@parlor/auth 0.0.0-stage → 0.2.0

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,YAAY,EAMlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAoDjE,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE;QACZ,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAC/C,QAAQ,CAAC,OAAO,EAAE;gBAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,EAAE;gBACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;aACxB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;KACX,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/C;AAED,UAAU,KAAK;IACb,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACxE,UAAU,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE;QACxB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACzC;IACE;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC,CAAC;AAuBN;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,YAAY,CA2RpF"}

package/dist/provider.js

@@ -0,0 +1,301 @@
+import { ANONYMOUS, asId, } from "@parlor/core";
+import { createRegistry } from "@parlor/core/registry";
+import { AuthFailure, REVOCATION_HORIZON_MS, } from "@parlor/server";
+import { betterAuth } from "better-auth";
+import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify, } from "jose";
+import { accountActions } from "./account.js";
+import { AUDIT_MIGRATION, createAuditLog } from "./audit.js";
+import { AUTH_PLUGIN, bridgeOf, MCP_SCOPE, } from "./better-auth.js";
+import { createDeviceRegistry, deviceAccountActions, DEVICE_LINKING_MIGRATION, DEVICES_MIGRATION, } from "./devices.js";
+import { grantIdOf } from "./grants.js";
+import { createGrantKeys, hostAccountActions, hostPrincipalOf, HOSTS_MIGRATION, hostRoutes, verifyHostAssertion, } from "./hosts.js";
+import { AUTH_MIGRATIONS } from "./migrations.js";
+import { RevocationSet } from "./revocation.js";
+import { authRoutes } from "./routes.js";
+import { agentPrincipalOf, credentialOf, delegate, verifyTurnToken, } from "./tokens.js";
+import { createTurnKeyStore, TURN_KEYS_MIGRATION, } from "./turn-keys.js";
+/** Stands in for the instance until the first call needs it. */
+function deferredInstance(options) {
+    let created;
+    const current = () => (created ??= betterAuth(options));
+    return {
+        options,
+        handler: (request) => current().handler(request),
+        api: { getSession: (input) => current().api.getSession(input) },
+        get $context() {
+            return current().$context;
+        },
+    };
+}
+function hasCookie(request, name) {
+    const cookie = request.headers.get("cookie");
+    if (!cookie)
+        return false;
+    return cookie.split(";").some((part) => part.trim().startsWith(`${name}=`));
+}
+/**
+ * Sessions become user principals: a cookie on the same-origin web, a bearer token in
+ * native shells. Access tokens Better Auth issued to MCP clients become agent principals
+ * without a turn.
+ */
+export function betterAuthProvider(provided) {
+    const instance = "instance" in provided ? provided.instance : deferredInstance(provided.options);
+    const bridge = bridgeOf(instance.options);
+    const settings = bridge.settings;
+    let revocations;
+    let keys;
+    let grantKeys;
+    let turnKeys;
+    let devices;
+    const clientNames = new Map();
+    const authenticatedAt = new WeakMap();
+    const installed = () => {
+        if (!grantKeys || !turnKeys || !devices) {
+            throw new Error("The auth provider is not installed.");
+        }
+        return { grantKeys, turnKeys, devices };
+    };
+    const started = () => {
+        if (!revocations)
+            throw new Error("The auth provider is not installed.");
+        return revocations;
+    };
+    let preparingTurnKeys = false;
+    const ready = async () => {
+        await started().ready();
+        if (!preparingTurnKeys) {
+            preparingTurnKeys = true;
+            installed()
+                .turnKeys.keys()
+                .catch(() => {
+                preparingTurnKeys = false;
+            });
+        }
+    };
+    const loadKeys = async () => {
+        const response = await instance.handler(new Request(`${settings.baseURL}/jwks`));
+        if (!response.ok)
+            throw new Error(`Better Auth answered /jwks with ${response.status}`);
+        return createLocalJWKSet((await response.json()));
+    };
+    const verify = async (token) => {
+        const options = {
+            issuer: settings.baseURL,
+            audience: settings.resource,
+            typ: "at+jwt",
+        };
+        keys ??= await loadKeys();
+        try {
+            return (await jwtVerify(token, keys, options)).payload;
+        }
+        catch (error) {
+            if (!(error instanceof errors.JWKSNoMatchingKey))
+                throw error;
+            keys = await loadKeys();
+            return (await jwtVerify(token, keys, options)).payload;
+        }
+    };
+    const clientName = (clientId) => {
+        let name = clientNames.get(clientId);
+        if (!name) {
+            name = instance.$context
+                .then((context) => context.adapter.findOne({
+                model: "oauthClient",
+                where: [{ field: "clientId", value: clientId }],
+            }))
+                .then((client) => client?.name || clientId);
+            name.catch(() => clientNames.delete(clientId));
+            clientNames.set(clientId, name);
+        }
+        return name;
+    };
+    const agentOf = async (token) => {
+        let payload;
+        try {
+            payload = await verify(token);
+        }
+        catch (error) {
+            if (error instanceof errors.JWTExpired) {
+                throw new AuthFailure("expired", "The access token expired.");
+            }
+            throw new AuthFailure("invalid", "The access token is invalid.");
+        }
+        const { sub, iat } = payload;
+        const clientId = payload.client_id;
+        const scopes = typeof payload.scope === "string" ? payload.scope.split(" ") : [];
+        if (typeof sub !== "string" || typeof clientId !== "string" || iat === undefined) {
+            throw new AuthFailure("invalid", "The access token is missing claims.");
+        }
+        if (!scopes.includes(MCP_SCOPE)) {
+            throw new AuthFailure("invalid", `The access token lacks the "${MCP_SCOPE}" scope.`);
+        }
+        const grantId = grantIdOf(sub, clientId);
+        if (await started().isRevoked({ kind: "grant", id: grantId }, iat * 1000)) {
+            throw new AuthFailure("revoked", "Access for this agent was revoked.");
+        }
+        return {
+            kind: "agent",
+            userId: asId("user", sub),
+            grantId,
+            agent: {
+                name: await clientName(clientId),
+                verified: clientId.startsWith("https://"),
+            },
+        };
+    };
+    const userOf = async (request) => {
+        const found = await instance.api.getSession({ headers: request.headers });
+        if (!found)
+            return undefined;
+        return {
+            kind: "user",
+            userId: asId("user", found.user.id),
+            sessionId: found.session.id,
+        };
+    };
+    const publicUrlOf = (request) => new URL(new URL(request.url).pathname, settings.origin).href;
+    const hostOf = async (request, assertion) => {
+        const grant = await verifyHostAssertion(assertion, { method: request.method, url: publicUrlOf(request) }, installed().grantKeys, Date.now());
+        if (await started().isRevoked({ kind: "grant", id: grant.grantId })) {
+            throw new AuthFailure("revoked", "This computer was disconnected.");
+        }
+        return hostPrincipalOf(grant);
+    };
+    const turnOf = async (token) => {
+        const store = installed().turnKeys;
+        let turnTokenKeys = await store.keys();
+        const kid = decodeProtectedHeader(token).kid;
+        if (kid !== undefined && !turnTokenKeys.publicKeys.has(kid)) {
+            turnTokenKeys = await store.refresh();
+        }
+        const claims = await verifyTurnToken(turnTokenKeys, token, Date.now());
+        if (await started().isRevoked({ kind: "grant", id: claims.gid })) {
+            throw new AuthFailure("revoked", "This computer was disconnected.");
+        }
+        return agentPrincipalOf(claims);
+    };
+    const authenticateRequest = async (request) => {
+        await ready();
+        const credential = credentialOf(request.headers.get("authorization"));
+        switch (credential?.kind) {
+            case "host":
+                return hostOf(request, credential.assertion);
+            case "turn":
+                return turnOf(credential.token);
+            case "access":
+                return agentOf(credential.token);
+            case "session": {
+                const user = await userOf(request);
+                if (!user)
+                    throw new AuthFailure("invalid", "The session is invalid or has ended.");
+                return user;
+            }
+            case undefined:
+                break;
+        }
+        const { authCookies } = await instance.$context;
+        if (!hasCookie(request, authCookies.sessionToken.name))
+            return ANONYMOUS;
+        return (await userOf(request)) ?? ANONYMOUS;
+    };
+    return {
+        name: AUTH_PLUGIN,
+        migrations: [
+            ...AUTH_MIGRATIONS,
+            HOSTS_MIGRATION,
+            DEVICES_MIGRATION,
+            TURN_KEYS_MIGRATION,
+            AUDIT_MIGRATION,
+            DEVICE_LINKING_MIGRATION,
+        ],
+        enforcing: true,
+        setup(host) {
+            const { database } = host;
+            if (!database)
+                throw new Error("The auth plugin needs a database.");
+            const set = new RevocationSet({
+                database,
+                horizonMs: REVOCATION_HORIZON_MS,
+            });
+            revocations = set;
+            const auditLog = createAuditLog(database);
+            bridge.revoke = (notice) => database.transaction((tx) => RevocationSet.revoke(tx, notice));
+            grantKeys = createGrantKeys(database);
+            devices = createDeviceRegistry(database);
+            turnKeys = createTurnKeyStore({
+                database,
+                issuer: settings.baseURL,
+                secret: async () => (await instance.$context).secret,
+            });
+            const hostDeps = {
+                host,
+                settings,
+            };
+            return {
+                actions: createRegistry({
+                    ...accountActions({ instance, host, revoke: bridge.revoke }).actions,
+                    ...hostAccountActions(hostDeps).actions,
+                    ...deviceAccountActions({ host, registry: devices }).actions,
+                }),
+                routes: [...authRoutes({ instance, settings, host }), ...hostRoutes(hostDeps)],
+                audit: (record) => auditLog.record(record),
+                close: async () => {
+                    await Promise.all([set.stop(), auditLog.stop()]);
+                },
+            };
+        },
+        async authenticate(request) {
+            const startedAt = Date.now();
+            const principal = await authenticateRequest(request);
+            if (principal.kind !== "anonymous")
+                authenticatedAt.set(principal, startedAt);
+            return principal;
+        },
+        challenge() {
+            const metadata = `${settings.origin}/.well-known/oauth-protected-resource${new URL(settings.resource).pathname}`;
+            return Response.json({ error: { code: "unauthenticated", message: "Sign in through OAuth first." } }, {
+                status: 401,
+                headers: {
+                    "www-authenticate": `Bearer resource_metadata="${metadata}", scope="${MCP_SCOPE}"`,
+                },
+            });
+        },
+        async delegate(host, turn) {
+            await ready();
+            return delegate(await installed().turnKeys.keys(), host, turn, Date.now());
+        },
+        async hostActive(grantId) {
+            const revoked = await started().isRevoked({ kind: "grant", id: grantId });
+            return !revoked && (await installed().grantKeys.get(grantId)) !== undefined;
+        },
+        async device(userId, deviceId) {
+            const registered = await installed().devices.get(userId, deviceId);
+            if (!registered)
+                return undefined;
+            const { id, name, platform, signingKey, presenceKey, vouches } = registered;
+            return {
+                id,
+                name,
+                platform,
+                signingKey,
+                presenceKey,
+                ...(vouches ? { vouches } : {}),
+            };
+        },
+        async account(userId) {
+            const { adapter } = await instance.$context;
+            const user = await adapter.findOne({
+                model: "user",
+                where: [{ field: "id", value: userId }],
+            });
+            return user ? { name: user.name, email: user.email } : undefined;
+        },
+        revoked(principal) {
+            const notice = principal.kind === "user"
+                ? { kind: "session", id: principal.sessionId }
+                : { kind: "grant", id: principal.grantId };
+            return started().signal([notice], authenticatedAt.get(principal));
+        },
+    };
+}
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,SAAS,EACT,IAAI,GAQL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEL,WAAW,EAKX,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,EAGN,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,QAAQ,EACR,SAAS,GAEV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,eAAe,EAEf,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EAGR,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AA4DxB,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,OAA0B;IAClD,IAAI,OAAuC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAkC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO;QACP,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;QAC/D,IAAI,QAAQ;YACV,OAAO,OAAO,EAAE,CAAC,QAAQ,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAmC;IACpE,MAAM,QAAQ,GACZ,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAuB,MAAM,CAAC,QAAQ,CAAC;IACrD,IAAI,WAAsC,CAAC;IAC3C,IAAI,IAAsD,CAAC;IAC3D,IAAI,SAAgC,CAAC;IACrC,IAAI,QAAkC,CAAC;IACvC,IAAI,OAAmC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAkB,CAAC;IAEtD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzE,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,SAAS,EAAE;iBACR,QAAQ,CAAC,IAAI,EAAE;iBACf,KAAK,CAAC,GAAG,EAAE;gBACV,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO,iBAAiB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAuB,EAAE;QAC1D,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,QAAQ,CAAC,OAAO;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,QAAQ;SACd,CAAC;QACF,IAAI,KAAK,MAAM,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,iBAAiB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9D,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAmB,EAAE;QACvD,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,QAAQ,CAAC,QAAQ;iBACrB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,OAAO,CAAC,OAAO,CAA2B;gBAChD,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CACH;iBACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA2B,EAAE;QAC/D,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,+BAA+B,SAAS,UAAU,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YACzB,OAAO;YACP,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;aAC1C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAgB,EAAsC,EAAE;QAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAU,EAAE,CAC/C,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,KAAK,EAClB,OAAgB,EAChB,SAAwB,EACA,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,SAAS,EACT,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EACrD,SAAS,EAAE,CAAC,SAAS,EACrB,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgB,EAA2B,EAAE;QACjE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC;QACnC,IAAI,aAAa,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAgB,EAAsB,EAAE;QACzE,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACtE,QAAQ,UAAU,EAAE,IAAI,EAAE,CAAC;YACzB,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YAC/C,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,QAAQ;gBACX,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACnC,KAAK,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnC,IAAI,CAAC,IAAI;oBACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM;QACV,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzE,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IAC9C,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE;YACV,GAAG,eAAe;YAClB,eAAe;YACf,iBAAiB;YACjB,mBAAmB;YACnB,eAAe;YACf,wBAAwB;SACzB;QACD,SAAS,EAAE,IAAI;QACf,KAAK,CAAC,IAAgB;YACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,QAAQ;gBACR,SAAS,EAAE,qBAAqB;aACjC,CAAC,CAAC;YACH,WAAW,GAAG,GAAG,CAAC;YAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CACzB,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACzC,QAAQ,GAAG,kBAAkB,CAAC;gBAC5B,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,OAAO;gBACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM;aACrD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG;gBACf,IAAI;gBACJ,QAAQ;aACT,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,cAAc,CAAC;oBACtB,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;oBACpE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,OAAO;oBACvC,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;iBAC7D,CAAC;gBACF,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9E,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1C,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnD,CAAC;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAgB;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;gBAAE,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS;YACP,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,wCAAwC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACjH,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAC/E;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,kBAAkB,EAAE,6BAA6B,QAAQ,aAAa,SAAS,GAAG;iBACnF;aACF,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAmB,EAAE,IAAoB;YACtD,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,MAAM,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAgB;YAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAkB;YAC7C,MAAM,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;YAC5E,OAAO;gBACL,EAAE;gBACF,IAAI;gBACJ,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAc;YAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAkC;gBAClE,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,SAAiC;YACvC,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,MAAM;gBACvB,CAAC,CAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAY;gBACzD,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,OAAO,EAAY,CAAC;YAC1D,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type AgentPrincipal,\n  ANONYMOUS,\n  asId,\n  type AuthenticatedPrincipal,\n  type DeviceId,\n  type GrantId,\n  type HostPrincipal,\n  type Principal,\n  type UserId,\n  type UserPrincipal,\n} from \"@parlor/core\";\nimport { createRegistry } from \"@parlor/core/registry\";\nimport {\n  type AccountProfile,\n  AuthFailure,\n  type AuthProvider,\n  type Delegation,\n  type DeviceKeys,\n  type PluginHost,\n  REVOCATION_HORIZON_MS,\n  type TurnDelegation,\n} from \"@parlor/server\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport {\n  createLocalJWKSet,\n  decodeProtectedHeader,\n  errors,\n  type JSONWebKeySet,\n  type JWTPayload,\n  jwtVerify,\n} from \"jose\";\n\nimport { accountActions } from \"./account.js\";\nimport { AUDIT_MIGRATION, createAuditLog } from \"./audit.js\";\nimport {\n  AUTH_PLUGIN,\n  bridgeOf,\n  MCP_SCOPE,\n  type ParlorAuthSettings,\n} from \"./better-auth.js\";\nimport {\n  createDeviceRegistry,\n  type DeviceRegistry,\n  deviceAccountActions,\n  DEVICE_LINKING_MIGRATION,\n  DEVICES_MIGRATION,\n} from \"./devices.js\";\nimport { grantIdOf } from \"./grants.js\";\nimport {\n  createGrantKeys,\n  type GrantKeys,\n  hostAccountActions,\n  hostPrincipalOf,\n  HOSTS_MIGRATION,\n  hostRoutes,\n  verifyHostAssertion,\n} from \"./hosts.js\";\nimport { AUTH_MIGRATIONS } from \"./migrations.js\";\nimport { RevocationSet } from \"./revocation.js\";\nimport { authRoutes } from \"./routes.js\";\nimport {\n  agentPrincipalOf,\n  credentialOf,\n  delegate,\n  type HostAssertion,\n  type TurnToken,\n  verifyTurnToken,\n} from \"./tokens.js\";\nimport {\n  createTurnKeyStore,\n  TURN_KEYS_MIGRATION,\n  type TurnKeyStore,\n} from \"./turn-keys.js\";\n\n/** The slice of a Better Auth instance Parlor relies on. */\nexport interface BetterAuthInstance {\n  readonly options: BetterAuthOptions;\n  handler(request: Request): Promise<Response>;\n  readonly api: {\n    getSession(input: { headers: Headers }): Promise<{\n      readonly session: { readonly id: string; readonly userId: string };\n      readonly user: {\n        readonly id: string;\n        readonly name: string;\n        readonly email: string;\n      };\n    } | null>;\n  };\n  readonly $context: Promise<BetterAuthContext>;\n}\n\ninterface Where {\n  readonly field: string;\n  readonly value: string;\n}\n\nexport interface BetterAuthContext {\n  readonly authCookies: { readonly sessionToken: { readonly name: string } };\n  readonly adapter: {\n    findMany<T>(input: { model: string; where?: Where[] }): Promise<T[]>;\n    findOne<T>(input: { model: string; where: Where[] }): Promise<T | null>;\n    deleteMany(input: { model: string; where: Where[] }): Promise<number>;\n  };\n  readonly secret: string;\n  readonly internalAdapter: {\n    listSessions(userId: string): Promise<StoredSession[]>;\n    deleteSession(token: string): Promise<void>;\n  };\n}\n\nexport interface StoredSession {\n  readonly id: string;\n  readonly token: string;\n  readonly userId: string;\n  readonly createdAt: Date;\n  readonly updatedAt: Date;\n  readonly expiresAt: Date;\n  readonly ipAddress?: string | null | undefined;\n  readonly userAgent?: string | null | undefined;\n}\n\nexport type BetterAuthProviderOptions =\n  | { readonly instance: BetterAuthInstance }\n  | {\n      /**\n       * The options for `betterAuth()`, which the provider calls on the first request.\n       * Better Auth starts querying the database as soon as it is created, and some\n       * runtimes, such as Cloudflare's, allow no I/O while the app loads.\n       */\n      readonly options: BetterAuthOptions;\n    };\n\n/** Stands in for the instance until the first call needs it. */\nfunction deferredInstance(options: BetterAuthOptions): BetterAuthInstance {\n  let created: BetterAuthInstance | undefined;\n  const current = () =>\n    (created ??= betterAuth(options) as unknown as BetterAuthInstance);\n  return {\n    options,\n    handler: (request) => current().handler(request),\n    api: { getSession: (input) => current().api.getSession(input) },\n    get $context() {\n      return current().$context;\n    },\n  };\n}\n\nfunction hasCookie(request: Request, name: string): boolean {\n  const cookie = request.headers.get(\"cookie\");\n  if (!cookie) return false;\n  return cookie.split(\";\").some((part) => part.trim().startsWith(`${name}=`));\n}\n\n/**\n * Sessions become user principals: a cookie on the same-origin web, a bearer token in\n * native shells. Access tokens Better Auth issued to MCP clients become agent principals\n * without a turn.\n */\nexport function betterAuthProvider(provided: BetterAuthProviderOptions): AuthProvider {\n  const instance =\n    \"instance\" in provided ? provided.instance : deferredInstance(provided.options);\n  const bridge = bridgeOf(instance.options);\n  const settings: ParlorAuthSettings = bridge.settings;\n  let revocations: RevocationSet | undefined;\n  let keys: ReturnType<typeof createLocalJWKSet> | undefined;\n  let grantKeys: GrantKeys | undefined;\n  let turnKeys: TurnKeyStore | undefined;\n  let devices: DeviceRegistry | undefined;\n  const clientNames = new Map<string, Promise<string>>();\n  const authenticatedAt = new WeakMap<object, number>();\n\n  const installed = () => {\n    if (!grantKeys || !turnKeys || !devices) {\n      throw new Error(\"The auth provider is not installed.\");\n    }\n    return { grantKeys, turnKeys, devices };\n  };\n\n  const started = () => {\n    if (!revocations) throw new Error(\"The auth provider is not installed.\");\n    return revocations;\n  };\n\n  let preparingTurnKeys = false;\n  const ready = async (): Promise<void> => {\n    await started().ready();\n    if (!preparingTurnKeys) {\n      preparingTurnKeys = true;\n      installed()\n        .turnKeys.keys()\n        .catch(() => {\n          preparingTurnKeys = false;\n        });\n    }\n  };\n\n  const loadKeys = async () => {\n    const response = await instance.handler(new Request(`${settings.baseURL}/jwks`));\n    if (!response.ok)\n      throw new Error(`Better Auth answered /jwks with ${response.status}`);\n    return createLocalJWKSet((await response.json()) as JSONWebKeySet);\n  };\n\n  const verify = async (token: string): Promise<JWTPayload> => {\n    const options = {\n      issuer: settings.baseURL,\n      audience: settings.resource,\n      typ: \"at+jwt\",\n    };\n    keys ??= await loadKeys();\n    try {\n      return (await jwtVerify(token, keys, options)).payload;\n    } catch (error) {\n      if (!(error instanceof errors.JWKSNoMatchingKey)) throw error;\n      keys = await loadKeys();\n      return (await jwtVerify(token, keys, options)).payload;\n    }\n  };\n\n  const clientName = (clientId: string): Promise<string> => {\n    let name = clientNames.get(clientId);\n    if (!name) {\n      name = instance.$context\n        .then((context) =>\n          context.adapter.findOne<{ name?: string | null }>({\n            model: \"oauthClient\",\n            where: [{ field: \"clientId\", value: clientId }],\n          }),\n        )\n        .then((client) => client?.name || clientId);\n      name.catch(() => clientNames.delete(clientId));\n      clientNames.set(clientId, name);\n    }\n    return name;\n  };\n\n  const agentOf = async (token: string): Promise<AgentPrincipal> => {\n    let payload: JWTPayload;\n    try {\n      payload = await verify(token);\n    } catch (error) {\n      if (error instanceof errors.JWTExpired) {\n        throw new AuthFailure(\"expired\", \"The access token expired.\");\n      }\n      throw new AuthFailure(\"invalid\", \"The access token is invalid.\");\n    }\n    const { sub, iat } = payload;\n    const clientId = payload.client_id;\n    const scopes = typeof payload.scope === \"string\" ? payload.scope.split(\" \") : [];\n    if (typeof sub !== \"string\" || typeof clientId !== \"string\" || iat === undefined) {\n      throw new AuthFailure(\"invalid\", \"The access token is missing claims.\");\n    }\n    if (!scopes.includes(MCP_SCOPE)) {\n      throw new AuthFailure(\n        \"invalid\",\n        `The access token lacks the \"${MCP_SCOPE}\" scope.`,\n      );\n    }\n    const grantId = grantIdOf(sub, clientId);\n    if (await started().isRevoked({ kind: \"grant\", id: grantId }, iat * 1000)) {\n      throw new AuthFailure(\"revoked\", \"Access for this agent was revoked.\");\n    }\n    return {\n      kind: \"agent\",\n      userId: asId(\"user\", sub),\n      grantId,\n      agent: {\n        name: await clientName(clientId),\n        verified: clientId.startsWith(\"https://\"),\n      },\n    };\n  };\n\n  const userOf = async (request: Request): Promise<UserPrincipal | undefined> => {\n    const found = await instance.api.getSession({ headers: request.headers });\n    if (!found) return undefined;\n    return {\n      kind: \"user\",\n      userId: asId(\"user\", found.user.id),\n      sessionId: found.session.id,\n    };\n  };\n\n  const publicUrlOf = (request: Request): string =>\n    new URL(new URL(request.url).pathname, settings.origin).href;\n\n  const hostOf = async (\n    request: Request,\n    assertion: HostAssertion,\n  ): Promise<HostPrincipal> => {\n    const grant = await verifyHostAssertion(\n      assertion,\n      { method: request.method, url: publicUrlOf(request) },\n      installed().grantKeys,\n      Date.now(),\n    );\n    if (await started().isRevoked({ kind: \"grant\", id: grant.grantId })) {\n      throw new AuthFailure(\"revoked\", \"This computer was disconnected.\");\n    }\n    return hostPrincipalOf(grant);\n  };\n\n  const turnOf = async (token: TurnToken): Promise<AgentPrincipal> => {\n    const store = installed().turnKeys;\n    let turnTokenKeys = await store.keys();\n    const kid = decodeProtectedHeader(token).kid;\n    if (kid !== undefined && !turnTokenKeys.publicKeys.has(kid)) {\n      turnTokenKeys = await store.refresh();\n    }\n    const claims = await verifyTurnToken(turnTokenKeys, token, Date.now());\n    if (await started().isRevoked({ kind: \"grant\", id: claims.gid })) {\n      throw new AuthFailure(\"revoked\", \"This computer was disconnected.\");\n    }\n    return agentPrincipalOf(claims);\n  };\n\n  const authenticateRequest = async (request: Request): Promise<Principal> => {\n    await ready();\n    const credential = credentialOf(request.headers.get(\"authorization\"));\n    switch (credential?.kind) {\n      case \"host\":\n        return hostOf(request, credential.assertion);\n      case \"turn\":\n        return turnOf(credential.token);\n      case \"access\":\n        return agentOf(credential.token);\n      case \"session\": {\n        const user = await userOf(request);\n        if (!user)\n          throw new AuthFailure(\"invalid\", \"The session is invalid or has ended.\");\n        return user;\n      }\n      case undefined:\n        break;\n    }\n    const { authCookies } = await instance.$context;\n    if (!hasCookie(request, authCookies.sessionToken.name)) return ANONYMOUS;\n    return (await userOf(request)) ?? ANONYMOUS;\n  };\n\n  return {\n    name: AUTH_PLUGIN,\n    migrations: [\n      ...AUTH_MIGRATIONS,\n      HOSTS_MIGRATION,\n      DEVICES_MIGRATION,\n      TURN_KEYS_MIGRATION,\n      AUDIT_MIGRATION,\n      DEVICE_LINKING_MIGRATION,\n    ],\n    enforcing: true,\n    setup(host: PluginHost) {\n      const { database } = host;\n      if (!database) throw new Error(\"The auth plugin needs a database.\");\n      const set = new RevocationSet({\n        database,\n        horizonMs: REVOCATION_HORIZON_MS,\n      });\n      revocations = set;\n      const auditLog = createAuditLog(database);\n      bridge.revoke = (notice) =>\n        database.transaction((tx) => RevocationSet.revoke(tx, notice));\n      grantKeys = createGrantKeys(database);\n      devices = createDeviceRegistry(database);\n      turnKeys = createTurnKeyStore({\n        database,\n        issuer: settings.baseURL,\n        secret: async () => (await instance.$context).secret,\n      });\n      const hostDeps = {\n        host,\n        settings,\n      };\n      return {\n        actions: createRegistry({\n          ...accountActions({ instance, host, revoke: bridge.revoke }).actions,\n          ...hostAccountActions(hostDeps).actions,\n          ...deviceAccountActions({ host, registry: devices }).actions,\n        }),\n        routes: [...authRoutes({ instance, settings, host }), ...hostRoutes(hostDeps)],\n        audit: (record) => auditLog.record(record),\n        close: async () => {\n          await Promise.all([set.stop(), auditLog.stop()]);\n        },\n      };\n    },\n    async authenticate(request: Request): Promise<Principal> {\n      const startedAt = Date.now();\n      const principal = await authenticateRequest(request);\n      if (principal.kind !== \"anonymous\") authenticatedAt.set(principal, startedAt);\n      return principal;\n    },\n    challenge(): Response {\n      const metadata = `${settings.origin}/.well-known/oauth-protected-resource${new URL(settings.resource).pathname}`;\n      return Response.json(\n        { error: { code: \"unauthenticated\", message: \"Sign in through OAuth first.\" } },\n        {\n          status: 401,\n          headers: {\n            \"www-authenticate\": `Bearer resource_metadata=\"${metadata}\", scope=\"${MCP_SCOPE}\"`,\n          },\n        },\n      );\n    },\n    async delegate(host: HostPrincipal, turn: TurnDelegation): Promise<Delegation> {\n      await ready();\n      return delegate(await installed().turnKeys.keys(), host, turn, Date.now());\n    },\n    async hostActive(grantId: GrantId): Promise<boolean> {\n      const revoked = await started().isRevoked({ kind: \"grant\", id: grantId });\n      return !revoked && (await installed().grantKeys.get(grantId)) !== undefined;\n    },\n    async device(userId: UserId, deviceId: DeviceId): Promise<DeviceKeys | undefined> {\n      const registered = await installed().devices.get(userId, deviceId);\n      if (!registered) return undefined;\n      const { id, name, platform, signingKey, presenceKey, vouches } = registered;\n      return {\n        id,\n        name,\n        platform,\n        signingKey,\n        presenceKey,\n        ...(vouches ? { vouches } : {}),\n      };\n    },\n    async account(userId: UserId): Promise<AccountProfile | undefined> {\n      const { adapter } = await instance.$context;\n      const user = await adapter.findOne<{ name: string; email: string }>({\n        model: \"user\",\n        where: [{ field: \"id\", value: userId }],\n      });\n      return user ? { name: user.name, email: user.email } : undefined;\n    },\n    revoked(principal: AuthenticatedPrincipal): AbortSignal {\n      const notice =\n        principal.kind === \"user\"\n          ? ({ kind: \"session\", id: principal.sessionId } as const)\n          : ({ kind: \"grant\", id: principal.grantId } as const);\n      return started().signal([notice], authenticatedAt.get(principal));\n    },\n  };\n}\n"]}

package/dist/revocation.d.ts

@@ -0,0 +1,51 @@
+import type { DataProvider } from "@parlor/core";
+export declare const REVOCATION_CHANNEL = "parlor_auth";
+/** NOTIFY payload. Ids only, never content. */
+export interface RevocationNotice {
+    readonly kind: "session" | "grant";
+    readonly id: string;
+}
+export interface RevocationSetOptions {
+    readonly database: DataProvider;
+    /**
+     * The longest any credential this set guards stays valid. Older revocations are
+     * forgotten: nothing they revoke can still verify.
+     */
+    readonly horizonMs: number;
+    readonly now?: (() => number) | undefined;
+    readonly relistenBaseMs?: number | undefined;
+    readonly relistenMaxMs?: number | undefined;
+}
+/**
+ * `following` answers from memory, kept current by NOTIFY. `checking` answers with one
+ * primary-key lookup per call: poll-only providers always do, and a following set falls
+ * back to it while its LISTEN connection is down.
+ */
+export type RevocationMode = "starting" | "following" | "checking";
+/**
+ * Every instance's view of what was revoked within the horizon. It loads before it
+ * admits anyone, and whenever its LISTEN connection drops it checks the table per call
+ * until it listens again and reloads, because a NOTIFY sent meanwhile is lost.
+ */
+export declare class RevocationSet {
+    #private;
+    constructor(options: RevocationSetOptions);
+    get mode(): RevocationMode;
+    /** Resolves once the set can answer; a failed start is retried by the next call. */
+    ready(): Promise<void>;
+    /**
+     * Revoked when a revocation of the notice is at or after `issuedAt`; without it, when
+     * any revocation of the notice is within the horizon.
+     */
+    isRevoked(notice: RevocationNotice, issuedAt?: number): Promise<boolean>;
+    /**
+     * Aborts when any of the notices is revoked at or after `since` (default: now). The
+     * watch is registered first and the revocations already known are checked after, so one
+     * that landed between `since` and this call still aborts it.
+     */
+    signal(notices: readonly RevocationNotice[], since?: number): AbortSignal;
+    /** Records the revocation in the caller's transaction; the NOTIFY goes out on commit. */
+    static revoke(tx: unknown, notice: RevocationNotice, at?: number): Promise<void>;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=revocation.d.ts.map

package/dist/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAKjD,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;AAWnE;;;;GAIG;AACH,qBAAa,aAAa;;IAkBxB,YAAY,OAAO,EAAE,oBAAoB,EAMxC;IAED,IAAI,IAAI,IAAI,cAAc,CAEzB;IAED,oFAAoF;IACpF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrB;IAED;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,SAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAOxE;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,KAAK,GAAE,MAAoB,GAAG,WAAW,CAcrF;IAED,yFAAyF;IACzF,OAAa,MAAM,CACjB,EAAE,EAAE,OAAO,EACX,MAAM,EAAE,gBAAgB,EACxB,EAAE,GAAE,MAAmB,GACtB,OAAO,CAAC,IAAI,CAAC,CAUf;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAO1B;CAwJF"}

package/dist/revocation.js

@@ -0,0 +1,233 @@
+import { sql } from "drizzle-orm";
+import { rowsOf } from "./database.js";
+export const REVOCATION_CHANNEL = "parlor_auth";
+const keyOf = ({ kind, id }) => `${kind}:${id}`;
+const owner = Symbol("parlor.revocation.owner");
+/**
+ * Every instance's view of what was revoked within the horizon. It loads before it
+ * admits anyone, and whenever its LISTEN connection drops it checks the table per call
+ * until it listens again and reloads, because a NOTIFY sent meanwhile is lost.
+ */
+export class RevocationSet {
+    #database;
+    #horizonMs;
+    #now;
+    #relistenBaseMs;
+    #relistenMaxMs;
+    #revoked = new Map();
+    #watches = new Map();
+    #forget = new FinalizationRegistry((key) => this.#sweepWatch(key));
+    #mode = "starting";
+    #ready;
+    #generation = 0;
+    #unlisten;
+    #reconnecting = false;
+    #retry;
+    #sweptAt = 0;
+    #stopped = false;
+    constructor(options) {
+        this.#database = options.database;
+        this.#horizonMs = options.horizonMs;
+        this.#now = options.now ?? Date.now;
+        this.#relistenBaseMs = options.relistenBaseMs ?? 1000;
+        this.#relistenMaxMs = options.relistenMaxMs ?? 30_000;
+    }
+    get mode() {
+        return this.#mode;
+    }
+    /** Resolves once the set can answer; a failed start is retried by the next call. */
+    ready() {
+        this.#ready ??= this.#start().catch((error) => {
+            this.#ready = undefined;
+            throw error;
+        });
+        return this.#ready;
+    }
+    /**
+     * Revoked when a revocation of the notice is at or after `issuedAt`; without it, when
+     * any revocation of the notice is within the horizon.
+     */
+    async isRevoked(notice, issuedAt = 0) {
+        await this.ready();
+        const at = this.#mode === "following"
+            ? this.#revoked.get(keyOf(notice))
+            : await this.#lookup(notice);
+        return at !== undefined && at >= Math.max(issuedAt, this.#now() - this.#horizonMs);
+    }
+    /**
+     * Aborts when any of the notices is revoked at or after `since` (default: now). The
+     * watch is registered first and the revocations already known are checked after, so one
+     * that landed between `since` and this call still aborts it.
+     */
+    signal(notices, since = this.#now()) {
+        const controller = new AbortController();
+        // The signal pins its controller, so a watch lives exactly as long as its holder.
+        Object.defineProperty(controller.signal, owner, { value: controller });
+        for (const notice of notices) {
+            const key = keyOf(notice);
+            const watch = this.#watches.get(key);
+            if (watch)
+                watch.since = Math.min(watch.since, since);
+            else
+                this.#watches.set(key, { controllers: new Set(), since });
+            this.#watches.get(key).controllers.add(new WeakRef(controller));
+            this.#forget.register(controller.signal, key);
+        }
+        this.#abortIfRevoked(controller, notices, since);
+        return controller.signal;
+    }
+    /** Records the revocation in the caller's transaction; the NOTIFY goes out on commit. */
+    static async revoke(tx, notice, at = Date.now()) {
+        const db = tx;
+        await db.execute(sql `
+      insert into parlor_auth_revocations (kind, id, revoked_at)
+      values (${notice.kind}, ${notice.id}, ${new Date(at).toISOString()})
+      on conflict (kind, id) do update set revoked_at = excluded.revoked_at`);
+        const payload = { kind: notice.kind, id: notice.id, at };
+        await db.execute(sql `select pg_notify(${REVOCATION_CHANNEL}, ${JSON.stringify(payload)})`);
+    }
+    async stop() {
+        this.#stopped = true;
+        this.#generation += 1;
+        if (this.#retry !== undefined)
+            clearTimeout(this.#retry);
+        const unlisten = this.#unlisten;
+        this.#unlisten = undefined;
+        await unlisten?.().catch(() => { });
+    }
+    async #start() {
+        await this.#prune();
+        if (!this.#database.listen) {
+            this.#mode = "checking";
+            return;
+        }
+        try {
+            await this.#connect(this.#now() - this.#horizonMs);
+        }
+        catch (error) {
+            console.warn("[parlor] revocations: LISTEN failed, checking per call:", error);
+            this.#mode = "checking";
+            this.#reconnect(this.#now());
+        }
+    }
+    async #connect(since) {
+        const generation = ++this.#generation;
+        const unlisten = await this.#database.listen(REVOCATION_CHANNEL, (payload) => this.#receive(payload), { onLost: () => this.#lost(generation) });
+        if (generation !== this.#generation) {
+            await unlisten().catch(() => { });
+            return;
+        }
+        this.#unlisten = unlisten;
+        const revocations = await this.#load(since);
+        if (generation !== this.#generation)
+            return;
+        for (const revocation of revocations)
+            this.#apply(revocation);
+        this.#mode = "following";
+    }
+    #lost(generation) {
+        if (generation !== this.#generation || this.#stopped)
+            return;
+        this.#generation += 1;
+        this.#unlisten = undefined;
+        this.#mode = "checking";
+        this.#reconnect(this.#now());
+    }
+    #reconnect(lostAt) {
+        if (this.#reconnecting)
+            return;
+        this.#reconnecting = true;
+        let delay = this.#relistenBaseMs;
+        const attempt = async () => {
+            this.#retry = undefined;
+            if (this.#stopped)
+                return;
+            try {
+                await this.#connect(Math.min(lostAt, this.#now() - this.#horizonMs));
+                this.#reconnecting = false;
+            }
+            catch (error) {
+                console.warn("[parlor] revocations: LISTEN failed, retrying:", error);
+                this.#retry = setTimeout(attempt, delay);
+                delay = Math.min(delay * 2, this.#relistenMaxMs);
+            }
+        };
+        this.#retry = setTimeout(attempt, 0);
+    }
+    #receive(payload) {
+        try {
+            this.#apply(JSON.parse(payload));
+        }
+        catch {
+            console.warn("[parlor] revocations: ignored a malformed notice");
+        }
+    }
+    #apply(revocation) {
+        const key = keyOf(revocation);
+        const known = this.#revoked.get(key);
+        if (known === undefined || revocation.at > known)
+            this.#revoked.set(key, revocation.at);
+        this.#sweepExpired();
+        const watch = this.#watches.get(key);
+        if (!watch || revocation.at < watch.since)
+            return;
+        this.#watches.delete(key);
+        for (const ref of watch.controllers)
+            ref.deref()?.abort();
+    }
+    #abortIfRevoked(controller, notices, since) {
+        const floor = Math.max(since, this.#now() - this.#horizonMs);
+        if (this.#mode === "following") {
+            const hit = notices.some((notice) => (this.#revoked.get(keyOf(notice)) ?? -1) >= floor);
+            if (hit)
+                controller.abort();
+            return;
+        }
+        Promise.all(notices.map((notice) => this.#lookup(notice))).then((found) => {
+            if (found.some((at) => at !== undefined && at >= floor))
+                controller.abort();
+        }, () => controller.abort());
+    }
+    #sweepExpired() {
+        const now = this.#now();
+        if (now - this.#sweptAt < this.#horizonMs)
+            return;
+        this.#sweptAt = now;
+        for (const [key, at] of this.#revoked) {
+            if (at < now - this.#horizonMs)
+                this.#revoked.delete(key);
+        }
+    }
+    #sweepWatch(key) {
+        const watch = this.#watches.get(key);
+        if (!watch)
+            return;
+        for (const ref of watch.controllers)
+            if (!ref.deref())
+                watch.controllers.delete(ref);
+        if (watch.controllers.size === 0)
+            this.#watches.delete(key);
+    }
+    async #lookup(notice) {
+        const rows = rowsOf(await this.#database.read().execute(sql `
+        select revoked_at from parlor_auth_revocations
+        where kind = ${notice.kind} and id = ${notice.id}`));
+        const row = rows[0];
+        return row ? new Date(row.revoked_at).getTime() : undefined;
+    }
+    async #load(since) {
+        const rows = rowsOf(await this.#database.read().execute(sql `
+        select kind, id, revoked_at from parlor_auth_revocations
+        where revoked_at >= ${new Date(since).toISOString()}`));
+        return rows.map((row) => ({
+            kind: row.kind,
+            id: row.id,
+            at: new Date(row.revoked_at).getTime(),
+        }));
+    }
+    async #prune() {
+        const cutoff = new Date(this.#now() - this.#horizonMs).toISOString();
+        await this.#database.read().execute(sql `delete from parlor_auth_revocations where revoked_at < ${cutoff}`);
+    }
+}
+//# sourceMappingURL=revocation.js.map