@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/http/errors.js

@@ -0,0 +1,71 @@
+// src/http/errors.ts
+var TOKEN_STATUS = {
+  invalid_client: 401,
+  server_error: 500,
+  internal_error: 500,
+  tenant_not_found: 400
+};
+function publicErrorCode(code) {
+  if (code === "internal_error")
+    return "server_error";
+  if (code === "tenant_not_found")
+    return "invalid_request";
+  if (code === "method_not_found")
+    return "invalid_request";
+  if (code === "unknown_state")
+    return "invalid_request";
+  return code;
+}
+function tokenEndpointErrorResponse(error) {
+  const status = TOKEN_STATUS[error.code] ?? 400;
+  const body = {
+    error: publicErrorCode(error.code),
+    error_description: error.description
+  };
+  const headers = new Headers({
+    "content-type": "application/json",
+    "cache-control": "no-store",
+    pragma: "no-cache"
+  });
+  if (status === 401) {
+    headers.set("www-authenticate", `Basic realm="oauth"`);
+  }
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function authorizeRedirectErrorResponse(error, appRedirectUri, appState) {
+  const url = new URL(appRedirectUri);
+  url.searchParams.set("error", publicErrorCode(error.code));
+  url.searchParams.set("error_description", error.description);
+  if (appState !== null)
+    url.searchParams.set("state", appState);
+  return new Response(null, {
+    status: 302,
+    headers: { location: url.toString(), "cache-control": "no-store" }
+  });
+}
+function authorizeDirectErrorResponse(error) {
+  const body = `${publicErrorCode(error.code)}: ${error.description}`;
+  return new Response(body, {
+    status: 400,
+    headers: { "content-type": "text/plain", "cache-control": "no-store" }
+  });
+}
+function isNonRecoverable(error) {
+  if (error.code === "invalid_client")
+    return true;
+  if (error.code === "tenant_not_found")
+    return true;
+  if (error.code === "method_not_found")
+    return true;
+  if (error.code === "invalid_request" && error.field === "redirect_uri") {
+    return true;
+  }
+  return false;
+}
+export {
+  tokenEndpointErrorResponse,
+  publicErrorCode,
+  isNonRecoverable,
+  authorizeRedirectErrorResponse,
+  authorizeDirectErrorResponse
+};

package/dist/esm/http/handlers/authorize.js

@@ -0,0 +1,163 @@
+// src/http/handlers/authorize.ts
+import { isErr } from "../../types/result";
+import { startAuthorize } from "../../domain/authorize";
+import { asTenantId } from "../../types/tenant";
+import { authError } from "../../types/error";
+import { renderPicker as renderDefaultPicker } from "../../ui/picker";
+import { applyResponsePolicy } from "../cookies";
+import {
+  authorizeDirectErrorResponse,
+  authorizeRedirectErrorResponse,
+  isNonRecoverable
+} from "../errors";
+import { authorizeQuerySchema } from "../schemas/authorize";
+function makeAuthorizeHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const url = new URL(c.req.url);
+    const raw = Object.fromEntries(url.searchParams.entries());
+    const parsed = authorizeQuerySchema.safeParse(raw);
+    if (!parsed.success) {
+      const first = parsed.error.issues[0];
+      const field = first?.path[0]?.toString() ?? "request";
+      return authorizeDirectErrorResponse(authError.invalidRequest(first?.message ?? "invalid request", field));
+    }
+    const q = parsed.data;
+    if (q.response_type !== "code") {
+      return authorizeDirectErrorResponse({
+        code: "invalid_request",
+        description: `unsupported response_type "${q.response_type}" — OAuth 2.1 is code-only`,
+        field: "response_type"
+      });
+    }
+    const request = {
+      tenantId: asTenantId(tenant.id),
+      clientId: q.client_id,
+      redirectUri: q.redirect_uri,
+      responseType: "code",
+      scopes: q.scope ?? [],
+      state: q.state ?? null,
+      ...q.audience !== undefined ? { audience: q.audience } : {},
+      ...q.method_id !== undefined ? { methodId: q.method_id } : {},
+      ...q.code_challenge !== undefined ? { codeChallenge: q.code_challenge } : {},
+      ...q.code_challenge_method !== undefined ? { codeChallengeMethod: q.code_challenge_method } : {},
+      ...q.prompt !== undefined ? { prompt: q.prompt } : {},
+      ...q.ui_locales !== undefined ? { uiLocales: q.ui_locales } : {},
+      ...q.nonce !== undefined ? { nonce: q.nonce } : {}
+    };
+    const result = await startAuthorize({
+      request,
+      rawRequest: c.req.raw,
+      tenant,
+      cookies: c.get("cookies")
+    }, {
+      sessionStore: deps.sessionStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      methodCache: deps.methodCache,
+      stateKeys: deps.stateKeys,
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      ...deps.callbackHostFor ? {
+        callbackHostFor: (id) => deps.callbackHostFor(id)
+      } : {}
+    });
+    if (isErr(result)) {
+      const err = result.error;
+      if (isNonRecoverable(err)) {
+        return authorizeDirectErrorResponse(err);
+      }
+      return authorizeRedirectErrorResponse(err, q.redirect_uri, q.state ?? null);
+    }
+    const out = result.value;
+    switch (out.kind) {
+      case "challenge": {
+        const flowCookie = {
+          name: "idp.flow",
+          value: out.flowId,
+          path: "/",
+          httpOnly: true,
+          sameSite: "lax",
+          maxAge: 60 * 10
+        };
+        return applyResponsePolicy(out.response, {
+          setCookies: [flowCookie, ...out.setCookies],
+          cookieDefaults: deps.cookieDefaults,
+          cacheControl: cacheControlFor(out.cache)
+        });
+      }
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri);
+        redirect.searchParams.set("code", out.code);
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState);
+        return applyResponsePolicy(new Response(null, {
+          status: 302,
+          headers: { location: redirect.toString() }
+        }), {
+          setCookies: [clearFlowCookie()],
+          cookieDefaults: deps.cookieDefaults
+        });
+      }
+      case "denied":
+        return applyResponsePolicy(authorizeRedirectErrorResponse({ code: "access_denied", description: out.reason }, q.redirect_uri, q.state ?? null), {
+          setCookies: [clearFlowCookie(), ...out.setCookies],
+          cookieDefaults: deps.cookieDefaults
+        });
+      case "select-method": {
+        const pickerCtx = {
+          clientId: q.client_id,
+          redirectUri: q.redirect_uri,
+          state: q.state ?? null,
+          scope: q.scope ? q.scope.join(" ") : null,
+          nonce: q.nonce ?? null,
+          codeChallenge: q.code_challenge ?? null,
+          codeChallengeMethod: q.code_challenge_method ?? null,
+          audience: q.audience ?? null,
+          prompt: q.prompt ? q.prompt.join(" ") : null,
+          uiLocales: q.ui_locales ? q.ui_locales.join(" ") : null
+        };
+        const methods = out.methods.map((m) => ({
+          id: m.id,
+          kind: m.kind,
+          type: m.type
+        }));
+        const render = deps.renderPicker ?? renderDefaultPicker;
+        return await render(methods, pickerCtx);
+      }
+    }
+  };
+}
+function clearFlowCookie() {
+  return {
+    name: "idp.flow",
+    value: null,
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: 0
+  };
+}
+function cacheControlFor(cache) {
+  if (!cache)
+    return "no-store";
+  if ((cache.maxAge ?? -1) === 0)
+    return "no-store";
+  const parts = [];
+  if (cache.isPrivate)
+    parts.push("private");
+  if (cache.maxAge !== undefined)
+    parts.push(`max-age=${cache.maxAge}`);
+  if (cache.sMaxAge !== undefined)
+    parts.push(`s-maxage=${cache.sMaxAge}`);
+  if (cache.immutable)
+    parts.push("immutable");
+  return parts.length ? parts.join(", ") : "no-store";
+}
+export {
+  makeAuthorizeHandler
+};

package/dist/esm/http/handlers/callback.js

@@ -0,0 +1,53 @@
+// src/http/handlers/callback.ts
+import { handleCallback } from "../../domain/callback";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { authorizeDirectErrorResponse } from "../errors";
+function makeCallbackHandler(deps) {
+  return async (c) => {
+    const result = await handleCallback({ rawRequest: c.req.raw, cookies: c.get("cookies") }, {
+      configStore: deps.configStore,
+      sessionStore: deps.sessionStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      methodCache: deps.methodCache,
+      stateKeys: deps.stateKeys,
+      ...deps.buildCustomContext ? { buildCustomContext: deps.buildCustomContext } : {},
+      clock: deps.clock
+    });
+    if (isErr(result)) {
+      return authorizeDirectErrorResponse(result.error);
+    }
+    const out = result.value;
+    switch (out.kind) {
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri);
+        redirect.searchParams.set("code", out.code);
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState);
+        return new Response(null, {
+          status: 302,
+          headers: {
+            location: redirect.toString(),
+            "cache-control": "no-store"
+          }
+        });
+      }
+      case "challenge":
+        return applyResponsePolicy(out.response, {
+          setCookies: out.setCookies,
+          cookieDefaults: deps.cookieDefaults,
+          cacheControl: out.cache ? out.cache.maxAge === 0 ? "no-store" : "no-store" : "no-store"
+        });
+      case "denied":
+        return applyResponsePolicy(new Response(`access_denied: ${out.reason}`, {
+          status: 403,
+          headers: { "content-type": "text/plain" }
+        }), { setCookies: out.setCookies, cookieDefaults: deps.cookieDefaults });
+    }
+  };
+}
+export {
+  makeCallbackHandler
+};

package/dist/esm/http/handlers/metadata.js

@@ -0,0 +1,34 @@
+// src/http/handlers/metadata.ts
+import { buildDiscoveryDocument, buildJwks } from "../../domain/discovery";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+function makeDiscoveryHandler(_deps) {
+  return async (c) => {
+    const doc = buildDiscoveryDocument({ issuerUrl: c.get("issuerUrl") });
+    return new Response(JSON.stringify(doc), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "public, max-age=60"
+      }
+    });
+  };
+}
+function makeJwksHandler(deps) {
+  return async (_c) => {
+    const res = await buildJwks(deps.keyStore);
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "public, max-age=60"
+      }
+    });
+  };
+}
+export {
+  makeJwksHandler,
+  makeDiscoveryHandler
+};

package/dist/esm/http/handlers/method-route.js

@@ -0,0 +1,87 @@
+// src/http/handlers/method-route.ts
+import { handleMethodRoute } from "../../domain/method-route";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { authorizeDirectErrorResponse } from "../errors";
+function makeMethodRouteHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const cookies = c.get("cookies");
+    const flowId = cookies.get("idp.flow");
+    if (!flowId) {
+      return authorizeDirectErrorResponse(authError.invalidRequest("missing flow cookie", "flow"));
+    }
+    const url = new URL(c.req.url);
+    const segments = url.pathname.split("/").filter(Boolean);
+    if (segments.length < 3 || segments[0] !== "m") {
+      return authorizeDirectErrorResponse(authError.invalidRequest("malformed method route", "path"));
+    }
+    const methodId = segments[1];
+    const subPath = "/" + segments.slice(2).join("/");
+    const httpMethod = c.req.method.toUpperCase() === "POST" ? "POST" : "GET";
+    const result = await handleMethodRoute({
+      rawRequest: c.req.raw,
+      tenant,
+      methodId,
+      subPath,
+      httpMethod,
+      flowId,
+      cookies
+    }, {
+      sessionStore: deps.sessionStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      methodCache: deps.methodCache,
+      clock: deps.clock
+    });
+    if (isErr(result))
+      return authorizeDirectErrorResponse(result.error);
+    const out = result.value;
+    switch (out.kind) {
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri);
+        redirect.searchParams.set("code", out.code);
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState);
+        return applyResponsePolicy(new Response(null, {
+          status: 302,
+          headers: { location: redirect.toString() }
+        }), {
+          setCookies: [clearFlowCookie()],
+          cookieDefaults: deps.cookieDefaults
+        });
+      }
+      case "challenge":
+        return applyResponsePolicy(out.response, {
+          setCookies: out.setCookies,
+          cookieDefaults: deps.cookieDefaults
+        });
+      case "denied":
+        return applyResponsePolicy(new Response(`access_denied: ${out.reason}`, {
+          status: 403,
+          headers: { "content-type": "text/plain" }
+        }), {
+          setCookies: [clearFlowCookie(), ...out.setCookies],
+          cookieDefaults: deps.cookieDefaults
+        });
+    }
+  };
+}
+function clearFlowCookie() {
+  return {
+    name: "idp.flow",
+    value: null,
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: 0
+  };
+}
+export {
+  makeMethodRouteHandler
+};

package/dist/esm/http/handlers/revocation.js

@@ -0,0 +1,98 @@
+// src/http/handlers/revocation.ts
+import { resolveClientCredentials } from "../../domain/client-auth";
+import { introspect } from "../../domain/introspect";
+import { revokeToken } from "../../domain/revoke";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { injectResolverHints } from "../resolver";
+import { introspectBodySchema, revokeBodySchema } from "../schemas/revocation";
+function makeRevokeHandler(deps) {
+  return async (c) => {
+    const body = await readForm(c.req.raw);
+    if (!body) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const parsed = revokeBodySchema.safeParse(Object.fromEntries(body.entries()));
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    const res = await revokeToken({
+      token: parsed.data.token,
+      ...parsed.data.token_type_hint ? { tokenTypeHint: parsed.data.token_type_hint } : {},
+      ...creds ? { clientId: creds.clientId } : {},
+      ...creds?.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {}
+    }, {
+      tokenStore: deps.tokenStore,
+      configStore: deps.configStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(null, {
+      status: 200,
+      headers: { "cache-control": "no-store" }
+    });
+  };
+}
+function makeIntrospectHandler(deps) {
+  return async (c) => {
+    const body = await readForm(c.req.raw);
+    if (!body) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const parsed = introspectBodySchema.safeParse(Object.fromEntries(body.entries()));
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    if (!creds) {
+      return tokenEndpointErrorResponse(authError.invalidClient("introspection requires client authentication"));
+    }
+    const tenantRes = await deps.resolveTenant(injectResolverHints(c.req.raw, { client_id: creds.clientId }));
+    if (isErr(tenantRes)) {
+      return tokenEndpointErrorResponse(authError.invalidClient(`unknown client "${creds.clientId}"`));
+    }
+    const res = await introspect({
+      token: parsed.data.token,
+      ...parsed.data.token_type_hint ? { tokenTypeHint: parsed.data.token_type_hint } : {},
+      clientId: creds.clientId,
+      ...creds.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {},
+      presenterTenantId: tenantRes.value
+    }, {
+      keyStore: deps.keyStore,
+      configStore: deps.configStore,
+      issuerUrl: c.get("issuerUrl")
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+async function readForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  return new URLSearchParams(await req.text());
+}
+export {
+  makeRevokeHandler,
+  makeIntrospectHandler
+};

package/dist/esm/http/handlers/token.js

@@ -0,0 +1,167 @@
+// src/http/handlers/token.ts
+import { clientCredentialsGrant } from "../../domain/client-credentials";
+import { exchangeCode } from "../../domain/token";
+import { exchangeToken } from "../../domain/token-exchange";
+import { refreshTokens } from "../../domain/refresh";
+import { isErr } from "../../types/result";
+import { authError } from "../../types/error";
+import { tokenEndpointErrorResponse } from "../errors";
+import { injectResolverHints } from "../resolver";
+import { tokenRequestSchema } from "../schemas/token";
+function makeTokenHandler(deps) {
+  return async (c) => {
+    const body = await readFormBody(c.req.raw);
+    if (!body) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const basic = parseBasicAuth(c.req.header("authorization") ?? null);
+    if (basic) {
+      body.set("client_id", basic.id);
+      body.set("client_secret", basic.secret);
+    }
+    const parsed = tokenRequestSchema.safeParse(Object.fromEntries(body.entries()));
+    if (!parsed.success) {
+      const first = parsed.error.issues[0];
+      if (first?.path[0] === "grant_type") {
+        return tokenEndpointErrorResponse(authError.unsupportedGrantType(first.message ?? "unsupported grant_type"));
+      }
+      return tokenEndpointErrorResponse(authError.invalidRequest(first?.message ?? "invalid request"));
+    }
+    const req = parsed.data;
+    if (req.grant_type === "authorization_code") {
+      const result = await exchangeCode({
+        grantType: "authorization_code",
+        code: req.code,
+        redirectUri: req.redirect_uri,
+        clientId: req.client_id,
+        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
+        ...req.code_verifier !== undefined ? { codeVerifier: req.code_verifier } : {}
+      }, {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+        success: deps.success,
+        ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock
+      });
+      if (isErr(result))
+        return tokenEndpointErrorResponse(result.error);
+      return jsonResponse(result.value);
+    }
+    if (req.grant_type === "client_credentials") {
+      const tenantRes = await deps.resolveTenant(injectResolverHints(c.req.raw, { client_id: req.client_id }));
+      if (isErr(tenantRes)) {
+        return tokenEndpointErrorResponse(tenantRes.error);
+      }
+      const params = {};
+      for (const [k, v] of body.entries()) {
+        if (typeof v === "string")
+          params[k] = v;
+      }
+      const result = await clientCredentialsGrant({
+        grantType: "client_credentials",
+        clientId: req.client_id,
+        clientSecret: req.client_secret,
+        ...req.scope !== undefined ? { scope: req.scope } : {},
+        params
+      }, {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+        methodCache: deps.methodCache,
+        success: deps.success,
+        ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock
+      }, tenantRes.value);
+      if (isErr(result))
+        return tokenEndpointErrorResponse(result.error);
+      return jsonResponse(result.value);
+    }
+    if (req.grant_type === "refresh_token") {
+      const refreshResult = await refreshTokens({
+        grantType: "refresh_token",
+        refreshToken: req.refresh_token,
+        ...req.scope !== undefined ? { scope: req.scope } : {},
+        ...req.client_id !== undefined ? { clientId: req.client_id } : {},
+        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {}
+      }, {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock
+      });
+      if (isErr(refreshResult))
+        return tokenEndpointErrorResponse(refreshResult.error);
+      return jsonResponse(refreshResult.value);
+    }
+    if (req.actor_token !== undefined) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("actor_token (delegation) is not supported; only impersonation / audience-switch is in scope"));
+    }
+    const exchangeResult = await exchangeToken({
+      grantType: req.grant_type,
+      subjectToken: req.subject_token,
+      audience: req.audience,
+      ...req.scope !== undefined ? { scope: req.scope } : {},
+      ...req.client_id !== undefined ? { clientId: req.client_id } : {},
+      ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {}
+    }, {
+      configStore: deps.configStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      ...deps.exchangeAudience ? { exchangeAudience: deps.exchangeAudience } : {},
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock
+    });
+    if (isErr(exchangeResult)) {
+      return tokenEndpointErrorResponse(exchangeResult.error);
+    }
+    return jsonResponse(exchangeResult.value);
+  };
+}
+function jsonResponse(body) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store",
+      pragma: "no-cache"
+    }
+  });
+}
+async function readFormBody(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  const text = await req.text();
+  return new URLSearchParams(text);
+}
+function parseBasicAuth(header) {
+  if (!header)
+    return null;
+  const m = /^Basic\s+(.+)$/i.exec(header);
+  if (!m || !m[1])
+    return null;
+  try {
+    const decoded = atob(m[1]);
+    const colon = decoded.indexOf(":");
+    if (colon === -1)
+      return null;
+    return {
+      id: decodeURIComponent(decoded.slice(0, colon)),
+      secret: decodeURIComponent(decoded.slice(colon + 1))
+    };
+  } catch {
+    return null;
+  }
+}
+export {
+  makeTokenHandler
+};