@udibo/oauth2 0.14.1 → 0.15.0

package/{esm → dist}/server/grants/device-authorization.d.ts

@@ -8,12 +8,12 @@
  * @see https://datatracker.ietf.org/doc/html/rfc8628
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { Token } from "../../models/token.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { DeviceAuthorization } from "../../models/device-authorization.js";
-import type { DeviceAuthorizationServiceInterface } from "../services/device-authorization.js";
-import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { Token } from "../../models/token.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { DeviceAuthorization } from "../../models/device-authorization.ts";
+import type { DeviceAuthorizationServiceInterface } from "../services/device-authorization.ts";
+import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.ts";
 /**
  * Services required by the device authorization grant.
  */

package/{esm → dist}/server/grants/device-authorization.js

@@ -95,8 +95,7 @@ export class DeviceAuthorizationGrant extends AbstractGrant {
      * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
      */
     async token(request, client, body) {
-        const { deviceAuthorizationService, tokenService } = await this
-            .resolveServices(request);
+        const { deviceAuthorizationService, tokenService } = await this.resolveServices(request);
         const deviceCode = body.get("device_code");
         if (typeof deviceCode !== "string") {
             throw new InvalidRequestError("device_code parameter required");
@@ -130,7 +129,7 @@ export class DeviceAuthorizationGrant extends AbstractGrant {
             throw new AuthorizationPendingError("authorization request is pending user approval");
         }
         const { user, scope } = authorization;
-        if (!await deviceAuthorizationService.revoke(authorization)) {
+        if (!(await deviceAuthorizationService.revoke(authorization))) {
             throw new InvalidGrantError("device_code already used");
         }
         const token = await this.generateToken(client, user, scope, tokenService);
@@ -143,7 +142,8 @@ export class DeviceAuthorizationGrant extends AbstractGrant {
         catch (error) {
             let stillStored;
             try {
-                stillStored = await deviceAuthorizationService.getByDeviceCode(deviceCode);
+                stillStored =
+                    await deviceAuthorizationService.getByDeviceCode(deviceCode);
             }
             catch {
                 throw error;

package/{esm → dist}/server/grants/grant.d.ts

@@ -16,13 +16,13 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4
  * @module
  */
-import type { ClientCredentials, ClientInterface } from "../../models/client.js";
-import type { RefreshToken, Token } from "../../models/token.js";
-import type { AuthenticationContext } from "../../models/authentication.js";
-import type { AbstractScope, ScopeConstructor } from "../../models/scope.js";
-import { BasicScope } from "../../models/scope.js";
-import type { ClientServiceInterface } from "../services/client.js";
-import type { TokenServiceInterface } from "../services/token.js";
+import type { ClientCredentials, ClientInterface } from "../../models/client.ts";
+import type { RefreshToken, Token } from "../../models/token.ts";
+import type { AuthenticationContext } from "../../models/authentication.ts";
+import type { AbstractScope, ScopeConstructor } from "../../models/scope.ts";
+import { BasicScope } from "../../models/scope.ts";
+import type { ClientServiceInterface } from "../services/client.ts";
+import type { TokenServiceInterface } from "../services/token.ts";
 /**
  * The core services every grant needs: client lookup/authentication and token
  * storage. Each grant defines its own services interface by extending this with

package/{esm → dist}/server/grants/grant.js

@@ -38,8 +38,8 @@ export class AbstractGrant {
     /** Creates a grant from the shared {@linkcode GrantOptions}. */
     constructor(options) {
         this.allowRefreshToken = options.allowRefreshToken ?? false;
-        this.Scope = options.Scope ??
-            BasicScope;
+        this.Scope =
+            options.Scope ?? BasicScope;
         this.#resolve = options.resolve;
     }
     /** The services this grant needs for `request`, from its `resolve` option. */
@@ -148,12 +148,12 @@ export class AbstractGrant {
                 if (refreshTokenExpiresAt) {
                     withRefresh.refreshTokenExpiresAt = refreshTokenExpiresAt;
                 }
-                const newFamilyExpiresAt = await tokenService
-                    .refreshTokenFamilyExpiresAt?.(client, user, familyCreatedAt, scope);
+                const newFamilyExpiresAt = await tokenService.refreshTokenFamilyExpiresAt?.(client, user, familyCreatedAt, scope);
                 if (newFamilyExpiresAt) {
-                    ceiling = ceiling && ceiling < newFamilyExpiresAt
-                        ? ceiling
-                        : newFamilyExpiresAt;
+                    ceiling =
+                        ceiling && ceiling < newFamilyExpiresAt
+                            ? ceiling
+                            : newFamilyExpiresAt;
                 }
                 result = withRefresh;
             }

package/{esm → dist}/server/grants/password.d.ts

@@ -17,11 +17,11 @@
  * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.4
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { Token } from "../../models/token.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { UserServiceInterface } from "../services/user.js";
-import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { Token } from "../../models/token.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { UserServiceInterface } from "../services/user.ts";
+import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.ts";
 /** Services required by the password grant. */
 export interface PasswordGrantServices<Client extends ClientInterface, User, S extends AbstractScope> extends GrantServices<Client, User, S> {
     /** Authenticates the resource owner by username and password. */

package/{esm → dist}/server/grants/refresh-token.d.ts

@@ -3,10 +3,10 @@
  * RFC 6749 Section 6.
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { RefreshToken } from "../../models/token.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { RefreshToken } from "../../models/token.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import { AbstractGrant, type GrantOptions, type GrantServices } from "./grant.ts";
 /** Services required by the refresh token grant. */
 export type RefreshTokenGrantServices<Client extends ClientInterface, User, S extends AbstractScope> = GrantServices<Client, User, S>;
 /**

package/{esm → dist}/server/grants/refresh-token.js

@@ -92,8 +92,7 @@ export class RefreshTokenGrant extends AbstractGrant {
                 nextScope = requestedScope;
             }
         }
-        const familyExpiresAt = currentToken.familyCreatedAt &&
-            tokenService.refreshTokenFamilyExpiresAt
+        const familyExpiresAt = currentToken.familyCreatedAt && tokenService.refreshTokenFamilyExpiresAt
             ? await tokenService.refreshTokenFamilyExpiresAt(client, user, currentToken.familyCreatedAt, nextScope)
             : undefined;
         if (familyExpiresAt && familyExpiresAt.getTime() <= Date.now()) {
@@ -109,10 +108,10 @@ export class RefreshTokenGrant extends AbstractGrant {
             };
         // A rotation stays in its ancestor's family so replaying any rotated-out
         // member revokes the whole chain.
-        nextRefreshToken.familyId = currentToken.familyId ??
-            nextRefreshToken.familyId;
-        nextRefreshToken.familyCreatedAt = currentToken.familyCreatedAt ??
-            nextRefreshToken.familyCreatedAt;
+        nextRefreshToken.familyId =
+            currentToken.familyId ?? nextRefreshToken.familyId;
+        nextRefreshToken.familyCreatedAt =
+            currentToken.familyCreatedAt ?? nextRefreshToken.familyCreatedAt;
         if (familyExpiresAt) {
             this.capAtFamilyExpiry(nextRefreshToken, familyExpiresAt);
         }

package/{esm → dist}/server/introspection-token-reader.d.ts

@@ -9,11 +9,11 @@
  * @see https://datatracker.ietf.org/doc/html/rfc7662
  * @module
  */
-import type { ClientInterface } from "../models/client.js";
-import type { AbstractScope, ScopeConstructor } from "../models/scope.js";
-import { BasicScope } from "../models/scope.js";
-import type { IntrospectionResponse, Token } from "../models/token.js";
-import type { TokenReaderInterface } from "./services/token.js";
+import type { ClientInterface } from "../models/client.ts";
+import type { AbstractScope, ScopeConstructor } from "../models/scope.ts";
+import { BasicScope } from "../models/scope.ts";
+import type { IntrospectionResponse, Token } from "../models/token.ts";
+import type { TokenReaderInterface } from "./services/token.ts";
 /**
  * Options for configuring the introspection token reader.
  *

package/{esm → dist}/server/introspection-token-reader.js

@@ -71,8 +71,8 @@ export class IntrospectionTokenReader {
         this.introspectionEndpoint = options.introspectionEndpoint;
         this.clientId = options.clientId;
         this.clientSecret = options.clientSecret;
-        this.Scope = options.Scope ??
-            BasicScope;
+        this.Scope =
+            options.Scope ?? BasicScope;
         this.getClient = options.getClient;
         this.getUser = options.getUser;
         this.fetchTimeoutMs = options.fetchTimeoutMs ?? 5_000;
@@ -138,7 +138,7 @@ export class IntrospectionTokenReader {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/x-www-form-urlencoded",
-                        "Authorization": encodeBasicAuth(this.clientId, this.clientSecret),
+                        Authorization: encodeBasicAuth(this.clientId, this.clientSecret),
                     },
                     body: new URLSearchParams({ token: accessToken }),
                     signal: packageDeadlineSignal(controller.signal),
@@ -154,7 +154,7 @@ export class IntrospectionTokenReader {
                     : new ServerError(`token introspection failed (HTTP ${response.status})`);
             }
             try {
-                return await response.json();
+                return (await response.json());
             }
             catch (cause) {
                 throw controller.signal.aborted

package/{esm → dist}/server/jwks-token-reader.d.ts

@@ -12,11 +12,11 @@
  * @see https://datatracker.ietf.org/doc/html/rfc7517
  * @module
  */
-import type { ClientInterface } from "../models/client.js";
-import type { AbstractScope, ScopeConstructor } from "../models/scope.js";
-import { BasicScope } from "../models/scope.js";
-import type { Token } from "../models/token.js";
-import type { TokenReaderInterface } from "./services/token.js";
+import type { ClientInterface } from "../models/client.ts";
+import type { AbstractScope, ScopeConstructor } from "../models/scope.ts";
+import { BasicScope } from "../models/scope.ts";
+import type { Token } from "../models/token.ts";
+import type { TokenReaderInterface } from "./services/token.ts";
 /**
  * Claims of a validated JWT access token, as defined by RFC 9068 §2.2.
  *

package/{esm → dist}/server/jwks-token-reader.js

@@ -255,8 +255,8 @@ export class JwksTokenReader {
         this.#cacheMaxAgeMs = options.cacheMaxAgeMs ?? 600_000;
         this.#minFetchIntervalMs = options.minFetchIntervalMs ?? 30_000;
         this.#fetchTimeoutMs = options.fetchTimeoutMs ?? 5_000;
-        this.#Scope = options.Scope ??
-            BasicScope;
+        this.#Scope =
+            options.Scope ?? BasicScope;
         this.#getClient = options.getClient;
         this.#getUser = options.getUser;
         this.#customFetch = options.fetch;
@@ -437,7 +437,7 @@ export class JwksTokenReader {
         }
     }
     async #load() {
-        const jwksUri = this.#jwksUri ?? await this.#discoverJwksUri();
+        const jwksUri = this.#jwksUri ?? (await this.#discoverJwksUri());
         const body = await this.#fetchJson(jwksUri, "jwks");
         if (!isRecord(body) || !Array.isArray(body.keys)) {
             throw new ServerError("jwks response has no `keys` array");
@@ -484,7 +484,7 @@ export class JwksTokenReader {
             let response;
             try {
                 response = await fetchImpl(url, {
-                    headers: { "Accept": "application/json" },
+                    headers: { Accept: "application/json" },
                     signal: packageDeadlineSignal(controller.signal),
                 });
             }

package/{esm → dist}/server/mod.d.ts

@@ -8,16 +8,15 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
-export type { ClientCredentials, ClientInterface } from "../models/client.js";
-export type { AuthenticationContext } from "../models/authentication.js";
-export type { IntrospectionResponse, RefreshToken, Token, TokenResponse, } from "../models/token.js";
-export { AbstractScope, BasicScope } from "../models/scope.js";
-export type { ScopeConstructor } from "../models/scope.js";
-export { Authorization, authorizationFromClaims, } from "../models/authorization.js";
-export type { AuthorizationFailure, AuthorizationInit, OrganizationContext, RequireConditions, } from "../models/authorization.js";
-export { AccessDeniedError, AuthorizationPendingError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, isOAuth2Error, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.js";
-export type { OAuth2ErrorClass, OAuth2ProblemDetailsExtensions, } from "../errors.js";
-export type { TokenReaderInterface } from "./services/token.js";
-export { checkRedirectUriPattern, isRedirectUriPattern, matchRedirectUri, } from "./redirect-uri.js";
-export type { IsPublicSuffix, RedirectUriPatternRule, RedirectUriPatternViolation, } from "./redirect-uri.js";
+export type { ClientCredentials, ClientInterface } from "../models/client.ts";
+export type { AuthenticationContext } from "../models/authentication.ts";
+export type { IntrospectionResponse, RefreshToken, Token, TokenResponse, } from "../models/token.ts";
+export { AbstractScope, BasicScope } from "../models/scope.ts";
+export type { ScopeConstructor } from "../models/scope.ts";
+export { Authorization, authorizationFromClaims, } from "../models/authorization.ts";
+export type { AuthorizationFailure, AuthorizationInit, OrganizationContext, RequireConditions, } from "../models/authorization.ts";
+export { AccessDeniedError, AuthorizationPendingError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, isOAuth2Error, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.ts";
+export type { OAuth2ErrorClass, OAuth2ProblemDetailsExtensions, } from "../errors.ts";
+export type { TokenReaderInterface } from "./services/token.ts";
+export { checkRedirectUriPattern, isRedirectUriPattern, matchRedirectUri, } from "./redirect-uri.ts";
+export type { IsPublicSuffix, RedirectUriPatternRule, RedirectUriPatternViolation, } from "./redirect-uri.ts";

package/{esm → dist}/server/mod.js

@@ -8,7 +8,6 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 export { AbstractScope, BasicScope } from "../models/scope.js";
 export { Authorization, authorizationFromClaims, } from "../models/authorization.js";
 export { AccessDeniedError, AuthorizationPendingError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, isOAuth2Error, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.js";

package/{esm → dist}/server/public-suffix/mod.d.ts

@@ -26,13 +26,12 @@
  * wildcard must not straddle (`github.io`, `vercel.app`, `blob.core.windows.net`)
  * is listed there and nowhere else.
  *
- * Regenerate it with `deno task psl:update`; `deno task psl:check` fails when
+ * Regenerate it with `pnpm psl:update`; `pnpm psl:check` fails when
  * the snapshot has drifted from publicsuffix.org and runs on a schedule in CI.
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
-import { publicSuffixListInfo } from "./rules.js";
+import { publicSuffixListInfo } from "./rules.ts";
 export { publicSuffixListInfo };
 /**
  * Whether a domain is a public suffix — a name others register *under* rather

package/{esm → dist}/server/public-suffix/mod.js

@@ -26,12 +26,11 @@
  * wildcard must not straddle (`github.io`, `vercel.app`, `blob.core.windows.net`)
  * is listed there and nowhere else.
  *
- * Regenerate it with `deno task psl:update`; `deno task psl:check` fails when
+ * Regenerate it with `pnpm psl:update`; `pnpm psl:check` fails when
  * the snapshot has drifted from publicsuffix.org and runs on a schedule in CI.
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 import { PUBLIC_SUFFIX_RULES, publicSuffixListInfo } from "./rules.js";
 export { publicSuffixListInfo };
 let rules;

package/{esm → dist}/server/public-suffix/rules.d.ts

@@ -1,6 +1,6 @@
 /**
  * The ICANN + private Public Suffix List, generated by
- * `deno task psl:update`. **Do not edit by hand.**
+ * `pnpm psl:update`. **Do not edit by hand.**
  *
  * @module
  */

package/{esm → dist}/server/public-suffix/rules.js

@@ -1,6 +1,6 @@
 /**
  * The ICANN + private Public Suffix List, generated by
- * `deno task psl:update`. **Do not edit by hand.**
+ * `pnpm psl:update`. **Do not edit by hand.**
  *
  * @module
  */

package/{esm → dist}/server/redirect-uri.js

@@ -172,13 +172,13 @@ function matchesLoopback(registration, redirectUri) {
     }
     if (!LOOPBACK_HOSTNAMES.has(registeredUrl.hostname))
         return false;
-    return registeredUrl.protocol === url.protocol &&
+    return (registeredUrl.protocol === url.protocol &&
         registeredUrl.hostname === url.hostname &&
         registeredUrl.username === url.username &&
         registeredUrl.password === url.password &&
         registeredUrl.pathname === url.pathname &&
         registeredUrl.search === url.search &&
-        registeredUrl.hash === url.hash;
+        registeredUrl.hash === url.hash);
 }
 function matchesPattern(pattern, redirectUri, isPublicSuffix) {
     if (checkRedirectUriPattern(pattern, isPublicSuffix) !== null)
@@ -220,8 +220,9 @@ function matchesPattern(pattern, redirectUri, isPublicSuffix) {
     }
     const [prefix, suffix] = patternLabels[0].split("*");
     const label = labels[0];
-    return label.length >= prefix.length + suffix.length &&
-        label.startsWith(prefix) && label.endsWith(suffix);
+    return (label.length >= prefix.length + suffix.length &&
+        label.startsWith(prefix) &&
+        label.endsWith(suffix));
 }
 /**
  * Find the registered redirect URI that authorizes a requested `redirect_uri`.

package/{esm → dist}/server/resource-server.d.ts

@@ -6,14 +6,13 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6750
  * @module
  */
-import "../_dnt.polyfills.js";
-import type { ClientInterface } from "../models/client.js";
-import type { Token } from "../models/token.js";
-import type { AbstractScope, ScopeConstructor } from "../models/scope.js";
-import { BasicScope } from "../models/scope.js";
-import { type OAuth2Error } from "../errors.js";
-import { type Authorization, type RequireConditions } from "../models/authorization.js";
-import type { TokenReaderInterface } from "./services/token.js";
+import type { ClientInterface } from "../models/client.ts";
+import type { Token } from "../models/token.ts";
+import type { AbstractScope, ScopeConstructor } from "../models/scope.ts";
+import { BasicScope } from "../models/scope.ts";
+import { type OAuth2Error } from "../errors.ts";
+import { type Authorization, type RequireConditions } from "../models/authorization.ts";
+import type { TokenReaderInterface } from "./services/token.ts";
 /** Bearer token regex pattern. */
 export declare const BEARER_TOKEN: RegExp;
 /** Services required by the resource server. */
@@ -300,7 +299,7 @@ export declare class ResourceServer<Client extends ClientInterface, User, S exte
      */
     assertScope(granted: S | null | undefined, requiredScope: S | string): void;
 }
-export { IntrospectionTokenReader } from "./introspection-token-reader.js";
-export type { IntrospectionTokenReaderOptions } from "./introspection-token-reader.js";
-export { JwksTokenReader } from "./jwks-token-reader.js";
-export type { JwksTokenReaderOptions, JwtAccessTokenClaims, } from "./jwks-token-reader.js";
+export { IntrospectionTokenReader } from "./introspection-token-reader.ts";
+export type { IntrospectionTokenReaderOptions } from "./introspection-token-reader.ts";
+export { JwksTokenReader } from "./jwks-token-reader.ts";
+export type { JwksTokenReaderOptions, JwtAccessTokenClaims, } from "./jwks-token-reader.ts";

package/{esm → dist}/server/resource-server.js

@@ -6,7 +6,6 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6750
  * @module
  */
-import "../_dnt.polyfills.js";
 import { BasicScope } from "../models/scope.js";
 import { AccessDeniedError, InsufficientPermissionsError, InsufficientScopeError, InvalidTokenError, toOAuth2Error, } from "../errors.js";
 import { authorizationFromClaims, } from "../models/authorization.js";
@@ -106,8 +105,8 @@ export class ResourceServer {
      *   overflows when converted to milliseconds.
      */
     constructor(options) {
-        this.Scope = options.Scope ??
-            BasicScope;
+        this.Scope =
+            options.Scope ?? BasicScope;
         this.realm = options.realm ?? "Service";
         this.clockSkewSeconds = options.clockSkewSeconds ?? 0;
         this.errorFormat = options.errorFormat ?? "oauth2";
@@ -135,9 +134,11 @@ export class ResourceServer {
      * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3
      */
     buildWwwAuthenticate(error, requiredScope) {
-        const quote = (value) => 
-        // deno-lint-ignore no-control-regex
-        value.replace(/[\x00-\x1f\x7f]/g, "").replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        const quote = (value) => value
+            // oxlint-disable-next-line no-control-regex
+            .replace(/[\x00-\x1f\x7f]/g, "")
+            .replace(/\\/g, "\\\\")
+            .replace(/"/g, '\\"');
         const parts = [`realm="${quote(this.realm)}"`];
         const code = error?.extensions.error;
         if (error && code && CHALLENGE_ERROR_CODES.has(code)) {
@@ -150,7 +151,8 @@ export class ResourceServer {
             parts.push(`scope="${quote(requiredScope)}"`);
         }
         else if (error instanceof InsufficientScopeError) {
-            const scope = error.extensions.requiredScope;
+            const scope = error.extensions
+                .requiredScope;
             if (scope) {
                 parts.push(`scope="${quote(scope)}"`);
             }
@@ -185,8 +187,7 @@ export class ResourceServer {
         const body = {
             error: oauth2Error.extensions.error ?? "server_error",
         };
-        const description = oauth2Error.extensions.error_description ??
-            oauth2Error.exposedMessage;
+        const description = oauth2Error.extensions.error_description ?? oauth2Error.exposedMessage;
         if (description) {
             body.error_description = description;
         }
@@ -296,8 +297,7 @@ export class ResourceServer {
             throw new InvalidTokenError("invalid access token");
         }
         if (token.accessTokenExpiresAt) {
-            const deadline = token.accessTokenExpiresAt.getTime() +
-                this.clockSkewSeconds * 1000;
+            const deadline = token.accessTokenExpiresAt.getTime() + this.clockSkewSeconds * 1000;
             if (deadline < Date.now()) {
                 throw new InvalidTokenError("access token has expired");
             }
@@ -358,9 +358,7 @@ export class ResourceServer {
         }
         const failure = context.authorization.unmet(conditions);
         if (failure) {
-            const required = failure.required === true
-                ? "an active organization"
-                : failure.required;
+            const required = failure.required === true ? "an active organization" : failure.required;
             throw new InsufficientPermissionsError(`${FAILURE_LABELS[failure.kind]}: ${required}`);
         }
     }

package/{esm → dist}/server/services/authorization-code.d.ts

@@ -2,11 +2,11 @@
  * Authorization code service interface and abstract implementation.
  * @module
  */
-import type { AuthorizationCode } from "../../models/authorization-code.js";
-import type { ClientInterface } from "../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { ClientServiceInterface } from "./client.js";
-import type { UserServiceInterface } from "./user.js";
+import type { AuthorizationCode } from "../../models/authorization-code.ts";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { ClientServiceInterface } from "./client.ts";
+import type { UserServiceInterface } from "./user.ts";
 /**
  * Service interface for authorization code management.
  */

package/{esm → dist}/server/services/client.d.ts

@@ -1,4 +1,4 @@
-import type { ClientInterface } from "../../models/client.js";
+import type { ClientInterface } from "../../models/client.ts";
 /**
  * Service interface for client management.
  */

package/{esm → dist}/server/services/device-authorization.d.ts

@@ -4,9 +4,9 @@
  * @see https://datatracker.ietf.org/doc/html/rfc8628
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { DeviceAuthorization } from "../../models/device-authorization.js";
-import type { AbstractScope } from "../../models/scope.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { DeviceAuthorization } from "../../models/device-authorization.ts";
+import type { AbstractScope } from "../../models/scope.ts";
 /**
  * Service interface for managing device authorizations.
  *

package/{esm → dist}/server/services/token.d.ts

@@ -1,9 +1,9 @@
-import type { ClientInterface } from "../../models/client.js";
-import type { AuthenticationContext } from "../../models/authentication.js";
-import type { RefreshToken, Token } from "../../models/token.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { ClientServiceInterface } from "./client.js";
-import type { UserServiceInterface } from "./user.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AuthenticationContext } from "../../models/authentication.ts";
+import type { RefreshToken, Token } from "../../models/token.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { ClientServiceInterface } from "./client.ts";
+import type { UserServiceInterface } from "./user.ts";
 /**
  * Minimal interface for reading/validating tokens.
  *

package/{esm → dist}/server/services/token.js

@@ -73,6 +73,8 @@ export class AbstractTokenService {
      * configured. Override to cap per client instead of service-wide.
      */
     refreshTokenFamilyExpiresAt(_client, _user, familyCreatedAt, _scope) {
-        return Promise.resolve(this.refreshTokenMaxLifetime == null ? undefined : new Date(familyCreatedAt.getTime() + this.refreshTokenMaxLifetime * 1000));
+        return Promise.resolve(this.refreshTokenMaxLifetime == null
+            ? undefined
+            : new Date(familyCreatedAt.getTime() + this.refreshTokenMaxLifetime * 1000));
     }
 }

package/{esm → dist}/server/services/user.d.ts

@@ -26,4 +26,4 @@ export interface UserServiceInterface<User> {
  * `@udibo/oauth2/identity` for the work-factor constants and the
  * `PasswordIdentityService` that records them on the credential.
  */
-export { generateSalt, hashPassword, verifyPassword, } from "../../identity/password.js";
+export { generateSalt, hashPassword, verifyPassword, } from "../../identity/password.ts";

package/{esm → dist}/server/signing-keys.d.ts

@@ -11,7 +11,7 @@
  *
  * @module
  */
-import type { AuthenticationContext } from "../models/authentication.js";
+import type { AuthenticationContext } from "../models/authentication.ts";
 /** A ready-to-use signing key: private half signs, public JWK is published. */
 export interface SigningKey {
     /** Key id, stamped into JWS headers and the JWKS entry. */

package/{esm → dist}/server/signing-keys.js

@@ -148,7 +148,12 @@ export async function importSigningKeyJwk(jwk) {
  * the primitive behind id_tokens and JWT access tokens.
  */
 export async function signJwt(key, payload, header = {}) {
-    const signingInput = `${encodeSegment({ alg: key.alg, typ: "JWT", kid: key.kid, ...header })}.${encodeSegment(payload)}`;
+    const signingInput = `${encodeSegment({
+        alg: key.alg,
+        typ: "JWT",
+        kid: key.kid,
+        ...header,
+    })}.${encodeSegment(payload)}`;
     const signature = await crypto.subtle.sign(ES256_SIGN_PARAMS, key.privateKey, encoder.encode(signingInput));
     return `${signingInput}.${base64urlEncode(new Uint8Array(signature))}`;
 }
@@ -173,7 +178,8 @@ export async function verifyJwt(jwt, publicJwk, options = {}) {
             return undefined;
         const payload = JSON.parse(decoder.decode(base64urlDecode(payloadPart)));
         if (!options.ignoreExpiration &&
-            typeof payload.exp === "number" && payload.exp * 1000 <= Date.now()) {
+            typeof payload.exp === "number" &&
+            payload.exp * 1000 <= Date.now()) {
             return undefined;
         }
         return payload;

package/{esm → dist}/server/utils/hash.js

@@ -2,7 +2,7 @@
  * Hashing utilities for secure token and secret storage.
  * @module
  */
-import { encodeHex } from "../../deps/jsr.io/@std/encoding/1.0.11/hex.js";
+import { encodeHex } from "../../utils/_encoding.js";
 /** Hashes a high-entropy string (UUID, token, secret) using SHA-256. */
 export async function sha256Hash(value) {
     const data = new TextEncoder().encode(value);

package/{esm → dist}/testing/contract/auth-request-storage.d.ts

@@ -38,7 +38,7 @@
  *
  * @module
  */
-import type { AuthRequestStorage } from "../../client/storage.js";
+import type { AuthRequestStorage } from "../../client/storage.ts";
 /** Options for {@link runAuthRequestStorageContractTests}. */
 export interface AuthRequestStorageContractOptions {
     /**