@_mustachio/openauth 0.10.0 → 0.11.0

package/dist/esm/domain/register.js

@@ -0,0 +1,74 @@
+// src/domain/register.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { randomId, randomToken } from "./crypto";
+import { hashClientSecret } from "./token";
+async function registerNewClient(request, tenant, deps) {
+  if (!deps.registerClient) {
+    return err(authError.invalidRequest("dynamic client registration is not enabled on this deployment"));
+  }
+  if (!Array.isArray(request.redirect_uris) || request.redirect_uris.length === 0) {
+    return err(authError.invalidRequest("redirect_uris must be a non-empty array", "redirect_uris"));
+  }
+  for (const uri of request.redirect_uris) {
+    try {
+      new URL(uri);
+    } catch {
+      return err(authError.invalidRequest(`redirect_uri "${uri}" is not a valid absolute URI`, "redirect_uris"));
+    }
+  }
+  const authMethod = request.token_endpoint_auth_method ?? "client_secret_basic";
+  const isPublic = authMethod === "none";
+  const clientId = (deps.newClientId ?? randomId)();
+  const grantTypes = request.grant_types ?? ["authorization_code"];
+  const responseTypes = request.response_types ?? ["code"];
+  const scopes = request.scope ? request.scope.split(/\s+/).filter(Boolean) : ["openid"];
+  let secret;
+  let secretHash;
+  if (!isPublic) {
+    secret = (deps.newClientSecret ?? randomToken)();
+    secretHash = await hashClientSecret(secret);
+  }
+  const clientPartial = {
+    id: clientId,
+    name: request.client_name ?? clientId,
+    redirectUris: request.redirect_uris,
+    scopes,
+    grantTypes: grantTypes.filter((g) => g === "authorization_code" || g === "refresh_token" || g === "client_credentials"),
+    ...request.post_logout_redirect_uris !== undefined ? { postLogoutRedirectUris: request.post_logout_redirect_uris } : {},
+    ...request.sector_identifier_uri !== undefined ? { sectorIdentifier: request.sector_identifier_uri } : {}
+  };
+  const clientConfig = isPublic ? {
+    ...clientPartial,
+    type: "public",
+    pkceRequired: true
+  } : {
+    ...clientPartial,
+    type: "confidential",
+    secretHash,
+    pkceRequired: true
+  };
+  const hookResult = await deps.registerClient({
+    tenant,
+    request
+  });
+  if (isErr(hookResult))
+    return err(hookResult.error);
+  const persisted = hookResult.value.client;
+  const persistedSecret = hookResult.value.secret;
+  const issuedAt = Math.floor(deps.clock() / 1000);
+  return ok({
+    client_id: persisted.id,
+    ...persistedSecret !== undefined ? { client_secret: persistedSecret } : {},
+    client_id_issued_at: issuedAt,
+    client_secret_expires_at: 0,
+    redirect_uris: persisted.redirectUris,
+    grant_types: persisted.grantTypes,
+    response_types: responseTypes,
+    token_endpoint_auth_method: authMethod,
+    ...request.client_name !== undefined ? { client_name: request.client_name } : {}
+  });
+}
+export {
+  registerNewClient
+};

package/dist/esm/domain/token-exchange.js

@@ -75,6 +75,7 @@ async function exchangeToken(req, deps) {
       methodId: subjectClaims.mid ?? "token_exchange",
       methodKind: subjectClaims.mkind ?? "token_exchange",
       scopes: requestedScopes,
+      ...subjectClaims.auth_time !== undefined ? { authTime: subjectClaims.auth_time } : {},
       ...subjectClaims.aud !== undefined && subjectClaims.aud !== callerClient.id ? { audience: subjectClaims.aud } : {}
     },
     family: (deps.newRefreshFamily ?? randomId)(),

package/dist/esm/domain/token.js

@@ -12,7 +12,8 @@ import {
   sha256,
   utf8
 } from "./crypto";
-import { signAccessToken } from "./jwt";
+import { buildIdTokenClaims, shouldIssueIdToken } from "./id-token";
+import { signAccessToken, signIdToken } from "./jwt";
 import { validatePkce } from "./pkce";
 async function saveEncryptedCode(code, payload, ttl, deps) {
   const keyResult = await deps.keyStore.currentEncryptionKey();
@@ -57,6 +58,9 @@ async function exchangeCode(req, deps) {
   const authResult = await verifyClientCredentials(client, req.clientSecret);
   if (authResult)
     return err(authResult);
+  if (client.dpopRequired && req.dpopJkt === undefined) {
+    return err(authError.invalidDpopProof(`client "${client.id}" requires DPoP-bound tokens`));
+  }
   if (payload.appRedirectUri !== req.redirectUri) {
     return err(authError.invalidGrant("redirect_uri mismatch with auth code"));
   }
@@ -104,7 +108,10 @@ async function exchangeCode(req, deps) {
   const minted = await mintTokens({
     tenant,
     claim,
-    payload,
+    payload: {
+      ...payload,
+      ...req.dpopJkt !== undefined ? { dpopJkt: req.dpopJkt } : {}
+    },
     deps,
     family: (deps.newRefreshFamily ?? randomId)()
   });
@@ -115,11 +122,13 @@ async function mintTokens(args) {
   const accessTtl = tenant.config.accessTtl !== undefined ? tenant.config.accessTtl * 1000 : DEFAULT_ACCESS_TTL_MS;
   const refreshTtl = tenant.config.refreshTtl !== undefined ? tenant.config.refreshTtl * 1000 : DEFAULT_REFRESH_TTL_MS;
   const now = deps.clock();
-  const subjectId = await deriveSubjectId(claim);
+  const receivingClient = tenant.config.clients.find((c) => c.id === payload.clientId);
+  const subjectId = await deriveSubjectId(claim, receivingClient?.sectorIdentifier);
   const keyRes = await deps.keyStore.currentSigningKey();
   if (isErr(keyRes))
     return err(keyRes.error);
   const signingKey = keyRes.value;
+  const userinfoClaimNames = Object.keys(payload.claimsRequest?.userinfo ?? {});
   const claims = {
     iss: deps.issuerUrl,
     sub: subjectId,
@@ -130,7 +139,10 @@ async function mintTokens(args) {
     mid: payload.methodId,
     mkind: payload.methodKind,
     scope: payload.scopes.join(" "),
-    claim
+    claim,
+    ...payload.authTime !== undefined ? { auth_time: payload.authTime } : {},
+    ...payload.dpopJkt !== undefined ? { cnf: { jkt: payload.dpopJkt } } : {},
+    ...userinfoClaimNames.length > 0 ? { uic: userinfoClaimNames } : {}
   };
   let accessToken;
   try {
@@ -151,6 +163,9 @@ async function mintTokens(args) {
       family,
       methodId: payload.methodId,
       methodKind: payload.methodKind,
+      authTime: payload.authTime ?? Math.floor(now / 1000),
+      ...payload.dpopJkt !== undefined ? { dpopJkt: payload.dpopJkt } : {},
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {},
       issuedAt: now,
       expiresAt: now + refreshTtl
     };
@@ -158,6 +173,28 @@ async function mintTokens(args) {
     if (isErr(saved))
       return err(saved.error);
   }
+  let idToken;
+  if (payload.authTime !== undefined && shouldIssueIdToken(payload.scopes)) {
+    const idClaims = await buildIdTokenClaims({
+      issuerUrl: deps.issuerUrl,
+      audience: payload.clientId,
+      subjectId,
+      claim,
+      scopes: payload.scopes,
+      authTime: payload.authTime,
+      ...payload.appNonce !== undefined ? { appNonce: payload.appNonce } : {},
+      now,
+      methodKind: payload.methodKind,
+      accessToken,
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {},
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
+    try {
+      idToken = await signIdToken(idClaims, signingKey.privateKeyRef, signingKey.alg, signingKey.kid);
+    } catch (e) {
+      return err(authError.serverError("id_token sign failed", e));
+    }
+  }
   await safeAudit(deps, {
     kind: "token_issued",
     tenantId: payload.tenantId,
@@ -166,23 +203,27 @@ async function mintTokens(args) {
     methodKind: payload.methodKind,
     subjectId,
     refreshTokenIdHash: refresh ? await hashTokenForAudit(refresh) : "",
+    ...idToken !== undefined ? { idTokenIssued: true } : {},
+    ...payload.dpopJkt !== undefined ? { dpopBound: true } : {},
     timestamp: now
   });
   return ok({
     access_token: accessToken,
-    token_type: "Bearer",
+    token_type: payload.dpopJkt !== undefined ? "DPoP" : "Bearer",
     expires_in: Math.floor(accessTtl / 1000),
     ...refresh !== undefined ? { refresh_token: refresh } : {},
+    ...idToken !== undefined ? { id_token: idToken } : {},
     scope: payload.scopes.join(" ")
   });
 }
 async function hashClientSecret(plain) {
   return base64url.encode(await sha256(utf8.encode(plain)));
 }
-async function deriveSubjectId(claim) {
+async function deriveSubjectId(claim, sectorIdentifier) {
   const c = claim;
   const ordered = canonicalize(c.properties);
-  return base64url.encode(await sha256(`${c.type}\x00${ordered}`)).slice(0, 22);
+  const seed = sectorIdentifier !== undefined ? `${sectorIdentifier}\x00${c.type}\x00${ordered}` : `${c.type}\x00${ordered}`;
+  return base64url.encode(await sha256(seed)).slice(0, 22);
 }
 function canonicalize(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {

package/dist/esm/domain/userinfo.js

@@ -1,25 +1,60 @@
 // src/domain/userinfo.ts
 import { authError } from "../types/error";
 import { err, isErr, ok } from "../types/result";
+import { computeAth, verifyDpopProof } from "./dpop";
+import { pickScopedClaims } from "./id-token";
 import { verifyAccessToken } from "./jwt";
-async function userinfo(bearerToken, deps) {
+async function userinfo(input, deps) {
   const keysRes = await deps.keyStore.signingKeys();
   if (isErr(keysRes))
     return err(keysRes.error);
   let claims;
   try {
-    claims = await verifyAccessToken(bearerToken, keysRes.value, {
+    claims = await verifyAccessToken(input.accessToken, keysRes.value, {
       ...deps.issuerUrl ? { issuer: deps.issuerUrl } : {}
     });
   } catch {
     return err(authError.invalidGrant("access token invalid or expired"));
   }
+  const boundJkt = claims.cnf?.jkt;
+  if (boundJkt !== undefined) {
+    if (input.scheme !== "DPoP") {
+      return err(authError.invalidDpopProof('access token is DPoP-bound; Authorization scheme must be "DPoP"'));
+    }
+    if (!input.dpopProof) {
+      return err(authError.invalidDpopProof("access token is DPoP-bound; request is missing a DPoP proof"));
+    }
+    if (!input.htu || !input.htm || input.nowSec === undefined) {
+      return err(authError.invalidDpopProof("userinfo dpop verification requires htu, htm, and nowSec"));
+    }
+    if (!deps.tokenStore) {
+      return err(authError.invalidDpopProof("userinfo dpop verification requires a token-store (jti replay protection)"));
+    }
+    const expectedAth = await computeAth(input.accessToken);
+    const dpopRes = await verifyDpopProof({
+      proofJwt: input.dpopProof,
+      htu: input.htu,
+      htm: input.htm,
+      nowSec: input.nowSec,
+      expectedAth
+    }, { tokenStore: deps.tokenStore });
+    if (isErr(dpopRes))
+      return err(dpopRes.error);
+    if (dpopRes.value.jkt !== boundJkt) {
+      return err(authError.invalidDpopProof("dpop proof key does not match access token cnf.jkt"));
+    }
+  } else if (input.scheme === "DPoP") {
+    return err(authError.invalidGrant("access token is not DPoP-bound; use Authorization: Bearer"));
+  }
   const claim = claims.claim;
+  const scopes = claims.scope ? claims.scope.split(" ").filter(Boolean) : [];
+  const scopedClaims = pickScopedClaims(claim, scopes, claims.uic ?? [], deps.customScopeClaims ?? {});
   return ok({
     sub: claims.sub,
     subject_type: claim.type,
     properties: claim.properties,
-    scope: claims.scope
+    scope: claims.scope,
+    ...scopedClaims
   });
 }
 export {

package/dist/esm/http/handlers/authorize.js

@@ -10,7 +10,10 @@ import {
   authorizeRedirectErrorResponse,
   isNonRecoverable
 } from "../errors";
-import { authorizeQuerySchema } from "../schemas/authorize";
+import {
+  authorizeQuerySchema,
+  authorizeRequestUriQuerySchema
+} from "../schemas/authorize";
 function makeAuthorizeHandler(deps) {
   return async (c) => {
     const tenant = c.get("tenant");
@@ -19,13 +22,37 @@ function makeAuthorizeHandler(deps) {
     }
     const url = new URL(c.req.url);
     const raw = Object.fromEntries(url.searchParams.entries());
-    const parsed = authorizeQuerySchema.safeParse(raw);
+    let workingRaw = raw;
+    if (raw.request_uri !== undefined) {
+      const parParsed = authorizeRequestUriQuerySchema.safeParse(raw);
+      if (!parParsed.success) {
+        return authorizeDirectErrorResponse(authError.invalidRequest(parParsed.error.issues[0]?.message ?? "invalid request", parParsed.error.issues[0]?.path[0]?.toString() ?? "request"));
+      }
+      if (!deps.sessionStore.consumePar) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("session adapter does not support PAR", "request_uri"));
+      }
+      const par = await deps.sessionStore.consumePar(parParsed.data.request_uri);
+      if (isErr(par)) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("unknown or expired request_uri", "request_uri"));
+      }
+      if (par.value.clientId !== parParsed.data.client_id) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("request_uri belongs to a different client", "request_uri"));
+      }
+      workingRaw = par.value.params;
+    }
+    const parsed = authorizeQuerySchema.safeParse(workingRaw);
     if (!parsed.success) {
       const first = parsed.error.issues[0];
       const field = first?.path[0]?.toString() ?? "request";
       return authorizeDirectErrorResponse(authError.invalidRequest(first?.message ?? "invalid request", field));
     }
     const q = parsed.data;
+    if (raw.request_uri === undefined) {
+      const client = tenant.config.clients.find((c2) => c2.id === q.client_id);
+      if (client?.requirePushedAuthorizationRequests) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("this client requires Pushed Authorization Requests (RFC 9126)", "request_uri"));
+      }
+    }
     if (q.response_type !== "code") {
       return authorizeDirectErrorResponse({
         code: "invalid_request",
@@ -33,6 +60,14 @@ function makeAuthorizeHandler(deps) {
         field: "response_type"
       });
     }
+    let claimsRequest;
+    if (q.claims !== undefined) {
+      const parsedClaims = parseClaimsParameter(q.claims);
+      if (!parsedClaims.ok) {
+        return authorizeDirectErrorResponse(authError.invalidRequest(parsedClaims.error, "claims"));
+      }
+      claimsRequest = parsedClaims.value;
+    }
     const request = {
       tenantId: asTenantId(tenant.id),
       clientId: q.client_id,
@@ -46,7 +81,8 @@ function makeAuthorizeHandler(deps) {
       ...q.code_challenge_method !== undefined ? { codeChallengeMethod: q.code_challenge_method } : {},
       ...q.prompt !== undefined ? { prompt: q.prompt } : {},
       ...q.ui_locales !== undefined ? { uiLocales: q.ui_locales } : {},
-      ...q.nonce !== undefined ? { nonce: q.nonce } : {}
+      ...q.nonce !== undefined ? { nonce: q.nonce } : {},
+      ...claimsRequest !== undefined ? { claimsRequest } : {}
     };
     const result = await startAuthorize({
       request,
@@ -132,6 +168,57 @@ function makeAuthorizeHandler(deps) {
     }
   };
 }
+function parseClaimsParameter(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return {
+      ok: false,
+      error: `claims parameter is not valid JSON: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, error: "claims parameter must be a JSON object" };
+  }
+  const obj = parsed;
+  const result = {};
+  for (const section of ["userinfo", "id_token"]) {
+    const v = obj[section];
+    if (v === undefined)
+      continue;
+    if (!v || typeof v !== "object" || Array.isArray(v)) {
+      return {
+        ok: false,
+        error: `claims.${section} must be a JSON object`
+      };
+    }
+    const sectionMap = {};
+    for (const [name, entry] of Object.entries(v)) {
+      if (entry === null) {
+        sectionMap[name] = null;
+        continue;
+      }
+      if (typeof entry !== "object" || Array.isArray(entry)) {
+        return {
+          ok: false,
+          error: `claims.${section}.${name} must be null or a JSON object`
+        };
+      }
+      const e = entry;
+      const normalized = {};
+      if (typeof e.essential === "boolean")
+        normalized.essential = e.essential;
+      if ("value" in e)
+        normalized.value = e.value;
+      if (Array.isArray(e.values))
+        normalized.values = e.values;
+      sectionMap[name] = normalized;
+    }
+    result[section] = sectionMap;
+  }
+  return { ok: true, value: result };
+}
 function clearFlowCookie() {
   return {
     name: "idp.flow",

package/dist/esm/http/handlers/end-session.js

@@ -0,0 +1,64 @@
+// src/http/handlers/end-session.ts
+import { endSession } from "../../domain/logout";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { tokenEndpointErrorResponse } from "../errors";
+import { endSessionParamsSchema } from "../schemas/end-session";
+function makeEndSessionHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    let raw;
+    const httpMethod = c.req.method.toUpperCase();
+    if (httpMethod === "GET") {
+      raw = Object.fromEntries(new URL(c.req.url).searchParams.entries());
+    } else if (httpMethod === "POST") {
+      const ct = (c.req.header("content-type") ?? "").toLowerCase();
+      if (!ct.startsWith("application/x-www-form-urlencoded")) {
+        return tokenEndpointErrorResponse(authError.invalidRequest("POST /end_session requires application/x-www-form-urlencoded body"));
+      }
+      raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()));
+    } else {
+      return tokenEndpointErrorResponse(authError.invalidRequest(`unsupported method "${httpMethod}"`));
+    }
+    const parsed = endSessionParamsSchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const q = parsed.data;
+    const res = await endSession({
+      ...q.id_token_hint !== undefined ? { idTokenHint: q.id_token_hint } : {},
+      ...q.client_id !== undefined ? { clientId: q.client_id } : {},
+      ...q.post_logout_redirect_uri !== undefined ? { postLogoutRedirectUri: q.post_logout_redirect_uri } : {},
+      ...q.state !== undefined ? { state: q.state } : {}
+    }, tenant, {
+      configStore: deps.configStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    if (res.value.kind === "redirect") {
+      return applyResponsePolicy(new Response(null, {
+        status: 302,
+        headers: { location: res.value.url }
+      }), { setCookies: [], cookieDefaults: deps.cookieDefaults });
+    }
+    return new Response("Logged out.", {
+      status: 200,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeEndSessionHandler
+};

package/dist/esm/http/handlers/metadata.js

@@ -2,9 +2,12 @@
 import { buildDiscoveryDocument, buildJwks } from "../../domain/discovery";
 import { isErr } from "../../types/result";
 import { tokenEndpointErrorResponse } from "../errors";
-function makeDiscoveryHandler(_deps) {
+function makeDiscoveryHandler(deps) {
   return async (c) => {
-    const doc = buildDiscoveryDocument({ issuerUrl: c.get("issuerUrl") });
+    const doc = buildDiscoveryDocument({
+      issuerUrl: c.get("issuerUrl"),
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
     return new Response(JSON.stringify(doc), {
       status: 200,
       headers: {

package/dist/esm/http/handlers/par.js

@@ -0,0 +1,53 @@
+// src/http/handlers/par.ts
+import { resolveClientCredentials } from "../../domain/client-auth";
+import { pushAuthorizationRequest } from "../../domain/par";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { parBodySchema } from "../schemas/par";
+function makeParHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase();
+    if (!ct.startsWith("application/x-www-form-urlencoded")) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()).entries());
+    const parsed = parBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    const clientId = creds?.clientId ?? parsed.data.client_id;
+    const { client_secret: _strip, ...paramsForAuthorize } = parsed.data;
+    const res = await pushAuthorizationRequest({
+      clientId,
+      ...creds?.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {},
+      params: paramsForAuthorize
+    }, tenant, {
+      configStore: deps.configStore,
+      sessionStore: deps.sessionStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeParHandler
+};

package/dist/esm/http/handlers/register.js

@@ -0,0 +1,46 @@
+// src/http/handlers/register.ts
+import { registerNewClient } from "../../domain/register";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { registerBodySchema } from "../schemas/register";
+function makeRegisterHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase();
+    if (!ct.startsWith("application/json")) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/json"));
+    }
+    let raw;
+    try {
+      raw = await c.req.raw.json();
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      return tokenEndpointErrorResponse(authError.invalidRequest(`malformed JSON: ${reason}`));
+    }
+    const parsed = registerBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const request = parsed.data;
+    const res = await registerNewClient(request, tenant, {
+      ...deps.registerClient ? { registerClient: deps.registerClient } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeRegisterHandler
+};