@udibo/oauth2 0.1.0

package/esm/adapters/hono/authorization-server.d.ts

@@ -0,0 +1,211 @@
+/**
+ * Hono adapter for the core {@link AuthorizationServer}.
+ *
+ * Provides Hono handler factories for each OAuth2 endpoint and a convenience
+ * `routes()` aggregator that mounts all standard endpoints at conventional
+ * paths. Also inherits resource-server-shaped helpers (`protect`,
+ * `authenticate`, `getContext`) so the same instance can protect API routes.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from "hono";
+ * import { HonoAuthorizationServer } from "@udibo/oauth2/hono/authorization-server";
+ *
+ * const issuer = "https://auth.example.com";
+ * const authServer = new HonoAuthorizationServer({
+ *   grants: { ...grants },
+ *   resolve: () => ({
+ *     services: { clientService, tokenService, authorizationCodeService },
+ *     issuer,
+ *     authorizationEndpoint: `${issuer}/oauth2/authorize`,
+ *     tokenEndpoint: `${issuer}/oauth2/token`,
+ *     revocationEndpoint: `${issuer}/oauth2/revoke`,
+ *     introspectionEndpoint: `${issuer}/oauth2/introspect`,
+ *   }),
+ * });
+ *
+ * const app = new Hono();
+ * app.route("/oauth2", authServer.routes({ authenticateUser }));
+ * app.use("/api/*", authServer.protect());
+ * app.get("/api/me", (c) => c.json(authServer.getContext(c).user));
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+import { Hono } from "hono";
+import type { Context, Handler, MiddlewareHandler } from "hono";
+import type { RequireConditions } from "../../models/authorization.js";
+import type { AuthenticationContext } from "../../models/authentication.js";
+import type { ClientInterface } from "../../models/client.js";
+import type { AbstractScope, BasicScope } from "../../models/scope.js";
+import { AuthorizationServer, type AuthorizationServerOptions } from "../../server/authorization-server.js";
+import type { AuthenticatedContext } from "../../server/resource-server.js";
+/**
+ * Authenticates the resource owner during an authorization request.
+ *
+ * Receives the Hono {@link Context} directly so the callback can read cookies
+ * or session variables without reconstructing a {@link Request}. Return one
+ * of:
+ *
+ * - `{ user, authorizedScope?, authenticationContext? }` — user is authenticated;
+ *   the authorize flow continues. Supply only verified event claims in
+ *   `authenticationContext`; the code and its tokens retain that snapshot.
+ * - `null` — explicit denial; the framework redirects to `redirect_uri` with
+ *   `error=access_denied`.
+ * - A `Response` (typically `c.redirect(...)` to a login page) —
+ *   short-circuits the authorize flow and is returned to the browser as-is.
+ *   This is how login redirects, interstitials, etc. are wired without
+ *   wrapping the framework handler.
+ */
+export type HonoAuthenticateUserFn<User> = (c: Context) => Promise<{
+    user: User;
+    authorizedScope?: AbstractScope;
+    authenticationContext?: AuthenticationContext;
+} | Response | null>;
+/**
+ * Collects consent from the resource owner for the requested scope.
+ *
+ * Receives the Hono {@link Context} so the callback can render a consent
+ * page, read form input, etc. Return one of:
+ *
+ * - `{ approved: true, scope? }` — consent granted (optionally narrowing the
+ *   scope per RFC 6749 §3.3).
+ * - `{ approved: false }` — consent denied; the framework redirects to
+ *   `redirect_uri` with `error=access_denied`.
+ * - A `Response` (typically `c.html(...)` rendering a consent page) —
+ *   short-circuits the authorize flow and is returned to the browser as-is.
+ *   The consent UI should resubmit to the authorize endpoint with a
+ *   decision parameter the callback can read on the next request.
+ */
+export type HonoHandleConsentFn<Client extends ClientInterface, S extends AbstractScope> = (c: Context, client: Client, requestedScope: S | undefined, user: unknown) => Promise<{
+    approved: boolean;
+    scope?: S;
+} | Response>;
+/** Options for {@link HonoAuthorizationServer.routes}. */
+export interface HonoRoutesOptions<Client extends ClientInterface, User, S extends AbstractScope> {
+    /** Authenticates the resource owner at the authorize endpoint. */
+    authenticateUser: HonoAuthenticateUserFn<User>;
+    /** Collects consent for the requested scope. Omit to auto-consent. */
+    handleConsent?: HonoHandleConsentFn<Client, S>;
+}
+/** Options for {@link HonoAuthorizationServer.authorizeHandler}. */
+export type HonoAuthorizeHandlerOptions<Client extends ClientInterface, User, S extends AbstractScope> = HonoRoutesOptions<Client, User, S>;
+/**
+ * Hono-specific wrapper around {@link AuthorizationServer}. Adds endpoint
+ * handler factories and the three resource-server-shaped helpers
+ * (`protect`, `authenticate`, `getContext`) against this same instance.
+ *
+ * Resource-server behavior (realm, errorFormat, throwOnError, token lookup)
+ * reads directly off the auth-server instance, so mutating those fields
+ * after construction propagates without the need to rewire any companion
+ * objects.
+ */
+export declare class HonoAuthorizationServer<Client extends ClientInterface, User, S extends AbstractScope = BasicScope> extends AuthorizationServer<Client, User, S> {
+    /** Forwards `options` to the core {@linkcode AuthorizationServer}. */
+    constructor(options: AuthorizationServerOptions<Client, User, S>);
+    /**
+     * Returns a Hono middleware that validates the bearer token against this
+     * server's token service. On success, sets the authenticated context at
+     * `c.get("@udibo/oauth2")`; on failure returns an RFC 6749 error response
+     * with a `WWW-Authenticate` header per RFC 6750 Section 3.
+     */
+    protect(requiredScope?: S | string): MiddlewareHandler;
+    /**
+     * Returns a Hono middleware that asserts an **already-authenticated** request
+     * carries `requiredScope` without re-validating the token — the per-route
+     * companion to {@link protect} for mounts that need different scopes per
+     * route. See {@link HonoResourceServer.requireScope}.
+     */
+    requireScope(requiredScope: S | string): MiddlewareHandler;
+    /**
+     * Middleware asserting the already-authenticated request satisfies every
+     * condition (scope, permission, role, organization) on this server's own
+     * protected routes. See {@link HonoResourceServer.require}.
+     */
+    require(conditions: RequireConditions): MiddlewareHandler;
+    /**
+     * Authenticates a Hono {@link Context} or a raw {@link Request} manually.
+     * Throws on failure — pair with
+     * {@link AuthorizationServer.handleAuthError} to convert to a response.
+     */
+    authenticate(c: Context | Request, requiredScope?: S | string): Promise<AuthenticatedContext<Client, User, S>>;
+    /** Typed accessor for the authenticated OAuth2 context. */
+    getContext(c: Context): AuthenticatedContext<Client, User, S>;
+    /**
+     * Handler for the token endpoint (RFC 6749 Section 3.2).
+     * Mount at `POST /token`.
+     */
+    tokenHandler(): Handler;
+    /**
+     * Handler for the authorization endpoint (RFC 6749 Section 3.1).
+     * Mount at `GET /authorize`. Callbacks receive the Hono {@link Context}.
+     */
+    authorizeHandler(options: HonoAuthorizeHandlerOptions<Client, User, S>): Handler;
+    /**
+     * Handler for the token revocation endpoint (RFC 7009).
+     * Mount at `POST /revoke`.
+     */
+    revocationHandler(): Handler;
+    /**
+     * Handler for the token introspection endpoint (RFC 7662).
+     * Mount at `POST /introspect`.
+     */
+    introspectionHandler(): Handler;
+    /**
+     * Handler for the authorization server metadata endpoint (RFC 8414).
+     * Mount at `GET /.well-known/oauth-authorization-server`.
+     */
+    metadataHandler(): Handler;
+    /**
+     * Handler for the OIDC discovery endpoint.
+     * Mount at `GET /.well-known/openid-configuration`. 404s when OIDC issuance
+     * is not configured.
+     */
+    oidcMetadataHandler(): Handler;
+    /**
+     * Handler for the JWKS endpoint (OIDC Discovery).
+     * Mount at `GET /jwks`. 404s when OIDC issuance is not configured.
+     */
+    jwksHandler(): Handler;
+    /**
+     * Handler for the OIDC UserInfo endpoint.
+     * Mount at `GET`/`POST /userinfo`.
+     */
+    userInfoHandler(): Handler;
+    /**
+     * Handler for the OIDC RP-Initiated Logout end-session endpoint.
+     * Mount at `GET|POST /end_session`. Answers 404 unless the server was
+     * constructed with an `endSession` callback.
+     */
+    endSessionHandler(): Handler;
+    /**
+     * Handler for the device authorization endpoint (RFC 8628).
+     * Mount at `POST /device_authorization`.
+     */
+    deviceAuthorizationHandler(): Handler;
+    /**
+     * Returns a Hono app with all standard OAuth2 endpoints mounted at
+     * conventional paths, relative to whatever base path the caller mounts it
+     * under.
+     *
+     * - `POST /token`
+     * - `GET /authorize`
+     * - `POST /revoke`
+     * - `POST /introspect`
+     * - `POST /device_authorization`
+     * - `GET /.well-known/oauth-authorization-server`
+     * - `GET /.well-known/openid-configuration`
+     * - `GET /jwks` and `GET`/`POST /userinfo` (live when OIDC issuance is
+     *   configured via `signingKeys`)
+     *
+     * Mount with `app.route("/oauth2", server.routes({...}))`.
+     *
+     * Every path and verb above comes from
+     * {@link ENDPOINT_PATHS}/{@link ENDPOINT_METHODS}, so the mounted surface and
+     * the URLs the server advertises can never drift apart. Users who want custom
+     * paths or only a subset of endpoints should mount the individual handler
+     * factories instead.
+     */
+    routes(options: HonoRoutesOptions<Client, User, S>): Hono;
+}

package/esm/adapters/hono/authorization-server.js

@@ -0,0 +1,214 @@
+/**
+ * Hono adapter for the core {@link AuthorizationServer}.
+ *
+ * Provides Hono handler factories for each OAuth2 endpoint and a convenience
+ * `routes()` aggregator that mounts all standard endpoints at conventional
+ * paths. Also inherits resource-server-shaped helpers (`protect`,
+ * `authenticate`, `getContext`) so the same instance can protect API routes.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from "hono";
+ * import { HonoAuthorizationServer } from "@udibo/oauth2/hono/authorization-server";
+ *
+ * const issuer = "https://auth.example.com";
+ * const authServer = new HonoAuthorizationServer({
+ *   grants: { ...grants },
+ *   resolve: () => ({
+ *     services: { clientService, tokenService, authorizationCodeService },
+ *     issuer,
+ *     authorizationEndpoint: `${issuer}/oauth2/authorize`,
+ *     tokenEndpoint: `${issuer}/oauth2/token`,
+ *     revocationEndpoint: `${issuer}/oauth2/revoke`,
+ *     introspectionEndpoint: `${issuer}/oauth2/introspect`,
+ *   }),
+ * });
+ *
+ * const app = new Hono();
+ * app.route("/oauth2", authServer.routes({ authenticateUser }));
+ * app.use("/api/*", authServer.protect());
+ * app.get("/api/me", (c) => c.json(authServer.getContext(c).user));
+ * ```
+ *
+ * @module
+ */
+import "../../_dnt.polyfills.js";
+import { Hono } from "hono";
+import { AuthorizationServer, ENDPOINT_METHODS, ENDPOINT_PATHS, } from "../../server/authorization-server.js";
+import { authenticateHonoRequest, createProtectMiddleware, createRequireMiddleware, createRequireScopeMiddleware, readContext, } from "./_common.js";
+/**
+ * Hono-specific wrapper around {@link AuthorizationServer}. Adds endpoint
+ * handler factories and the three resource-server-shaped helpers
+ * (`protect`, `authenticate`, `getContext`) against this same instance.
+ *
+ * Resource-server behavior (realm, errorFormat, throwOnError, token lookup)
+ * reads directly off the auth-server instance, so mutating those fields
+ * after construction propagates without the need to rewire any companion
+ * objects.
+ */
+export class HonoAuthorizationServer extends AuthorizationServer {
+    /** Forwards `options` to the core {@linkcode AuthorizationServer}. */
+    constructor(options) {
+        super(options);
+    }
+    /**
+     * Returns a Hono middleware that validates the bearer token against this
+     * server's token service. On success, sets the authenticated context at
+     * `c.get("@udibo/oauth2")`; on failure returns an RFC 6749 error response
+     * with a `WWW-Authenticate` header per RFC 6750 Section 3.
+     */
+    protect(requiredScope) {
+        return createProtectMiddleware(this, requiredScope);
+    }
+    /**
+     * Returns a Hono middleware that asserts an **already-authenticated** request
+     * carries `requiredScope` without re-validating the token — the per-route
+     * companion to {@link protect} for mounts that need different scopes per
+     * route. See {@link HonoResourceServer.requireScope}.
+     */
+    requireScope(requiredScope) {
+        return createRequireScopeMiddleware(this, "HonoAuthorizationServer", requiredScope);
+    }
+    /**
+     * Middleware asserting the already-authenticated request satisfies every
+     * condition (scope, permission, role, organization) on this server's own
+     * protected routes. See {@link HonoResourceServer.require}.
+     */
+    require(conditions) {
+        return createRequireMiddleware(this, "HonoAuthorizationServer", conditions);
+    }
+    /**
+     * Authenticates a Hono {@link Context} or a raw {@link Request} manually.
+     * Throws on failure — pair with
+     * {@link AuthorizationServer.handleAuthError} to convert to a response.
+     */
+    authenticate(c, requiredScope) {
+        return authenticateHonoRequest(this, c, requiredScope);
+    }
+    /** Typed accessor for the authenticated OAuth2 context. */
+    getContext(c) {
+        return readContext(c, "HonoAuthorizationServer");
+    }
+    /**
+     * Handler for the token endpoint (RFC 6749 Section 3.2).
+     * Mount at `POST /token`.
+     */
+    tokenHandler() {
+        return (c) => this.handleTokenRequest(c.req.raw);
+    }
+    /**
+     * Handler for the authorization endpoint (RFC 6749 Section 3.1).
+     * Mount at `GET /authorize`. Callbacks receive the Hono {@link Context}.
+     */
+    authorizeHandler(options) {
+        const { authenticateUser, handleConsent } = options;
+        return (c) => {
+            const auth = () => authenticateUser(c);
+            const consent = handleConsent
+                ? (client, requestedScope, user) => handleConsent(c, client, requestedScope, user)
+                : undefined;
+            return this.handleAuthorizeRequest(c.req.raw, auth, consent);
+        };
+    }
+    /**
+     * Handler for the token revocation endpoint (RFC 7009).
+     * Mount at `POST /revoke`.
+     */
+    revocationHandler() {
+        return (c) => this.handleRevocationRequest(c.req.raw);
+    }
+    /**
+     * Handler for the token introspection endpoint (RFC 7662).
+     * Mount at `POST /introspect`.
+     */
+    introspectionHandler() {
+        return (c) => this.handleIntrospectionRequest(c.req.raw);
+    }
+    /**
+     * Handler for the authorization server metadata endpoint (RFC 8414).
+     * Mount at `GET /.well-known/oauth-authorization-server`.
+     */
+    metadataHandler() {
+        return (c) => this.handleMetadataRequest(c.req.raw);
+    }
+    /**
+     * Handler for the OIDC discovery endpoint.
+     * Mount at `GET /.well-known/openid-configuration`. 404s when OIDC issuance
+     * is not configured.
+     */
+    oidcMetadataHandler() {
+        return (c) => this.handleOidcMetadataRequest(c.req.raw);
+    }
+    /**
+     * Handler for the JWKS endpoint (OIDC Discovery).
+     * Mount at `GET /jwks`. 404s when OIDC issuance is not configured.
+     */
+    jwksHandler() {
+        return (c) => this.handleJwksRequest(c.req.raw);
+    }
+    /**
+     * Handler for the OIDC UserInfo endpoint.
+     * Mount at `GET`/`POST /userinfo`.
+     */
+    userInfoHandler() {
+        return (c) => this.handleUserInfoRequest(c.req.raw);
+    }
+    /**
+     * Handler for the OIDC RP-Initiated Logout end-session endpoint.
+     * Mount at `GET|POST /end_session`. Answers 404 unless the server was
+     * constructed with an `endSession` callback.
+     */
+    endSessionHandler() {
+        return (c) => this.handleEndSessionRequest(c.req.raw);
+    }
+    /**
+     * Handler for the device authorization endpoint (RFC 8628).
+     * Mount at `POST /device_authorization`.
+     */
+    deviceAuthorizationHandler() {
+        return (c) => this.handleDeviceAuthorizationRequest(c.req.raw);
+    }
+    /**
+     * Returns a Hono app with all standard OAuth2 endpoints mounted at
+     * conventional paths, relative to whatever base path the caller mounts it
+     * under.
+     *
+     * - `POST /token`
+     * - `GET /authorize`
+     * - `POST /revoke`
+     * - `POST /introspect`
+     * - `POST /device_authorization`
+     * - `GET /.well-known/oauth-authorization-server`
+     * - `GET /.well-known/openid-configuration`
+     * - `GET /jwks` and `GET`/`POST /userinfo` (live when OIDC issuance is
+     *   configured via `signingKeys`)
+     *
+     * Mount with `app.route("/oauth2", server.routes({...}))`.
+     *
+     * Every path and verb above comes from
+     * {@link ENDPOINT_PATHS}/{@link ENDPOINT_METHODS}, so the mounted surface and
+     * the URLs the server advertises can never drift apart. Users who want custom
+     * paths or only a subset of endpoints should mount the individual handler
+     * factories instead.
+     */
+    routes(options) {
+        const handlers = {
+            authorization: this.authorizeHandler(options),
+            token: this.tokenHandler(),
+            revocation: this.revocationHandler(),
+            introspection: this.introspectionHandler(),
+            deviceAuthorization: this.deviceAuthorizationHandler(),
+            jwks: this.jwksHandler(),
+            userinfo: this.userInfoHandler(),
+            endSession: this.endSessionHandler(),
+            metadata: this.metadataHandler(),
+            oidcMetadata: this.oidcMetadataHandler(),
+        };
+        const app = new Hono();
+        for (const [key, handler] of Object.entries(handlers)) {
+            const endpoint = key;
+            app.on([...ENDPOINT_METHODS[endpoint]], ENDPOINT_PATHS[endpoint], handler);
+        }
+        return app;
+    }
+}

package/esm/adapters/hono/bff/auth-request-store.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Stateless {@link AuthRequestStorage} for {@link HonoBff}.
+ *
+ * The pending authorization request — the `state`, its PKCE code verifier, and
+ * where to return afterwards — has to survive the round trip to the identity
+ * provider. The client's default {@link MemoryAuthRequestStorage} keeps it in
+ * the process that started the flow, which breaks on any platform that spreads
+ * requests across isolates or instances: `/auth/login` stores the record on one
+ * and `/auth/callback` looks for it on another, so sign-in fails intermittently
+ * with `unknown state parameter`.
+ *
+ * {@link EncryptedCookieAuthRequestStorage} carries the record in an encrypted
+ * cookie instead (AES-GCM under a server-held secret, the same construction
+ * {@link EncryptedCookieSessionStore} uses), so no server-side storage is
+ * involved and any instance can complete the flow. Apps that already have a
+ * database can implement {@link AuthRequestStorage} against it instead.
+ *
+ * **Which storage you pick is a reliability decision, not a security one.**
+ * Server-side storage on its own says a `state` is pending somewhere — never
+ * that *this* browser is the one that started it, so a process-wide store like
+ * the memory default would otherwise let anyone's browser complete anyone
+ * else's pending sign-in (login CSRF). {@link HonoBff} closes that separately
+ * and unconditionally: `/auth/login` also binds the `state` to the browser in
+ * a short-lived cookie that `/auth/callback` requires, whichever storage is
+ * configured. Choose here on whether every instance can read the record back.
+ *
+ * @module
+ */
+import type { Context } from "hono";
+import type { AuthRequestStorage } from "../../../client/mod.js";
+/**
+ * Cookie attributes for the pending-authorization cookie.
+ *
+ * The **default** name is prefix-aware: it carries `__Host-` only when every
+ * attribute that prefix requires holds, and falls back to the bare name
+ * otherwise. An **explicit** {@link name} whose prefix contradicts the other
+ * attributes throws from the {@link EncryptedCookieAuthRequestStorage}
+ * constructor instead of emitting a cookie every browser silently drops.
+ */
+export interface AuthRequestCookieOptions {
+    /**
+     * Cookie name. Defaults to `"__Host-oauth2_auth_request"` when the other
+     * options satisfy that prefix — {@link secure} on, {@link path} `"/"`, and no
+     * {@link domain} — and to `"oauth2_auth_request"` otherwise, because a
+     * browser rejects a `__Host-` cookie that breaks any of them.
+     *
+     * Setting this explicitly to a `__Host-` or `__Secure-` prefixed name throws
+     * when the other options contradict the prefix. Prefixes are matched
+     * case-insensitively, as browsers match them.
+     */
+    name?: string;
+    /**
+     * Cookie path. Defaults to `"/"`. Any other value drops the default
+     * `__Host-` prefix, which requires `Path=/`.
+     */
+    path?: string;
+    /**
+     * Marks the cookie Secure. Defaults to `true`. Turning it off — as local
+     * plain-HTTP development needs — drops the default `__Host-` prefix, which
+     * requires `Secure`.
+     */
+    secure?: boolean;
+    /**
+     * `SameSite` policy. Defaults to `"Lax"`, which is the strictest value that
+     * still survives the identity provider's redirect back to the callback —
+     * `"Strict"` withholds the cookie on that navigation and every sign-in
+     * fails.
+     *
+     * `"None"` requires {@link AuthRequestCookieOptions.secure}; the constructor
+     * throws on the combination rather than emitting a cookie every modern
+     * browser silently drops.
+     */
+    sameSite?: "Strict" | "Lax" | "None";
+    /**
+     * Optional cookie domain. Omitting it (the default) keeps the cookie
+     * host-bound; setting it drops the default `__Host-` prefix, which forbids
+     * `Domain`.
+     */
+    domain?: string;
+}
+/** Options for {@link EncryptedCookieAuthRequestStorage}. */
+export interface EncryptedCookieAuthRequestStorageOptions {
+    /**
+     * Secret the AES-256 key is derived from; at least 32 bytes. Reuse the
+     * secret across instances so any of them can unseal a cookie another sealed.
+     */
+    secret: string;
+    /** Cookie attribute overrides. */
+    cookie?: AuthRequestCookieOptions;
+    /**
+     * How long a pending request stays valid, in ms. Also the cookie's
+     * `Max-Age`. Defaults to 10 minutes, matching the client's
+     * `authRequestTtlMs` default.
+     */
+    ttlMs?: number;
+    /**
+     * How many pending requests the cookie carries at once. A second sign-in
+     * started in another tab would otherwise evict the first, so its callback
+     * would fail. Defaults to 3; the oldest is dropped beyond that.
+     */
+    maxPending?: number;
+}
+/**
+ * Resolves the {@link AuthRequestStorage} for a single request.
+ *
+ * {@link HonoBffOptions.authRequestStorage} takes one of these rather than a
+ * bare storage because a cookie-backed store can only read and write through
+ * the request's {@link Context}. Pass an
+ * {@link EncryptedCookieAuthRequestStorage}, or implement `forRequest` over
+ * storage of your own.
+ */
+export interface AuthRequestStorageFactory {
+    /** Returns the storage bound to `c`, for the duration of that request. */
+    forRequest(c: Context): AuthRequestStorage;
+}
+/**
+ * Stateless {@link AuthRequestStorage}: the pending authorization requests live
+ * in an AES-GCM cookie under a server-held secret, so `/auth/login` and
+ * `/auth/callback` need not be served by the same instance.
+ *
+ * Reach for it whenever the BFF runs on more than one isolate or instance —
+ * the client's default in-memory storage fails those deployments with
+ * `unknown state parameter`. The AES key is derived on first use and shared by
+ * every later request.
+ *
+ * @example
+ * ```ts
+ * const bff = new HonoBff({
+ *   client,
+ *   sessionStore: new EncryptedCookieSessionStore({ secret }),
+ *   authRequestStorage: new EncryptedCookieAuthRequestStorage({ secret }),
+ * });
+ * ```
+ */
+export declare class EncryptedCookieAuthRequestStorage implements AuthRequestStorageFactory {
+    #private;
+    /**
+     * Resolves and validates the cookie name up front; the AES key is derived
+     * lazily on the first request that touches the cookie.
+     *
+     * @throws {Error} When an explicit {@link AuthRequestCookieOptions.name}
+     * carries a `__Host-`/`__Secure-` prefix the other cookie options contradict,
+     * or when {@link AuthRequestCookieOptions.sameSite} is `"None"` without
+     * {@link AuthRequestCookieOptions.secure}.
+     */
+    constructor(options: EncryptedCookieAuthRequestStorageOptions);
+    /** Returns the storage bound to `c`, for the duration of that request. */
+    forRequest(c: Context): AuthRequestStorage;
+}
+/**
+ * Convenience factory for {@link EncryptedCookieAuthRequestStorage} — the same
+ * as `new EncryptedCookieAuthRequestStorage(options)`, for call sites that
+ * prefer a function to a constructor.
+ *
+ * @example
+ * ```ts
+ * import { encryptedCookieAuthRequestStorage } from "@udibo/oauth2/hono/bff";
+ *
+ * const authRequestStorage = encryptedCookieAuthRequestStorage({
+ *   secret: Deno.env.get("SESSION_SECRET")!,
+ * });
+ * ```
+ */
+export declare function encryptedCookieAuthRequestStorage(options: EncryptedCookieAuthRequestStorageOptions): EncryptedCookieAuthRequestStorage;