@parlor/auth 0.0.0-stage → 0.1.0

package/dist/statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statements.js","sourceRoot":"","sources":["../src/statements.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA0EnD,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAQ/B,MAAM,MAAM,GAAG,KAAK,EAAE,KAAiB,EAAuB,EAAE,CAC9D,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE/E,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAiB,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,MAAoB,EACpB,EAAU;IAEV,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QACvD,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,EAAE;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,MAAoB,EACpB,EAAU;IAEV,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EACJ,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,MAAM,QAAQ,CACZ,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CACjE;QACP,EAAE;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,IAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,SAAS,EAAE,MAAM,eAAe,CAC9B,GAAG,EACH,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAC7D,MAAM,CAAC,EAAE,CACV;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,QAAgB,EAChB,UAAsB,EACtB,WAAmC;IAEnC,MAAM,KAAK,GAAG,CAAC,GAAe,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,OAAO,QAAQ,CACb,cAAc,CAAC;QACb,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;QACxB,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;QAC1B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAClD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;IACvF,IAAI,KAAK,EAAE,CAAC;IACZ,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gBAAgB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,EAAU;IAEV,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;QACxB,OAAO;QACP,MAAM;QACN,UAAU;QACV,EAAE;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,KAAa,EACb,MAAc,EACd,EAAU;IAEV,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CACrB,KAAK,EACL,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EACvC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,UAAsB,EAAE,EAAE,CAChE,cAAc,CAAC;IACb,CAAC,EAAE,CAAC;IACJ,IAAI,EAAE,SAAS;IACf,QAAQ;IACR,UAAU,EAAE;QACV,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,CAAC,EAAE,UAAU,CAAC,CAAC;KAChB;CACF,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,QAAgB,EAChB,UAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,MAAM,UAAU,CAAC,MAAM,CAAC,EACxB,IAAI,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CACnD,CAAC;IACF,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,KAAa,EACb,QAAgB,EAChB,UAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/B,MAAM,EACN,MAAM,UAAU,CAAC,MAAM,CAAC,EACxB,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EACtC,IAAI,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AASD,KAAK,UAAU,cAAc,CAC3B,SAAoB,EACpB,SAA0B,EAC1B,WAAwC;IAExC,IAAI,WAAW,EAAE,MAAM,KAAK,UAAU,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACtF,IACE,SAAS,CAAC,iBAAiB,KAAK,SAAS;QACzC,SAAS,CAAC,cAAc,KAAK,SAAS,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,eAAe,GAAG,eAAe,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAe,CAAC;IACvF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5D,IACE,UAAU,CAAC,IAAI,KAAK,cAAc;QAClC,UAAU,CAAC,SAAS,KAAK,SAAS;QAClC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,GAAG;QACnC,UAAU,CAAC,WAAW,KAAK,IAAI,EAC/B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,SAAoB,EACpB,SAA0B,EAC1B,MAAoB;IAEpB,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrF,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC/B,OAAO,WAAW,EAAE,MAAM,KAAK,WAAW;QACxC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB,EACzB,MAAoB,EACpB,OAAsB;IAEtB,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAClE,IAAI,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,cAAc;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7D,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,69 @@
+import { type AgentPrincipal, type HostPrincipal, type TurnBinding } from "@parlor/core";
+import { type Delegation, type TurnDelegation } from "@parlor/server";
+/** A host assertion's audience: signed by the computer's own key, per request. */
+export declare const HOST_AUDIENCE = "parlor:host";
+/** A turn token's audience: signed by the server, carried by the host's MCP proxy. */
+export declare const TURN_AUDIENCE = "parlor:mcp";
+export declare const HOST_ASSERTION_TYP = "parlor-host+jwt";
+export declare const TURN_TOKEN_TYP = "parlor-turn+jwt";
+/**
+ * A turn token never outlives the revocation horizon, or a revoked grant's token could
+ * verify after `RevocationSet` forgot the revocation.
+ */
+export declare const MAX_TURN_TOKEN_TTL_MS: number;
+export type TokenAudience = typeof HOST_AUDIENCE | typeof TURN_AUDIENCE;
+declare const audience: unique symbol;
+/** A compact JWS whose audience is known from the scheme it arrived under; never swapped. */
+export type Jws<A extends TokenAudience> = string & {
+    readonly [audience]: A;
+};
+export type HostAssertion = Jws<typeof HOST_AUDIENCE>;
+export type TurnToken = Jws<typeof TURN_AUDIENCE>;
+/** What an `authorization` header carries, sorted by scheme and shape before any verification. */
+export type Credential = {
+    readonly kind: "host";
+    readonly assertion: HostAssertion;
+} | {
+    readonly kind: "turn";
+    readonly token: TurnToken;
+} | {
+    readonly kind: "access";
+    readonly token: string;
+} | {
+    readonly kind: "session";
+    readonly token: string;
+};
+export interface TurnTokenClaims {
+    readonly aud: typeof TURN_AUDIENCE;
+    readonly iss: string;
+    /** user id */
+    readonly sub: string;
+    /** grant id: revoking the grant kills the token */
+    readonly gid: string;
+    readonly hid: string;
+    readonly thr: string;
+    readonly trn: string;
+    /** the client the prompt came from; `ui_*` binds to it */
+    readonly cid: string;
+    readonly agt: string;
+    readonly iat: number;
+    /** as long as the turn's lease */
+    readonly exp: number;
+}
+export interface TurnTokenKeys {
+    readonly issuer: string;
+    readonly kid: string;
+    readonly privateKey: CryptoKey;
+    readonly publicKeys: ReadonlyMap<string, CryptoKey>;
+}
+/** `ParlorHost <jws>` is a host; a `Bearer` JWS whose header says `typ: parlor-turn+jwt` is a turn. */
+export declare function credentialOf(authorization: string | null): Credential | undefined;
+/** Mints a turn token for `host`'s grant; the provider's `delegate`. */
+export declare function delegate(keys: TurnTokenKeys, host: HostPrincipal, turn: TurnDelegation, now: number): Promise<Delegation>;
+/** Signature, `aud`, `iss` and `exp` only; the caller then asks `RevocationSet` about `gid`. */
+export declare function verifyTurnToken(keys: TurnTokenKeys, token: TurnToken, now: number): Promise<TurnTokenClaims>;
+export declare function agentPrincipalOf(claims: TurnTokenClaims): AgentPrincipal & {
+    readonly turn: TurnBinding;
+};
+export {};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,UAAU,EAEf,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAIxB,kFAAkF;AAClF,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,sFAAsF;AACtF,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AACpD,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAIhD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAwC,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,GAAG,OAAO,aAAa,CAAC;AAExE,OAAO,CAAC,MAAM,QAAQ,EAAE,OAAO,MAAM,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,aAAa,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;AAElD,kGAAkG;AAClG,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,aAAa,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,cAAc;IACd,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACrD;AAgBD,uGAAuG;AACvG,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,GAAG,SAAS,CAkBjF;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAgBD,gGAAgG;AAChG,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,GACtB,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAajD"}

package/dist/tokens.js

@@ -0,0 +1,134 @@
+import { asId, } from "@parlor/core";
+import { AuthFailure, REVOCATION_HORIZON_MS, } from "@parlor/server";
+import { decodeProtectedHeader, errors, jwtVerify, SignJWT } from "jose";
+import { z } from "zod";
+/** A host assertion's audience: signed by the computer's own key, per request. */
+export const HOST_AUDIENCE = "parlor:host";
+/** A turn token's audience: signed by the server, carried by the host's MCP proxy. */
+export const TURN_AUDIENCE = "parlor:mcp";
+export const HOST_ASSERTION_TYP = "parlor-host+jwt";
+export const TURN_TOKEN_TYP = "parlor-turn+jwt";
+const CLOCK_SKEW_MS = 60_000;
+/**
+ * A turn token never outlives the revocation horizon, or a revoked grant's token could
+ * verify after `RevocationSet` forgot the revocation.
+ */
+export const MAX_TURN_TOKEN_TTL_MS = REVOCATION_HORIZON_MS - CLOCK_SKEW_MS;
+const JWS_SHAPE = /^[\w-]+\.[\w-]+\.[\w-]+$/;
+function brand(compact) {
+    return compact;
+}
+function typOf(jws) {
+    try {
+        return decodeProtectedHeader(jws).typ;
+    }
+    catch {
+        throw new AuthFailure("invalid", "The token is malformed.");
+    }
+}
+/** `ParlorHost <jws>` is a host; a `Bearer` JWS whose header says `typ: parlor-turn+jwt` is a turn. */
+export function credentialOf(authorization) {
+    if (authorization === null)
+        return undefined;
+    const match = /^([A-Za-z]+)\s+(\S+)$/.exec(authorization);
+    const scheme = match?.[1]?.toLowerCase();
+    const value = match?.[2];
+    if (value === undefined || (scheme !== "bearer" && scheme !== "parlorhost")) {
+        throw new AuthFailure("invalid", "Use a Bearer token.");
+    }
+    if (scheme === "parlorhost") {
+        if (!JWS_SHAPE.test(value)) {
+            throw new AuthFailure("invalid", "The host assertion is malformed.");
+        }
+        return { kind: "host", assertion: brand(value) };
+    }
+    if (!JWS_SHAPE.test(value))
+        return { kind: "session", token: value };
+    return typOf(value) === TURN_TOKEN_TYP
+        ? { kind: "turn", token: brand(value) }
+        : { kind: "access", token: value };
+}
+/** Mints a turn token for `host`'s grant; the provider's `delegate`. */
+export async function delegate(keys, host, turn, now) {
+    if (!(turn.ttlMs > 0))
+        throw new RangeError("A turn token needs a positive lifetime.");
+    const iat = Math.floor(now / 1000);
+    const exp = iat + Math.ceil(Math.min(turn.ttlMs, MAX_TURN_TOKEN_TTL_MS) / 1000);
+    const claims = {
+        aud: TURN_AUDIENCE,
+        iss: keys.issuer,
+        sub: host.userId,
+        gid: host.grantId,
+        hid: host.hostId,
+        thr: turn.threadId,
+        trn: turn.turnId,
+        cid: turn.clientId,
+        agt: turn.agent,
+        iat,
+        exp,
+    };
+    const token = await new SignJWT({ ...claims })
+        .setProtectedHeader({ alg: "ES256", typ: TURN_TOKEN_TYP, kid: keys.kid })
+        .sign(keys.privateKey);
+    return { token, expiresAt: exp * 1000 };
+}
+const claimsSchema = z.object({
+    aud: z.literal(TURN_AUDIENCE),
+    iss: z.string().min(1),
+    sub: z.string().min(1),
+    gid: z.string().min(1),
+    hid: z.string().min(1),
+    thr: z.string().min(1),
+    trn: z.string().min(1),
+    cid: z.string(),
+    agt: z.string().min(1),
+    iat: z.number().int(),
+    exp: z.number().int(),
+});
+/** Signature, `aud`, `iss` and `exp` only; the caller then asks `RevocationSet` about `gid`. */
+export async function verifyTurnToken(keys, token, now) {
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(token, (header) => {
+            const key = header.kid === undefined ? undefined : keys.publicKeys.get(header.kid);
+            if (!key)
+                throw new errors.JWKSNoMatchingKey();
+            return key;
+        }, {
+            algorithms: ["ES256"],
+            typ: TURN_TOKEN_TYP,
+            issuer: keys.issuer,
+            audience: TURN_AUDIENCE,
+            currentDate: new Date(now),
+        }));
+    }
+    catch (error) {
+        if (error instanceof errors.JWTExpired) {
+            throw new AuthFailure("expired", "The turn token expired.");
+        }
+        throw new AuthFailure("invalid", "The turn token is invalid.");
+    }
+    const claims = claimsSchema.safeParse(payload);
+    if (!claims.success)
+        throw new AuthFailure("invalid", "The turn token is malformed.");
+    const { iat, exp } = claims.data;
+    if (exp - iat > MAX_TURN_TOKEN_TTL_MS / 1000 || iat * 1000 > now + CLOCK_SKEW_MS) {
+        throw new AuthFailure("invalid", "The turn token has an impossible lifetime.");
+    }
+    return claims.data;
+}
+export function agentPrincipalOf(claims) {
+    return {
+        kind: "agent",
+        userId: asId("user", claims.sub),
+        grantId: asId("grant", claims.gid),
+        agent: { name: claims.agt, verified: true },
+        turn: {
+            threadId: asId("thread", claims.thr),
+            turnId: asId("turn", claims.trn),
+            hostId: asId("host", claims.hid),
+            clientId: claims.cid,
+        },
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,IAAI,GAGL,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EAEX,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAC3C,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,GAAG,aAAa,CAAC;AA2C3E,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAE7C,SAAS,KAAK,CAA0B,OAAe;IACrD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,YAAY,CAAC,aAA4B;IACvD,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAuB,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACrE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,cAAc;QACpC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAuB,KAAK,CAAC,EAAE;QAC7D,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAmB,EACnB,IAAmB,EACnB,IAAoB,EACpB,GAAW;IAEX,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,MAAM,GAAoB;QAC9B,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,KAAK;QACf,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;SAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,KAAgB,EAChB,GAAW;IAEX,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,GAAG,GACP,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC,EACD;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SAC3B,CACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,GAAG,GAAG,GAAG,qBAAqB,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3C,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG;SACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/turn-keys.d.ts

@@ -0,0 +1,16 @@
+import type { DataProvider } from "@parlor/core";
+import type { Migration } from "@parlor/server";
+import type { TurnTokenKeys } from "./tokens.js";
+export declare const TURN_KEYS_MIGRATION: Migration;
+export interface TurnKeyStore {
+    keys(): Promise<TurnTokenKeys>;
+    refresh(): Promise<TurnTokenKeys>;
+}
+export interface TurnKeyStoreOptions {
+    readonly database: DataProvider;
+    readonly issuer: string;
+    readonly secret: () => Promise<string>;
+    readonly now?: (() => number) | undefined;
+}
+export declare function createTurnKeyStore(options: TurnKeyStoreOptions): TurnKeyStore;
+//# sourceMappingURL=turn-keys.d.ts.map

package/dist/turn-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-keys.d.ts","sourceRoot":"","sources":["../src/turn-keys.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,eAAO,MAAM,mBAAmB,EAAE,SAWjC,CAAC;AAiCF,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3C;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAiG7E"}

package/dist/turn-keys.js

@@ -0,0 +1,108 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
+import { sql } from "drizzle-orm";
+import { exportJWK, generateKeyPair } from "jose";
+import { jwkOf, rowsOf } from "./database.js";
+export const TURN_KEYS_MIGRATION = {
+    id: "auth/0005_turn_keys",
+    sql: `
+    create table parlor_auth_turn_keys (
+      kid text primary key,
+      public_key jsonb not null,
+      private_key text not null,
+      active boolean not null default true,
+      created_at timestamptz not null default now()
+    );
+    create unique index parlor_auth_turn_keys_active on parlor_auth_turn_keys (active) where active`,
+};
+const KEY_ALGORITHM = { name: "ECDSA", namedCurve: "P-256" };
+const REFRESH_MIN_INTERVAL_MS = 1000;
+function sealingKey(secret) {
+    return Buffer.from(hkdfSync("sha256", secret, "", "parlor-auth/turn-keys", 32));
+}
+function seal(secret, plaintext) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", sealingKey(secret), iv);
+    const body = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return [iv, cipher.getAuthTag(), body]
+        .map((part) => part.toString("base64url"))
+        .join(".");
+}
+function unseal(secret, sealed) {
+    const [iv, tag, body] = sealed.split(".").map((part) => Buffer.from(part, "base64url"));
+    if (!iv || !tag || !body)
+        throw new Error("The sealed turn key is malformed.");
+    const decipher = createDecipheriv("aes-256-gcm", sealingKey(secret), iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(body), decipher.final()]).toString("utf8");
+}
+export function createTurnKeyStore(options) {
+    const { database, issuer } = options;
+    const now = options.now ?? Date.now;
+    let loaded;
+    let refreshedAt = 0;
+    const read = async () => rowsOf(await database.read().execute(sql `select kid, public_key, private_key, active from parlor_auth_turn_keys`));
+    const replace = async (secret, retiring) => {
+        const pair = await generateKeyPair("ES256", { extractable: true });
+        const publicKey = await exportJWK(pair.publicKey);
+        const privateKey = await exportJWK(pair.privateKey);
+        const kid = crypto.randomUUID();
+        await database.transaction(async (tx) => {
+            const db = tx;
+            if (retiring !== undefined) {
+                await db.execute(sql `update parlor_auth_turn_keys set active = false where kid = ${retiring} and active`);
+            }
+            await db.execute(sql `
+        insert into parlor_auth_turn_keys (kid, public_key, private_key)
+        values (${kid}, ${JSON.stringify(publicKey)}::jsonb, ${seal(secret, JSON.stringify(privateKey))})
+        on conflict do nothing`);
+        });
+    };
+    const signingKeyOf = async (secret, row) => {
+        try {
+            return await crypto.subtle.importKey("jwk", JSON.parse(unseal(secret, row.private_key)), KEY_ALGORITHM, false, ["sign"]);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const build = async (mayReplace) => {
+        const secret = await options.secret();
+        let rows = await read();
+        let active = rows.find((row) => row.active);
+        let privateKey = active && (await signingKeyOf(secret, active));
+        if (!privateKey && !mayReplace)
+            throw new Error("The turn signing key cannot be opened.");
+        if (!privateKey) {
+            await replace(secret, active?.kid);
+            rows = await read();
+            active = rows.find((row) => row.active);
+            privateKey = active && (await signingKeyOf(secret, active));
+        }
+        if (!active || !privateKey)
+            throw new Error("The turn signing key could not be created.");
+        const verifyKeys = await Promise.all(rows.map(async (row) => {
+            const key = await crypto.subtle.importKey("jwk", jwkOf(row.public_key), KEY_ALGORITHM, false, ["verify"]);
+            return [row.kid, key];
+        }));
+        return { issuer, kid: active.kid, privateKey, publicKeys: new Map(verifyKeys) };
+    };
+    const load = () => {
+        loaded ??= build(true).catch((error) => {
+            loaded = undefined;
+            throw error;
+        });
+        return loaded;
+    };
+    return {
+        keys: load,
+        async refresh() {
+            const current = await load();
+            if (now() - refreshedAt < REFRESH_MIN_INTERVAL_MS)
+                return current;
+            refreshedAt = now();
+            loaded = build(false).catch(() => current);
+            return loaded;
+        },
+    };
+}
+//# sourceMappingURL=turn-keys.js.map

package/dist/turn-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-keys.js","sourceRoot":"","sources":["../src/turn-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItF,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAElD,OAAO,EAAiB,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAG7D,MAAM,CAAC,MAAM,mBAAmB,GAAc;IAC5C,EAAE,EAAE,qBAAqB;IACzB,GAAG,EAAE;;;;;;;;oGAQ6F;CACnG,CAAC;AAEF,MAAM,aAAa,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AASrC,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,SAAiB;IAC7C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC;SACnC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SACzC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,MAAc;IAC5C,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAcD,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,MAA0C,CAAC;IAC/C,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,MAAM,IAAI,GAAG,KAAK,IAAuB,EAAE,CACzC,MAAM,CACJ,MAAO,QAAQ,CAAC,IAAI,EAAe,CAAC,OAAO,CACzC,GAAG,CAAA,wEAAwE,CAC5E,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,QAA4B,EAAiB,EAAE;QACpF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,EAAc,CAAC;YAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,+DAA+D,QAAQ,aAAa,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;kBAER,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;+BACxE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EACxB,MAAc,EACd,GAAW,EACqB,EAAE;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAe,EACzD,aAAa,EACb,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,UAAmB,EAA0B,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACnC,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;YACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EACrB,aAAa,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAU,CAAC;QACjC,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IAClF,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAA2B,EAAE;QACxC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC9C,MAAM,GAAG,SAAS,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,CAAC,OAAO;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;YAC7B,IAAI,GAAG,EAAE,GAAG,WAAW,GAAG,uBAAuB;gBAAE,OAAO,OAAO,CAAC;YAClE,WAAW,GAAG,GAAG,EAAE,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@parlor/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "homepage": "https://cychien.github.io/parlor",
+  "bugs": "https://github.com/cychien/parlor/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cychien/parlor.git",
+    "directory": "packages/auth"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "import": "./dist/schema.js",
+      "default": "./dist/schema.js"
+    }
+  },
+  "dependencies": {
+    "@better-auth/cimd": "1.7.7",
+    "@better-auth/mcp": "1.7.7",
+    "@better-auth/oauth-provider": "1.7.7",
+    "better-auth": "1.7.7",
+    "drizzle-orm": "^0.45.4",
+    "jose": "^6.2.12",
+    "zod": "^4.6.5",
+    "@parlor/capabilities": "0.1.0",
+    "@parlor/chat": "0.1.0",
+    "@parlor/client": "0.1.0",
+    "@parlor/core": "0.1.0",
+    "@parlor/server": "0.1.0"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/client": "^2.3.1",
+    "@types/node": "^24.14.0",
+    "@types/pg": "^8.23.1",
+    "auth": "1.7.7",
+    "pg": "^8.23.1",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3",
+    "@parlor/data": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }