@parlor/auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cychien
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,26 @@
-# Temporary Holding Version
+# @parlor/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign-in for Parlor apps on Better Auth: sessions, per-user scopes, OAuth for MCP clients, and pairing a computer's agents with an account.
+
+```sh
+pnpm parlor add auth
+```
+
+`parlor add auth` installs this package and writes the wiring. The server side it writes:
+
+```ts
+import { betterAuthProvider, parlorAuth } from "@parlor/auth";
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuthProvider({
+  instance: betterAuth(
+    parlorAuth({
+      appName: "Todos",
+      signInPage: "/sign-in",
+      emailAndPassword: { enabled: true },
+    }),
+  ),
+});
+```
+
+Docs: https://cychien.github.io/parlor/guides/auth/

package/dist/account.d.ts

@@ -0,0 +1,52 @@
+import { type ActionContext, type UserPrincipal } from "@parlor/core";
+import { type ActionsOf } from "@parlor/core/registry";
+import type { PluginHost } from "@parlor/server";
+import { z } from "zod";
+import type { DeviceAccountActions } from "./devices.js";
+import type { HostAccountActions } from "./hosts.js";
+import type { BetterAuthInstance } from "./provider.js";
+import type { RevocationNotice } from "./revocation.js";
+export declare const SESSIONS_TAG = "parlor_auth_sessions";
+export declare const AGENTS_TAG = "parlor_auth_agents";
+export interface SignedInSession {
+    readonly id: string;
+    readonly current: boolean;
+    readonly userAgent: string | null;
+    readonly ipAddress: string | null;
+    readonly createdAt: string;
+    readonly lastActiveAt: string;
+}
+export interface ConnectedAgent {
+    readonly clientId: string;
+    readonly name: string;
+    readonly scopes: readonly string[];
+    readonly connectedAt: string;
+}
+export type AccountActions = ActionsOf<ReturnType<typeof accountActions>> & HostAccountActions & DeviceAccountActions;
+interface AccountDeps {
+    readonly instance: BetterAuthInstance;
+    readonly host: PluginHost;
+    readonly revoke: (notice: RevocationNotice) => Promise<void>;
+}
+export declare function signedIn(ctx: ActionContext): UserPrincipal;
+/**
+ * Plugin actions at `/_parlor/auth/actions/<name>`. Better Auth writes through its own
+ * connection, so these never run inside an action transaction (on PGlite that would
+ * deadlock) and announce their changes afterwards instead of declaring `writes`.
+ */
+export declare function accountActions({ instance, host, revoke }: AccountDeps): import("@parlor/core/registry").ActionRegistry<{
+    sessions: import("@parlor/core").ActionDefinition<z.ZodObject<{}, z.core.$strip>, SignedInSession[]>;
+    revokeSession: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        id: z.ZodString;
+    }, z.core.$strip>, {
+        id: string;
+    }>;
+    agents: import("@parlor/core").ActionDefinition<z.ZodObject<{}, z.core.$strip>, ConnectedAgent[]>;
+    revokeAgent: import("@parlor/core").ActionDefinition<z.ZodObject<{
+        clientId: z.ZodString;
+    }, z.core.$strip>, {
+        id: string;
+    }>;
+}>;
+export {};
+//# sourceMappingURL=account.d.ts.map

package/dist/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,SAAS,EAAkB,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,YAAY,yBAAyB,CAAC;AACnD,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAaD,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,GACvE,kBAAkB,GAClB,oBAAoB,CAAC;AAEvB,UAAU,WAAW;IACnB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAK1D;AAKD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW;;;;;;;;;;;;;GAiGrE"}

package/dist/account.js

@@ -0,0 +1,114 @@
+import { ActionError, defineAction, } from "@parlor/core";
+import { createRegistry } from "@parlor/core/registry";
+import { z } from "zod";
+import { grantIdOf } from "./grants.js";
+export const SESSIONS_TAG = "parlor_auth_sessions";
+export const AGENTS_TAG = "parlor_auth_agents";
+export function signedIn(ctx) {
+    if (ctx.principal.kind !== "user") {
+        throw new ActionError("forbidden", "Only a signed-in user manages the account.");
+    }
+    return ctx.principal;
+}
+const scopesOf = (scopes) => typeof scopes === "string" ? scopes.split(" ").filter(Boolean) : [...scopes];
+/**
+ * Plugin actions at `/_parlor/auth/actions/<name>`. Better Auth writes through its own
+ * connection, so these never run inside an action transaction (on PGlite that would
+ * deadlock) and announce their changes afterwards instead of declaring `writes`.
+ */
+export function accountActions({ instance, host, revoke }) {
+    return createRegistry({
+        sessions: defineAction({
+            description: "List the places this account is signed in.",
+            input: z.object({}),
+            reads: [SESSIONS_TAG],
+            run: async (_input, ctx) => {
+                const user = signedIn(ctx);
+                const { internalAdapter } = await instance.$context;
+                const sessions = await internalAdapter.listSessions(user.userId);
+                return sessions
+                    .filter((session) => session.expiresAt.getTime() > Date.now())
+                    .sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())
+                    .map((session) => ({
+                    id: session.id,
+                    current: session.id === user.sessionId,
+                    userAgent: session.userAgent ?? null,
+                    ipAddress: session.ipAddress ?? null,
+                    createdAt: session.createdAt.toISOString(),
+                    lastActiveAt: session.updatedAt.toISOString(),
+                }));
+            },
+        }),
+        revokeSession: defineAction({
+            description: "Sign this account out of one place; its open connections close.",
+            input: z.object({ id: z.string().min(1) }),
+            run: async ({ id }, ctx) => {
+                const user = signedIn(ctx);
+                const { internalAdapter } = await instance.$context;
+                const sessions = await internalAdapter.listSessions(user.userId);
+                const session = sessions.find((candidate) => candidate.id === id);
+                if (!session)
+                    throw new ActionError("not_found", `No session ${id}`);
+                await internalAdapter.deleteSession(session.token);
+                await host.announce(ctx.scope, [[SESSIONS_TAG, id]]);
+                return { id };
+            },
+        }),
+        agents: defineAction({
+            description: "List the agents this account authorized through MCP.",
+            input: z.object({}),
+            reads: [AGENTS_TAG],
+            run: async (_input, ctx) => {
+                const user = signedIn(ctx);
+                const { adapter } = await instance.$context;
+                const mine = [{ field: "userId", value: user.userId }];
+                const [consents, refreshTokens] = await Promise.all([
+                    adapter.findMany({ model: "oauthConsent", where: mine }),
+                    adapter.findMany({
+                        model: "oauthRefreshToken",
+                        where: mine,
+                    }),
+                ]);
+                // A trusted client skips consent, so its live refresh tokens are its only trace.
+                const live = refreshTokens.filter((token) => !token.revoked && token.expiresAt.getTime() > Date.now());
+                const grants = new Map();
+                for (const grant of [...live, ...consents]) {
+                    const known = grants.get(grant.clientId);
+                    if (!known || grant.createdAt < known.createdAt)
+                        grants.set(grant.clientId, grant);
+                }
+                return Promise.all([...grants.values()].map(async (grant) => {
+                    const client = await adapter.findOne({
+                        model: "oauthClient",
+                        where: [{ field: "clientId", value: grant.clientId }],
+                    });
+                    return {
+                        clientId: grant.clientId,
+                        name: client?.name || grant.clientId,
+                        scopes: scopesOf(grant.scopes),
+                        connectedAt: grant.createdAt.toISOString(),
+                    };
+                }));
+            },
+        }),
+        revokeAgent: defineAction({
+            description: "Revoke an agent's access; its tokens stop working at once.",
+            input: z.object({ clientId: z.string().min(1) }),
+            run: async ({ clientId }, ctx) => {
+                const user = signedIn(ctx);
+                await revoke({ kind: "grant", id: grantIdOf(user.userId, clientId) });
+                const { adapter } = await instance.$context;
+                const where = [
+                    { field: "userId", value: user.userId },
+                    { field: "clientId", value: clientId },
+                ];
+                for (const model of ["oauthConsent", "oauthRefreshToken", "oauthAccessToken"]) {
+                    await adapter.deleteMany({ model, where });
+                }
+                await host.announce(ctx.scope, [[AGENTS_TAG, clientId]]);
+                return { id: clientId };
+            },
+        }),
+    });
+}
+//# sourceMappingURL=account.js.map

package/dist/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAEX,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AACnD,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAuC/C,MAAM,UAAU,QAAQ,CAAC,GAAkB;IACzC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,CAAC;AACvB,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,EAAE,CAC3C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAe;IACpE,OAAO,cAAc,CAAC;QACpB,QAAQ,EAAE,YAAY,CAAC;YACrB,WAAW,EAAE,4CAA4C;YACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA8B,EAAE;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,OAAO,QAAQ;qBACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;qBAC7D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;qBAC7D,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS;oBACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;oBAC1C,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC9C,CAAC,CAAC,CAAC;YACR,CAAC;SACF,CAAC;QACF,aAAa,EAAE,YAAY,CAAC;YAC1B,WAAW,EAAE,iEAAiE;YAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;gBACrE,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;SACF,CAAC;QACF,MAAM,EAAE,YAAY,CAAC;YACnB,WAAW,EAAE,sDAAsD;YACnE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA6B,EAAE;gBACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAClD,OAAO,CAAC,QAAQ,CAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC/D,OAAO,CAAC,QAAQ,CAAuB;wBACrC,KAAK,EAAE,mBAAmB;wBAC1B,KAAK,EAAE,IAAI;qBACZ,CAAC;iBACH,CAAC,CAAC;gBACH,iFAAiF;gBACjF,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;gBACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;gBACxC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS;wBAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;oBACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAA2B;wBAC7D,KAAK,EAAE,aAAa;wBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;qBACtD,CAAC,CAAC;oBACH,OAAO;wBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ;wBACpC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;wBAC9B,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC3C,CAAC;gBACJ,CAAC,CAAC,CACH,CAAC;YACJ,CAAC;SACF,CAAC;QACF,WAAW,EAAE,YAAY,CAAC;YACxB,WAAW,EAAE,4DAA4D;YACzE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,MAAM,KAAK,GAAG;oBACZ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;oBACvC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;iBACvC,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBAC9E,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YAC1B,CAAC;SACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,10 @@
+import type { DataProvider } from "@parlor/core";
+import type { ActionAudit, Migration } from "@parlor/server";
+export declare const AUDIT_MIGRATION: Migration;
+export interface AuditLog {
+    record(audit: ActionAudit): void;
+    flush(): Promise<void>;
+    stop(): Promise<void>;
+}
+export declare function createAuditLog(database: DataProvider): AuditLog;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAK7D,eAAO,MAAM,eAAe,EAAE,SAiC7B,CAAC;AA+BF,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,CAkE/D"}

package/dist/audit.js

@@ -0,0 +1,130 @@
+import { sql } from "drizzle-orm";
+export const AUDIT_MIGRATION = {
+    id: "auth/0006_audit",
+    sql: `
+    create table parlor_auth_audit (
+      id bigint generated always as identity primary key,
+      at timestamptz not null,
+      action text not null,
+      actor_kind text not null,
+      user_id text,
+      grant_id text,
+      session_id text,
+      device_id text,
+      host_id text,
+      agent_name text,
+      agent_verified boolean,
+      thread_id text,
+      turn_id text,
+      source text not null,
+      scope text not null,
+      input_digest text not null,
+      stage text not null,
+      outcome text not null,
+      confirmation text
+    );
+    create index parlor_auth_audit_by_user on parlor_auth_audit (user_id, at);
+    create function parlor_auth_audit_append_only() returns trigger language plpgsql as $$
+    begin
+      raise exception 'parlor_auth_audit is append-only';
+    end
+    $$;
+    create trigger parlor_auth_audit_append_only
+      before update or delete on parlor_auth_audit
+      for each row execute function parlor_auth_audit_append_only()`,
+};
+const FLUSH_MS = 250;
+const FLUSH_AT = 100;
+const KEEP_AT_MOST = 10_000;
+function audited({ principal, stage, confirmation }) {
+    return principal.kind === "agent" || stage === "refused" || confirmation !== undefined;
+}
+function rowOf(audit) {
+    const { principal } = audit;
+    const user = principal.kind === "anonymous" ? undefined : principal.userId;
+    const grant = principal.kind === "agent" || principal.kind === "host"
+        ? principal.grantId
+        : undefined;
+    const turn = principal.kind === "agent" ? principal.turn : undefined;
+    const host = principal.kind === "host" ? principal.hostId : turn?.hostId;
+    return sql `(${new Date(audit.at).toISOString()}, ${audit.action}, ${principal.kind},
+    ${user ?? null}, ${grant ?? null},
+    ${principal.kind === "user" ? principal.sessionId : null},
+    ${principal.kind === "user" ? (principal.deviceId ?? null) : null},
+    ${host ?? null},
+    ${principal.kind === "agent" ? principal.agent.name : null},
+    ${principal.kind === "agent" ? principal.agent.verified : null},
+    ${turn?.threadId ?? null}, ${turn?.turnId ?? null},
+    ${audit.source}, ${audit.scope}, ${audit.inputDigest}, ${audit.stage}, ${audit.outcome},
+    ${audit.confirmation ?? null})`;
+}
+export function createAuditLog(database) {
+    let queued = [];
+    let timer;
+    let writing = Promise.resolve();
+    let stopped = false;
+    const write = async () => {
+        if (queued.length === 0)
+            return;
+        const batch = queued;
+        queued = [];
+        try {
+            await database.transaction(async (tx) => {
+                await tx.execute(sql `
+          insert into parlor_auth_audit
+            (at, action, actor_kind, user_id, grant_id, session_id, device_id, host_id,
+             agent_name, agent_verified, thread_id, turn_id, source, scope, input_digest,
+             stage, outcome, confirmation)
+          values ${sql.join(batch.map(rowOf), sql `, `)}`);
+            });
+        }
+        catch (error) {
+            queued = [...batch, ...queued].slice(-KEEP_AT_MOST);
+            throw error;
+        }
+    };
+    const flush = () => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        timer = undefined;
+        const next = writing.then(write, write);
+        writing = next.catch(() => { });
+        return next;
+    };
+    const schedule = () => {
+        if (timer !== undefined || stopped)
+            return;
+        timer = setTimeout(() => {
+            timer = undefined;
+            flush().catch((error) => {
+                console.error("[parlor] audit write failed, will retry:", error);
+                schedule();
+            });
+        }, FLUSH_MS);
+        timer.unref?.();
+    };
+    return {
+        record(audit) {
+            if (!audited(audit))
+                return;
+            queued.push(audit);
+            if (queued.length >= FLUSH_AT) {
+                flush().catch((error) => {
+                    console.error("[parlor] audit write failed, will retry:", error);
+                    schedule();
+                });
+            }
+            else {
+                schedule();
+            }
+        },
+        flush,
+        async stop() {
+            stopped = true;
+            await flush().catch((error) => {
+                console.error("[parlor] audit write failed on shutdown:", error);
+            });
+        },
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,EAAE,EAAE,iBAAiB;IACrB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA8B6D;CACnE,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,SAAS,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAe;IAC9D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,KAAK,CAAC,KAAkB;IAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC3E,MAAM,KAAK,GACT,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QACrD,CAAC,CAAC,SAAS,CAAC,OAAO;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IACzE,OAAO,GAAG,CAAA,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI;MAC9E,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI;MAC9B,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;MACtD,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;MAC/D,IAAI,IAAI,IAAI;MACZ,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;MACxD,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;MAC5D,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,IAAI,IAAI;MAC/C,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO;MACpF,KAAK,CAAC,YAAY,IAAI,IAAI,GAAG,CAAC;AACpC,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,QAAsB;IACnD,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC;QACrB,MAAM,GAAG,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACtC,MAAO,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;;;;mBAKvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,GAAG,SAAS,CAAC;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO;YAAE,OAAO;QAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,KAAK,GAAG,SAAS,CAAC;YAClB,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC/B,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;gBACjE,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,KAAK;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC/B,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;oBACjE,QAAQ,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,KAAK;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/better-auth.d.ts

@@ -0,0 +1,41 @@
+import type { BetterAuthOptions } from "better-auth";
+import type { RevocationNotice } from "./revocation.js";
+export declare const AUTH_PLUGIN = "auth";
+export declare const AUTH_BASE_PATH = "/_parlor/auth";
+export declare const MCP_SCOPE = "mcp";
+export declare const CONSENT_PATH = "/consent";
+export declare const ACCESS_TOKEN_TTL_S: number;
+export interface ParlorAuthOptions extends Omit<BetterAuthOptions, "basePath" | "baseURL"> {
+    /**
+     * The app's public origin, which serves its pages and `/_parlor`. Defaults to
+     * `PARLOR_ORIGIN`, then to the web origin `parlor dev` sets.
+     */
+    readonly origin?: string | undefined;
+    /**
+     * The app page that signs a user in. An MCP client's authorization lands there and
+     * resumes once the user signs in through `@parlor/auth/client`.
+     */
+    readonly signInPage: string;
+}
+export interface ParlorAuthSettings {
+    readonly appName?: string | undefined;
+    readonly origin: string;
+    readonly baseURL: string;
+    readonly resource: string;
+}
+interface Bridge {
+    settings: ParlorAuthSettings;
+    revoke?: ((notice: RevocationNotice) => Promise<void>) | undefined;
+}
+export declare function bridgeOf(options: BetterAuthOptions): Bridge;
+/** The other frontends one `parlor dev` serves next to the web target, each on its own port. */
+export declare function devOrigins(env?: NodeJS.ProcessEnv): readonly string[];
+/**
+ * The Better Auth options Parlor needs, merged into the app's own: sessions as a cookie
+ * on the web and a bearer token in native shells, and an OAuth authorization server for
+ * MCP clients (MCP 2026-07-28: protected resource metadata, Client ID Metadata Documents,
+ * PKCE, tokens bound to `/_parlor/mcp`).
+ */
+export declare function parlorAuth(options: ParlorAuthOptions): BetterAuthOptions;
+export {};
+//# sourceMappingURL=better-auth.d.ts.map

package/dist/better-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,aAAa,CAAC;AAGvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,WAAW,SAAS,CAAC;AAClC,eAAO,MAAM,cAAc,kBAAwC,CAAC;AACpE,eAAO,MAAM,SAAS,QAAQ,CAAC;AAC/B,eAAO,MAAM,YAAY,aAAa,CAAC;AAGvC,eAAO,MAAM,kBAAkB,QAA2C,CAAC;AAa3E,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,iBAAiB,EACjB,UAAU,GAAG,SAAS,CACvB;IACC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,MAAM;IACd,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACpE;AA8BD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAQ3D;AAED,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,MAAM,EAAE,CAMlF;AAWD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CA4BxE"}

package/dist/better-auth.js

@@ -0,0 +1,118 @@
+import { cimd } from "@better-auth/cimd";
+import { fetchClientMetadataResource } from "@better-auth/cimd/node";
+import { mcp } from "@better-auth/mcp";
+import { DEFAULT_BASE_PATH, REVOCATION_HORIZON_MS, SHELL_ORIGINS } from "@parlor/server";
+import { bearer, jwt } from "better-auth/plugins";
+export const AUTH_PLUGIN = "auth";
+export const AUTH_BASE_PATH = `${DEFAULT_BASE_PATH}/${AUTH_PLUGIN}`;
+export const MCP_SCOPE = "mcp";
+export const CONSENT_PATH = "/consent";
+/** Clock skew a revocation must outlast beyond a credential's own lifetime. */
+const SKEW_MS = 60_000;
+export const ACCESS_TOKEN_TTL_S = (REVOCATION_HORIZON_MS - SKEW_MS) / 1000;
+/** Better Auth endpoints that would let a user bypass Parlor's own account actions. */
+const DISABLED_PATHS = [
+    "/oauth2/create-client",
+    "/oauth2/update-client",
+    "/oauth2/delete-client",
+    "/oauth2/client/rotate-secret",
+    "/oauth2/get-clients",
+    "/oauth2/delete-consent",
+    "/oauth2/update-consent",
+];
+const BRIDGE_PLUGIN = "parlor";
+function bridgePlugin(bridge) {
+    const ended = async (notice) => {
+        if (!bridge.revoke) {
+            throw new Error("Install betterAuthProvider() in createServer({ auth }).");
+        }
+        await bridge.revoke(notice);
+    };
+    return {
+        id: BRIDGE_PLUGIN,
+        bridge,
+        init: () => ({
+            options: {
+                databaseHooks: {
+                    session: {
+                        delete: { after: (session) => ended({ kind: "session", id: session.id }) },
+                    },
+                },
+            },
+        }),
+    };
+}
+export function bridgeOf(options) {
+    const plugin = options.plugins?.find((candidate) => candidate.id === BRIDGE_PLUGIN);
+    if (!plugin) {
+        throw new Error("Pass the Better Auth options through parlorAuth() before betterAuth().");
+    }
+    return plugin.bridge;
+}
+/** The other frontends one `parlor dev` serves next to the web target, each on its own port. */
+export function devOrigins(env = process.env) {
+    if (env.PARLOR_DEV !== "1")
+        return [];
+    return (env.PARLOR_DEV_ORIGINS ?? "")
+        .split(",")
+        .map((origin) => origin.trim())
+        .filter((origin) => /^https?:\/\//.test(origin));
+}
+function originOf(options) {
+    const origin = options.origin ?? process.env.PARLOR_ORIGIN ?? process.env.PARLOR_WEB_ORIGIN;
+    if (!origin) {
+        throw new Error("Set PARLOR_ORIGIN to the app's public origin, or pass `origin`.");
+    }
+    return new URL(origin).origin;
+}
+/**
+ * The Better Auth options Parlor needs, merged into the app's own: sessions as a cookie
+ * on the web and a bearer token in native shells, and an OAuth authorization server for
+ * MCP clients (MCP 2026-07-28: protected resource metadata, Client ID Metadata Documents,
+ * PKCE, tokens bound to `/_parlor/mcp`).
+ */
+export function parlorAuth(options) {
+    const { origin: _origin, signInPage, ...rest } = options;
+    const origin = originOf(options);
+    const baseURL = `${origin}${AUTH_BASE_PATH}`;
+    const resource = `${origin}${DEFAULT_BASE_PATH}/mcp`;
+    const bridge = {
+        settings: { appName: rest.appName, origin, baseURL, resource },
+    };
+    const trusted = rest.trustedOrigins;
+    return {
+        ...rest,
+        baseURL,
+        basePath: AUTH_BASE_PATH,
+        trustedOrigins: Array.isArray(trusted)
+            ? [origin, ...SHELL_ORIGINS, ...devOrigins(), ...trusted]
+            : async (request) => [
+                origin,
+                ...SHELL_ORIGINS,
+                ...devOrigins(),
+                ...(typeof trusted === "function" ? await trusted(request) : []),
+            ],
+        disabledPaths: [...DISABLED_PATHS, ...(rest.disabledPaths ?? [])],
+        plugins: [
+            ...(rest.plugins ?? []),
+            ...frameworkPlugins(resource, signInPage),
+            bridgePlugin(bridge),
+        ],
+    };
+}
+function frameworkPlugins(resource, signInPage) {
+    // Better Auth's plugin types are not written for exactOptionalPropertyTypes.
+    return [
+        bearer(),
+        jwt(),
+        mcp({
+            resource,
+            loginPage: signInPage,
+            consentPage: `${AUTH_BASE_PATH}${CONSENT_PATH}`,
+            scopes: [MCP_SCOPE, "offline_access"],
+            accessTokenExpiresIn: ACCESS_TOKEN_TTL_S,
+        }),
+        cimd({ fetchClientMetadataResource, metadataProfile: "mcp-2026-07-28" }),
+    ];
+}
+//# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEzF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAIlD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,iBAAiB,IAAI,WAAW,EAAE,CAAC;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAC/B,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AACvC,+EAA+E;AAC/E,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,qBAAqB,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;AAE3E,uFAAuF;AACvF,MAAM,cAAc,GAAG;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,8BAA8B;IAC9B,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;AA8BF,MAAM,aAAa,GAAG,QAAQ,CAAC;AAM/B,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,KAAK,EAAE,MAAwB,EAAE,EAAE;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,MAAM;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACX,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE;qBAC3E;iBACF;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA0B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAQ,MAAuB,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAClC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,iBAAiB,MAAM,CAAC;IACrD,MAAM,MAAM,GAAW;QACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC/D,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;IACpC,OAAO;QACL,GAAG,IAAI;QACP,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACpC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC;YACzD,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;gBACjB,MAAM;gBACN,GAAG,aAAa;gBAChB,GAAG,UAAU,EAAE;gBACf,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;QACL,aAAa,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACvB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;YACzC,YAAY,CAAC,MAAM,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;IAC5D,6EAA6E;IAC7E,OAAO;QACL,MAAM,EAAE;QACR,GAAG,EAAE;QACL,GAAG,CAAC;YACF,QAAQ;YACR,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,GAAG,cAAc,GAAG,YAAY,EAAE;YAC/C,MAAM,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC;YACrC,oBAAoB,EAAE,kBAAkB;SACzC,CAAC;QACF,IAAI,CAAC,EAAE,2BAA2B,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;KACnD,CAAC;AAC1B,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,43 @@
+import { type DeviceKey, type SessionStore } from "@parlor/capabilities";
+import { type ActionClient, type DeviceLinker, type DeviceSource, type HostAuthorizer, type SessionDevice, type SessionSource } from "@parlor/client";
+import type { AccountActions } from "../account.js";
+export interface AuthClientOptions {
+    /** The backend origin; defaults to the shell's `server.url`, or this page's origin. */
+    readonly baseUrl?: string | undefined;
+    readonly basePath?: string | undefined;
+    /**
+     * Where a bearer session is kept. Defaults to the `sessionStore` capability: native
+     * shells keep a bearer token, the web keeps a cookie.
+     */
+    readonly session?: SessionStore | undefined;
+    /** Where this device's signing keys live. Defaults to the `deviceKey` capability. */
+    readonly deviceKey?: DeviceKey | undefined;
+    readonly fetch?: typeof fetch | undefined;
+}
+export declare class AuthClientError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    readonly name = "AuthClientError";
+    constructor(message: string, status: number, code: string | undefined);
+}
+export type DeviceHandle = SessionDevice;
+export interface AuthClient extends SessionSource, DeviceSource, HostAuthorizer, DeviceLinker {
+    deviceSetup(): Promise<"needed" | "ready">;
+    /** Plug into `createActionClient({ headers })` so every surface carries the session. */
+    readonly headers: () => Promise<HeadersInit>;
+    signIn(input: {
+        readonly email: string;
+        readonly password: string;
+    }): Promise<void>;
+    signUp(input: {
+        readonly name: string;
+        readonly email: string;
+        readonly password: string;
+    }): Promise<void>;
+    signOut(): Promise<void>;
+    /** The account actions: `sessions`, `revokeSession`, `agents`, `revokeAgent`. */
+    readonly account: ActionClient<AccountActions>;
+}
+export declare function createAuthClient(options?: AuthClientOptions): AuthClient;
+export type { HostPairing, SessionStore } from "@parlor/capabilities";
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,SAAS,EAKd,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,YAAY,EAGjB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,cAAc,EAGnB,KAAK,aAAa,EAElB,KAAK,aAAa,EAEnB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA4BpD,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;CAC3C;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAItC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;IAJnC,SAAkB,IAAI,qBAAqB;IAC3C,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EAGlC;CACF;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC,MAAM,WAAW,UACf,SAAQ,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY;IACjE,WAAW,IAAI,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;CAChD;AA+HD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAkX5E;AAED,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}