@aiquants/auth-react-router 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AI Quants / fehde-k
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,62 @@
+# @aiquants/auth-react-router
+
+React Router v7 auth adapter for [`@aiquants/auth-core`](../auth-core/): Google OAuth (remix-auth v4 + a vendored `GoogleStrategy` over `remix-auth-oauth2`) authenticator factory, cookie session storage, per-request loader guard with token refresh + photo cache, auth route handlers, and a `<GoogleForm>` login button. All app couplings (env, backend HTTP, DB photo lookup, warmup, test backdoor) are **DI ports**. The Google strategy (formerly `@coji/remix-auth-google`, 68 lines) is vendored in `src/server/google-strategy-impl.ts`, so the package has no `@coji/*` dependency.
+
+## Install
+
+```bash
+pnpm add @aiquants/auth-core @aiquants/auth-react-router
+```
+
+Peers: `react`, `react-router@^7`, `remix-auth@^4`, `remix-auth-oauth2@^3`, `react-icons`.
+
+## Wiring (single composition point — `app/services/auth/config.server.ts`)
+
+```ts
+import { emailDomainAllowlist, parseAllowlistCsv } from "@aiquants/auth-core"
+import { createAuthServer } from "@aiquants/auth-react-router/server"
+
+export const authServer = createAuthServer({
+    google: { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET, redirectURI: env.GOOGLE_OAUTH_REDIRECT_URL },
+    session: { secrets: [env.REMIX_SESSION_SECRET] },
+    isEmailAllowed: emailDomainAllowlist(parseAllowlistCsv(env.ALLOWED_EMAILS), parseAllowlistCsv(env.ALLOWED_DOMAINS)),
+    backendAuth: { verify: verifyBackend, signup: (p, t) => signupBackend(p, t) },      // FastAPI verify/signup
+    getUserPhoto: async (openid) => (await getOpenids({ openid }))[0]?.picture ?? "",   // drizzle TDOpenid
+    warmup: async () => { await Promise.all([ensureQuantsConnection(), ensureSanwaConnection()]) },
+    mockUser: quantsMockUserPort,   // test backdoor (E2E) — omit in production-only apps
+})
+export const { authenticator, sessionStorage, getSession, getSessionUser, saveSession, requireUser, requireAdminUser, commitSession, destroySession, authenticate, refreshedAccessToken, authenticateInLoader, loginLoader, loginAction, logoutLoader, logout, logoutAndRedirect, googleCallbackLoader } = authServer
+```
+
+Client:
+
+```tsx
+import { GoogleForm } from "@aiquants/auth-react-router/client"
+<GoogleForm />   // <Form method="POST"> + _action="Sign In with Google"
+```
+
+Tailwind: add `@source "../../node_modules/@aiquants/auth-react-router/src";` (or the workspace path) so the `GoogleForm` classes are scanned — `src` ships in the published package.
+
+## Behavior contract (preserved from quants-react-router)
+
+- **Session cookie byte compatibility**: `__session` (httpOnly/lax/30d), key `"user"`, value = `{ id, displayName, name, emails, accessToken, refreshToken?, expirationDateMs?, provider, role? }` — never `photo`/`_json`/`photos`. Changing this invalidates all live 30-day sessions.
+- **Verify order**: Google profile check → `backendAuth.verify` → allowlist → `backendAuth.signup` (every login). Failures redirect to `<loginPath>?error=<encoded Japanese message>` (messages overridable via `messages`).
+- **Token refresh**: expiry check → Google `oauth2/v4/token` rotate → session update; `invalid_grant` destroys the session and redirects to login with `Set-Cookie`.
+- **Loader guard**: `authenticateInLoader(request, { failureRedirect })` returns `{ user?, cookie? }`; `failureRedirect: null` = no-redirect mode. Photo lookups are cached with in-flight dedup per factory instance.
+
+## DI ports absorbing per-app differences (quants vs sanledge)
+
+| Port | quants | sanledge |
+| --- | --- | --- |
+| `google.scopes` | default | + `directory.readonly` etc. |
+| `mockUser` | `mock_user_id` cookie parse + name map | fixed id |
+| `warmup` | 2 pools | 1 pool |
+| `backendAuth` | quants-api | sanledge-api |
+
+## Intentional changes vs the original (§8, approved)
+
+1. No import-time env reads/throws — all validation happens in `createAuthServer`.
+2. Allowlist matching is trim+lowercase (unified with the Python side via `@aiquants/auth-core`).
+3. Dead exports (`refreshBackend`, `authenticateBackend`) are not ported — the backend port only needs `verify`/`signup`.
+
+MIT

package/dist/client.d.mts

@@ -0,0 +1,16 @@
+import * as react from 'react';
+
+/** GoogleForm のプロパティ。 */
+type GoogleFormProps = {
+    /** フォーム action の値 (loginAction の switch と一致させる)。既定 "Sign In with Google"。 */
+    actionValue?: string;
+    /** ボタンの表示ラベル。既定 "Sign in with Google"。 */
+    label?: string;
+};
+/**
+ * Renders the Google sign-in form (POST with `_action`).
+ * Google サインインフォーム (`_action` 付き POST) を描画する。
+ */
+declare const GoogleForm: ({ actionValue, label }?: GoogleFormProps) => react.JSX.Element;
+
+export { GoogleForm, type GoogleFormProps };

package/dist/client.d.ts

@@ -0,0 +1,16 @@
+import * as react from 'react';
+
+/** GoogleForm のプロパティ。 */
+type GoogleFormProps = {
+    /** フォーム action の値 (loginAction の switch と一致させる)。既定 "Sign In with Google"。 */
+    actionValue?: string;
+    /** ボタンの表示ラベル。既定 "Sign in with Google"。 */
+    label?: string;
+};
+/**
+ * Renders the Google sign-in form (POST with `_action`).
+ * Google サインインフォーム (`_action` 付き POST) を描画する。
+ */
+declare const GoogleForm: ({ actionValue, label }?: GoogleFormProps) => react.JSX.Element;
+
+export { GoogleForm, type GoogleFormProps };

package/dist/client.js

@@ -0,0 +1,2 @@
+"use strict";var i=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var u=Object.getOwnPropertyNames;var b=Object.prototype.hasOwnProperty;var f=(e,o)=>{for(var t in o)i(e,t,{get:o[t],enumerable:!0})},d=(e,o,t,l)=>{if(o&&typeof o=="object"||typeof o=="function")for(let r of u(o))!b.call(e,r)&&r!==t&&i(e,r,{get:()=>o[r],enumerable:!(l=p(o,r))||l.enumerable});return e};var F=e=>d(i({},"__esModule",{value:!0}),e);var h={};f(h,{GoogleForm:()=>a});module.exports=F(h);var s=require("react-icons/fa"),m=require("react-router"),g=require("tailwind-variants"),n=require("react/jsx-runtime"),x=(0,g.tv)({slots:{googleForm:"my-4",btn:"w-full flex items-center justify-center gap-3 rounded-2xl bg-gradient-to-r from-blue-500 to-indigo-500 px-6 py-3 text-white font-bold shadow-lg transition-all duration-300 hover:from-blue-600 hover:to-indigo-600 hover:scale-105 focus:outline-none focus:ring-2 focus:ring-blue-300",icon:"",btnText:"text-base tracking-wide"}}),a=({actionValue:e="Sign In with Google",label:o="Sign in with Google"}={})=>{let{googleForm:t,btn:l,icon:r,btnText:c}=x();return(0,n.jsx)(m.Form,{method:"POST",className:t(),children:(0,n.jsxs)("button",{type:"submit",name:"_action",value:e,className:l(),children:[(0,n.jsx)(s.FaGoogle,{size:24,className:"text-white drop-shadow"}),(0,n.jsx)("span",{className:c(),children:o})]})})};0&&(module.exports={GoogleForm});
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts","../src/client/GoogleForm.tsx"],"sourcesContent":["/**\n * @aiquants/auth-react-router/client — client-side auth components barrel.\n * クライアントサイド認証コンポーネントのバレル。\n */\nexport type { GoogleFormProps } from \"./client/GoogleForm\"\nexport { GoogleForm } from \"./client/GoogleForm\"\n","/**\n * @module GoogleForm\n * @description Google sign-in form button (tailwind-variants styled).\n * Google サインインフォームボタン (tailwind-variants スタイル)。\n *\n * 原本 (quants-react-router components/elements/GoogleForm.tsx) を挙動保存で移植。\n * ラベル・action 値は props 化し、既定値は原本と同一 (\"Sign In with Google\")。\n */\nimport { FaGoogle } from \"react-icons/fa\"\nimport { Form } from \"react-router\"\nimport { tv } from \"tailwind-variants\"\n\nconst googleFormStyles = tv({\n    slots: {\n        googleForm: \"my-4\",\n        btn: \"w-full flex items-center justify-center gap-3 rounded-2xl bg-gradient-to-r from-blue-500 to-indigo-500 px-6 py-3 text-white font-bold shadow-lg transition-all duration-300 hover:from-blue-600 hover:to-indigo-600 hover:scale-105 focus:outline-none focus:ring-2 focus:ring-blue-300\",\n        icon: \"\",\n        btnText: \"text-base tracking-wide\",\n    },\n})\n\n/** GoogleForm のプロパティ。 */\nexport type GoogleFormProps = {\n    /** フォーム action の値 (loginAction の switch と一致させる)。既定 \"Sign In with Google\"。 */\n    actionValue?: string\n    /** ボタンの表示ラベル。既定 \"Sign in with Google\"。 */\n    label?: string\n}\n\n/**\n * Renders the Google sign-in form (POST with `_action`).\n * Google サインインフォーム (`_action` 付き POST) を描画する。\n */\nexport const GoogleForm = ({ actionValue = \"Sign In with Google\", label = \"Sign in with Google\" }: GoogleFormProps = {}) => {\n    const { googleForm, btn, icon: _icon, btnText } = googleFormStyles()\n    return (\n        <Form method=\"POST\" className={googleForm()}>\n            <button type=\"submit\" name=\"_action\" value={actionValue} className={btn()}>\n                <FaGoogle size={24} className=\"text-white drop-shadow\" />\n                <span className={btnText()}>{label}</span>\n            </button>\n        </Form>\n    )\n}\n"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,gBAAAE,IAAA,eAAAC,EAAAH,GCQA,IAAAI,EAAyB,0BACzBC,EAAqB,wBACrBC,EAAmB,6BA2BPC,EAAA,6BAzBNC,KAAmB,MAAG,CACxB,MAAO,CACH,WAAY,OACZ,IAAK,0RACL,KAAM,GACN,QAAS,yBACb,CACJ,CAAC,EAcYC,EAAa,CAAC,CAAE,YAAAC,EAAc,sBAAuB,MAAAC,EAAQ,qBAAsB,EAAqB,CAAC,IAAM,CACxH,GAAM,CAAE,WAAAC,EAAY,IAAAC,EAAK,KAAMC,EAAO,QAAAC,CAAQ,EAAIP,EAAiB,EACnE,SACI,OAAC,QAAK,OAAO,OAAO,UAAWI,EAAW,EACtC,oBAAC,UAAO,KAAK,SAAS,KAAK,UAAU,MAAOF,EAAa,UAAWG,EAAI,EACpE,oBAAC,YAAS,KAAM,GAAI,UAAU,yBAAyB,KACvD,OAAC,QAAK,UAAWE,EAAQ,EAAI,SAAAJ,EAAM,GACvC,EACJ,CAER","names":["client_exports","__export","GoogleForm","__toCommonJS","import_fa","import_react_router","import_tailwind_variants","import_jsx_runtime","googleFormStyles","GoogleForm","actionValue","label","googleForm","btn","_icon","btnText"]}

package/dist/client.mjs

@@ -0,0 +1,2 @@
+import{FaGoogle as i}from"react-icons/fa";import{Form as s}from"react-router";import{tv as m}from"tailwind-variants";import{jsx as o,jsxs as c}from"react/jsx-runtime";var g=m({slots:{googleForm:"my-4",btn:"w-full flex items-center justify-center gap-3 rounded-2xl bg-gradient-to-r from-blue-500 to-indigo-500 px-6 py-3 text-white font-bold shadow-lg transition-all duration-300 hover:from-blue-600 hover:to-indigo-600 hover:scale-105 focus:outline-none focus:ring-2 focus:ring-blue-300",icon:"",btnText:"text-base tracking-wide"}}),a=({actionValue:e="Sign In with Google",label:t="Sign in with Google"}={})=>{let{googleForm:r,btn:n,icon:p,btnText:l}=g();return o(s,{method:"POST",className:r(),children:c("button",{type:"submit",name:"_action",value:e,className:n(),children:[o(i,{size:24,className:"text-white drop-shadow"}),o("span",{className:l(),children:t})]})})};export{a as GoogleForm};
+//# sourceMappingURL=client.mjs.map

package/dist/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/GoogleForm.tsx"],"sourcesContent":["/**\n * @module GoogleForm\n * @description Google sign-in form button (tailwind-variants styled).\n * Google サインインフォームボタン (tailwind-variants スタイル)。\n *\n * 原本 (quants-react-router components/elements/GoogleForm.tsx) を挙動保存で移植。\n * ラベル・action 値は props 化し、既定値は原本と同一 (\"Sign In with Google\")。\n */\nimport { FaGoogle } from \"react-icons/fa\"\nimport { Form } from \"react-router\"\nimport { tv } from \"tailwind-variants\"\n\nconst googleFormStyles = tv({\n    slots: {\n        googleForm: \"my-4\",\n        btn: \"w-full flex items-center justify-center gap-3 rounded-2xl bg-gradient-to-r from-blue-500 to-indigo-500 px-6 py-3 text-white font-bold shadow-lg transition-all duration-300 hover:from-blue-600 hover:to-indigo-600 hover:scale-105 focus:outline-none focus:ring-2 focus:ring-blue-300\",\n        icon: \"\",\n        btnText: \"text-base tracking-wide\",\n    },\n})\n\n/** GoogleForm のプロパティ。 */\nexport type GoogleFormProps = {\n    /** フォーム action の値 (loginAction の switch と一致させる)。既定 \"Sign In with Google\"。 */\n    actionValue?: string\n    /** ボタンの表示ラベル。既定 \"Sign in with Google\"。 */\n    label?: string\n}\n\n/**\n * Renders the Google sign-in form (POST with `_action`).\n * Google サインインフォーム (`_action` 付き POST) を描画する。\n */\nexport const GoogleForm = ({ actionValue = \"Sign In with Google\", label = \"Sign in with Google\" }: GoogleFormProps = {}) => {\n    const { googleForm, btn, icon: _icon, btnText } = googleFormStyles()\n    return (\n        <Form method=\"POST\" className={googleForm()}>\n            <button type=\"submit\" name=\"_action\" value={actionValue} className={btn()}>\n                <FaGoogle size={24} className=\"text-white drop-shadow\" />\n                <span className={btnText()}>{label}</span>\n            </button>\n        </Form>\n    )\n}\n"],"mappings":"AAQA,OAAS,YAAAA,MAAgB,iBACzB,OAAS,QAAAC,MAAY,eACrB,OAAS,MAAAC,MAAU,oBA2BP,OACI,OAAAC,EADJ,QAAAC,MAAA,oBAzBZ,IAAMC,EAAmBH,EAAG,CACxB,MAAO,CACH,WAAY,OACZ,IAAK,0RACL,KAAM,GACN,QAAS,yBACb,CACJ,CAAC,EAcYI,EAAa,CAAC,CAAE,YAAAC,EAAc,sBAAuB,MAAAC,EAAQ,qBAAsB,EAAqB,CAAC,IAAM,CACxH,GAAM,CAAE,WAAAC,EAAY,IAAAC,EAAK,KAAMC,EAAO,QAAAC,CAAQ,EAAIP,EAAiB,EACnE,OACIF,EAACF,EAAA,CAAK,OAAO,OAAO,UAAWQ,EAAW,EACtC,SAAAL,EAAC,UAAO,KAAK,SAAS,KAAK,UAAU,MAAOG,EAAa,UAAWG,EAAI,EACpE,UAAAP,EAACH,EAAA,CAAS,KAAM,GAAI,UAAU,yBAAyB,EACvDG,EAAC,QAAK,UAAWS,EAAQ,EAAI,SAAAJ,EAAM,GACvC,EACJ,CAER","names":["FaGoogle","Form","tv","jsx","jsxs","googleFormStyles","GoogleForm","actionValue","label","googleForm","btn","_icon","btnText"]}

package/dist/server.d.mts

@@ -0,0 +1,299 @@
+import * as react_router from 'react-router';
+import { Session } from 'react-router';
+import * as remix_auth from 'remix-auth';
+import { Authenticator } from 'remix-auth';
+import * as _aiquants_auth_core from '@aiquants/auth-core';
+import { SessionProfile, AuthMessages, MyGoogleProfile } from '@aiquants/auth-core';
+
+/**
+ * @module ports
+ * @description DI port types for the React Router auth adapter.
+ * React Router 認証アダプタの DI ポート型定義。
+ *
+ * アプリ固有の結合 (env・backend HTTP・DB 由来の写真解決・DB ウォームアップ・テストバックドア) は
+ * すべてここで定義するポートとして注入する。パッケージ内には汎用ロジックだけを置く。
+ */
+
+/** OAuth Google の資格情報とオプション (scopes はアプリ注入 — sanledge が拡張)。 */
+type GoogleOAuthConfig = {
+    clientId: string;
+    clientSecret: string;
+    redirectURI: string;
+    /** 追加スコープ (既定は openid profile email)。 */
+    scopes?: string[];
+    accessType?: "online" | "offline";
+    includeGrantedScopes?: boolean;
+    prompt?: "none" | "consent" | "select_account";
+};
+/** セッション cookie 設定 (既定は __session/lax/30 日)。secrets のみ必須。 */
+type SessionConfig = {
+    secrets: string[];
+    /** cookie 名。既定 "__session" (変更すると全ライブセッションが無効化されるため既定を推奨)。 */
+    cookieName?: string;
+    /** 有効期間 (秒)。既定 60*60*24*30。 */
+    maxAge?: number;
+    /** Secure 属性。既定は NODE_ENV === "production"。 */
+    secure?: boolean;
+    /** セッション内のユーザーキー。既定 "user"。 */
+    sessionKey?: string;
+};
+/** バックエンド (FastAPI) 認証ポート。verify → allowlist → signup の順で呼ばれる。 */
+type BackendAuthPort = {
+    /** GET /openid/verify 相当。ok なら true。 */
+    verify: (provider: string, accessToken: string) => Promise<boolean>;
+    /** POST /openid/signup?overwrite_existing=true 相当 (毎ログイン実行)。 */
+    signup: (provider: string, accessToken: string) => Promise<unknown>;
+};
+/** ユーザー写真解決ポート (drizzle TDOpenid 等はアプリ側)。キャッシュ + dedup はパッケージ内。 */
+type UserPhotoPort = (openid: string) => Promise<string>;
+/** 毎リクエストの DB 接続ウォームアップ (quants は 2 プール、sanledge は 1 プール)。 */
+type WarmupPort = () => Promise<void>;
+/** テストバックドア (quants は mock_user_id パース + 名前マップ、sanledge は固定 id)。 */
+type MockUserPort = {
+    /** このリクエストでバックドアを使うか (NODE_ENV/cookie の判定はアプリ側)。 */
+    enabled: (request: Request) => boolean;
+    /** バックドア時に返すセッションプロファイル。 */
+    resolve: (request: Request) => SessionProfile;
+};
+/** ロガーポート (既定は console)。 */
+type LoggerPort = {
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+};
+/** 認証サーバーの集約設定。 */
+type AuthServerConfig = {
+    google: GoogleOAuthConfig;
+    session: SessionConfig;
+    /** allowlist 判定 (auth-core の emailDomainAllowlist を推奨)。 */
+    isEmailAllowed: (email: string | null | undefined) => boolean;
+    /** バックエンド verify/signup。省略時はスキップ (フロント単独運用)。 */
+    backendAuth?: BackendAuthPort;
+    /** ユーザー写真解決。省略時は常に空文字。 */
+    getUserPhoto?: UserPhotoPort;
+    /** 毎リクエストのウォームアップ。省略時は何もしない。 */
+    warmup?: WarmupPort;
+    /** テストバックドア。省略時は無効 (本番安全側)。 */
+    mockUser?: MockUserPort;
+    /** ログインページのパス。既定 "/auth/login"。 */
+    loginPath?: string;
+    /** ログイン成功後のリダイレクト先。既定 "/"。 */
+    postLoginRedirect?: string;
+    /** ログアウト後のリダイレクト先。既定 "/"。 */
+    postLogoutRedirect?: string;
+    /** エラーメッセージ上書き (既定は日本語の原本文言)。 */
+    messages?: Partial<AuthMessages>;
+    /** ロガー (既定 console)。 */
+    logger?: LoggerPort;
+};
+
+/** createAuthServer が返す認証サーバー束。 */
+type AuthServer = ReturnType<typeof createAuthServer>;
+/**
+ * Builds the full auth server bundle from a single config.
+ * 単一の設定から認証サーバー束一式を生成する。
+ */
+declare const createAuthServer: (config: AuthServerConfig) => {
+    loginLoader: ({ request }: {
+        request: Request;
+    }) => Promise<{
+        error: string | null;
+    }>;
+    loginAction: ({ request }: {
+        request: Request;
+    }) => Promise<_aiquants_auth_core.MyGoogleProfile | null>;
+    logoutLoader: ({ request }: {
+        request: Request;
+    }) => Promise<never>;
+    logout: (request: Request) => Promise<string>;
+    logoutAndRedirect: (request: Request) => Promise<Response>;
+    googleCallbackLoader: ({ request }: {
+        request: Request;
+    }) => Promise<never>;
+    authenticator: remix_auth.Authenticator<_aiquants_auth_core.MyGoogleProfile>;
+    storage: {
+        sessionStorage: react_router.SessionStorage<react_router.SessionData, react_router.SessionData>;
+        sessionKey: string;
+        getSession: (request: Request) => Promise<react_router.Session<react_router.SessionData, react_router.SessionData>>;
+        getSessionUser: (request: Request) => Promise<_aiquants_auth_core.SessionProfile | undefined>;
+        saveSession: (request: Request, user: _aiquants_auth_core.SessionProfile) => Promise<string>;
+        requireUser: (request: Request) => Promise<_aiquants_auth_core.SessionProfile>;
+        requireAdminUser: (request: Request) => Promise<_aiquants_auth_core.SessionProfile>;
+        logout: (request: Request) => Promise<string>;
+        commitSession: (session: react_router.Session<react_router.SessionData, react_router.SessionData>, options?: react_router.CookieSerializeOptions) => Promise<string>;
+        destroySession: (session: react_router.Session<react_router.SessionData, react_router.SessionData>, options?: react_router.CookieSerializeOptions) => Promise<string>;
+    };
+    authFns: {
+        authenticate: (request: Request, session: react_router.Session, options?: {
+            failureRedirect?: string;
+        }) => Promise<{
+            accessToken: any;
+            refreshToken: any;
+            expirationDateMs: any;
+        }>;
+        refreshedAccessToken: (session: react_router.Session) => Promise<{
+            accessToken: any;
+            refreshToken: any;
+            expirationDateMs: number;
+        }>;
+    };
+    sessionStorage: react_router.SessionStorage<react_router.SessionData, react_router.SessionData>;
+    getSession: (request: Request) => Promise<react_router.Session<react_router.SessionData, react_router.SessionData>>;
+    getSessionUser: (request: Request) => Promise<_aiquants_auth_core.SessionProfile | undefined>;
+    saveSession: (request: Request, user: _aiquants_auth_core.SessionProfile) => Promise<string>;
+    requireUser: (request: Request) => Promise<_aiquants_auth_core.SessionProfile>;
+    requireAdminUser: (request: Request) => Promise<_aiquants_auth_core.SessionProfile>;
+    commitSession: (session: react_router.Session<react_router.SessionData, react_router.SessionData>, options?: react_router.CookieSerializeOptions) => Promise<string>;
+    destroySession: (session: react_router.Session<react_router.SessionData, react_router.SessionData>, options?: react_router.CookieSerializeOptions) => Promise<string>;
+    authenticate: (request: Request, session: react_router.Session, options?: {
+        failureRedirect?: string;
+    }) => Promise<{
+        accessToken: any;
+        refreshToken: any;
+        expirationDateMs: any;
+    }>;
+    refreshedAccessToken: (session: react_router.Session) => Promise<{
+        accessToken: any;
+        refreshToken: any;
+        expirationDateMs: number;
+    }>;
+    authenticateInLoader: (request: Request, options: {
+        failureRedirect: string;
+    } | {
+        failureRedirect: null;
+    }) => Promise<{
+        user?: _aiquants_auth_core.MyGoogleProfile;
+        cookie?: string;
+    }>;
+};
+
+/** createAuthSessionStorage が返すセッション操作束。 */
+type AuthSessionStorage = ReturnType<typeof createAuthSessionStorage>;
+/**
+ * Builds the cookie session storage and session helpers.
+ * cookie セッションストレージとセッションヘルパー群を生成する。
+ *
+ * @throws secrets が空の場合 (fail-closed の設定ガード)。
+ */
+declare const createAuthSessionStorage: (config: SessionConfig, options?: {
+    mockUser?: MockUserPort;
+    loginPath?: string;
+    postLoginRedirect?: string;
+}) => {
+    sessionStorage: react_router.SessionStorage<react_router.SessionData, react_router.SessionData>;
+    sessionKey: string;
+    getSession: (request: Request) => Promise<react_router.Session<react_router.SessionData, react_router.SessionData>>;
+    getSessionUser: (request: Request) => Promise<SessionProfile | undefined>;
+    saveSession: (request: Request, user: SessionProfile) => Promise<string>;
+    requireUser: (request: Request) => Promise<SessionProfile>;
+    requireAdminUser: (request: Request) => Promise<SessionProfile>;
+    logout: (request: Request) => Promise<string>;
+    commitSession: (session: react_router.Session<react_router.SessionData, react_router.SessionData>, options?: react_router.CookieSerializeOptions) => Promise<string>;
+    destroySession: (session: react_router.Session<react_router.SessionData, react_router.SessionData>, options?: react_router.CookieSerializeOptions) => Promise<string>;
+};
+
+/** トークンリフレッシュ失敗の基底エラー。 */
+declare class TokenRefreshError extends Error {
+    constructor(message: string);
+}
+/** Google の invalid_grant (失効/取り消し済みリフレッシュトークン) エラー。 */
+declare class GoogleInvalidGrantError extends TokenRefreshError {
+    constructor();
+}
+/** createAuthenticate が返す認証関数束。 */
+type AuthenticateFns = ReturnType<typeof createAuthenticate>;
+/**
+ * Builds the `authenticate` / `refreshedAccessToken` pair wired to injected config.
+ * 注入設定に結線した `authenticate` / `refreshedAccessToken` を生成する。
+ */
+declare const createAuthenticate: (config: AuthServerConfig, storage: AuthSessionStorage, logger: LoggerPort) => {
+    authenticate: (request: Request, session: Session, options?: {
+        failureRedirect?: string;
+    }) => Promise<{
+        accessToken: any;
+        refreshToken: any;
+        expirationDateMs: any;
+    }>;
+    refreshedAccessToken: (session: Session) => Promise<{
+        accessToken: any;
+        refreshToken: any;
+        expirationDateMs: number;
+    }>;
+};
+
+/**
+ * @module authenticate-in-loader
+ * @description Per-request loader authentication guard with photo cache and warmup.
+ * 写真キャッシュとウォームアップ付きの毎リクエストローダー認証ガード。
+ *
+ * 原本 (quants-react-router authenticateInLoader.server.ts) を挙動保存で移植。
+ * DB クエリ (getOpenids) は `getUserPhoto` ポートへ、DB プールウォームアップは `warmup`
+ * ポートへ置き換えた。写真キャッシュ (Map + pending dedup) はファクトリインスタンスごとに
+ * 保持する (module-level mutable state の排除)。
+ */
+
+/**
+ * Builds the per-request loader guard wired to injected ports.
+ * 注入ポートに結線した毎リクエストローダーガードを生成する。
+ */
+declare const createAuthenticateInLoader: (config: AuthServerConfig, storage: AuthSessionStorage, authFns: AuthenticateFns, logger: LoggerPort) => (request: Request, options: {
+    failureRedirect: string;
+} | {
+    failureRedirect: null;
+}) => Promise<{
+    user?: MyGoogleProfile;
+    cookie?: string;
+}>;
+
+/**
+ * @module google-strategy
+ * @description Google OAuth authenticator factory (remix-auth v4 + local GoogleStrategy).
+ * Google OAuth 認証器ファクトリ (remix-auth v4 + 同梱の GoogleStrategy)。
+ *
+ * 原本 (quants-react-router auth.server.ts) の verify コールバックを挙動保存で移植。
+ * env 読取り・backend HTTP・allowlist・エラーメッセージはすべてポート/設定注入に置き換えた。
+ * 検証順序 (Google プロフィール検証 → backend verify → allowlist → backend signup)、
+ * リダイレクト先 (`<loginPath>?error=<encoded>`)、エラーメッセージ文言は原本と等価。
+ */
+
+/**
+ * Builds a remix-auth Authenticator with the Google strategy wired to injected ports.
+ * 注入ポートに結線した Google ストラテジー付き Authenticator を生成する。
+ */
+declare const createGoogleAuthenticator: (config: AuthServerConfig) => Authenticator<MyGoogleProfile>;
+
+/**
+ * @module handlers
+ * @description Route handler factories for login / logout / Google callback.
+ * login / logout / Google コールバックのルートハンドラ工場。
+ *
+ * 原本 (quants-react-router routes/_auth+ の 4 ルート + features/logoutAndRedirect.ts) の
+ * サーバー側ロジックを挙動保存で移植。UI (JSX) はアプリ側に残す。
+ * コールバックのセッション保存形状 (SessionProfile、photo/_json/photos を含まない) は
+ * cookie byte 互換のため厳密に保存する。
+ */
+
+/**
+ * Builds loader/action handlers for the auth routes.
+ * 認証ルート用の loader/action ハンドラ群を生成する。
+ */
+declare const createAuthHandlers: (config: AuthServerConfig, storage: AuthSessionStorage, authenticator: Authenticator<MyGoogleProfile>, logger: LoggerPort) => {
+    loginLoader: ({ request }: {
+        request: Request;
+    }) => Promise<{
+        error: string | null;
+    }>;
+    loginAction: ({ request }: {
+        request: Request;
+    }) => Promise<MyGoogleProfile | null>;
+    logoutLoader: ({ request }: {
+        request: Request;
+    }) => Promise<never>;
+    logout: (request: Request) => Promise<string>;
+    logoutAndRedirect: (request: Request) => Promise<Response>;
+    googleCallbackLoader: ({ request }: {
+        request: Request;
+    }) => Promise<never>;
+};
+
+export { type AuthServer, type AuthServerConfig, type AuthSessionStorage, type BackendAuthPort, GoogleInvalidGrantError, type GoogleOAuthConfig, type LoggerPort, type MockUserPort, type SessionConfig, TokenRefreshError, type UserPhotoPort, type WarmupPort, createAuthHandlers, createAuthServer, createAuthSessionStorage, createAuthenticate, createAuthenticateInLoader, createGoogleAuthenticator };