@kaperkunde/auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kaperkunde
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,13 @@
-# Temporary Holding Version
+# @kaperkunde/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Better Auth as the OAuth 2.1 authorization server for an app's MCP
+connector, plus the rules and words the sign-in forms share.
+
+| Import                    | What it gives                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `@kaperkunde/auth/preset` | `mcpAuthPreset({ urls, scopes })` to spread into `betterAuth({…})`: jwt (its `/token` closed, no set-auth-jwt header), mcp (code + refresh only, open registration, an hour's access token), cimd, and the production rate limit with room for the OAuth endpoints. `discoveryRoute(auth.handler)` for the root `.well-known` routes                                                                                                                                            |
+| `@kaperkunde/auth`        | `mcpUrls` (issuer, resource, JWKS over loopback, resource metadata); `parseScopeList`, `effectiveScopes` (token ∩ live consent, null once disconnected); `bearerChallenge`, `mcpAuthError`, `withCors`, `bearerTokenFrom`, `calledToolNames`; `hashOpaqueToken` + `opaqueTokenClaims` (refuses revoked, expired, DPoP-bound, disabled-client, expired-session and other-resource tokens); `validatePassword`, `withResetPasswordEmail`, `authErrorMessage`, `oauthRedirectFrom` |
+
+The app keeps what is its own: the database adapter, its hooks, the scope
+names and their descriptions, and the lookups (`oauthConsent`,
+`oauthAccessToken`) through its own client, whose rows these functions judge.

package/dist/index.d.mts

@@ -0,0 +1,99 @@
+import { n as mcpUrls, t as McpUrls } from "./urls-Cbyx1eIp.mjs";
+/** The headers an MCP route answers with, for clients in the browser too. */
+export declare const MCP_CORS_HEADERS: Readonly<Record<string, string>>;
+/** A response with CORS headers set over its own. */
+export declare function withCors(response: Response, headers?: Readonly<Record<string, string>>): Response;
+/**
+ * The WWW-Authenticate value that sends a client to sign in (RFC 6750 and
+ * 9728): where the resource's metadata is, and the scopes to ask for. A
+ * client reads `scope` to build its authorization request, and adds
+ * offline_access itself when it is listed.
+ */
+export declare function bearerChallenge({ urls, scopes, error, description }: {
+  urls: Pick<McpUrls, "resourceMetadataUrl">;
+  scopes: readonly string[];
+  error?: "invalid_token" | "insufficient_scope" | "invalid_request";
+  description?: string;
+}): string;
+/**
+ * A JSON-RPC error answer with its challenge: 401 to sign in again, 403 for
+ * a token without the scope a call needs.
+ */
+export declare function mcpAuthError({ status, message, challenge }: {
+  status: 401 | 403;
+  message: string;
+  challenge: string;
+}): Response;
+/** The token of an `Authorization: Bearer …` request, or null. */
+export declare function bearerTokenFrom(request: Request): string | null;
+/** Tool names a JSON-RPC body calls (one request or a batch), for scope checks and rate buckets. */
+export declare function calledToolNames(request: Request): Promise<string[]>;
+/** One password rule for sign-up, reset and change-password forms. */
+export declare function validatePassword(password: string, verify: string, { minLength }?: {
+  minLength?: number;
+}): string | null;
+/** Query parameter carrying the account's address on the password-reset link. */
+export declare const RESET_PASSWORD_EMAIL_PARAM = "email";
+/**
+ * Adds the account's address to the callback on a Better Auth reset link,
+ * so the form can sign the person in once the new password is set. The
+ * address comes from the user row Better Auth resolved, never from whoever
+ * asked, so a caller's redirectTo cannot put someone else's address on it.
+ */
+export declare function withResetPasswordEmail(url: string, email: string): string;
+export declare const UNEXPECTED_ERROR = "Something went wrong on our side. Try again in a minute.";
+type AuthError = {
+  code?: string;
+  message?: string;
+  status?: number;
+  error?: string;
+};
+/**
+ * Better Auth answers with codes; people read sentences. A server error is
+ * always the unexpected-error sentence, never Better Auth's own message.
+ * `overrides` lets an app word a code its own way.
+ */
+export declare function authErrorMessage(error: AuthError | null | undefined, fallback: string, overrides?: Readonly<Record<string, string>>): string;
+/** Where an authorization continues after signing in for a connecting app, if it does. */
+export declare function oauthRedirectFrom(data: unknown): string | null;
+/**
+ * Access tokens for clients that did not name the resource they wanted (RFC
+ * 8707). The authorization server issues an opaque token then, rather than a
+ * JWT bound to the resource, and keeps a SHA-256 of it. The app looks the
+ * row up by `hashOpaqueToken` with its own database client and hands it to
+ * `opaqueTokenClaims`, which answers JWT-shaped claims or null.
+ */
+export declare function hashOpaqueToken(token: string): string;
+/** Whether a bearer token is the opaque kind (a JWT has dots). */
+export declare function isOpaqueToken(token: string): boolean;
+type OpaqueTokenRow = {
+  clientId: string;
+  userId: string | null;
+  scopes: unknown;
+  resources?: unknown;
+  expiresAt: Date;
+  revoked?: Date | boolean | null;
+  /** DPoP-bound tokens need a proof a plain Bearer request cannot carry. */
+  confirmation?: unknown;
+  client?: {
+    disabled?: boolean | null;
+  } | null;
+  session?: {
+    expiresAt: Date;
+  } | null;
+};
+export declare function opaqueTokenClaims(row: OpaqueTokenRow | null | undefined, resource: string, now?: Date): Record<string, unknown> | null;
+/**
+ * Scopes as Better Auth stores them (an array, a space- or comma-separated
+ * string, or JSON text on MySQL), as a list.
+ */
+export declare function parseScopeList(value: unknown): string[];
+/**
+ * What a request may do: the token's scopes, narrowed to what the person
+ * still allows the app. Access tokens are self-contained and refresh tokens
+ * carry their original scopes, so the consent row is the only live record:
+ * checking it on every request makes Disconnect take effect at once
+ * (`consented` null), and intersecting makes a downgrade take effect too.
+ */
+export declare function effectiveScopes(tokenScopes: unknown, consented: unknown | null): string[] | null;
+export { type McpUrls, type OpaqueTokenRow, mcpUrls };

package/dist/index.mjs

@@ -0,0 +1,200 @@
+import { createHash } from "node:crypto";
+// src/challenge.ts
+/** The headers an MCP route answers with, for clients in the browser too. */
+const MCP_CORS_HEADERS = {
+	"Access-Control-Allow-Origin": "*",
+	"Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+	"Access-Control-Allow-Headers": "Authorization, Content-Type, Accept, MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Session-Id, Last-Event-ID",
+	"Access-Control-Expose-Headers": "WWW-Authenticate, Mcp-Session-Id"
+};
+/** A response with CORS headers set over its own. */
+function withCors(response, headers = MCP_CORS_HEADERS) {
+	const merged = new Headers(response.headers);
+	for (const [key, value] of Object.entries(headers)) merged.set(key, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: merged
+	});
+}
+function quoted(value) {
+	return `"${value.replace(/["\\]/g, "\\$&")}"`;
+}
+/**
+* The WWW-Authenticate value that sends a client to sign in (RFC 6750 and
+* 9728): where the resource's metadata is, and the scopes to ask for. A
+* client reads `scope` to build its authorization request, and adds
+* offline_access itself when it is listed.
+*/
+function bearerChallenge({ urls, scopes, error, description }) {
+	return `Bearer ${[
+		...error ? [`error=${quoted(error)}`] : [],
+		...description ? [`error_description=${quoted(description)}`] : [],
+		`resource_metadata=${quoted(urls.resourceMetadataUrl)}`,
+		`scope=${quoted(scopes.join(" "))}`
+	].join(", ")}`;
+}
+/**
+* A JSON-RPC error answer with its challenge: 401 to sign in again, 403 for
+* a token without the scope a call needs.
+*/
+function mcpAuthError({ status, message, challenge }) {
+	return withCors(new Response(JSON.stringify({
+		jsonrpc: "2.0",
+		error: {
+			code: -32e3,
+			message
+		},
+		id: null
+	}), {
+		status,
+		headers: {
+			"Content-Type": "application/json",
+			"WWW-Authenticate": challenge
+		}
+	}));
+}
+/** The token of an `Authorization: Bearer …` request, or null. */
+function bearerTokenFrom(request) {
+	return (request.headers.get("authorization") ?? "").match(/^Bearer\s+(.+)$/i)?.[1]?.trim() || null;
+}
+/** Tool names a JSON-RPC body calls (one request or a batch), for scope checks and rate buckets. */
+async function calledToolNames(request) {
+	if (request.method !== "POST") return [];
+	let body;
+	try {
+		body = await request.clone().json();
+	} catch {
+		return [];
+	}
+	return (Array.isArray(body) ? body : [body]).flatMap((message) => {
+		const m = message;
+		return m?.method === "tools/call" && typeof m.params?.name === "string" ? [m.params.name] : [];
+	});
+}
+// src/forms.ts
+/** One password rule for sign-up, reset and change-password forms. */
+function validatePassword(password, verify, { minLength = 8 } = {}) {
+	if (password.length < minLength) return `Password must be at least ${minLength} characters.`;
+	if (password !== verify) return "Passwords do not match.";
+	return null;
+}
+/** Query parameter carrying the account's address on the password-reset link. */
+const RESET_PASSWORD_EMAIL_PARAM = "email";
+/**
+* Adds the account's address to the callback on a Better Auth reset link,
+* so the form can sign the person in once the new password is set. The
+* address comes from the user row Better Auth resolved, never from whoever
+* asked, so a caller's redirectTo cannot put someone else's address on it.
+*/
+function withResetPasswordEmail(url, email) {
+	try {
+		const link = new URL(url);
+		const callback = new URL(link.searchParams.get("callbackURL") || "/reset-password", link.origin);
+		callback.searchParams.set(RESET_PASSWORD_EMAIL_PARAM, email);
+		link.searchParams.set("callbackURL", `${callback.pathname}${callback.search}`);
+		return link.toString();
+	} catch {
+		return url;
+	}
+}
+const UNEXPECTED_ERROR = "Something went wrong on our side. Try again in a minute.";
+const MESSAGES = {
+	INVALID_EMAIL_OR_PASSWORD: "Wrong email or password.",
+	USER_ALREADY_EXISTS: "An account with this email already exists. Sign in instead.",
+	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "An account with this email already exists. Sign in instead.",
+	PASSWORD_TOO_SHORT: "Use at least 8 characters for your password.",
+	PASSWORD_TOO_LONG: "That password is too long. Use at most 128 characters.",
+	INVALID_EMAIL: "Enter a valid email address.",
+	INVALID_PASSWORD: "Your current password is wrong.",
+	CREDENTIAL_ACCOUNT_NOT_FOUND: "This account has no password to change.",
+	INVALID_TOKEN: "This link has expired or was already used. Ask for a new one.",
+	EMAIL_NOT_VERIFIED: "Confirm your email address first: we sent you a link."
+};
+/**
+* Better Auth answers with codes; people read sentences. A server error is
+* always the unexpected-error sentence, never Better Auth's own message.
+* `overrides` lets an app word a code its own way.
+*/
+function authErrorMessage(error, fallback, overrides = {}) {
+	if (!error) return fallback;
+	if (error.status === 429) return "Too many attempts. Wait a minute and try again.";
+	if (error.status !== void 0 && error.status >= 500) return UNEXPECTED_ERROR;
+	const code = error.code ?? "";
+	if (overrides[code]) return overrides[code];
+	if (MESSAGES[code]) return MESSAGES[code];
+	if (error.error === "invalid_signature" || code === "INVALID_SIGNATURE") return "This request to connect an app has expired. Go back to the app and start connecting again.";
+	return fallback;
+}
+/** Where an authorization continues after signing in for a connecting app, if it does. */
+function oauthRedirectFrom(data) {
+	if (!data || typeof data !== "object") return null;
+	const record = data;
+	const url = typeof record.url === "string" ? record.url : record.redirect_uri;
+	return typeof url === "string" && (record.redirect === true || record.redirect_uri) ? url : null;
+}
+// src/scopes.ts
+/**
+* Scopes as Better Auth stores them (an array, a space- or comma-separated
+* string, or JSON text on MySQL), as a list.
+*/
+function parseScopeList(value) {
+	if (Array.isArray(value)) return value.filter((entry) => typeof entry === "string");
+	if (typeof value !== "string" || !value.trim()) return [];
+	const trimmed = value.trim();
+	if (trimmed.startsWith("[")) try {
+		return parseScopeList(JSON.parse(trimmed));
+	} catch {
+		return [];
+	}
+	return trimmed.split(/[\s,]+/).filter(Boolean);
+}
+/**
+* What a request may do: the token's scopes, narrowed to what the person
+* still allows the app. Access tokens are self-contained and refresh tokens
+* carry their original scopes, so the consent row is the only live record:
+* checking it on every request makes Disconnect take effect at once
+* (`consented` null), and intersecting makes a downgrade take effect too.
+*/
+function effectiveScopes(tokenScopes, consented) {
+	if (consented === null || consented === void 0) return null;
+	const allowed = new Set(parseScopeList(consented));
+	return parseScopeList(tokenScopes).filter((scope) => allowed.has(scope));
+}
+// src/opaque-token.ts
+/**
+* Access tokens for clients that did not name the resource they wanted (RFC
+* 8707). The authorization server issues an opaque token then, rather than a
+* JWT bound to the resource, and keeps a SHA-256 of it. The app looks the
+* row up by `hashOpaqueToken` with its own database client and hands it to
+* `opaqueTokenClaims`, which answers JWT-shaped claims or null.
+*/
+function hashOpaqueToken(token) {
+	return createHash("sha256").update(token).digest("base64url");
+}
+/** Whether a bearer token is the opaque kind (a JWT has dots). */
+function isOpaqueToken(token) {
+	return Boolean(token) && !token.includes(".");
+}
+function opaqueTokenClaims(row, resource, now = /* @__PURE__ */ new Date()) {
+	if (!row || !row.userId || row.revoked || row.expiresAt <= now || row.confirmation || row.client?.disabled || row.session && row.session.expiresAt <= now) return null;
+	const resources = parseScopeList(row.resources);
+	if (resources.length > 0 && !resources.includes(resource)) return null;
+	return {
+		sub: row.userId,
+		azp: row.clientId,
+		scope: parseScopeList(row.scopes).join(" "),
+		exp: Math.floor(row.expiresAt.getTime() / 1e3)
+	};
+}
+// src/urls.ts
+function mcpUrls({ siteUrl, resourcePath = "/mcp", port = process.env.PORT?.trim() || "3000", jwksUrl = process.env.MCP_JWKS_URL?.trim() }) {
+	const issuer = siteUrl.replace(/\/+$/, "");
+	return {
+		issuer,
+		resource: `${issuer}${resourcePath}`,
+		jwksUrl: jwksUrl || `http://127.0.0.1:${port}/api/auth/jwks`,
+		resourceMetadataUrl: `${issuer}/.well-known/oauth-protected-resource${resourcePath}`
+	};
+}
+export { MCP_CORS_HEADERS, RESET_PASSWORD_EMAIL_PARAM, UNEXPECTED_ERROR, authErrorMessage, bearerChallenge, bearerTokenFrom, calledToolNames, effectiveScopes, hashOpaqueToken, isOpaqueToken, mcpAuthError, mcpUrls, oauthRedirectFrom, opaqueTokenClaims, parseScopeList, validatePassword, withCors, withResetPasswordEmail };

package/dist/preset.d.mts

@@ -0,0 +1,60 @@
+import { t as McpUrls } from "./urls-Cbyx1eIp.mjs";
+/**
+ * The Better Auth options an app needs to be an OAuth 2.1 authorization
+ * server for its MCP connector, as one object spread into `betterAuth({…})`:
+ *
+ * - `jwt` signs the access tokens, with its own `/token` endpoint closed and
+ *   no set-auth-jwt header on session responses, so a signed-in browser is
+ *   never handed a token of the same shape;
+ * - `mcp`: authorization code and refresh token only (every token belongs to
+ *   a person who approved it), open dynamic registration, an hour's access
+ *   token and a refresh token for `refreshDays`;
+ * - `cimd` for clients that identify with a metadata document (Claude);
+ * - the rate limit, in production only, with room for the OAuth endpoints
+ *   every connector reaches from one provider's egress range.
+ *
+ *   betterAuth({ ...mcpAuthPreset({ urls, scopes, consentPage }), emailAndPassword: … })
+ *
+ * An app with its own `plugins` passes them in `extraPlugins`.
+ */
+export declare function mcpAuthPreset({ urls, scopes, loginPage, consentPage, refreshDays, rateLimited, extraPlugins, disabledPaths }: {
+  urls: Pick<McpUrls, "issuer" | "resource">;
+  scopes: readonly string[];
+  loginPage?: string;
+  consentPage?: string;
+  refreshDays?: number;
+  rateLimited?: boolean;
+  extraPlugins?: readonly unknown[];
+  disabledPaths?: readonly string[];
+}): {
+  disabledPaths: string[];
+  rateLimit: {
+    enabled: boolean;
+    window: number;
+    max: number;
+    customRules: {
+      "/oauth2/token": {
+        window: number;
+        max: number;
+      };
+      "/oauth2/register": {
+        window: number;
+        max: number;
+      };
+      "/jwks": false;
+    };
+  };
+  plugins: unknown[];
+};
+/**
+ * Route handlers for the OAuth discovery documents at the site root. Better
+ * Auth serves them from its plugins, but only for requests reaching its
+ * handler under /api/auth; MCP clients look for them at the root, so these
+ * hand the request on untouched and add CORS for browser clients.
+ *
+ *   export const { GET, OPTIONS } = discoveryRoute(auth.handler)
+ */
+export declare function discoveryRoute(handler: (request: Request) => Promise<Response>): {
+  GET(request: Request): Promise<Response>;
+  OPTIONS(): Response;
+};

package/dist/preset.mjs

@@ -0,0 +1,101 @@
+import { cimd } from "@better-auth/cimd";
+import { fetchClientMetadataResource } from "@better-auth/cimd/node";
+import { mcp } from "@better-auth/mcp";
+import { jwt } from "better-auth/plugins";
+// src/preset.ts
+/**
+* The Better Auth options an app needs to be an OAuth 2.1 authorization
+* server for its MCP connector, as one object spread into `betterAuth({…})`:
+*
+* - `jwt` signs the access tokens, with its own `/token` endpoint closed and
+*   no set-auth-jwt header on session responses, so a signed-in browser is
+*   never handed a token of the same shape;
+* - `mcp`: authorization code and refresh token only (every token belongs to
+*   a person who approved it), open dynamic registration, an hour's access
+*   token and a refresh token for `refreshDays`;
+* - `cimd` for clients that identify with a metadata document (Claude);
+* - the rate limit, in production only, with room for the OAuth endpoints
+*   every connector reaches from one provider's egress range.
+*
+*   betterAuth({ ...mcpAuthPreset({ urls, scopes, consentPage }), emailAndPassword: … })
+*
+* An app with its own `plugins` passes them in `extraPlugins`.
+*/
+function mcpAuthPreset({ urls, scopes, loginPage = "/login", consentPage = "/oauth/consent", refreshDays = 60, rateLimited = process.env.NODE_ENV === "production" && process.env.E2E?.trim() !== "1", extraPlugins = [], disabledPaths = [] }) {
+	return {
+		disabledPaths: ["/token", ...disabledPaths],
+		rateLimit: {
+			enabled: rateLimited,
+			window: 60,
+			max: 20,
+			customRules: {
+				"/oauth2/token": {
+					window: 60,
+					max: 300
+				},
+				"/oauth2/register": {
+					window: 60,
+					max: 60
+				},
+				"/jwks": false
+			}
+		},
+		plugins: [
+			jwt({
+				jwt: { issuer: urls.issuer },
+				disableSettingJwtHeader: true
+			}),
+			mcp({
+				loginPage,
+				consentPage,
+				resource: urls.resource,
+				scopes: [...scopes],
+				grantTypes: ["authorization_code", "refresh_token"],
+				allowDynamicClientRegistration: true,
+				allowUnauthenticatedClientRegistration: true,
+				accessTokenExpiresIn: 3600,
+				refreshTokenExpiresIn: 86400 * refreshDays
+			}),
+			cimd({
+				fetchClientMetadataResource,
+				metadataProfile: "mcp-2026-07-28"
+			}),
+			...extraPlugins
+		]
+	};
+}
+const DISCOVERY_CORS = {
+	"Access-Control-Allow-Origin": "*",
+	"Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
+	"Access-Control-Allow-Headers": "Content-Type, MCP-Protocol-Version",
+	"Access-Control-Max-Age": "86400"
+};
+/**
+* Route handlers for the OAuth discovery documents at the site root. Better
+* Auth serves them from its plugins, but only for requests reaching its
+* handler under /api/auth; MCP clients look for them at the root, so these
+* hand the request on untouched and add CORS for browser clients.
+*
+*   export const { GET, OPTIONS } = discoveryRoute(auth.handler)
+*/
+function discoveryRoute(handler) {
+	return {
+		async GET(request) {
+			const response = await handler(request);
+			const headers = new Headers(response.headers);
+			for (const [key, value] of Object.entries(DISCOVERY_CORS)) headers.set(key, value);
+			return new Response(response.body, {
+				status: response.status,
+				statusText: response.statusText,
+				headers
+			});
+		},
+		OPTIONS() {
+			return new Response(null, {
+				status: 204,
+				headers: DISCOVERY_CORS
+			});
+		}
+	};
+}
+export { discoveryRoute, mcpAuthPreset };

package/dist/urls-Cbyx1eIp.d.mts

@@ -0,0 +1,23 @@
+/**
+ * The addresses an MCP connector's OAuth needs. The issuer is the site
+ * origin itself, not Better Auth's /api/auth base path, so the authorization
+ * server's metadata sits at the plain /.well-known path every MCP client
+ * probes first; the endpoints it lists still point into /api/auth/oauth2/*.
+ */
+type McpUrls = {
+  /** The site origin. */
+  issuer: string;
+  /** The protected resource tokens are bound to: the connector URL a person pastes, byte for byte. */
+  resource: string;
+  /** Where the route verifies access tokens. Over loopback: the keys belong to this process. */
+  jwksUrl: string;
+  /** RFC 9728's metadata document for the resource. */
+  resourceMetadataUrl: string;
+};
+declare function mcpUrls({ siteUrl, resourcePath, port, jwksUrl }: {
+  siteUrl: string;
+  resourcePath?: string;
+  port?: string;
+  jwksUrl?: string;
+}): McpUrls;
+export { mcpUrls as n, McpUrls as t };

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "@kaperkunde/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Better Auth as the OAuth 2.1 server for an MCP connector: the preset, discovery routes, scope and consent checks, challenges, opaque tokens, and the auth forms' rules and messages.",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kaperkunde/common-public.git",
+    "directory": "packages/auth"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./preset": {
+      "types": "./dist/preset.d.mts",
+      "import": "./dist/preset.mjs"
+    }
+  },
+  "peerDependencies": {
+    "@better-auth/cimd": "^1.7.7",
+    "@better-auth/mcp": "^1.7.7",
+    "better-auth": "^1.7.7"
+  },
+  "peerDependenciesMeta": {
+    "@better-auth/cimd": {
+      "optional": true
+    },
+    "@better-auth/mcp": {
+      "optional": true
+    },
+    "better-auth": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@better-auth/cimd": "1.7.7",
+    "@better-auth/mcp": "1.7.7",
+    "@better-auth/oauth-provider": "1.7.7",
+    "better-auth": "1.7.7"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsdown src/index.ts src/preset.ts --format esm --dts --clean",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  }
 }