@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/http/handlers/authorize.js

@@ -0,0 +1,250 @@
+// src/http/handlers/authorize.ts
+import { isErr } from "../../types/result";
+import { startAuthorize } from "../../domain/authorize";
+import { asTenantId } from "../../types/tenant";
+import { authError } from "../../types/error";
+import { renderPicker as renderDefaultPicker } from "../../ui/picker";
+import { applyResponsePolicy } from "../cookies";
+import {
+  authorizeDirectErrorResponse,
+  authorizeRedirectErrorResponse,
+  isNonRecoverable
+} from "../errors";
+import {
+  authorizeQuerySchema,
+  authorizeRequestUriQuerySchema
+} from "../schemas/authorize";
+function makeAuthorizeHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const url = new URL(c.req.url);
+    const raw = Object.fromEntries(url.searchParams.entries());
+    let workingRaw = raw;
+    if (raw.request_uri !== undefined) {
+      const parParsed = authorizeRequestUriQuerySchema.safeParse(raw);
+      if (!parParsed.success) {
+        return authorizeDirectErrorResponse(authError.invalidRequest(parParsed.error.issues[0]?.message ?? "invalid request", parParsed.error.issues[0]?.path[0]?.toString() ?? "request"));
+      }
+      if (!deps.sessionStore.consumePar) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("session adapter does not support PAR", "request_uri"));
+      }
+      const par = await deps.sessionStore.consumePar(parParsed.data.request_uri);
+      if (isErr(par)) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("unknown or expired request_uri", "request_uri"));
+      }
+      if (par.value.clientId !== parParsed.data.client_id) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("request_uri belongs to a different client", "request_uri"));
+      }
+      workingRaw = par.value.params;
+    }
+    const parsed = authorizeQuerySchema.safeParse(workingRaw);
+    if (!parsed.success) {
+      const first = parsed.error.issues[0];
+      const field = first?.path[0]?.toString() ?? "request";
+      return authorizeDirectErrorResponse(authError.invalidRequest(first?.message ?? "invalid request", field));
+    }
+    const q = parsed.data;
+    if (raw.request_uri === undefined) {
+      const client = tenant.config.clients.find((c2) => c2.id === q.client_id);
+      if (client?.requirePushedAuthorizationRequests) {
+        return authorizeDirectErrorResponse(authError.invalidRequest("this client requires Pushed Authorization Requests (RFC 9126)", "request_uri"));
+      }
+    }
+    if (q.response_type !== "code") {
+      return authorizeDirectErrorResponse({
+        code: "invalid_request",
+        description: `unsupported response_type "${q.response_type}" — OAuth 2.1 is code-only`,
+        field: "response_type"
+      });
+    }
+    let claimsRequest;
+    if (q.claims !== undefined) {
+      const parsedClaims = parseClaimsParameter(q.claims);
+      if (!parsedClaims.ok) {
+        return authorizeDirectErrorResponse(authError.invalidRequest(parsedClaims.error, "claims"));
+      }
+      claimsRequest = parsedClaims.value;
+    }
+    const request = {
+      tenantId: asTenantId(tenant.id),
+      clientId: q.client_id,
+      redirectUri: q.redirect_uri,
+      responseType: "code",
+      scopes: q.scope ?? [],
+      state: q.state ?? null,
+      ...q.audience !== undefined ? { audience: q.audience } : {},
+      ...q.method_id !== undefined ? { methodId: q.method_id } : {},
+      ...q.code_challenge !== undefined ? { codeChallenge: q.code_challenge } : {},
+      ...q.code_challenge_method !== undefined ? { codeChallengeMethod: q.code_challenge_method } : {},
+      ...q.prompt !== undefined ? { prompt: q.prompt } : {},
+      ...q.ui_locales !== undefined ? { uiLocales: q.ui_locales } : {},
+      ...q.nonce !== undefined ? { nonce: q.nonce } : {},
+      ...claimsRequest !== undefined ? { claimsRequest } : {}
+    };
+    const result = await startAuthorize({
+      request,
+      rawRequest: c.req.raw,
+      tenant,
+      cookies: c.get("cookies")
+    }, {
+      sessionStore: deps.sessionStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      methodCache: deps.methodCache,
+      stateKeys: deps.stateKeys,
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      ...deps.callbackHostFor ? {
+        callbackHostFor: (id) => deps.callbackHostFor(id)
+      } : {}
+    });
+    if (isErr(result)) {
+      const err = result.error;
+      if (isNonRecoverable(err)) {
+        return authorizeDirectErrorResponse(err);
+      }
+      return authorizeRedirectErrorResponse(err, q.redirect_uri, q.state ?? null);
+    }
+    const out = result.value;
+    switch (out.kind) {
+      case "challenge": {
+        const flowCookie = {
+          name: "idp.flow",
+          value: out.flowId,
+          path: "/",
+          httpOnly: true,
+          sameSite: "lax",
+          maxAge: 60 * 10
+        };
+        return applyResponsePolicy(out.response, {
+          setCookies: [flowCookie, ...out.setCookies],
+          cookieDefaults: deps.cookieDefaults,
+          cacheControl: cacheControlFor(out.cache)
+        });
+      }
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri);
+        redirect.searchParams.set("code", out.code);
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState);
+        return applyResponsePolicy(new Response(null, {
+          status: 302,
+          headers: { location: redirect.toString() }
+        }), {
+          setCookies: [clearFlowCookie()],
+          cookieDefaults: deps.cookieDefaults
+        });
+      }
+      case "denied":
+        return applyResponsePolicy(authorizeRedirectErrorResponse({ code: "access_denied", description: out.reason }, q.redirect_uri, q.state ?? null), {
+          setCookies: [clearFlowCookie(), ...out.setCookies],
+          cookieDefaults: deps.cookieDefaults
+        });
+      case "select-method": {
+        const pickerCtx = {
+          clientId: q.client_id,
+          redirectUri: q.redirect_uri,
+          state: q.state ?? null,
+          scope: q.scope ? q.scope.join(" ") : null,
+          nonce: q.nonce ?? null,
+          codeChallenge: q.code_challenge ?? null,
+          codeChallengeMethod: q.code_challenge_method ?? null,
+          audience: q.audience ?? null,
+          prompt: q.prompt ? q.prompt.join(" ") : null,
+          uiLocales: q.ui_locales ? q.ui_locales.join(" ") : null
+        };
+        const methods = out.methods.map((m) => ({
+          id: m.id,
+          kind: m.kind,
+          type: m.type
+        }));
+        const render = deps.renderPicker ?? renderDefaultPicker;
+        return await render(methods, pickerCtx);
+      }
+    }
+  };
+}
+function parseClaimsParameter(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    return {
+      ok: false,
+      error: `claims parameter is not valid JSON: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, error: "claims parameter must be a JSON object" };
+  }
+  const obj = parsed;
+  const result = {};
+  for (const section of ["userinfo", "id_token"]) {
+    const v = obj[section];
+    if (v === undefined)
+      continue;
+    if (!v || typeof v !== "object" || Array.isArray(v)) {
+      return {
+        ok: false,
+        error: `claims.${section} must be a JSON object`
+      };
+    }
+    const sectionMap = {};
+    for (const [name, entry] of Object.entries(v)) {
+      if (entry === null) {
+        sectionMap[name] = null;
+        continue;
+      }
+      if (typeof entry !== "object" || Array.isArray(entry)) {
+        return {
+          ok: false,
+          error: `claims.${section}.${name} must be null or a JSON object`
+        };
+      }
+      const e = entry;
+      const normalized = {};
+      if (typeof e.essential === "boolean")
+        normalized.essential = e.essential;
+      if ("value" in e)
+        normalized.value = e.value;
+      if (Array.isArray(e.values))
+        normalized.values = e.values;
+      sectionMap[name] = normalized;
+    }
+    result[section] = sectionMap;
+  }
+  return { ok: true, value: result };
+}
+function clearFlowCookie() {
+  return {
+    name: "idp.flow",
+    value: null,
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: 0
+  };
+}
+function cacheControlFor(cache) {
+  if (!cache)
+    return "no-store";
+  if ((cache.maxAge ?? -1) === 0)
+    return "no-store";
+  const parts = [];
+  if (cache.isPrivate)
+    parts.push("private");
+  if (cache.maxAge !== undefined)
+    parts.push(`max-age=${cache.maxAge}`);
+  if (cache.sMaxAge !== undefined)
+    parts.push(`s-maxage=${cache.sMaxAge}`);
+  if (cache.immutable)
+    parts.push("immutable");
+  return parts.length ? parts.join(", ") : "no-store";
+}
+export {
+  makeAuthorizeHandler
+};

package/dist/esm/http/handlers/callback.js

@@ -0,0 +1,53 @@
+// src/http/handlers/callback.ts
+import { handleCallback } from "../../domain/callback";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { authorizeDirectErrorResponse } from "../errors";
+function makeCallbackHandler(deps) {
+  return async (c) => {
+    const result = await handleCallback({ rawRequest: c.req.raw, cookies: c.get("cookies") }, {
+      configStore: deps.configStore,
+      sessionStore: deps.sessionStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      methodCache: deps.methodCache,
+      stateKeys: deps.stateKeys,
+      ...deps.buildCustomContext ? { buildCustomContext: deps.buildCustomContext } : {},
+      clock: deps.clock
+    });
+    if (isErr(result)) {
+      return authorizeDirectErrorResponse(result.error);
+    }
+    const out = result.value;
+    switch (out.kind) {
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri);
+        redirect.searchParams.set("code", out.code);
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState);
+        return new Response(null, {
+          status: 302,
+          headers: {
+            location: redirect.toString(),
+            "cache-control": "no-store"
+          }
+        });
+      }
+      case "challenge":
+        return applyResponsePolicy(out.response, {
+          setCookies: out.setCookies,
+          cookieDefaults: deps.cookieDefaults,
+          cacheControl: out.cache ? out.cache.maxAge === 0 ? "no-store" : "no-store" : "no-store"
+        });
+      case "denied":
+        return applyResponsePolicy(new Response(`access_denied: ${out.reason}`, {
+          status: 403,
+          headers: { "content-type": "text/plain" }
+        }), { setCookies: out.setCookies, cookieDefaults: deps.cookieDefaults });
+    }
+  };
+}
+export {
+  makeCallbackHandler
+};

package/dist/esm/http/handlers/end-session.js

@@ -0,0 +1,64 @@
+// src/http/handlers/end-session.ts
+import { endSession } from "../../domain/logout";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { tokenEndpointErrorResponse } from "../errors";
+import { endSessionParamsSchema } from "../schemas/end-session";
+function makeEndSessionHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    let raw;
+    const httpMethod = c.req.method.toUpperCase();
+    if (httpMethod === "GET") {
+      raw = Object.fromEntries(new URL(c.req.url).searchParams.entries());
+    } else if (httpMethod === "POST") {
+      const ct = (c.req.header("content-type") ?? "").toLowerCase();
+      if (!ct.startsWith("application/x-www-form-urlencoded")) {
+        return tokenEndpointErrorResponse(authError.invalidRequest("POST /end_session requires application/x-www-form-urlencoded body"));
+      }
+      raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()));
+    } else {
+      return tokenEndpointErrorResponse(authError.invalidRequest(`unsupported method "${httpMethod}"`));
+    }
+    const parsed = endSessionParamsSchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const q = parsed.data;
+    const res = await endSession({
+      ...q.id_token_hint !== undefined ? { idTokenHint: q.id_token_hint } : {},
+      ...q.client_id !== undefined ? { clientId: q.client_id } : {},
+      ...q.post_logout_redirect_uri !== undefined ? { postLogoutRedirectUri: q.post_logout_redirect_uri } : {},
+      ...q.state !== undefined ? { state: q.state } : {}
+    }, tenant, {
+      configStore: deps.configStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      issuerUrl: c.get("issuerUrl"),
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    if (res.value.kind === "redirect") {
+      return applyResponsePolicy(new Response(null, {
+        status: 302,
+        headers: { location: res.value.url }
+      }), { setCookies: [], cookieDefaults: deps.cookieDefaults });
+    }
+    return new Response("Logged out.", {
+      status: 200,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeEndSessionHandler
+};

package/dist/esm/http/handlers/metadata.js

@@ -0,0 +1,37 @@
+// src/http/handlers/metadata.ts
+import { buildDiscoveryDocument, buildJwks } from "../../domain/discovery";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+function makeDiscoveryHandler(deps) {
+  return async (c) => {
+    const doc = buildDiscoveryDocument({
+      issuerUrl: c.get("issuerUrl"),
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
+    return new Response(JSON.stringify(doc), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "public, max-age=60"
+      }
+    });
+  };
+}
+function makeJwksHandler(deps) {
+  return async (_c) => {
+    const res = await buildJwks(deps.keyStore);
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "public, max-age=60"
+      }
+    });
+  };
+}
+export {
+  makeJwksHandler,
+  makeDiscoveryHandler
+};

package/dist/esm/http/handlers/method-route.js

@@ -0,0 +1,87 @@
+// src/http/handlers/method-route.ts
+import { handleMethodRoute } from "../../domain/method-route";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { applyResponsePolicy } from "../cookies";
+import { authorizeDirectErrorResponse } from "../errors";
+function makeMethodRouteHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const cookies = c.get("cookies");
+    const flowId = cookies.get("idp.flow");
+    if (!flowId) {
+      return authorizeDirectErrorResponse(authError.invalidRequest("missing flow cookie", "flow"));
+    }
+    const url = new URL(c.req.url);
+    const segments = url.pathname.split("/").filter(Boolean);
+    if (segments.length < 3 || segments[0] !== "m") {
+      return authorizeDirectErrorResponse(authError.invalidRequest("malformed method route", "path"));
+    }
+    const methodId = segments[1];
+    const subPath = "/" + segments.slice(2).join("/");
+    const httpMethod = c.req.method.toUpperCase() === "POST" ? "POST" : "GET";
+    const result = await handleMethodRoute({
+      rawRequest: c.req.raw,
+      tenant,
+      methodId,
+      subPath,
+      httpMethod,
+      flowId,
+      cookies
+    }, {
+      sessionStore: deps.sessionStore,
+      tokenStore: deps.tokenStore,
+      keyStore: deps.keyStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      methodCache: deps.methodCache,
+      clock: deps.clock
+    });
+    if (isErr(result))
+      return authorizeDirectErrorResponse(result.error);
+    const out = result.value;
+    switch (out.kind) {
+      case "issue-code": {
+        const redirect = new URL(out.appRedirectUri);
+        redirect.searchParams.set("code", out.code);
+        if (out.appState !== null)
+          redirect.searchParams.set("state", out.appState);
+        return applyResponsePolicy(new Response(null, {
+          status: 302,
+          headers: { location: redirect.toString() }
+        }), {
+          setCookies: [clearFlowCookie()],
+          cookieDefaults: deps.cookieDefaults
+        });
+      }
+      case "challenge":
+        return applyResponsePolicy(out.response, {
+          setCookies: out.setCookies,
+          cookieDefaults: deps.cookieDefaults
+        });
+      case "denied":
+        return applyResponsePolicy(new Response(`access_denied: ${out.reason}`, {
+          status: 403,
+          headers: { "content-type": "text/plain" }
+        }), {
+          setCookies: [clearFlowCookie(), ...out.setCookies],
+          cookieDefaults: deps.cookieDefaults
+        });
+    }
+  };
+}
+function clearFlowCookie() {
+  return {
+    name: "idp.flow",
+    value: null,
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: 0
+  };
+}
+export {
+  makeMethodRouteHandler
+};

package/dist/esm/http/handlers/par.js

@@ -0,0 +1,53 @@
+// src/http/handlers/par.ts
+import { resolveClientCredentials } from "../../domain/client-auth";
+import { pushAuthorizationRequest } from "../../domain/par";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { parBodySchema } from "../schemas/par";
+function makeParHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase();
+    if (!ct.startsWith("application/x-www-form-urlencoded")) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()).entries());
+    const parsed = parBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    const clientId = creds?.clientId ?? parsed.data.client_id;
+    const { client_secret: _strip, ...paramsForAuthorize } = parsed.data;
+    const res = await pushAuthorizationRequest({
+      clientId,
+      ...creds?.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {},
+      params: paramsForAuthorize
+    }, tenant, {
+      configStore: deps.configStore,
+      sessionStore: deps.sessionStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeParHandler
+};

package/dist/esm/http/handlers/register.js

@@ -0,0 +1,46 @@
+// src/http/handlers/register.ts
+import { registerNewClient } from "../../domain/register";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { registerBodySchema } from "../schemas/register";
+function makeRegisterHandler(deps) {
+  return async (c) => {
+    const tenant = c.get("tenant");
+    if (!tenant) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("tenant unresolved"));
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase();
+    if (!ct.startsWith("application/json")) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/json"));
+    }
+    let raw;
+    try {
+      raw = await c.req.raw.json();
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e);
+      return tokenEndpointErrorResponse(authError.invalidRequest(`malformed JSON: ${reason}`));
+    }
+    const parsed = registerBodySchema.safeParse(raw);
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid request"));
+    }
+    const request = parsed.data;
+    const res = await registerNewClient(request, tenant, {
+      ...deps.registerClient ? { registerClient: deps.registerClient } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+export {
+  makeRegisterHandler
+};

package/dist/esm/http/handlers/revocation.js

@@ -0,0 +1,98 @@
+// src/http/handlers/revocation.ts
+import { resolveClientCredentials } from "../../domain/client-auth";
+import { introspect } from "../../domain/introspect";
+import { revokeToken } from "../../domain/revoke";
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { tokenEndpointErrorResponse } from "../errors";
+import { injectResolverHints } from "../resolver";
+import { introspectBodySchema, revokeBodySchema } from "../schemas/revocation";
+function makeRevokeHandler(deps) {
+  return async (c) => {
+    const body = await readForm(c.req.raw);
+    if (!body) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const parsed = revokeBodySchema.safeParse(Object.fromEntries(body.entries()));
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    const res = await revokeToken({
+      token: parsed.data.token,
+      ...parsed.data.token_type_hint ? { tokenTypeHint: parsed.data.token_type_hint } : {},
+      ...creds ? { clientId: creds.clientId } : {},
+      ...creds?.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {}
+    }, {
+      tokenStore: deps.tokenStore,
+      configStore: deps.configStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(null, {
+      status: 200,
+      headers: { "cache-control": "no-store" }
+    });
+  };
+}
+function makeIntrospectHandler(deps) {
+  return async (c) => {
+    const body = await readForm(c.req.raw);
+    if (!body) {
+      return tokenEndpointErrorResponse(authError.invalidRequest("body must be application/x-www-form-urlencoded"));
+    }
+    const parsed = introspectBodySchema.safeParse(Object.fromEntries(body.entries()));
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(authError.invalidRequest(parsed.error.issues[0]?.message ?? "invalid"));
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret
+    });
+    if (!creds) {
+      return tokenEndpointErrorResponse(authError.invalidClient("introspection requires client authentication"));
+    }
+    const tenantRes = await deps.resolveTenant(injectResolverHints(c.req.raw, { client_id: creds.clientId }));
+    if (isErr(tenantRes)) {
+      return tokenEndpointErrorResponse(authError.invalidClient(`unknown client "${creds.clientId}"`));
+    }
+    const res = await introspect({
+      token: parsed.data.token,
+      ...parsed.data.token_type_hint ? { tokenTypeHint: parsed.data.token_type_hint } : {},
+      clientId: creds.clientId,
+      ...creds.clientSecret !== undefined ? { clientSecret: creds.clientSecret } : {},
+      presenterTenantId: tenantRes.value
+    }, {
+      keyStore: deps.keyStore,
+      configStore: deps.configStore,
+      issuerUrl: c.get("issuerUrl")
+    });
+    if (isErr(res))
+      return tokenEndpointErrorResponse(res.error);
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+async function readForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  return new URLSearchParams(await req.text());
+}
+export {
+  makeRevokeHandler,
+  makeIntrospectHandler
+};