@q32/core 0.1.21 → 0.1.23

package/README.md

@@ -6,6 +6,7 @@ The first release focuses on common infrastructure repeated across Q32 apps:
 
 - AI provider contracts and JSON extraction helpers
 - API operation registries
+- framework-neutral auth/session/MCP auth services with thin Hono and React Router adapters
 - billing plan/status primitives
 - Cloudflare binding guards
 - environment parsing
@@ -50,9 +51,12 @@ import {
   D1JobStore,
   D1_JOBS_SCHEMA,
   appUrl,
+  createAuthSystem,
   createId,
+  honoAuthMiddleware,
   jsonResponse,
   oauthAuthorizationServerMetadata,
+  reactRouterAuthContext,
   renderSitemapXml,
   recordOpsEvent,
   signSession,
@@ -60,3 +64,7 @@ import {
 ```
 
 See [docs/evaluation.md](docs/evaluation.md) for the project-inventory replacement matrix and [docs/jobs.md](docs/jobs.md) for the shared jobs model.
+
+Framework adapters are deliberately thin. Put policy and persistence in `auth`,
+`jobs`, `ops-events`, and `api`; use `hono` or `react-router` only to translate a
+framework request/response shape into those shared services.

package/dist/auth.d.ts

@@ -0,0 +1,99 @@
+import { type McpOAuthRepository, type McpTokenRow, type OAuthClientInformation, type OAuthClientRegistration, type OAuthTokens } from "./oauth.js";
+export type CookieOptions = {
+    name: string;
+};
+export type SessionAuthOptions<TSession> = {
+    secret: string;
+    cookie: CookieOptions;
+    verifyToken?: (token: string | undefined, secret: string, request: Request) => Promise<TSession | null> | TSession | null;
+    verify?: (payload: TSession) => Promise<TSession | null> | TSession | null;
+};
+export type AuthContext<TPrincipal = unknown, TSession = unknown> = {
+    request: Request;
+    session: TSession | null;
+    principal: TPrincipal | null;
+};
+export type AuthSystemOptions<TPrincipal, TSession> = {
+    session?: SessionAuthOptions<TSession>;
+    loadPrincipal?: (session: TSession, request: Request) => Promise<TPrincipal | null> | TPrincipal | null;
+};
+export declare class AuthSystem<TPrincipal = unknown, TSession = unknown> {
+    private readonly options;
+    constructor(options: AuthSystemOptions<TPrincipal, TSession>);
+    sessionFromRequest(request: Request): Promise<TSession | null>;
+    contextFromRequest(request: Request): Promise<AuthContext<TPrincipal, TSession>>;
+    requirePrincipal(request: Request): Promise<TPrincipal>;
+}
+export declare function createAuthSystem<TPrincipal = unknown, TSession = unknown>(options: AuthSystemOptions<TPrincipal, TSession>): AuthSystem<TPrincipal, TSession>;
+export declare function getCookie(request: Request, name: string): string | undefined;
+export declare function requireAdminRequest(request: Request, expectedToken: string | undefined): void;
+export type McpAuthInfo<TSubject extends Record<string, string> = Record<string, string>> = {
+    token: string;
+    clientId: string;
+    scopes: string[];
+    expiresAt: number;
+    resource?: URL;
+    subject: TSubject;
+    extra?: Record<string, unknown>;
+};
+export type McpAuthorizationParams = {
+    redirectUri: string;
+    state?: string;
+    scopes?: string[];
+    resource?: URL;
+    codeChallenge: string;
+};
+export type McpAuthorizeResult = {
+    kind: "redirect";
+    location: string;
+    status?: number;
+} | {
+    kind: "authorized";
+    code: string;
+    redirect: string;
+};
+export type McpAuthServiceOptions<TPrincipal, TSubject extends Record<string, string>> = {
+    repository: McpOAuthRepository;
+    sessionAuth?: AuthSystem<TPrincipal, unknown>;
+    loginPath?: string;
+    defaultScopes?: string[];
+    authCodeTtlSeconds?: number;
+    accessTokenTtlSeconds?: number;
+    refreshTokenTtlSeconds?: number;
+    refreshTokenReuseGraceSeconds?: number;
+    tokenEncryptionSecret: string;
+    principalToSubject: (principal: TPrincipal) => TSubject | null | Promise<TSubject | null>;
+    subjectToPrincipal?: (subject: TSubject) => TPrincipal | null | Promise<TPrincipal | null>;
+    canAuthorize?: (principal: TPrincipal, client: OAuthClientInformation, params: McpAuthorizationParams) => boolean | Promise<boolean>;
+    canUseToken?: (principal: TPrincipal, row: McpTokenRow) => boolean | Promise<boolean>;
+    accessDeniedDescription?: string;
+    createAuthorizationCode?: () => string;
+    createAccessToken?: () => string;
+    createRefreshToken?: () => string;
+    now?: () => number;
+};
+export declare class McpAuthService<TPrincipal, TSubject extends Record<string, string> = Record<string, string>> {
+    private readonly options;
+    readonly skipLocalPkceValidation = false;
+    constructor(options: McpAuthServiceOptions<TPrincipal, TSubject>);
+    get clientsStore(): {
+        getClient: (clientId: string) => Promise<OAuthClientInformation | undefined>;
+        registerClient: (client: OAuthClientRegistration) => Promise<OAuthClientInformation>;
+    };
+    authorize(client: OAuthClientInformation, params: McpAuthorizationParams, request: Request): Promise<McpAuthorizeResult>;
+    challengeForAuthorizationCode(client: OAuthClientInformation, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformation, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformation, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<McpAuthInfo<TSubject>>;
+    revokeToken(client: OAuthClientInformation, request: {
+        token: string;
+    }): Promise<void>;
+    private validAuthorizationCode;
+    private issueTokens;
+    private issueTokenSet;
+    private cachedRefreshResponse;
+    private defaultScopes;
+    private loginRedirect;
+    private now;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,QAAQ,IAAI;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC1H,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,UAAU,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,IAAI;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,UAAU,EAAE,QAAQ,IAAI;IACpD,OAAO,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC;CACzG,CAAC;AAEF,qBAAa,UAAU,CAAC,UAAU,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC;IAEvE,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAW9D,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAMhF,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;CAK9D;AAED,wBAAgB,gBAAgB,CAAC,UAAU,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,EACvE,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,GAC/C,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAElC;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ5E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAE7F;AAED,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,qBAAqB,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI;IACvF,UAAU,EAAE,kBAAkB,CAAC;IAC/B,WAAW,CAAC,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,CAAC,SAAS,EAAE,UAAU,KAAK,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1F,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3F,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrI,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,MAAM,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAQF,qBAAa,cAAc,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAG1F,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,uBAAuB,SAAS;gBAEZ,OAAO,EAAE,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC;IAEjF,IAAI,YAAY,IAAI;QAClB,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;QAC7E,cAAc,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;KACtF,CAKA;IAEK,SAAS,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoCxH,6BAA6B,CAAC,MAAM,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKzG,yBAAyB,CAC7B,MAAM,EAAE,sBAAsB,EAC9B,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAcjB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAiCnI,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAqBhE,WAAW,CAAC,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAW9E,sBAAsB;YAQtB,WAAW;YASX,aAAa;YAwBb,qBAAqB;IAKnC,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,GAAG;CAGZ"}

package/dist/auth.js

@@ -0,0 +1,232 @@
+import { HttpError, requireAdminToken } from "./http.js";
+import { createOAuthRedirect, decryptOAuthTokenResponse, encryptOAuthTokenResponse, issueMcpOAuthTokenSet, parseOAuthJsonArray, } from "./oauth.js";
+import { verifySession } from "./session.js";
+export class AuthSystem {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async sessionFromRequest(request) {
+        const config = this.options.session;
+        if (!config)
+            return null;
+        const token = getCookie(request, config.cookie.name);
+        const payload = config.verifyToken
+            ? await config.verifyToken(token, config.secret, request)
+            : await verifySession(token, config.secret);
+        if (!payload)
+            return null;
+        return config.verify ? await config.verify(payload) : payload;
+    }
+    async contextFromRequest(request) {
+        const session = await this.sessionFromRequest(request);
+        const principal = session && this.options.loadPrincipal ? await this.options.loadPrincipal(session, request) : null;
+        return { request, session, principal };
+    }
+    async requirePrincipal(request) {
+        const context = await this.contextFromRequest(request);
+        if (!context.principal)
+            throw new HttpError(401, "Authentication required.", "authentication_required");
+        return context.principal;
+    }
+}
+export function createAuthSystem(options) {
+    return new AuthSystem(options);
+}
+export function getCookie(request, name) {
+    const cookie = request.headers.get("cookie");
+    if (!cookie)
+        return undefined;
+    for (const part of cookie.split(";")) {
+        const [rawName, ...rawValue] = part.trim().split("=");
+        if (rawName === name)
+            return decodeURIComponent(rawValue.join("="));
+    }
+    return undefined;
+}
+export function requireAdminRequest(request, expectedToken) {
+    requireAdminToken(request, expectedToken);
+}
+const DEFAULT_SCOPE = "mcp:read";
+const DEFAULT_AUTH_CODE_TTL_SECONDS = 10 * 60;
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+const DEFAULT_REFRESH_TOKEN_REUSE_GRACE_SECONDS = 10 * 60;
+export class McpAuthService {
+    options;
+    skipLocalPkceValidation = false;
+    constructor(options) {
+        this.options = options;
+    }
+    get clientsStore() {
+        return {
+            getClient: (clientId) => this.options.repository.getClient(clientId),
+            registerClient: (client) => this.options.repository.registerClient(client),
+        };
+    }
+    async authorize(client, params, request) {
+        const principal = this.options.sessionAuth ? await this.options.sessionAuth.requirePrincipal(request).catch(() => null) : null;
+        if (!principal) {
+            return { kind: "redirect", location: this.loginRedirect(request), status: 302 };
+        }
+        const allowed = this.options.canAuthorize ? await this.options.canAuthorize(principal, client, params) : true;
+        const subject = allowed ? await this.options.principalToSubject(principal) : null;
+        if (!allowed || !subject) {
+            const redirect = createOAuthRedirect(params.redirectUri, {
+                error: "access_denied",
+                error_description: this.options.accessDeniedDescription ?? "Access denied.",
+                state: params.state,
+            });
+            return { kind: "redirect", location: redirect, status: 302 };
+        }
+        const code = this.options.createAuthorizationCode?.() ?? `mcpcode_${crypto.randomUUID().replace(/-/g, "")}`;
+        await this.options.repository.createAuthorizationCode({
+            code,
+            clientId: client.client_id,
+            subject,
+            redirectUri: params.redirectUri,
+            scopes: params.scopes?.length ? params.scopes : this.defaultScopes(),
+            resource: params.resource?.href ?? null,
+            codeChallenge: params.codeChallenge,
+            expiresAt: this.now() + (this.options.authCodeTtlSeconds ?? DEFAULT_AUTH_CODE_TTL_SECONDS),
+        });
+        return {
+            kind: "authorized",
+            code,
+            redirect: createOAuthRedirect(params.redirectUri, { code, state: params.state }),
+        };
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const row = await this.validAuthorizationCode(client, authorizationCode);
+        return row.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
+        const row = await this.validAuthorizationCode(client, authorizationCode);
+        if (redirectUri && row.redirectUri !== redirectUri)
+            throw invalidGrant("Redirect URI mismatch");
+        if (resource?.href && row.resource && row.resource !== resource.href)
+            throw invalidGrant("Resource mismatch");
+        await this.options.repository.consumeAuthorizationCode(row.authorizationCodeId);
+        return this.issueTokens({
+            clientId: row.clientId,
+            subject: row.subject,
+            scopes: parseOAuthJsonArray(row.scopesJson),
+            resource: row.resource ? new URL(row.resource) : resource,
+        });
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const row = await this.options.repository.getTokenByRefreshToken(refreshToken);
+        if (!row || row.clientId !== client.client_id)
+            throw invalidGrant("Invalid refresh token");
+        const cachedResponse = await this.cachedRefreshResponse(row);
+        if (cachedResponse)
+            return cachedResponse;
+        if (row.revokedAt)
+            throw invalidGrant("Invalid refresh token");
+        if (row.refreshExpiresAt && row.refreshExpiresAt < this.now())
+            throw invalidGrant("Refresh token expired");
+        const grantedScopes = parseOAuthJsonArray(row.scopesJson);
+        const requestedScopes = scopes?.length ? scopes.filter((scope) => grantedScopes.includes(scope)) : grantedScopes;
+        const issued = await this.issueTokenSet({
+            clientId: row.clientId,
+            subject: row.subject,
+            scopes: requestedScopes,
+            resource: resource ?? (row.resource ? new URL(row.resource) : undefined),
+        });
+        const encryptedResponse = await encryptOAuthTokenResponse(issued.tokens, this.options.tokenEncryptionSecret);
+        const claimedRotation = await this.options.repository.markTokenRotated({
+            tokenId: row.tokenId,
+            rotatedToTokenId: issued.tokenId,
+            refreshReuseExpiresAt: this.now() + (this.options.refreshTokenReuseGraceSeconds ?? DEFAULT_REFRESH_TOKEN_REUSE_GRACE_SECONDS),
+            rotatedResponseCiphertext: encryptedResponse.ciphertext,
+            rotatedResponseNonce: encryptedResponse.nonce,
+        });
+        if (claimedRotation)
+            return issued.tokens;
+        await this.options.repository.revokeToken(issued.tokenId);
+        const winner = await this.options.repository.getTokenByRefreshToken(refreshToken);
+        const winnerResponse = winner ? await this.cachedRefreshResponse(winner) : null;
+        if (winnerResponse)
+            return winnerResponse;
+        throw invalidGrant("Invalid refresh token");
+    }
+    async verifyAccessToken(token) {
+        const row = await this.options.repository.getTokenByAccessToken(token);
+        if (!row || row.revokedAt || row.accessExpiresAt < this.now())
+            throw new HttpError(401, "Invalid access token.", "invalid_access_token");
+        const subject = row.subject;
+        const principal = this.options.subjectToPrincipal ? await this.options.subjectToPrincipal(subject) : null;
+        if (this.options.subjectToPrincipal && !principal)
+            throw new HttpError(401, "Invalid access token.", "invalid_access_token");
+        if (principal && this.options.canUseToken && !(await this.options.canUseToken(principal, row))) {
+            throw new HttpError(403, "Token is not allowed.", "token_not_allowed");
+        }
+        await this.options.repository.touchAccessToken(row.tokenId);
+        return {
+            token,
+            clientId: row.clientId,
+            scopes: parseOAuthJsonArray(row.scopesJson),
+            expiresAt: row.accessExpiresAt,
+            resource: row.resource ? new URL(row.resource) : undefined,
+            subject,
+            extra: { ...subject },
+        };
+    }
+    async revokeToken(client, request) {
+        const accessRow = await this.options.repository.getTokenByAccessToken(request.token);
+        if (accessRow && accessRow.clientId === client.client_id) {
+            await this.options.repository.revokeToken(accessRow.tokenId);
+            return;
+        }
+        const refreshRow = await this.options.repository.getTokenByRefreshToken(request.token);
+        if (refreshRow && refreshRow.clientId === client.client_id)
+            await this.options.repository.revokeToken(refreshRow.tokenId);
+    }
+    async validAuthorizationCode(client, authorizationCode) {
+        const row = await this.options.repository.getAuthorizationCode(authorizationCode);
+        if (!row || row.clientId !== client.client_id || row.usedAt || row.expiresAt < this.now()) {
+            throw invalidGrant("Invalid authorization code");
+        }
+        return row;
+    }
+    async issueTokens(input) {
+        return (await this.issueTokenSet(input)).tokens;
+    }
+    async issueTokenSet(input) {
+        return issueMcpOAuthTokenSet(this.options.repository, {
+            clientId: input.clientId,
+            subject: input.subject,
+            scopes: input.scopes,
+            resource: input.resource,
+        }, {
+            accessTokenTtlSeconds: this.options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS,
+            refreshTokenTtlSeconds: this.options.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS,
+            createAccessToken: this.options.createAccessToken,
+            createRefreshToken: this.options.createRefreshToken,
+            now: this.options.now,
+        });
+    }
+    async cachedRefreshResponse(row) {
+        if (!row.rotatedResponseCiphertext || !row.rotatedResponseNonce || !row.refreshReuseExpiresAt || row.refreshReuseExpiresAt < this.now())
+            return null;
+        return decryptOAuthTokenResponse(row.rotatedResponseCiphertext, row.rotatedResponseNonce, this.options.tokenEncryptionSecret);
+    }
+    defaultScopes() {
+        return this.options.defaultScopes?.length ? this.options.defaultScopes : [DEFAULT_SCOPE];
+    }
+    loginRedirect(request) {
+        const loginPath = this.options.loginPath ?? "/login";
+        const url = new URL(loginPath, request.url);
+        url.searchParams.set("next", request.url);
+        return `${url.pathname}${url.search}`;
+    }
+    now() {
+        return this.options.now?.() ?? Math.floor(Date.now() / 1000);
+    }
+}
+function invalidGrant(message) {
+    const error = new Error(message);
+    error.name = "InvalidGrantError";
+    return error;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EAMrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAwB7C,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,OAAgD;QAAhD,YAAO,GAAP,OAAO,CAAyC;IAAG,CAAC;IAEjF,KAAK,CAAC,kBAAkB,CAAC,OAAgB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW;YAChC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;YACzD,CAAC,CAAC,MAAM,aAAa,CAAW,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAgB;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,yBAAyB,CAAC,CAAC;QACxG,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgD;IAEhD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,aAAiC;IACrF,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AA6CD,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC;AACjD,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5D,MAAM,yCAAyC,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1D,MAAM,OAAO,cAAc;IAGI;IAFpB,uBAAuB,GAAG,KAAK,CAAC;IAEzC,YAA6B,OAAoD;QAApD,YAAO,GAAP,OAAO,CAA6C;IAAG,CAAC;IAErF,IAAI,YAAY;QAId,OAAO;YACL,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5E,cAAc,EAAE,CAAC,MAA+B,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC;SACpG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAA8B,EAAE,MAA8B,EAAE,OAAgB;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/H,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE;gBACvD,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB,IAAI,gBAAgB;gBAC3E,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;YACpD,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;SAC3F,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI;YACJ,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,MAA8B,EAAE,iBAAyB;QAC3F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAA8B,EAC9B,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACzE,IAAI,WAAW,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAChG,IAAI,QAAQ,EAAE,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI;YAAE,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAE9G,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAmB;YAChC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAA8B,EAAE,YAAoB,EAAE,MAAiB,EAAE,QAAc;QAChH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAC/E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC3F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAE3G,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACjH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAmB;YAChC,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SACzE,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC7G,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACrE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,gBAAgB,EAAE,MAAM,CAAC,OAAO;YAChC,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,IAAI,yCAAyC,CAAC;YAC7H,yBAAyB,EAAE,iBAAiB,CAAC,UAAU;YACvD,oBAAoB,EAAE,iBAAiB,CAAC,KAAK;SAC9C,CAAC,CAAC;QACH,IAAI,eAAe;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAE1C,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAClF,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,MAAM,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;QACzI,MAAM,OAAO,GAAG,GAAG,CAAC,OAAmB,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1G,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;QAC7H,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC3C,SAAS,EAAE,GAAG,CAAC,eAAe;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,OAAO;YACP,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE;SACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAA8B,EAAE,OAA0B;QAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5H,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,MAA8B,EAAE,iBAAyB;QAC5F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1F,MAAM,YAAY,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAKzB;QACC,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAK3B;QACC,OAAO,qBAAqB,CAC1B,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB;YACE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,EACD;YACE,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,gCAAgC;YAC7F,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,iCAAiC;YAChG,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;YACnD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,GAAgB;QAClD,IAAI,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACrJ,OAAO,yBAAyB,CAAC,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAChI,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC3F,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hono.d.ts

@@ -0,0 +1,22 @@
+import type { AuthSystem, McpAuthService, McpAuthorizationParams } from "./auth.js";
+import type { OAuthClientInformation } from "./oauth.js";
+export type HonoContextLike<TEnv = unknown> = {
+    req: {
+        raw: Request;
+        url: string;
+    };
+    env?: TEnv;
+    set?: (key: string, value: unknown) => void;
+    get?: (key: string) => unknown;
+    json: (value: unknown, status?: number) => Response;
+    redirect: (location: string, status?: number) => Response;
+    res?: Response;
+};
+export type HonoNext = () => Promise<void>;
+export declare function honoAuthMiddleware<TPrincipal, TSession>(auth: AuthSystem<TPrincipal, TSession>, options?: {
+    contextKey?: string;
+    requirePrincipal?: boolean;
+}): (context: HonoContextLike, next: HonoNext) => Promise<Response | void>;
+export declare function honoRequirePrincipal<TPrincipal, TSession>(context: HonoContextLike, auth: AuthSystem<TPrincipal, TSession>): Promise<TPrincipal>;
+export declare function honoMcpAuthorize<TPrincipal, TSubject extends Record<string, string>>(context: HonoContextLike, service: McpAuthService<TPrincipal, TSubject>, client: OAuthClientInformation, params: McpAuthorizationParams): Promise<Response>;
+//# sourceMappingURL=hono.d.ts.map

package/dist/hono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,eAAe,CAAC,IAAI,GAAG,OAAO,IAAI;IAC5C,GAAG,EAAE;QACH,GAAG,EAAE,OAAO,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IACpD,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IAC1D,GAAG,CAAC,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3C,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EACrD,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EACtC,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAChE,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAaxE;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAC7D,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxF,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAC7C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAInB"}

package/dist/hono.js

@@ -0,0 +1,26 @@
+import { errorResponse, HttpError } from "./http.js";
+export function honoAuthMiddleware(auth, options = {}) {
+    return async (context, next) => {
+        try {
+            const authContext = await auth.contextFromRequest(context.req.raw);
+            if (options.requirePrincipal && !authContext.principal) {
+                throw new HttpError(401, "Authentication required.", "authentication_required");
+            }
+            context.set?.(options.contextKey ?? "auth", authContext);
+            await next();
+        }
+        catch (error) {
+            return errorResponse(error);
+        }
+    };
+}
+export async function honoRequirePrincipal(context, auth) {
+    return auth.requirePrincipal(context.req.raw);
+}
+export async function honoMcpAuthorize(context, service, client, params) {
+    const result = await service.authorize(client, params, context.req.raw);
+    if (result.kind === "redirect")
+        return context.redirect(result.location, result.status ?? 302);
+    return context.redirect(result.redirect, 302);
+}
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.js","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAkBrD,MAAM,UAAU,kBAAkB,CAChC,IAAsC,EACtC,UAA+D,EAAE;IAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBACvD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,yBAAyB,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAwB,EACxB,IAAsC;IAEtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAwB,EACxB,OAA6C,EAC7C,MAA8B,EAC9B,MAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./api.js";
 export * from "./ai.js";
+export * from "./auth.js";
 export * from "./billing.js";
 export * from "./cloudflare.js";
 export * from "./crypto.js";
@@ -7,6 +8,7 @@ export * from "./d1.js";
 export * from "./encoding.js";
 export * from "./email.js";
 export * from "./env.js";
+export * from "./hono.js";
 export * from "./http.js";
 export * from "./ids.js";
 export * from "./jobs.js";
@@ -17,6 +19,7 @@ export * from "./pg.js";
 export * from "./pg-kysely.js";
 export * from "./r2-json.js";
 export * from "./rate-limit.js";
+export * from "./react-router.js";
 export * from "./seo.js";
 export * from "./session.js";
 export * from "./testing.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from "./api.js";
 export * from "./ai.js";
+export * from "./auth.js";
 export * from "./billing.js";
 export * from "./cloudflare.js";
 export * from "./crypto.js";
@@ -7,6 +8,7 @@ export * from "./d1.js";
 export * from "./encoding.js";
 export * from "./email.js";
 export * from "./env.js";
+export * from "./hono.js";
 export * from "./http.js";
 export * from "./ids.js";
 export * from "./jobs.js";
@@ -17,6 +19,7 @@ export * from "./pg.js";
 export * from "./pg-kysely.js";
 export * from "./r2-json.js";
 export * from "./rate-limit.js";
+export * from "./react-router.js";
 export * from "./seo.js";
 export * from "./session.js";
 export * from "./testing.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}

package/dist/react-router.d.ts

@@ -0,0 +1,14 @@
+import type { AuthSystem, McpAuthService, McpAuthorizationParams } from "./auth.js";
+import type { OAuthClientInformation } from "./oauth.js";
+export type ReactRouterRequestArgs = {
+    request: Request;
+    params?: Record<string, string | undefined>;
+    context?: unknown;
+};
+export declare function reactRouterAuthContext<TPrincipal, TSession>(auth: AuthSystem<TPrincipal, TSession>, args: ReactRouterRequestArgs): Promise<import("./auth.js").AuthContext<TPrincipal, TSession>>;
+export declare function reactRouterRequirePrincipal<TPrincipal, TSession>(auth: AuthSystem<TPrincipal, TSession>, args: ReactRouterRequestArgs): Promise<TPrincipal>;
+export declare function reactRouterJson(value: unknown, init?: ResponseInit): Response;
+export declare function reactRouterRedirect(location: string, status?: number): Response;
+export declare function reactRouterError(error: unknown): Response;
+export declare function reactRouterMcpAuthorize<TPrincipal, TSubject extends Record<string, string>>(args: ReactRouterRequestArgs, service: McpAuthService<TPrincipal, TSubject>, client: OAuthClientInformation, params: McpAuthorizationParams): Promise<Response>;
+//# sourceMappingURL=react-router.d.ts.map

package/dist/react-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-router.d.ts","sourceRoot":"","sources":["../src/react-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,QAAQ,EAC/D,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EACtC,IAAI,EAAE,sBAAsB,kEAG7B;AAED,wBAAsB,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EACpE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EACtC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,YAAiB,GAAG,QAAQ,CAEjF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK5E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAOzD;AAED,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/F,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAC7C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAGnB"}

package/dist/react-router.js

@@ -0,0 +1,30 @@
+import { HttpError, jsonResponse } from "./http.js";
+export async function reactRouterAuthContext(auth, args) {
+    return auth.contextFromRequest(args.request);
+}
+export async function reactRouterRequirePrincipal(auth, args) {
+    return auth.requirePrincipal(args.request);
+}
+export function reactRouterJson(value, init = {}) {
+    return jsonResponse(value, init);
+}
+export function reactRouterRedirect(location, status = 302) {
+    return new Response(null, {
+        status,
+        headers: { location },
+    });
+}
+export function reactRouterError(error) {
+    if (error instanceof Response)
+        return error;
+    if (error instanceof HttpError) {
+        return jsonResponse({ error: { code: error.code, message: error.message } }, { status: error.status });
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return jsonResponse({ error: { code: "internal_error", message } }, { status: 500 });
+}
+export async function reactRouterMcpAuthorize(args, service, client, params) {
+    const result = await service.authorize(client, params, args.request);
+    return reactRouterRedirect(result.kind === "redirect" ? result.location : result.redirect, result.kind === "redirect" ? (result.status ?? 302) : 302);
+}
+//# sourceMappingURL=react-router.js.map

package/dist/react-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-router.js","sourceRoot":"","sources":["../src/react-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AASpD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAsC,EACtC,IAA4B;IAE5B,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAsC,EACtC,IAA4B;IAE5B,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,OAAqB,EAAE;IACrE,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,MAAM,GAAG,GAAG;IAChE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,QAAQ,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA4B,EAC5B,OAA6C,EAC7C,MAA8B,EAC9B,MAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,mBAAmB,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACxJ,CAAC"}

package/docs/evaluation.md

@@ -12,6 +12,7 @@ This package was seeded from repeated infrastructure found across Erik/Q32 TypeS
 | JSON responses, bearer/admin token checks, request body parsing | `http` | Replace repeated Worker/Hono-adjacent HTTP utility functions. |
 | Prefixed IDs, random tokens, base64url, SHA-256 | `ids` | Replace local `createId`, token, digest-key, and hash helpers. |
 | Signed session tokens and cookies | `session` | Replace small HMAC session implementations where full auth frameworks are unnecessary. |
+| Auth/session/MCP authorization policy | `auth` | Keep principal lookup, session verification, admin checks, OAuth authorization-code exchange, token verification, and refresh rotation independent of Hono, React Router, or any single app. |
 | Credential or provider-secret encryption | `crypto` | Replace local AES-GCM JSON encryption helpers backed by WebCrypto. |
 | D1-like database typing and explicit migrations | `d1` | Replace duplicated `D1DatabaseLike` types and simple migration runners. |
 | Postgres migration and JSON helpers | `pg` | Replace small pg migration scripts while still using official `pg` or `postgres` clients in apps. |
@@ -23,8 +24,9 @@ This package was seeded from repeated infrastructure found across Erik/Q32 TypeS
 | Email provider boundary | `email` | Standardize provider-independent send input/result shapes and address helpers. |
 | Billing plan/status checks | `billing` | Replace local plan rank and active subscription status helpers around Stripe-backed apps. |
 | Worker test helpers | `testing` | Replace small fake Queue/R2 helpers and JSON response assertions in unit tests; complements workerd/Miniflare integration tests. |
-| OAuth/MCP metadata | `oauth`, `mcp` | Replace repeated discovery metadata and API-to-tool descriptors; full OAuth token stores remain app-specific for now. |
+| OAuth/MCP metadata and storage | `oauth`, `mcp` | Replace repeated discovery metadata, API-to-tool descriptors, and configurable D1 OAuth client/code/token repositories. |
 | API operation registries | `api` | Replace local operation registries used for OpenAPI, admin APIs, and MCP exposure. |
+| Framework request adapters | `hono`, `react-router` | Translate Hono middleware and React Router loader/action requests into the same framework-neutral auth/API services. |
 
 ## Current Fit
 
@@ -37,14 +39,13 @@ Strong first replacement candidates:
 - D1 jobs in `travelerideas`, `bizsnipe`, `logtura`, and smaller domain apps.
 - signed session, ID, token, and base64url helpers in `zura`, `relin`, `getflight`, and `adgiro`.
 - API operation metadata from `bce.email` and `relin`.
-- OAuth/MCP metadata from `getflight`, `captcha`, `ipogrid`, `relin`, and `bce.email`.
+- OAuth/MCP metadata and auth/token flow from `getflight`, `captcha`, `ipogrid`, `relin`, and `bce.email`.
 
 ## Not Yet Complete
 
 The package intentionally does not yet replace:
 
-- full app account systems
-- full OAuth authorization-code and refresh-token stores
+- complete app-specific login/account repositories
 - Stripe billing repositories
 - Postgres job runners and migration orchestration
 - email provider clients

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@q32/core",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Shared TypeScript primitives for Q32 Cloudflare Worker projects.",
   "license": "MIT",
   "type": "module",
@@ -28,6 +28,10 @@
       "types": "./dist/ai.d.ts",
       "default": "./dist/ai.js"
     },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
     "./billing": {
       "types": "./dist/billing.d.ts",
       "default": "./dist/billing.js"
@@ -60,6 +64,10 @@
       "types": "./dist/hash.d.ts",
       "default": "./dist/hash.js"
     },
+    "./hono": {
+      "types": "./dist/hono.d.ts",
+      "default": "./dist/hono.js"
+    },
     "./http": {
       "types": "./dist/http.d.ts",
       "default": "./dist/http.js"
@@ -100,6 +108,10 @@
       "types": "./dist/rate-limit.d.ts",
       "default": "./dist/rate-limit.js"
     },
+    "./react-router": {
+      "types": "./dist/react-router.d.ts",
+      "default": "./dist/react-router.js"
+    },
     "./seo": {
       "types": "./dist/seo.d.ts",
       "default": "./dist/seo.js"

package/src/auth.ts

@@ -0,0 +1,341 @@
+import { HttpError, requireAdminToken } from "./http.js";
+import {
+  createOAuthRedirect,
+  decryptOAuthTokenResponse,
+  encryptOAuthTokenResponse,
+  issueMcpOAuthTokenSet,
+  type McpOAuthRepository,
+  type McpTokenRow,
+  type OAuthClientInformation,
+  type OAuthClientRegistration,
+  type OAuthTokens,
+  parseOAuthJsonArray,
+} from "./oauth.js";
+import { verifySession } from "./session.js";
+
+export type CookieOptions = {
+  name: string;
+};
+
+export type SessionAuthOptions<TSession> = {
+  secret: string;
+  cookie: CookieOptions;
+  verifyToken?: (token: string | undefined, secret: string, request: Request) => Promise<TSession | null> | TSession | null;
+  verify?: (payload: TSession) => Promise<TSession | null> | TSession | null;
+};
+
+export type AuthContext<TPrincipal = unknown, TSession = unknown> = {
+  request: Request;
+  session: TSession | null;
+  principal: TPrincipal | null;
+};
+
+export type AuthSystemOptions<TPrincipal, TSession> = {
+  session?: SessionAuthOptions<TSession>;
+  loadPrincipal?: (session: TSession, request: Request) => Promise<TPrincipal | null> | TPrincipal | null;
+};
+
+export class AuthSystem<TPrincipal = unknown, TSession = unknown> {
+  constructor(private readonly options: AuthSystemOptions<TPrincipal, TSession>) {}
+
+  async sessionFromRequest(request: Request): Promise<TSession | null> {
+    const config = this.options.session;
+    if (!config) return null;
+    const token = getCookie(request, config.cookie.name);
+    const payload = config.verifyToken
+      ? await config.verifyToken(token, config.secret, request)
+      : await verifySession<TSession>(token, config.secret);
+    if (!payload) return null;
+    return config.verify ? await config.verify(payload) : payload;
+  }
+
+  async contextFromRequest(request: Request): Promise<AuthContext<TPrincipal, TSession>> {
+    const session = await this.sessionFromRequest(request);
+    const principal = session && this.options.loadPrincipal ? await this.options.loadPrincipal(session, request) : null;
+    return { request, session, principal };
+  }
+
+  async requirePrincipal(request: Request): Promise<TPrincipal> {
+    const context = await this.contextFromRequest(request);
+    if (!context.principal) throw new HttpError(401, "Authentication required.", "authentication_required");
+    return context.principal;
+  }
+}
+
+export function createAuthSystem<TPrincipal = unknown, TSession = unknown>(
+  options: AuthSystemOptions<TPrincipal, TSession>,
+): AuthSystem<TPrincipal, TSession> {
+  return new AuthSystem(options);
+}
+
+export function getCookie(request: Request, name: string): string | undefined {
+  const cookie = request.headers.get("cookie");
+  if (!cookie) return undefined;
+  for (const part of cookie.split(";")) {
+    const [rawName, ...rawValue] = part.trim().split("=");
+    if (rawName === name) return decodeURIComponent(rawValue.join("="));
+  }
+  return undefined;
+}
+
+export function requireAdminRequest(request: Request, expectedToken: string | undefined): void {
+  requireAdminToken(request, expectedToken);
+}
+
+export type McpAuthInfo<TSubject extends Record<string, string> = Record<string, string>> = {
+  token: string;
+  clientId: string;
+  scopes: string[];
+  expiresAt: number;
+  resource?: URL;
+  subject: TSubject;
+  extra?: Record<string, unknown>;
+};
+
+export type McpAuthorizationParams = {
+  redirectUri: string;
+  state?: string;
+  scopes?: string[];
+  resource?: URL;
+  codeChallenge: string;
+};
+
+export type McpAuthorizeResult =
+  | { kind: "redirect"; location: string; status?: number }
+  | { kind: "authorized"; code: string; redirect: string };
+
+export type McpAuthServiceOptions<TPrincipal, TSubject extends Record<string, string>> = {
+  repository: McpOAuthRepository;
+  sessionAuth?: AuthSystem<TPrincipal, unknown>;
+  loginPath?: string;
+  defaultScopes?: string[];
+  authCodeTtlSeconds?: number;
+  accessTokenTtlSeconds?: number;
+  refreshTokenTtlSeconds?: number;
+  refreshTokenReuseGraceSeconds?: number;
+  tokenEncryptionSecret: string;
+  principalToSubject: (principal: TPrincipal) => TSubject | null | Promise<TSubject | null>;
+  subjectToPrincipal?: (subject: TSubject) => TPrincipal | null | Promise<TPrincipal | null>;
+  canAuthorize?: (principal: TPrincipal, client: OAuthClientInformation, params: McpAuthorizationParams) => boolean | Promise<boolean>;
+  canUseToken?: (principal: TPrincipal, row: McpTokenRow) => boolean | Promise<boolean>;
+  accessDeniedDescription?: string;
+  createAuthorizationCode?: () => string;
+  createAccessToken?: () => string;
+  createRefreshToken?: () => string;
+  now?: () => number;
+};
+
+const DEFAULT_SCOPE = "mcp:read";
+const DEFAULT_AUTH_CODE_TTL_SECONDS = 10 * 60;
+const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+const DEFAULT_REFRESH_TOKEN_REUSE_GRACE_SECONDS = 10 * 60;
+
+export class McpAuthService<TPrincipal, TSubject extends Record<string, string> = Record<string, string>> {
+  readonly skipLocalPkceValidation = false;
+
+  constructor(private readonly options: McpAuthServiceOptions<TPrincipal, TSubject>) {}
+
+  get clientsStore(): {
+    getClient: (clientId: string) => Promise<OAuthClientInformation | undefined>;
+    registerClient: (client: OAuthClientRegistration) => Promise<OAuthClientInformation>;
+  } {
+    return {
+      getClient: (clientId: string) => this.options.repository.getClient(clientId),
+      registerClient: (client: OAuthClientRegistration) => this.options.repository.registerClient(client),
+    };
+  }
+
+  async authorize(client: OAuthClientInformation, params: McpAuthorizationParams, request: Request): Promise<McpAuthorizeResult> {
+    const principal = this.options.sessionAuth ? await this.options.sessionAuth.requirePrincipal(request).catch(() => null) : null;
+    if (!principal) {
+      return { kind: "redirect", location: this.loginRedirect(request), status: 302 };
+    }
+
+    const allowed = this.options.canAuthorize ? await this.options.canAuthorize(principal, client, params) : true;
+    const subject = allowed ? await this.options.principalToSubject(principal) : null;
+    if (!allowed || !subject) {
+      const redirect = createOAuthRedirect(params.redirectUri, {
+        error: "access_denied",
+        error_description: this.options.accessDeniedDescription ?? "Access denied.",
+        state: params.state,
+      });
+      return { kind: "redirect", location: redirect, status: 302 };
+    }
+
+    const code = this.options.createAuthorizationCode?.() ?? `mcpcode_${crypto.randomUUID().replace(/-/g, "")}`;
+    await this.options.repository.createAuthorizationCode({
+      code,
+      clientId: client.client_id,
+      subject,
+      redirectUri: params.redirectUri,
+      scopes: params.scopes?.length ? params.scopes : this.defaultScopes(),
+      resource: params.resource?.href ?? null,
+      codeChallenge: params.codeChallenge,
+      expiresAt: this.now() + (this.options.authCodeTtlSeconds ?? DEFAULT_AUTH_CODE_TTL_SECONDS),
+    });
+
+    return {
+      kind: "authorized",
+      code,
+      redirect: createOAuthRedirect(params.redirectUri, { code, state: params.state }),
+    };
+  }
+
+  async challengeForAuthorizationCode(client: OAuthClientInformation, authorizationCode: string): Promise<string> {
+    const row = await this.validAuthorizationCode(client, authorizationCode);
+    return row.codeChallenge;
+  }
+
+  async exchangeAuthorizationCode(
+    client: OAuthClientInformation,
+    authorizationCode: string,
+    _codeVerifier?: string,
+    redirectUri?: string,
+    resource?: URL,
+  ): Promise<OAuthTokens> {
+    const row = await this.validAuthorizationCode(client, authorizationCode);
+    if (redirectUri && row.redirectUri !== redirectUri) throw invalidGrant("Redirect URI mismatch");
+    if (resource?.href && row.resource && row.resource !== resource.href) throw invalidGrant("Resource mismatch");
+
+    await this.options.repository.consumeAuthorizationCode(row.authorizationCodeId);
+    return this.issueTokens({
+      clientId: row.clientId,
+      subject: row.subject as TSubject,
+      scopes: parseOAuthJsonArray(row.scopesJson),
+      resource: row.resource ? new URL(row.resource) : resource,
+    });
+  }
+
+  async exchangeRefreshToken(client: OAuthClientInformation, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens> {
+    const row = await this.options.repository.getTokenByRefreshToken(refreshToken);
+    if (!row || row.clientId !== client.client_id) throw invalidGrant("Invalid refresh token");
+    const cachedResponse = await this.cachedRefreshResponse(row);
+    if (cachedResponse) return cachedResponse;
+    if (row.revokedAt) throw invalidGrant("Invalid refresh token");
+    if (row.refreshExpiresAt && row.refreshExpiresAt < this.now()) throw invalidGrant("Refresh token expired");
+
+    const grantedScopes = parseOAuthJsonArray(row.scopesJson);
+    const requestedScopes = scopes?.length ? scopes.filter((scope) => grantedScopes.includes(scope)) : grantedScopes;
+    const issued = await this.issueTokenSet({
+      clientId: row.clientId,
+      subject: row.subject as TSubject,
+      scopes: requestedScopes,
+      resource: resource ?? (row.resource ? new URL(row.resource) : undefined),
+    });
+    const encryptedResponse = await encryptOAuthTokenResponse(issued.tokens, this.options.tokenEncryptionSecret);
+    const claimedRotation = await this.options.repository.markTokenRotated({
+      tokenId: row.tokenId,
+      rotatedToTokenId: issued.tokenId,
+      refreshReuseExpiresAt: this.now() + (this.options.refreshTokenReuseGraceSeconds ?? DEFAULT_REFRESH_TOKEN_REUSE_GRACE_SECONDS),
+      rotatedResponseCiphertext: encryptedResponse.ciphertext,
+      rotatedResponseNonce: encryptedResponse.nonce,
+    });
+    if (claimedRotation) return issued.tokens;
+
+    await this.options.repository.revokeToken(issued.tokenId);
+    const winner = await this.options.repository.getTokenByRefreshToken(refreshToken);
+    const winnerResponse = winner ? await this.cachedRefreshResponse(winner) : null;
+    if (winnerResponse) return winnerResponse;
+    throw invalidGrant("Invalid refresh token");
+  }
+
+  async verifyAccessToken(token: string): Promise<McpAuthInfo<TSubject>> {
+    const row = await this.options.repository.getTokenByAccessToken(token);
+    if (!row || row.revokedAt || row.accessExpiresAt < this.now()) throw new HttpError(401, "Invalid access token.", "invalid_access_token");
+    const subject = row.subject as TSubject;
+    const principal = this.options.subjectToPrincipal ? await this.options.subjectToPrincipal(subject) : null;
+    if (this.options.subjectToPrincipal && !principal) throw new HttpError(401, "Invalid access token.", "invalid_access_token");
+    if (principal && this.options.canUseToken && !(await this.options.canUseToken(principal, row))) {
+      throw new HttpError(403, "Token is not allowed.", "token_not_allowed");
+    }
+    await this.options.repository.touchAccessToken(row.tokenId);
+    return {
+      token,
+      clientId: row.clientId,
+      scopes: parseOAuthJsonArray(row.scopesJson),
+      expiresAt: row.accessExpiresAt,
+      resource: row.resource ? new URL(row.resource) : undefined,
+      subject,
+      extra: { ...subject },
+    };
+  }
+
+  async revokeToken(client: OAuthClientInformation, request: { token: string }): Promise<void> {
+    const accessRow = await this.options.repository.getTokenByAccessToken(request.token);
+    if (accessRow && accessRow.clientId === client.client_id) {
+      await this.options.repository.revokeToken(accessRow.tokenId);
+      return;
+    }
+
+    const refreshRow = await this.options.repository.getTokenByRefreshToken(request.token);
+    if (refreshRow && refreshRow.clientId === client.client_id) await this.options.repository.revokeToken(refreshRow.tokenId);
+  }
+
+  private async validAuthorizationCode(client: OAuthClientInformation, authorizationCode: string) {
+    const row = await this.options.repository.getAuthorizationCode(authorizationCode);
+    if (!row || row.clientId !== client.client_id || row.usedAt || row.expiresAt < this.now()) {
+      throw invalidGrant("Invalid authorization code");
+    }
+    return row;
+  }
+
+  private async issueTokens(input: {
+    clientId: string;
+    subject: TSubject;
+    scopes: string[];
+    resource?: URL;
+  }): Promise<OAuthTokens> {
+    return (await this.issueTokenSet(input)).tokens;
+  }
+
+  private async issueTokenSet(input: {
+    clientId: string;
+    subject: TSubject;
+    scopes: string[];
+    resource?: URL;
+  }) {
+    return issueMcpOAuthTokenSet(
+      this.options.repository,
+      {
+        clientId: input.clientId,
+        subject: input.subject,
+        scopes: input.scopes,
+        resource: input.resource,
+      },
+      {
+        accessTokenTtlSeconds: this.options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS,
+        refreshTokenTtlSeconds: this.options.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS,
+        createAccessToken: this.options.createAccessToken,
+        createRefreshToken: this.options.createRefreshToken,
+        now: this.options.now,
+      },
+    );
+  }
+
+  private async cachedRefreshResponse(row: McpTokenRow): Promise<OAuthTokens | null> {
+    if (!row.rotatedResponseCiphertext || !row.rotatedResponseNonce || !row.refreshReuseExpiresAt || row.refreshReuseExpiresAt < this.now()) return null;
+    return decryptOAuthTokenResponse(row.rotatedResponseCiphertext, row.rotatedResponseNonce, this.options.tokenEncryptionSecret);
+  }
+
+  private defaultScopes(): string[] {
+    return this.options.defaultScopes?.length ? this.options.defaultScopes : [DEFAULT_SCOPE];
+  }
+
+  private loginRedirect(request: Request): string {
+    const loginPath = this.options.loginPath ?? "/login";
+    const url = new URL(loginPath, request.url);
+    url.searchParams.set("next", request.url);
+    return `${url.pathname}${url.search}`;
+  }
+
+  private now(): number {
+    return this.options.now?.() ?? Math.floor(Date.now() / 1000);
+  }
+}
+
+function invalidGrant(message: string): Error {
+  const error = new Error(message);
+  error.name = "InvalidGrantError";
+  return error;
+}

package/src/hono.ts

@@ -0,0 +1,54 @@
+import type { AuthSystem, McpAuthService, McpAuthorizationParams } from "./auth.js";
+import { errorResponse, HttpError } from "./http.js";
+import type { OAuthClientInformation } from "./oauth.js";
+
+export type HonoContextLike<TEnv = unknown> = {
+  req: {
+    raw: Request;
+    url: string;
+  };
+  env?: TEnv;
+  set?: (key: string, value: unknown) => void;
+  get?: (key: string) => unknown;
+  json: (value: unknown, status?: number) => Response;
+  redirect: (location: string, status?: number) => Response;
+  res?: Response;
+};
+
+export type HonoNext = () => Promise<void>;
+
+export function honoAuthMiddleware<TPrincipal, TSession>(
+  auth: AuthSystem<TPrincipal, TSession>,
+  options: { contextKey?: string; requirePrincipal?: boolean } = {},
+): (context: HonoContextLike, next: HonoNext) => Promise<Response | void> {
+  return async (context, next) => {
+    try {
+      const authContext = await auth.contextFromRequest(context.req.raw);
+      if (options.requirePrincipal && !authContext.principal) {
+        throw new HttpError(401, "Authentication required.", "authentication_required");
+      }
+      context.set?.(options.contextKey ?? "auth", authContext);
+      await next();
+    } catch (error) {
+      return errorResponse(error);
+    }
+  };
+}
+
+export async function honoRequirePrincipal<TPrincipal, TSession>(
+  context: HonoContextLike,
+  auth: AuthSystem<TPrincipal, TSession>,
+): Promise<TPrincipal> {
+  return auth.requirePrincipal(context.req.raw);
+}
+
+export async function honoMcpAuthorize<TPrincipal, TSubject extends Record<string, string>>(
+  context: HonoContextLike,
+  service: McpAuthService<TPrincipal, TSubject>,
+  client: OAuthClientInformation,
+  params: McpAuthorizationParams,
+): Promise<Response> {
+  const result = await service.authorize(client, params, context.req.raw);
+  if (result.kind === "redirect") return context.redirect(result.location, result.status ?? 302);
+  return context.redirect(result.redirect, 302);
+}

package/src/index.ts

@@ -1,5 +1,6 @@
 export * from "./api.js";
 export * from "./ai.js";
+export * from "./auth.js";
 export * from "./billing.js";
 export * from "./cloudflare.js";
 export * from "./crypto.js";
@@ -7,6 +8,7 @@ export * from "./d1.js";
 export * from "./encoding.js";
 export * from "./email.js";
 export * from "./env.js";
+export * from "./hono.js";
 export * from "./http.js";
 export * from "./ids.js";
 export * from "./jobs.js";
@@ -17,6 +19,7 @@ export * from "./pg.js";
 export * from "./pg-kysely.js";
 export * from "./r2-json.js";
 export * from "./rate-limit.js";
+export * from "./react-router.js";
 export * from "./seo.js";
 export * from "./session.js";
 export * from "./testing.js";

package/src/react-router.ts

@@ -0,0 +1,53 @@
+import type { AuthSystem, McpAuthService, McpAuthorizationParams } from "./auth.js";
+import { HttpError, jsonResponse } from "./http.js";
+import type { OAuthClientInformation } from "./oauth.js";
+
+export type ReactRouterRequestArgs = {
+  request: Request;
+  params?: Record<string, string | undefined>;
+  context?: unknown;
+};
+
+export async function reactRouterAuthContext<TPrincipal, TSession>(
+  auth: AuthSystem<TPrincipal, TSession>,
+  args: ReactRouterRequestArgs,
+) {
+  return auth.contextFromRequest(args.request);
+}
+
+export async function reactRouterRequirePrincipal<TPrincipal, TSession>(
+  auth: AuthSystem<TPrincipal, TSession>,
+  args: ReactRouterRequestArgs,
+): Promise<TPrincipal> {
+  return auth.requirePrincipal(args.request);
+}
+
+export function reactRouterJson(value: unknown, init: ResponseInit = {}): Response {
+  return jsonResponse(value, init);
+}
+
+export function reactRouterRedirect(location: string, status = 302): Response {
+  return new Response(null, {
+    status,
+    headers: { location },
+  });
+}
+
+export function reactRouterError(error: unknown): Response {
+  if (error instanceof Response) return error;
+  if (error instanceof HttpError) {
+    return jsonResponse({ error: { code: error.code, message: error.message } }, { status: error.status });
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return jsonResponse({ error: { code: "internal_error", message } }, { status: 500 });
+}
+
+export async function reactRouterMcpAuthorize<TPrincipal, TSubject extends Record<string, string>>(
+  args: ReactRouterRequestArgs,
+  service: McpAuthService<TPrincipal, TSubject>,
+  client: OAuthClientInformation,
+  params: McpAuthorizationParams,
+): Promise<Response> {
+  const result = await service.authorize(client, params, args.request);
+  return reactRouterRedirect(result.kind === "redirect" ? result.location : result.redirect, result.kind === "redirect" ? (result.status ?? 302) : 302);
+}