@q32/core 0.1.20 → 0.1.22

package/README.md

@@ -6,6 +6,7 @@ The first release focuses on common infrastructure repeated across Q32 apps:
 
 - AI provider contracts and JSON extraction helpers
 - API operation registries
+- framework-neutral auth/session/MCP auth services with thin Hono and React Router adapters
 - billing plan/status primitives
 - Cloudflare binding guards
 - environment parsing
@@ -15,7 +16,7 @@ The first release focuses on common infrastructure repeated across Q32 apps:
 - HTTP JSON/error helpers
 - D1-like database types and migration runner
 - encoding helpers
-- D1-backed jobs
+- durable D1-backed jobs, child orchestration, queue publishers, and pipeline managers
 - `ops_events`
 - Postgres migration helpers
 - R2 JSON artifacts
@@ -50,13 +51,20 @@ import {
   D1JobStore,
   D1_JOBS_SCHEMA,
   appUrl,
+  createAuthSystem,
   createId,
+  honoAuthMiddleware,
   jsonResponse,
   oauthAuthorizationServerMetadata,
+  reactRouterAuthContext,
   renderSitemapXml,
   recordOpsEvent,
   signSession,
 } from "@q32/core";
 ```
 
-See [docs/evaluation.md](docs/evaluation.md) for the project-inventory replacement matrix.
+See [docs/evaluation.md](docs/evaluation.md) for the project-inventory replacement matrix and [docs/jobs.md](docs/jobs.md) for the shared jobs model.
+
+Framework adapters are deliberately thin. Put policy and persistence in `auth`,
+`jobs`, `ops-events`, and `api`; use `hono` or `react-router` only to translate a
+framework request/response shape into those shared services.

package/dist/auth.d.ts

@@ -0,0 +1,98 @@
+import { type McpOAuthRepository, type McpTokenRow, type OAuthClientInformation, type OAuthClientRegistration, type OAuthTokens } from "./oauth.js";
+export type CookieOptions = {
+    name: string;
+};
+export type SessionAuthOptions<TSession> = {
+    secret: string;
+    cookie: CookieOptions;
+    verify?: (payload: TSession) => Promise<TSession | null> | TSession | null;
+};
+export type AuthContext<TPrincipal = unknown, TSession = unknown> = {
+    request: Request;
+    session: TSession | null;
+    principal: TPrincipal | null;
+};
+export type AuthSystemOptions<TPrincipal, TSession> = {
+    session?: SessionAuthOptions<TSession>;
+    loadPrincipal?: (session: TSession, request: Request) => Promise<TPrincipal | null> | TPrincipal | null;
+};
+export declare class AuthSystem<TPrincipal = unknown, TSession = unknown> {
+    private readonly options;
+    constructor(options: AuthSystemOptions<TPrincipal, TSession>);
+    sessionFromRequest(request: Request): Promise<TSession | null>;
+    contextFromRequest(request: Request): Promise<AuthContext<TPrincipal, TSession>>;
+    requirePrincipal(request: Request): Promise<TPrincipal>;
+}
+export declare function createAuthSystem<TPrincipal = unknown, TSession = unknown>(options: AuthSystemOptions<TPrincipal, TSession>): AuthSystem<TPrincipal, TSession>;
+export declare function getCookie(request: Request, name: string): string | undefined;
+export declare function requireAdminRequest(request: Request, expectedToken: string | undefined): void;
+export type McpAuthInfo<TSubject extends Record<string, string> = Record<string, string>> = {
+    token: string;
+    clientId: string;
+    scopes: string[];
+    expiresAt: number;
+    resource?: URL;
+    subject: TSubject;
+    extra?: Record<string, unknown>;
+};
+export type McpAuthorizationParams = {
+    redirectUri: string;
+    state?: string;
+    scopes?: string[];
+    resource?: URL;
+    codeChallenge: string;
+};
+export type McpAuthorizeResult = {
+    kind: "redirect";
+    location: string;
+    status?: number;
+} | {
+    kind: "authorized";
+    code: string;
+    redirect: string;
+};
+export type McpAuthServiceOptions<TPrincipal, TSubject extends Record<string, string>> = {
+    repository: McpOAuthRepository;
+    sessionAuth?: AuthSystem<TPrincipal, unknown>;
+    loginPath?: string;
+    defaultScopes?: string[];
+    authCodeTtlSeconds?: number;
+    accessTokenTtlSeconds?: number;
+    refreshTokenTtlSeconds?: number;
+    refreshTokenReuseGraceSeconds?: number;
+    tokenEncryptionSecret: string;
+    principalToSubject: (principal: TPrincipal) => TSubject | null | Promise<TSubject | null>;
+    subjectToPrincipal?: (subject: TSubject) => TPrincipal | null | Promise<TPrincipal | null>;
+    canAuthorize?: (principal: TPrincipal, client: OAuthClientInformation, params: McpAuthorizationParams) => boolean | Promise<boolean>;
+    canUseToken?: (principal: TPrincipal, row: McpTokenRow) => boolean | Promise<boolean>;
+    accessDeniedDescription?: string;
+    createAuthorizationCode?: () => string;
+    createAccessToken?: () => string;
+    createRefreshToken?: () => string;
+    now?: () => number;
+};
+export declare class McpAuthService<TPrincipal, TSubject extends Record<string, string> = Record<string, string>> {
+    private readonly options;
+    readonly skipLocalPkceValidation = false;
+    constructor(options: McpAuthServiceOptions<TPrincipal, TSubject>);
+    get clientsStore(): {
+        getClient: (clientId: string) => Promise<OAuthClientInformation | undefined>;
+        registerClient: (client: OAuthClientRegistration) => Promise<OAuthClientInformation>;
+    };
+    authorize(client: OAuthClientInformation, params: McpAuthorizationParams, request: Request): Promise<McpAuthorizeResult>;
+    challengeForAuthorizationCode(client: OAuthClientInformation, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformation, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformation, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<McpAuthInfo<TSubject>>;
+    revokeToken(client: OAuthClientInformation, request: {
+        token: string;
+    }): Promise<void>;
+    private validAuthorizationCode;
+    private issueTokens;
+    private issueTokenSet;
+    private cachedRefreshResponse;
+    private defaultScopes;
+    private loginRedirect;
+    private now;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,QAAQ,IAAI;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,UAAU,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,IAAI;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,UAAU,EAAE,QAAQ,IAAI;IACpD,OAAO,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC;CACzG,CAAC;AAEF,qBAAa,UAAU,CAAC,UAAU,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC;IAEvE,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAS9D,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAMhF,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;CAK9D;AAED,wBAAgB,gBAAgB,CAAC,UAAU,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,EACvE,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,GAC/C,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAElC;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ5E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAE7F;AAED,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,qBAAqB,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI;IACvF,UAAU,EAAE,kBAAkB,CAAC;IAC/B,WAAW,CAAC,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1F,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3F,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrI,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,MAAM,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAQF,qBAAa,cAAc,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAG1F,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,uBAAuB,SAAS;gBAEZ,OAAO,EAAE,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC;IAEjF,IAAI,YAAY,IAAI;QAClB,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;QAC7E,cAAc,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;KACtF,CAKA;IAEK,SAAS,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoCxH,6BAA6B,CAAC,MAAM,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKzG,yBAAyB,CAC7B,MAAM,EAAE,sBAAsB,EAC9B,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAcjB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAiCnI,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAqBhE,WAAW,CAAC,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAW9E,sBAAsB;YAQtB,WAAW;YASX,aAAa;YAwBb,qBAAqB;IAKnC,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,GAAG;CAGZ"}

package/dist/auth.js

@@ -0,0 +1,230 @@
+import { HttpError, requireAdminToken } from "./http.js";
+import { createOAuthRedirect, decryptOAuthTokenResponse, encryptOAuthTokenResponse, issueMcpOAuthTokenSet, parseOAuthJsonArray, } from "./oauth.js";
+import { verifySession } from "./session.js";
+export class AuthSystem {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async sessionFromRequest(request) {
+        const config = this.options.session;
+        if (!config)
+            return null;
+        const token = getCookie(request, config.cookie.name);
+        const payload = await verifySession(token, config.secret);
+        if (!payload)
+            return null;
+        return config.verify ? await config.verify(payload) : payload;
+    }
+    async contextFromRequest(request) {
+        const session = await this.sessionFromRequest(request);
+        const principal = session && this.options.loadPrincipal ? await this.options.loadPrincipal(session, request) : null;
+        return { request, session, principal };
+    }
+    async requirePrincipal(request) {
+        const context = await this.contextFromRequest(request);
+        if (!context.principal)
+            throw new HttpError(401, "Authentication required.", "authentication_required");
+        return context.principal;
+    }
+}
+export function createAuthSystem(options) {
+    return new AuthSystem(options);
+}
+export function getCookie(request, name) {
+    const cookie = request.headers.get("cookie");
+    if (!cookie)
+        return undefined;
+    for (const part of cookie.split(";")) {
+        const [rawName, ...rawValue] = part.trim().split("=");
+        if (rawName === name)
+            return decodeURIComponent(rawValue.join("="));
+    }
+    return undefined;
+}
+export function requireAdminRequest(request, expectedToken) {
+    requireAdminToken(request, expectedToken);
+}
+const DEFAULT_SCOPE = "mcp:read";
+const DEFAULT_AUTH_CODE_TTL_SECONDS = 10 * 60;
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+const DEFAULT_REFRESH_TOKEN_REUSE_GRACE_SECONDS = 10 * 60;
+export class McpAuthService {
+    options;
+    skipLocalPkceValidation = false;
+    constructor(options) {
+        this.options = options;
+    }
+    get clientsStore() {
+        return {
+            getClient: (clientId) => this.options.repository.getClient(clientId),
+            registerClient: (client) => this.options.repository.registerClient(client),
+        };
+    }
+    async authorize(client, params, request) {
+        const principal = this.options.sessionAuth ? await this.options.sessionAuth.requirePrincipal(request).catch(() => null) : null;
+        if (!principal) {
+            return { kind: "redirect", location: this.loginRedirect(request), status: 302 };
+        }
+        const allowed = this.options.canAuthorize ? await this.options.canAuthorize(principal, client, params) : true;
+        const subject = allowed ? await this.options.principalToSubject(principal) : null;
+        if (!allowed || !subject) {
+            const redirect = createOAuthRedirect(params.redirectUri, {
+                error: "access_denied",
+                error_description: this.options.accessDeniedDescription ?? "Access denied.",
+                state: params.state,
+            });
+            return { kind: "redirect", location: redirect, status: 302 };
+        }
+        const code = this.options.createAuthorizationCode?.() ?? `mcpcode_${crypto.randomUUID().replace(/-/g, "")}`;
+        await this.options.repository.createAuthorizationCode({
+            code,
+            clientId: client.client_id,
+            subject,
+            redirectUri: params.redirectUri,
+            scopes: params.scopes?.length ? params.scopes : this.defaultScopes(),
+            resource: params.resource?.href ?? null,
+            codeChallenge: params.codeChallenge,
+            expiresAt: this.now() + (this.options.authCodeTtlSeconds ?? DEFAULT_AUTH_CODE_TTL_SECONDS),
+        });
+        return {
+            kind: "authorized",
+            code,
+            redirect: createOAuthRedirect(params.redirectUri, { code, state: params.state }),
+        };
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const row = await this.validAuthorizationCode(client, authorizationCode);
+        return row.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
+        const row = await this.validAuthorizationCode(client, authorizationCode);
+        if (redirectUri && row.redirectUri !== redirectUri)
+            throw invalidGrant("Redirect URI mismatch");
+        if (resource?.href && row.resource && row.resource !== resource.href)
+            throw invalidGrant("Resource mismatch");
+        await this.options.repository.consumeAuthorizationCode(row.authorizationCodeId);
+        return this.issueTokens({
+            clientId: row.clientId,
+            subject: row.subject,
+            scopes: parseOAuthJsonArray(row.scopesJson),
+            resource: row.resource ? new URL(row.resource) : resource,
+        });
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const row = await this.options.repository.getTokenByRefreshToken(refreshToken);
+        if (!row || row.clientId !== client.client_id)
+            throw invalidGrant("Invalid refresh token");
+        const cachedResponse = await this.cachedRefreshResponse(row);
+        if (cachedResponse)
+            return cachedResponse;
+        if (row.revokedAt)
+            throw invalidGrant("Invalid refresh token");
+        if (row.refreshExpiresAt && row.refreshExpiresAt < this.now())
+            throw invalidGrant("Refresh token expired");
+        const grantedScopes = parseOAuthJsonArray(row.scopesJson);
+        const requestedScopes = scopes?.length ? scopes.filter((scope) => grantedScopes.includes(scope)) : grantedScopes;
+        const issued = await this.issueTokenSet({
+            clientId: row.clientId,
+            subject: row.subject,
+            scopes: requestedScopes,
+            resource: resource ?? (row.resource ? new URL(row.resource) : undefined),
+        });
+        const encryptedResponse = await encryptOAuthTokenResponse(issued.tokens, this.options.tokenEncryptionSecret);
+        const claimedRotation = await this.options.repository.markTokenRotated({
+            tokenId: row.tokenId,
+            rotatedToTokenId: issued.tokenId,
+            refreshReuseExpiresAt: this.now() + (this.options.refreshTokenReuseGraceSeconds ?? DEFAULT_REFRESH_TOKEN_REUSE_GRACE_SECONDS),
+            rotatedResponseCiphertext: encryptedResponse.ciphertext,
+            rotatedResponseNonce: encryptedResponse.nonce,
+        });
+        if (claimedRotation)
+            return issued.tokens;
+        await this.options.repository.revokeToken(issued.tokenId);
+        const winner = await this.options.repository.getTokenByRefreshToken(refreshToken);
+        const winnerResponse = winner ? await this.cachedRefreshResponse(winner) : null;
+        if (winnerResponse)
+            return winnerResponse;
+        throw invalidGrant("Invalid refresh token");
+    }
+    async verifyAccessToken(token) {
+        const row = await this.options.repository.getTokenByAccessToken(token);
+        if (!row || row.revokedAt || row.accessExpiresAt < this.now())
+            throw new HttpError(401, "Invalid access token.", "invalid_access_token");
+        const subject = row.subject;
+        const principal = this.options.subjectToPrincipal ? await this.options.subjectToPrincipal(subject) : null;
+        if (this.options.subjectToPrincipal && !principal)
+            throw new HttpError(401, "Invalid access token.", "invalid_access_token");
+        if (principal && this.options.canUseToken && !(await this.options.canUseToken(principal, row))) {
+            throw new HttpError(403, "Token is not allowed.", "token_not_allowed");
+        }
+        await this.options.repository.touchAccessToken(row.tokenId);
+        return {
+            token,
+            clientId: row.clientId,
+            scopes: parseOAuthJsonArray(row.scopesJson),
+            expiresAt: row.accessExpiresAt,
+            resource: row.resource ? new URL(row.resource) : undefined,
+            subject,
+            extra: { ...subject },
+        };
+    }
+    async revokeToken(client, request) {
+        const accessRow = await this.options.repository.getTokenByAccessToken(request.token);
+        if (accessRow && accessRow.clientId === client.client_id) {
+            await this.options.repository.revokeToken(accessRow.tokenId);
+            return;
+        }
+        const refreshRow = await this.options.repository.getTokenByRefreshToken(request.token);
+        if (refreshRow && refreshRow.clientId === client.client_id)
+            await this.options.repository.revokeToken(refreshRow.tokenId);
+    }
+    async validAuthorizationCode(client, authorizationCode) {
+        const row = await this.options.repository.getAuthorizationCode(authorizationCode);
+        if (!row || row.clientId !== client.client_id || row.usedAt || row.expiresAt < this.now()) {
+            throw invalidGrant("Invalid authorization code");
+        }
+        return row;
+    }
+    async issueTokens(input) {
+        return (await this.issueTokenSet(input)).tokens;
+    }
+    async issueTokenSet(input) {
+        return issueMcpOAuthTokenSet(this.options.repository, {
+            clientId: input.clientId,
+            subject: input.subject,
+            scopes: input.scopes,
+            resource: input.resource,
+        }, {
+            accessTokenTtlSeconds: this.options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS,
+            refreshTokenTtlSeconds: this.options.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS,
+            createAccessToken: this.options.createAccessToken,
+            createRefreshToken: this.options.createRefreshToken,
+            now: this.options.now,
+        });
+    }
+    async cachedRefreshResponse(row) {
+        if (!row.rotatedResponseCiphertext || !row.rotatedResponseNonce || !row.refreshReuseExpiresAt || row.refreshReuseExpiresAt < this.now())
+            return null;
+        return decryptOAuthTokenResponse(row.rotatedResponseCiphertext, row.rotatedResponseNonce, this.options.tokenEncryptionSecret);
+    }
+    defaultScopes() {
+        return this.options.defaultScopes?.length ? this.options.defaultScopes : [DEFAULT_SCOPE];
+    }
+    loginRedirect(request) {
+        const loginPath = this.options.loginPath ?? "/login";
+        const url = new URL(loginPath, request.url);
+        url.searchParams.set("next", request.url);
+        return `${url.pathname}${url.search}`;
+    }
+    now() {
+        return this.options.now?.() ?? Math.floor(Date.now() / 1000);
+    }
+}
+function invalidGrant(message) {
+    const error = new Error(message);
+    error.name = "InvalidGrantError";
+    return error;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EAMrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAuB7C,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,OAAgD;QAAhD,YAAO,GAAP,OAAO,CAAyC;IAAG,CAAC;IAEjF,KAAK,CAAC,kBAAkB,CAAC,OAAgB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAW,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAgB;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,yBAAyB,CAAC,CAAC;QACxG,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgD;IAEhD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,aAAiC;IACrF,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AA6CD,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC;AACjD,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5D,MAAM,yCAAyC,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1D,MAAM,OAAO,cAAc;IAGI;IAFpB,uBAAuB,GAAG,KAAK,CAAC;IAEzC,YAA6B,OAAoD;QAApD,YAAO,GAAP,OAAO,CAA6C;IAAG,CAAC;IAErF,IAAI,YAAY;QAId,OAAO;YACL,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5E,cAAc,EAAE,CAAC,MAA+B,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC;SACpG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAA8B,EAAE,MAA8B,EAAE,OAAgB;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/H,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE;gBACvD,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB,IAAI,gBAAgB;gBAC3E,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;YACpD,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;SAC3F,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI;YACJ,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,MAA8B,EAAE,iBAAyB;QAC3F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAA8B,EAC9B,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACzE,IAAI,WAAW,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAChG,IAAI,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI;YAAE,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAE9G,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAmB;YAChC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAA8B,EAAE,YAAoB,EAAE,MAAiB,EAAE,QAAc;QAChH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAC/E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC3F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAE3G,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACjH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAmB;YAChC,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SACzE,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC7G,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACrE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,gBAAgB,EAAE,MAAM,CAAC,OAAO;YAChC,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,IAAI,yCAAyC,CAAC;YAC7H,yBAAyB,EAAE,iBAAiB,CAAC,UAAU;YACvD,oBAAoB,EAAE,iBAAiB,CAAC,KAAK;SAC9C,CAAC,CAAC;QACH,IAAI,eAAe;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAE1C,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAClF,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;QACzI,MAAM,OAAO,GAAG,GAAG,CAAC,OAAmB,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1G,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;QAC7H,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC3C,SAAS,EAAE,GAAG,CAAC,eAAe;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,OAAO;YACP,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE;SACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAA8B,EAAE,OAA0B;QAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5H,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,MAA8B,EAAE,iBAAyB;QAC5F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1F,MAAM,YAAY,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAKzB;QACC,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAK3B;QACC,OAAO,qBAAqB,CAC1B,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB;YACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,EACD;YACE,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,gCAAgC;YAC7F,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,iCAAiC;YAChG,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;YACnD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,GAAgB;QAClD,IAAI,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACrJ,OAAO,yBAAyB,CAAC,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAChI,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC3F,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hono.d.ts

@@ -0,0 +1,22 @@
+import type { AuthSystem, McpAuthService, McpAuthorizationParams } from "./auth.js";
+import type { OAuthClientInformation } from "./oauth.js";
+export type HonoContextLike<TEnv = unknown> = {
+    req: {
+        raw: Request;
+        url: string;
+    };
+    env?: TEnv;
+    set?: (key: string, value: unknown) => void;
+    get?: (key: string) => unknown;
+    json: (value: unknown, status?: number) => Response;
+    redirect: (location: string, status?: number) => Response;
+    res?: Response;
+};
+export type HonoNext = () => Promise<void>;
+export declare function honoAuthMiddleware<TPrincipal, TSession>(auth: AuthSystem<TPrincipal, TSession>, options?: {
+    contextKey?: string;
+    requirePrincipal?: boolean;
+}): (context: HonoContextLike, next: HonoNext) => Promise<Response | void>;
+export declare function honoRequirePrincipal<TPrincipal, TSession>(context: HonoContextLike, auth: AuthSystem<TPrincipal, TSession>): Promise<TPrincipal>;
+export declare function honoMcpAuthorize<TPrincipal, TSubject extends Record<string, string>>(context: HonoContextLike, service: McpAuthService<TPrincipal, TSubject>, client: OAuthClientInformation, params: McpAuthorizationParams): Promise<Response>;
+//# sourceMappingURL=hono.d.ts.map

package/dist/hono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,eAAe,CAAC,IAAI,GAAG,OAAO,IAAI;IAC5C,GAAG,EAAE;QACH,GAAG,EAAE,OAAO,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IACpD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IAC1D,GAAG,CAAC,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3C,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EACrD,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EACtC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAChE,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAaxE;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAC7D,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxF,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAC7C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAInB"}

package/dist/hono.js

@@ -0,0 +1,26 @@
+import { errorResponse, HttpError } from "./http.js";
+export function honoAuthMiddleware(auth, options = {}) {
+    return async (context, next) => {
+        try {
+            const authContext = await auth.contextFromRequest(context.req.raw);
+            if (options.requirePrincipal && !authContext.principal) {
+                throw new HttpError(401, "Authentication required.", "authentication_required");
+            }
+            context.set?.(options.contextKey ?? "auth", authContext);
+            await next();
+        }
+        catch (error) {
+            return errorResponse(error);
+        }
+    };
+}
+export async function honoRequirePrincipal(context, auth) {
+    return auth.requirePrincipal(context.req.raw);
+}
+export async function honoMcpAuthorize(context, service, client, params) {
+    const result = await service.authorize(client, params, context.req.raw);
+    if (result.kind === "redirect")
+        return context.redirect(result.location, result.status ?? 302);
+    return context.redirect(result.redirect, 302);
+}
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.js","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAkBrD,MAAM,UAAU,kBAAkB,CAChC,IAAsC,EACtC,UAA+D,EAAE;IAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBACvD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,yBAAyB,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAwB,EACxB,IAAsC;IAEtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAwB,EACxB,OAA6C,EAC7C,MAA8B,EAC9B,MAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./api.js";
 export * from "./ai.js";
+export * from "./auth.js";
 export * from "./billing.js";
 export * from "./cloudflare.js";
 export * from "./crypto.js";
@@ -7,6 +8,7 @@ export * from "./d1.js";
 export * from "./encoding.js";
 export * from "./email.js";
 export * from "./env.js";
+export * from "./hono.js";
 export * from "./http.js";
 export * from "./ids.js";
 export * from "./jobs.js";
@@ -17,6 +19,7 @@ export * from "./pg.js";
 export * from "./pg-kysely.js";
 export * from "./r2-json.js";
 export * from "./rate-limit.js";
+export * from "./react-router.js";
 export * from "./seo.js";
 export * from "./session.js";
 export * from "./testing.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from "./api.js";
 export * from "./ai.js";
+export * from "./auth.js";
 export * from "./billing.js";
 export * from "./cloudflare.js";
 export * from "./crypto.js";
@@ -7,6 +8,7 @@ export * from "./d1.js";
 export * from "./encoding.js";
 export * from "./email.js";
 export * from "./env.js";
+export * from "./hono.js";
 export * from "./http.js";
 export * from "./ids.js";
 export * from "./jobs.js";
@@ -17,6 +19,7 @@ export * from "./pg.js";
 export * from "./pg-kysely.js";
 export * from "./r2-json.js";
 export * from "./rate-limit.js";
+export * from "./react-router.js";
 export * from "./seo.js";
 export * from "./session.js";
 export * from "./testing.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}