenticatedRequest(request, {
+                validateBody: (body) => this.#assertSingletonParameters(body, ["token", "token_type_hint"]),
             });
             const token = body.get("token");
             if (typeof token !== "string") {
@@ -1027,12 +1021,8 @@ export class AuthorizationServer extends ResourceServer {
      */
     async handleIntrospectionRequest(request) {
         try {
-            const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request, {
-                validateBody: (body) => this.#assertSingletonParameters(body, [
-                    "token",
-                    "token_type_hint",
-                ]),
+            const { context, body, client } = await this.#beginClientAuthenticatedRequest(request, {
+                validateBody: (body) => this.#assertSingletonParameters(body, ["token", "token_type_hint"]),
             });
             const tokenValue = body.get("token");
             if (typeof tokenValue !== "string") {
@@ -1044,9 +1034,10 @@ export class AuthorizationServer extends ResourceServer {
             let response;
             const resolved = await this.#resolveToken(tokenService, tokenValue, hint);
             const expiresAt = resolved && this.#introspectedExpiry(resolved);
-            if (!resolved || (expiresAt && expiresAt < new Date()) ||
+            if (!resolved ||
+                (expiresAt && expiresAt < new Date()) ||
                 (this.#canIntrospectToken &&
-                    await this.#canIntrospectToken(client, resolved.token, resolved.tokenType) !== true)) {
+                    (await this.#canIntrospectToken(client, resolved.token, resolved.tokenType)) !== true)) {
                 response = { active: false };
             }
             else {
@@ -1088,7 +1079,7 @@ export class AuthorizationServer extends ResourceServer {
                 headers: {
                     "Content-Type": "application/json;charset=UTF-8",
                     "Cache-Control": "no-store",
-                    "Pragma": "no-cache",
+                    Pragma: "no-cache",
                 },
             });
         }
@@ -1221,16 +1212,13 @@ export class AuthorizationServer extends ResourceServer {
      */
     async handleDeviceAuthorizationRequest(request) {
         try {
-            const { context, body, client } = await this
-                .#beginClientAuthenticatedRequest(request, {
+            const { context, body, client } = await this.#beginClientAuthenticatedRequest(request, {
                 requiredGrantType: DEVICE_AUTHORIZATION_GRANT_TYPE,
                 validateBody: (body) => this.#assertSingletonParameters(body, ["scope"]),
             });
             const grant = this.#deviceAuthorizationGrant();
             const scopeText = body.get("scope");
-            const scope = typeof scopeText === "string"
-                ? grant.parseScope(scopeText)
-                : undefined;
+            const scope = typeof scopeText === "string" ? grant.parseScope(scopeText) : undefined;
             // RFC 8628 §3.2 requires a verification_uri the user can visit.
             if (!context.verificationUri) {
                 throw new ServerError("verificationUri must be configured for the device authorization " +
@@ -1249,7 +1237,7 @@ export class AuthorizationServer extends ResourceServer {
                 headers: {
                     "Content-Type": "application/json;charset=UTF-8",
                     "Cache-Control": "no-store",
-                    "Pragma": "no-cache",
+                    Pragma: "no-cache",
                 },
             });
         }
@@ -1292,7 +1280,9 @@ export class AuthorizationServer extends ResourceServer {
 export function localAuthServerFetch(authServer) {
     return async (input, init) => {
         const request = input instanceof Request
-            ? (init ? new Request(input, init) : input)
+            ? init
+                ? new Request(input, init)
+                : input
             : new Request(String(input), init);
         const url = new URL(request.url);
         const path = url.pathname;

package/{esm → dist}/server/client-authentication.d.ts

@@ -6,8 +6,8 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3
  * @module
  */
-import type { ClientCredentials, ClientInterface } from "../models/client.js";
-import type { ClientServiceInterface } from "./services/client.js";
+import type { ClientCredentials, ClientInterface } from "../models/client.ts";
+import type { ClientServiceInterface } from "./services/client.ts";
 /**
  * Reads the credentials a request presents: HTTP Basic first (RFC 6749 Section
  * 2.3.1), then `client_id`/`client_secret` in `body`, the form body the

package/{esm → dist}/server/grants/authorization-code.d.ts

@@ -3,15 +3,15 @@
  * RFC 6749 Section 4.1 and RFC 7636.
  * @module
  */
-import type { AuthorizationCode } from "../../models/authorization-code.js";
-import type { AuthenticationContext } from "../../models/authentication.js";
-import type { ClientCredentials, ClientInterface } from "../../models/client.js";
-import type { Token } from "../../models/token.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { ChallengeMethod, ChallengeMethods } from "../../utils/pkce.js";
-import type { ClientServiceInterface } from "../services/client.js";
-import type { AuthorizationCodeServiceInterface } from "../services/authorization-code.js";
-import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.js";
+import type { AuthorizationCode } from "../../models/authorization-code.ts";
+import type { AuthenticationContext } from "../../models/authentication.ts";
+import type { ClientCredentials, ClientInterface } from "../../models/client.ts";
+import type { Token } from "../../models/token.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { ChallengeMethod, ChallengeMethods } from "../../utils/pkce.ts";
+import type { ClientServiceInterface } from "../services/client.ts";
+import type { AuthorizationCodeServiceInterface } from "../services/authorization-code.ts";
+import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.ts";
 /** Services required by the authorization code grant. */
 export interface AuthorizationCodeGrantServices<Client extends ClientInterface, User, S extends AbstractScope> extends GrantServices<Client, User, S> {
     /** Generates, stores, and looks up authorization codes for the exchange. */

package/{esm → dist}/server/grants/authorization-code.js

@@ -45,8 +45,8 @@ export class AuthorizationCodeGrant extends AbstractGrant {
         });
         this.challengeMethods = options.challengeMethods ?? defaultChallengeMethods;
         this.requirePKCE = options.requirePKCE ?? true;
-        this.requireClientAuthentication = options.requireClientAuthentication ??
-            true;
+        this.requireClientAuthentication =
+            options.requireClientAuthentication ?? true;
     }
     /**
      * Extracts client credentials from a request, carrying the PKCE
@@ -178,8 +178,7 @@ export class AuthorizationCodeGrant extends AbstractGrant {
      * @see https://datatracker.ietf.org/doc/html/rfc7636#section-4.5
      */
     async token(request, client, body) {
-        const { authorizationCodeService, tokenService } = await this
-            .resolveServices(request);
+        const { authorizationCodeService, tokenService } = await this.resolveServices(request);
         const code = body.get("code");
         if (typeof code !== "string") {
             throw new InvalidRequestError("code parameter required");
@@ -192,7 +191,7 @@ export class AuthorizationCodeGrant extends AbstractGrant {
         if (!authorizationCode || authorizationCode.expiresAt < new Date()) {
             throw new InvalidGrantError("invalid code");
         }
-        if (!await authorizationCodeService.revoke(authorizationCode)) {
+        if (!(await authorizationCodeService.revoke(authorizationCode))) {
             throw new InvalidGrantError("code already used");
         }
         const codeVerifier = body.get("code_verifier");
@@ -200,7 +199,7 @@ export class AuthorizationCodeGrant extends AbstractGrant {
             if (!validateCodeVerifier(codeVerifier)) {
                 throw new InvalidRequestError("code_verifier must be 43-128 characters using [A-Z] / [a-z] / [0-9] / - / . / _ / ~");
             }
-            if (!await this.verifyCode(authorizationCode, codeVerifier)) {
+            if (!(await this.verifyCode(authorizationCode, codeVerifier))) {
                 throw new InvalidGrantError("code_verifier verification failed");
             }
         }

package/{esm → dist}/server/grants/client-credentials.d.ts

@@ -3,10 +3,10 @@
  * RFC 6749 Section 4.4.
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { Token } from "../../models/token.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { Token } from "../../models/token.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.ts";
 /** Services required by the client credentials grant. */
 export type ClientCredentialsGrantServices<Client extends ClientInterface, User, S extends AbstractScope> = GrantServices<Client, User, S>;
 /**