@parlor/auth 0.1.0 → 0.2.0

package/dist/native-sign-in.js

@@ -0,0 +1,183 @@
+import { createHash } from "node:crypto";
+import { addOAuthServerContext, APIError, createAuthEndpoint, createAuthMiddleware, getIP, getOAuthState, } from "better-auth/api";
+import { constantTimeEqual, generateRandomString } from "better-auth/crypto";
+import { generateIdTokenNonce, generateState, getOAuthCallbackPath, } from "better-auth/oauth2";
+import { z } from "zod";
+import { failure } from "./pages.js";
+export const NATIVE_SIGN_IN_PATH = "/native/sign-in/social";
+export const NATIVE_TOKEN_PATH = "/native/token";
+/** How long the app has to redeem the code its URL scheme received. */
+export const NATIVE_CODE_TTL_MS = 60_000;
+const NATIVE_REQUEST = "parlorNativeSignIn";
+const CODE_IDENTIFIER = "parlor-native-sign-in:";
+const TOKEN_HEADER = "set-auth-token";
+const sha256 = (text) => createHash("sha256").update(text).digest("base64url");
+const codeIdentifier = (code) => `${CODE_IDENTIFIER}${sha256(code)}`;
+function returnsToApp(redirectUri, scheme) {
+    if (!scheme)
+        return false;
+    try {
+        return new URL(redirectUri).protocol === `${scheme}:`;
+    }
+    catch {
+        return false;
+    }
+}
+function withParams(url, params) {
+    const target = new URL(url);
+    for (const [name, value] of Object.entries(params)) {
+        if (value)
+            target.searchParams.set(name, value);
+    }
+    return target.href;
+}
+async function providerOf(providers, id) {
+    for (const entry of providers ?? []) {
+        const provider = typeof entry === "function" ? await entry() : entry;
+        if (provider.id === id)
+            return provider;
+    }
+    return undefined;
+}
+/** Leaves the browser that ran the sign-in without the session: only the app gets it. */
+function withoutSession(headers, cookies) {
+    const kept = headers
+        .getSetCookie()
+        .filter((cookie) => !cookies.some((name) => cookie.startsWith(`${name}=`) || cookie.startsWith(`${name}.`)));
+    headers.delete("set-cookie");
+    for (const cookie of kept)
+        headers.append("set-cookie", cookie);
+    headers.delete(TOKEN_HEADER);
+}
+const invalidGrant = () => new APIError("BAD_REQUEST", {
+    message: "This sign-in has expired or was already used. Sign in again.",
+    code: "INVALID_GRANT",
+});
+/**
+ * Social sign-in for native shells, whose webview a provider such as Google refuses. The
+ * app opens `/native/sign-in/social` in the system's sign-in browser with a PKCE challenge;
+ * after Better Auth's callback the browser keeps no session and is sent to the app's URL
+ * scheme with a single-use code, which only the app holding the verifier can redeem at
+ * `/native/token` for a bearer token.
+ */
+export function nativeSignIn(options) {
+    const { scheme } = options;
+    return {
+        id: "parlor-native-sign-in",
+        endpoints: {
+            nativeSignInSocial: createAuthEndpoint(NATIVE_SIGN_IN_PATH, {
+                method: "GET",
+                query: z.object({
+                    provider: z.string().min(1),
+                    redirect_uri: z.string(),
+                    code_challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+                    code_challenge_method: z.literal("S256"),
+                    state: z.string().min(1).max(512),
+                }),
+            }, async (ctx) => {
+                const { provider: id, redirect_uri: redirectUri, state } = ctx.query;
+                if (!returnsToApp(redirectUri, scheme)) {
+                    return failure(scheme
+                        ? `Sign-in can only return to this app's ${scheme}: links.`
+                        : "Set app.scheme in parlor.config.ts to sign in from the app.", 400);
+                }
+                const providers = ctx.context
+                    .socialProviders;
+                const provider = await providerOf(providers, id);
+                if (!provider) {
+                    throw ctx.redirect(withParams(redirectUri, { error: "provider_not_found", state }));
+                }
+                const request = {
+                    redirectUri,
+                    codeChallenge: ctx.query.code_challenge,
+                    state,
+                };
+                await addOAuthServerContext({ [NATIVE_REQUEST]: request });
+                const idTokenNonce = generateIdTokenNonce(provider);
+                const flow = await generateState(ctx, { idTokenNonce });
+                const url = await provider.createAuthorizationURL({
+                    ...flow,
+                    idTokenNonce,
+                    redirectURI: `${ctx.context.baseURL}${getOAuthCallbackPath(provider)}`,
+                });
+                throw ctx.redirect(url.toString());
+            }),
+            nativeToken: createAuthEndpoint(NATIVE_TOKEN_PATH, {
+                method: "POST",
+                body: z.object({
+                    code: z.string().min(1),
+                    code_verifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),
+                }),
+            }, async (ctx) => {
+                const { internalAdapter, sessionConfig } = ctx.context;
+                const stored = await internalAdapter.consumeVerificationValue(codeIdentifier(ctx.body.code));
+                if (!stored)
+                    throw invalidGrant();
+                const pending = JSON.parse(stored.value);
+                if (!constantTimeEqual(sha256(ctx.body.code_verifier), pending.codeChallenge)) {
+                    await internalAdapter.deleteSession(pending.sessionToken);
+                    throw invalidGrant();
+                }
+                const headers = ctx.request?.headers;
+                const session = await internalAdapter.updateSession(pending.sessionToken, {
+                    expiresAt: new Date(Date.now() + sessionConfig.expiresIn * 1000),
+                    ...(headers
+                        ? {
+                            userAgent: headers.get("user-agent") ?? "",
+                            ipAddress: getIP(headers, ctx.context.options) ?? "",
+                        }
+                        : {}),
+                });
+                if (!session)
+                    throw invalidGrant();
+                ctx.setHeader(TOKEN_HEADER, pending.sessionToken);
+                ctx.setHeader("access-control-expose-headers", TOKEN_HEADER);
+                return ctx.json({ token: pending.sessionToken });
+            }),
+        },
+        hooks: {
+            after: [
+                {
+                    matcher: (ctx) => Boolean(ctx.path?.startsWith("/callback/")),
+                    handler: createAuthMiddleware(async (ctx) => {
+                        const request = (await getOAuthState())?.serverContext?.[NATIVE_REQUEST];
+                        const headers = ctx.context.responseHeaders;
+                        const location = headers?.get("location");
+                        if (!request || !headers || !location)
+                            return;
+                        const session = ctx.context.newSession;
+                        let outcome;
+                        if (session) {
+                            const code = generateRandomString(32);
+                            const expiresAt = new Date(Date.now() + NATIVE_CODE_TTL_MS);
+                            const pending = {
+                                sessionToken: session.session.token,
+                                codeChallenge: request.codeChallenge,
+                            };
+                            await ctx.context.internalAdapter.updateSession(pending.sessionToken, {
+                                expiresAt,
+                            });
+                            await ctx.context.internalAdapter.createVerificationValue({
+                                identifier: codeIdentifier(code),
+                                value: JSON.stringify(pending),
+                                expiresAt,
+                            });
+                            outcome = { code };
+                        }
+                        else {
+                            const failed = new URL(location, ctx.context.baseURL).searchParams;
+                            outcome = {
+                                error: failed.get("error") ?? "sign_in_failed",
+                                error_description: failed.get("error_description"),
+                            };
+                        }
+                        const { sessionToken, sessionData, dontRememberToken, accountData } = ctx.context.authCookies;
+                        withoutSession(headers, [sessionToken, sessionData, dontRememberToken, accountData].map((cookie) => cookie.name));
+                        headers.set("location", withParams(request.redirectUri, { ...outcome, state: request.state }));
+                    }),
+                },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=native-sign-in.js.map

package/dist/native-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sign-in.js","sourceRoot":"","sources":["../src/native-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,EACL,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAC5C,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,YAAY,GAAG,gBAAgB,CAAC;AA2BtC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAE7E,SAAS,YAAY,CAAC,WAAmB,EAAE,MAA0B;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,GAAG,MAAM,GAAG,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAAiD;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAAqD,EACrD,EAAU;IAEV,KAAK,MAAM,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrE,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,OAAgB,EAAE,OAA0B;IAClE,MAAM,IAAI,GAAG,OAAO;SACjB,YAAY,EAAE;SACd,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CACzE,CACJ,CAAC;IACJ,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,IAAI,QAAQ,CAAC,aAAa,EAAE;IAC1B,OAAO,EAAE,8DAA8D;IACvE,IAAI,EAAE,eAAe;CACtB,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgD;IAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,OAAO;QACL,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE;YACT,kBAAkB,EAAE,kBAAkB,CACpC,mBAAmB,EACnB;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;oBACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;oBACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;oBACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;oBACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;iBAClC,CAAC;aACH,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;gBACrE,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;oBACvC,OAAO,OAAO,CACZ,MAAM;wBACJ,CAAC,CAAC,yCAAyC,MAAM,UAAU;wBAC3D,CAAC,CAAC,6DAA6D,EACjE,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO;qBAC1B,eAAmD,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,GAAG,CAAC,QAAQ,CAChB,UAAU,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAChE,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAkB;oBAC7B,WAAW;oBACX,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc;oBACvC,KAAK;iBACN,CAAC;gBACF,MAAM,qBAAqB,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC3D,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC;oBAChD,GAAG,IAAI;oBACP,YAAY;oBACZ,WAAW,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBACvE,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrC,CAAC,CACF;YACD,WAAW,EAAE,kBAAkB,CAC7B,iBAAiB,EACjB;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC;iBAC7D,CAAC;aACH,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;gBACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,wBAAwB,CAC3D,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9B,CAAC;gBACF,IAAI,CAAC,MAAM;oBAAE,MAAM,YAAY,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAgB,CAAC;gBACxD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC9E,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBAC1D,MAAM,YAAY,EAAE,CAAC;gBACvB,CAAC;gBACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;gBACrC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE;oBACxE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC;oBAChE,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC;4BACE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;4BAC1C,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;yBACrD;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO;oBAAE,MAAM,YAAY,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YACnD,CAAC,CACF;SACF;QACD,KAAK,EAAE;YACL,KAAK,EAAE;gBACL;oBACE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;oBAC7D,OAAO,EAAE,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAE1D,CAAC;wBACd,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;wBAC5C,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;wBAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;4BAAE,OAAO;wBAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;wBACvC,IAAI,OAAsC,CAAC;wBAC3C,IAAI,OAAO,EAAE,CAAC;4BACZ,MAAM,IAAI,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;4BACtC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC;4BAC5D,MAAM,OAAO,GAAgB;gCAC3B,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;gCACnC,aAAa,EAAE,OAAO,CAAC,aAAa;6BACrC,CAAC;4BACF,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE;gCACpE,SAAS;6BACV,CAAC,CAAC;4BACH,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC;gCACxD,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC;gCAChC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gCAC9B,SAAS;6BACV,CAAC,CAAC;4BACH,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC;wBACrB,CAAC;6BAAM,CAAC;4BACN,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC;4BACnE,OAAO,GAAG;gCACR,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,gBAAgB;gCAC9C,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC;6BACnD,CAAC;wBACJ,CAAC;wBACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,GACjE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;wBAC1B,cAAc,CACZ,OAAO,EACP,CAAC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,GAAG,CAC7D,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CACxB,CACF,CAAC;wBACF,OAAO,CAAC,GAAG,CACT,UAAU,EACV,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CACtE,CAAC;oBACJ,CAAC,CAAC;iBACH;aACF;SACF;KACyB,CAAC;AAC/B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type { BetterAuthPlugin } from \"better-auth\";\nimport {\n  addOAuthServerContext,\n  APIError,\n  createAuthEndpoint,\n  createAuthMiddleware,\n  getIP,\n  getOAuthState,\n} from \"better-auth/api\";\nimport { constantTimeEqual, generateRandomString } from \"better-auth/crypto\";\nimport {\n  generateIdTokenNonce,\n  generateState,\n  getOAuthCallbackPath,\n} from \"better-auth/oauth2\";\nimport { z } from \"zod\";\n\nimport { failure } from \"./pages.js\";\n\nexport const NATIVE_SIGN_IN_PATH = \"/native/sign-in/social\";\nexport const NATIVE_TOKEN_PATH = \"/native/token\";\n/** How long the app has to redeem the code its URL scheme received. */\nexport const NATIVE_CODE_TTL_MS = 60_000;\n\nconst NATIVE_REQUEST = \"parlorNativeSignIn\";\nconst CODE_IDENTIFIER = \"parlor-native-sign-in:\";\nconst TOKEN_HEADER = \"set-auth-token\";\n\ninterface NativeRequest {\n  readonly redirectUri: string;\n  readonly codeChallenge: string;\n  readonly state: string;\n}\n\ninterface PendingCode {\n  readonly sessionToken: string;\n  readonly codeChallenge: string;\n}\n\ninterface OAuthProvider {\n  readonly id: string;\n  readonly requiresIdTokenNonce?: boolean | undefined;\n  readonly callbackPath?: string | undefined;\n  createAuthorizationURL(input: {\n    state: string;\n    codeVerifier: string;\n    idTokenNonce?: string | undefined;\n    redirectURI: string;\n  }): Promise<URL> | URL;\n}\n\ntype Lazy<T> = T | (() => T | Promise<T>);\n\nconst sha256 = (text: string) => createHash(\"sha256\").update(text).digest(\"base64url\");\nconst codeIdentifier = (code: string) => `${CODE_IDENTIFIER}${sha256(code)}`;\n\nfunction returnsToApp(redirectUri: string, scheme: string | undefined): boolean {\n  if (!scheme) return false;\n  try {\n    return new URL(redirectUri).protocol === `${scheme}:`;\n  } catch {\n    return false;\n  }\n}\n\nfunction withParams(url: string, params: Record<string, string | null | undefined>) {\n  const target = new URL(url);\n  for (const [name, value] of Object.entries(params)) {\n    if (value) target.searchParams.set(name, value);\n  }\n  return target.href;\n}\n\nasync function providerOf(\n  providers: readonly Lazy<OAuthProvider>[] | undefined,\n  id: string,\n): Promise<OAuthProvider | undefined> {\n  for (const entry of providers ?? []) {\n    const provider = typeof entry === \"function\" ? await entry() : entry;\n    if (provider.id === id) return provider;\n  }\n  return undefined;\n}\n\n/** Leaves the browser that ran the sign-in without the session: only the app gets it. */\nfunction withoutSession(headers: Headers, cookies: readonly string[]): void {\n  const kept = headers\n    .getSetCookie()\n    .filter(\n      (cookie) =>\n        !cookies.some(\n          (name) => cookie.startsWith(`${name}=`) || cookie.startsWith(`${name}.`),\n        ),\n    );\n  headers.delete(\"set-cookie\");\n  for (const cookie of kept) headers.append(\"set-cookie\", cookie);\n  headers.delete(TOKEN_HEADER);\n}\n\nconst invalidGrant = () =>\n  new APIError(\"BAD_REQUEST\", {\n    message: \"This sign-in has expired or was already used. Sign in again.\",\n    code: \"INVALID_GRANT\",\n  });\n\n/**\n * Social sign-in for native shells, whose webview a provider such as Google refuses. The\n * app opens `/native/sign-in/social` in the system's sign-in browser with a PKCE challenge;\n * after Better Auth's callback the browser keeps no session and is sent to the app's URL\n * scheme with a single-use code, which only the app holding the verifier can redeem at\n * `/native/token` for a bearer token.\n */\nexport function nativeSignIn(options: { readonly scheme: string | undefined }) {\n  const { scheme } = options;\n  return {\n    id: \"parlor-native-sign-in\",\n    endpoints: {\n      nativeSignInSocial: createAuthEndpoint(\n        NATIVE_SIGN_IN_PATH,\n        {\n          method: \"GET\",\n          query: z.object({\n            provider: z.string().min(1),\n            redirect_uri: z.string(),\n            code_challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),\n            code_challenge_method: z.literal(\"S256\"),\n            state: z.string().min(1).max(512),\n          }),\n        },\n        async (ctx) => {\n          const { provider: id, redirect_uri: redirectUri, state } = ctx.query;\n          if (!returnsToApp(redirectUri, scheme)) {\n            return failure(\n              scheme\n                ? `Sign-in can only return to this app's ${scheme}: links.`\n                : \"Set app.scheme in parlor.config.ts to sign in from the app.\",\n              400,\n            );\n          }\n          const providers = ctx.context\n            .socialProviders as unknown as Lazy<OAuthProvider>[];\n          const provider = await providerOf(providers, id);\n          if (!provider) {\n            throw ctx.redirect(\n              withParams(redirectUri, { error: \"provider_not_found\", state }),\n            );\n          }\n          const request: NativeRequest = {\n            redirectUri,\n            codeChallenge: ctx.query.code_challenge,\n            state,\n          };\n          await addOAuthServerContext({ [NATIVE_REQUEST]: request });\n          const idTokenNonce = generateIdTokenNonce(provider);\n          const flow = await generateState(ctx, { idTokenNonce });\n          const url = await provider.createAuthorizationURL({\n            ...flow,\n            idTokenNonce,\n            redirectURI: `${ctx.context.baseURL}${getOAuthCallbackPath(provider)}`,\n          });\n          throw ctx.redirect(url.toString());\n        },\n      ),\n      nativeToken: createAuthEndpoint(\n        NATIVE_TOKEN_PATH,\n        {\n          method: \"POST\",\n          body: z.object({\n            code: z.string().min(1),\n            code_verifier: z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/),\n          }),\n        },\n        async (ctx) => {\n          const { internalAdapter, sessionConfig } = ctx.context;\n          const stored = await internalAdapter.consumeVerificationValue(\n            codeIdentifier(ctx.body.code),\n          );\n          if (!stored) throw invalidGrant();\n          const pending = JSON.parse(stored.value) as PendingCode;\n          if (!constantTimeEqual(sha256(ctx.body.code_verifier), pending.codeChallenge)) {\n            await internalAdapter.deleteSession(pending.sessionToken);\n            throw invalidGrant();\n          }\n          const headers = ctx.request?.headers;\n          const session = await internalAdapter.updateSession(pending.sessionToken, {\n            expiresAt: new Date(Date.now() + sessionConfig.expiresIn * 1000),\n            ...(headers\n              ? {\n                  userAgent: headers.get(\"user-agent\") ?? \"\",\n                  ipAddress: getIP(headers, ctx.context.options) ?? \"\",\n                }\n              : {}),\n          });\n          if (!session) throw invalidGrant();\n          ctx.setHeader(TOKEN_HEADER, pending.sessionToken);\n          ctx.setHeader(\"access-control-expose-headers\", TOKEN_HEADER);\n          return ctx.json({ token: pending.sessionToken });\n        },\n      ),\n    },\n    hooks: {\n      after: [\n        {\n          matcher: (ctx) => Boolean(ctx.path?.startsWith(\"/callback/\")),\n          handler: createAuthMiddleware(async (ctx) => {\n            const request = (await getOAuthState())?.serverContext?.[NATIVE_REQUEST] as\n              | NativeRequest\n              | undefined;\n            const headers = ctx.context.responseHeaders;\n            const location = headers?.get(\"location\");\n            if (!request || !headers || !location) return;\n            const session = ctx.context.newSession;\n            let outcome: Record<string, string | null>;\n            if (session) {\n              const code = generateRandomString(32);\n              const expiresAt = new Date(Date.now() + NATIVE_CODE_TTL_MS);\n              const pending: PendingCode = {\n                sessionToken: session.session.token,\n                codeChallenge: request.codeChallenge,\n              };\n              await ctx.context.internalAdapter.updateSession(pending.sessionToken, {\n                expiresAt,\n              });\n              await ctx.context.internalAdapter.createVerificationValue({\n                identifier: codeIdentifier(code),\n                value: JSON.stringify(pending),\n                expiresAt,\n              });\n              outcome = { code };\n            } else {\n              const failed = new URL(location, ctx.context.baseURL).searchParams;\n              outcome = {\n                error: failed.get(\"error\") ?? \"sign_in_failed\",\n                error_description: failed.get(\"error_description\"),\n              };\n            }\n            const { sessionToken, sessionData, dontRememberToken, accountData } =\n              ctx.context.authCookies;\n            withoutSession(\n              headers,\n              [sessionToken, sessionData, dontRememberToken, accountData].map(\n                (cookie) => cookie.name,\n              ),\n            );\n            headers.set(\n              \"location\",\n              withParams(request.redirectUri, { ...outcome, state: request.state }),\n            );\n          }),\n        },\n      ],\n    },\n  } satisfies BetterAuthPlugin;\n}\n"]}

package/dist/pages.js.map

@@ -1 +1 @@
-{"version":3,"file":"pages.js","sourceRoot":"","sources":["../src/pages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,IAAI,CAAC,OAAO,CACV,UAAU,EACV,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAE,CACnF,CAAC;AAEJ,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;CAgBb,CAAC;AAEF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAEvE,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,IAAY,EACZ,UAA6B;IAE7B,MAAM,IAAI,GAAG;;;;;SAKN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,yBAAyB,EAAE;gBACzB,oBAAoB;gBACpB,qBAAqB,UAAU,GAAG;gBAClC,eAAe,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACrC,wBAAwB;gBACxB,iBAAiB;aAClB,CAAC,IAAI,CAAC,IAAI,CAAC;YACZ,wBAAwB,EAAE,SAAS;YACnC,6DAA6D;YAC7D,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc;IACrD,MAAM,QAAQ,GAAG,IAAI,CACnB,sBAAsB,EACtB,mCAAmC,MAAM,CAAC,OAAO,CAAC,MAAM,EACxD,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../src/pages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,IAAI,CAAC,OAAO,CACV,UAAU,EACV,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAE,CACnF,CAAC;AAEJ,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;CAgBb,CAAC;AAEF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAEvE,MAAM,UAAU,IAAI,CAClB,KAAa,EACb,IAAY,EACZ,UAA6B;IAE7B,MAAM,IAAI,GAAG;;;;;SAKN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,yBAAyB,EAAE;gBACzB,oBAAoB;gBACpB,qBAAqB,UAAU,GAAG;gBAClC,eAAe,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACrC,wBAAwB;gBACxB,iBAAiB;aAClB,CAAC,IAAI,CAAC,IAAI,CAAC;YACZ,wBAAwB,EAAE,SAAS;YACnC,6DAA6D;YAC7D,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc;IACrD,MAAM,QAAQ,GAAG,IAAI,CACnB,sBAAsB,EACtB,mCAAmC,MAAM,CAAC,OAAO,CAAC,MAAM,EACxD,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nexport const escape = (text: string) =>\n  text.replace(\n    /[&<>\"']/g,\n    (char) =>\n      ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[char]!,\n  );\n\nconst STYLE = `\n:root { color-scheme: light dark; --bg: #f6f6f4; --card: #fff; --text: #1d1d1b; --muted: #5f5f5a; --line: #e2e2dc; --accent: #1d1d1b; --on-accent: #fff; }\n@media (prefers-color-scheme: dark) { :root { --bg: #151514; --card: #1f1f1d; --text: #ededea; --muted: #a3a39d; --line: #34342f; --accent: #ededea; --on-accent: #151514; } }\n* { box-sizing: border-box; }\nbody { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 16px; background: var(--bg); color: var(--text); font: 15px/1.5 system-ui, -apple-system, \"Segoe UI\", sans-serif; }\nmain { width: 100%; max-width: 420px; background: var(--card); border: 1px solid var(--line); border-radius: 12px; padding: 28px; }\nh1 { font-size: 20px; line-height: 1.3; margin: 0 0 8px; }\np { margin: 0 0 12px; color: var(--muted); }\nul { margin: 0 0 20px; padding-left: 20px; }\nli { margin-bottom: 6px; }\nstrong { color: var(--text); font-weight: 600; }\ncode { font: 0.9em ui-monospace, \"SF Mono\", Menlo, monospace; color: var(--text); }\nform { display: flex; gap: 8px; justify-content: flex-end; margin: 0; }\nbutton { font: inherit; font-weight: 600; padding: 9px 18px; border-radius: 8px; border: 1px solid var(--line); background: transparent; color: var(--text); cursor: pointer; }\nbutton[value=\"true\"], button[value=\"connect\"] { background: var(--accent); border-color: var(--accent); color: var(--on-accent); }\nbutton:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }\n`;\n\nconst STYLE_HASH = createHash(\"sha256\").update(STYLE).digest(\"base64\");\n\nexport function page(\n  title: string,\n  body: string,\n  formAction: readonly string[],\n): Response {\n  const html = `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escape(title)}</title>\n<style>${STYLE}</style>\n</head>\n<body><main>${body}</main></body>\n</html>`;\n  return new Response(html, {\n    headers: {\n      \"content-type\": \"text/html; charset=utf-8\",\n      \"cache-control\": \"no-store\",\n      \"content-security-policy\": [\n        \"default-src 'none'\",\n        `style-src 'sha256-${STYLE_HASH}'`,\n        `form-action ${formAction.join(\" \")}`,\n        \"frame-ancestors 'none'\",\n        \"base-uri 'none'\",\n      ].join(\"; \"),\n      \"x-content-type-options\": \"nosniff\",\n      // no-referrer would make the form POST carry `Origin: null`.\n      \"referrer-policy\": \"same-origin\",\n    },\n  });\n}\n\nexport function failure(message: string, status: number): Response {\n  const response = page(\n    \"Authorization failed\",\n    `<h1>Authorization failed</h1><p>${escape(message)}</p>`,\n    [\"'none'\"],\n  );\n  return new Response(response.body, { status, headers: response.headers });\n}\n"]}

package/dist/provider.d.ts

@@ -1,5 +1,5 @@
 import { type AuthProvider } from "@parlor/server";
-import type { BetterAuthOptions } from "better-auth";
+import { type BetterAuthOptions } from "better-auth";
 /** The slice of a Better Auth instance Parlor relies on. */
 export interface BetterAuthInstance {
     readonly options: BetterAuthOptions;
@@ -61,14 +61,21 @@ export interface StoredSession {
     readonly ipAddress?: string | null | undefined;
     readonly userAgent?: string | null | undefined;
 }
-export interface BetterAuthProviderOptions {
+export type BetterAuthProviderOptions = {
     readonly instance: BetterAuthInstance;
-}
+} | {
+    /**
+     * The options for `betterAuth()`, which the provider calls on the first request.
+     * Better Auth starts querying the database as soon as it is created, and some
+     * runtimes, such as Cloudflare's, allow no I/O while the app loads.
+     */
+    readonly options: BetterAuthOptions;
+};
 /**
  * Sessions become user principals: a cookie on the same-origin web, a bearer token in
  * native shells. Access tokens Better Auth issued to MCP clients become agent principals
  * without a turn.
  */
-export declare function betterAuthProvider({ instance, }: BetterAuthProviderOptions): AuthProvider;
+export declare function betterAuthProvider(provided: BetterAuthProviderOptions): AuthProvider;
 export {};
 //# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,YAAY,EAMlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAoDrD,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE;QACZ,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAC/C,QAAQ,CAAC,OAAO,EAAE;gBAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,EAAE;gBACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;aACxB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;KACX,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/C;AAED,UAAU,KAAK;IACb,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACxE,UAAU,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE;QACxB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAQD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,GACT,EAAE,yBAAyB,GAAG,YAAY,CAyR1C"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,YAAY,EAMlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAoDjE,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE;QACZ,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAC/C,QAAQ,CAAC,OAAO,EAAE;gBAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,EAAE;gBACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;aACxB,CAAC;SACH,GAAG,IAAI,CAAC,CAAC;KACX,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/C;AAED,UAAU,KAAK;IACb,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACxE,UAAU,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE;QACxB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7C,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GACzC;IACE;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC,CAAC;AAuBN;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,YAAY,CA2RpF"}

package/dist/provider.js

@@ -1,6 +1,7 @@
 import { ANONYMOUS, asId, } from "@parlor/core";
 import { createRegistry } from "@parlor/core/registry";
 import { AuthFailure, REVOCATION_HORIZON_MS, } from "@parlor/server";
+import { betterAuth } from "better-auth";
 import { createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify, } from "jose";
 import { accountActions } from "./account.js";
 import { AUDIT_MIGRATION, createAuditLog } from "./audit.js";
@@ -13,6 +14,19 @@ import { RevocationSet } from "./revocation.js";
 import { authRoutes } from "./routes.js";
 import { agentPrincipalOf, credentialOf, delegate, verifyTurnToken, } from "./tokens.js";
 import { createTurnKeyStore, TURN_KEYS_MIGRATION, } from "./turn-keys.js";
+/** Stands in for the instance until the first call needs it. */
+function deferredInstance(options) {
+    let created;
+    const current = () => (created ??= betterAuth(options));
+    return {
+        options,
+        handler: (request) => current().handler(request),
+        api: { getSession: (input) => current().api.getSession(input) },
+        get $context() {
+            return current().$context;
+        },
+    };
+}
 function hasCookie(request, name) {
     const cookie = request.headers.get("cookie");
     if (!cookie)
@@ -24,7 +38,8 @@ function hasCookie(request, name) {
  * native shells. Access tokens Better Auth issued to MCP clients become agent principals
  * without a turn.
  */
-export function betterAuthProvider({ instance, }) {
+export function betterAuthProvider(provided) {
+    const instance = "instance" in provided ? provided.instance : deferredInstance(provided.options);
     const bridge = bridgeOf(instance.options);
     const settings = bridge.settings;
     let revocations;

package/dist/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,SAAS,EACT,IAAI,GAQL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEL,WAAW,EAKX,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,EAGN,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,QAAQ,EACR,SAAS,GAEV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,eAAe,EAEf,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EAGR,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAqDxB,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,GACkB;IAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAuB,MAAM,CAAC,QAAQ,CAAC;IACrD,IAAI,WAAsC,CAAC;IAC3C,IAAI,IAAsD,CAAC;IAC3D,IAAI,SAAgC,CAAC;IACrC,IAAI,QAAkC,CAAC;IACvC,IAAI,OAAmC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAkB,CAAC;IAEtD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzE,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,SAAS,EAAE;iBACR,QAAQ,CAAC,IAAI,EAAE;iBACf,KAAK,CAAC,GAAG,EAAE;gBACV,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO,iBAAiB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAuB,EAAE;QAC1D,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,QAAQ,CAAC,OAAO;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,QAAQ;SACd,CAAC;QACF,IAAI,KAAK,MAAM,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,iBAAiB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9D,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAmB,EAAE;QACvD,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,QAAQ,CAAC,QAAQ;iBACrB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,OAAO,CAAC,OAAO,CAA2B;gBAChD,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CACH;iBACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA2B,EAAE;QAC/D,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,+BAA+B,SAAS,UAAU,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YACzB,OAAO;YACP,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;aAC1C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAgB,EAAsC,EAAE;QAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAU,EAAE,CAC/C,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,KAAK,EAClB,OAAgB,EAChB,SAAwB,EACA,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,SAAS,EACT,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EACrD,SAAS,EAAE,CAAC,SAAS,EACrB,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgB,EAA2B,EAAE;QACjE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC;QACnC,IAAI,aAAa,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAgB,EAAsB,EAAE;QACzE,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACtE,QAAQ,UAAU,EAAE,IAAI,EAAE,CAAC;YACzB,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YAC/C,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,QAAQ;gBACX,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACnC,KAAK,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnC,IAAI,CAAC,IAAI;oBACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM;QACV,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzE,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IAC9C,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE;YACV,GAAG,eAAe;YAClB,eAAe;YACf,iBAAiB;YACjB,mBAAmB;YACnB,eAAe;YACf,wBAAwB;SACzB;QACD,SAAS,EAAE,IAAI;QACf,KAAK,CAAC,IAAgB;YACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,QAAQ;gBACR,SAAS,EAAE,qBAAqB;aACjC,CAAC,CAAC;YACH,WAAW,GAAG,GAAG,CAAC;YAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CACzB,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACzC,QAAQ,GAAG,kBAAkB,CAAC;gBAC5B,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,OAAO;gBACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM;aACrD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG;gBACf,IAAI;gBACJ,QAAQ;aACT,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,cAAc,CAAC;oBACtB,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;oBACpE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,OAAO;oBACvC,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;iBAC7D,CAAC;gBACF,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9E,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1C,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnD,CAAC;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAgB;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;gBAAE,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS;YACP,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,wCAAwC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACjH,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAC/E;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,kBAAkB,EAAE,6BAA6B,QAAQ,aAAa,SAAS,GAAG;iBACnF;aACF,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAmB,EAAE,IAAoB;YACtD,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,MAAM,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAgB;YAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAkB;YAC7C,MAAM,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;YAC5E,OAAO;gBACL,EAAE;gBACF,IAAI;gBACJ,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAc;YAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAkC;gBAClE,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,SAAiC;YACvC,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,MAAM;gBACvB,CAAC,CAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAY;gBACzD,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,OAAO,EAAY,CAAC;YAC1D,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,SAAS,EACT,IAAI,GAQL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEL,WAAW,EAKX,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,EAGN,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,QAAQ,EACR,SAAS,GAEV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EAEpB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,eAAe,EAEf,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EAGR,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AA4DxB,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,OAA0B;IAClD,IAAI,OAAuC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAkC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO;QACP,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;QAC/D,IAAI,QAAQ;YACV,OAAO,OAAO,EAAE,CAAC,QAAQ,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAmC;IACpE,MAAM,QAAQ,GACZ,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAuB,MAAM,CAAC,QAAQ,CAAC;IACrD,IAAI,WAAsC,CAAC;IAC3C,IAAI,IAAsD,CAAC;IAC3D,IAAI,SAAgC,CAAC;IACrC,IAAI,QAAkC,CAAC;IACvC,IAAI,OAAmC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAkB,CAAC;IAEtD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzE,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,SAAS,EAAE;iBACR,QAAQ,CAAC,IAAI,EAAE;iBACf,KAAK,CAAC,GAAG,EAAE;gBACV,iBAAiB,GAAG,KAAK,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO,iBAAiB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAuB,EAAE;QAC1D,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,QAAQ,CAAC,OAAO;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,EAAE,QAAQ;SACd,CAAC;QACF,IAAI,KAAK,MAAM,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,iBAAiB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9D,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAmB,EAAE;QACvD,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,QAAQ,CAAC,QAAQ;iBACrB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,OAAO,CAAC,OAAO,CAA2B;gBAChD,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CACH;iBACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA2B,EAAE;QAC/D,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,+BAA+B,SAAS,UAAU,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YACzB,OAAO;YACP,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;aAC1C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAgB,EAAsC,EAAE;QAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;SAC5B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAU,EAAE,CAC/C,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,KAAK,EAClB,OAAgB,EAChB,SAAwB,EACA,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,SAAS,EACT,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EACrD,SAAS,EAAE,CAAC,SAAS,EACrB,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgB,EAA2B,EAAE;QACjE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC;QACnC,IAAI,aAAa,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,aAAa,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAgB,EAAsB,EAAE;QACzE,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACtE,QAAQ,UAAU,EAAE,IAAI,EAAE,CAAC;YACzB,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YAC/C,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,QAAQ;gBACX,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACnC,KAAK,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnC,IAAI,CAAC,IAAI;oBACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM;QACV,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzE,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IAC9C,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE;YACV,GAAG,eAAe;YAClB,eAAe;YACf,iBAAiB;YACjB,mBAAmB;YACnB,eAAe;YACf,wBAAwB;SACzB;QACD,SAAS,EAAE,IAAI;QACf,KAAK,CAAC,IAAgB;YACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,QAAQ;gBACR,SAAS,EAAE,qBAAqB;aACjC,CAAC,CAAC;YACH,WAAW,GAAG,GAAG,CAAC;YAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CACzB,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACzC,QAAQ,GAAG,kBAAkB,CAAC;gBAC5B,QAAQ;gBACR,MAAM,EAAE,QAAQ,CAAC,OAAO;gBACxB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM;aACrD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG;gBACf,IAAI;gBACJ,QAAQ;aACT,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,cAAc,CAAC;oBACtB,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;oBACpE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,OAAO;oBACvC,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;iBAC7D,CAAC;gBACF,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9E,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC1C,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACnD,CAAC;aACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAgB;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;gBAAE,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS;YACP,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,wCAAwC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACjH,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,EAC/E;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,kBAAkB,EAAE,6BAA6B,QAAQ,aAAa,SAAS,GAAG;iBACnF;aACF,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAmB,EAAE,IAAoB;YACtD,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,MAAM,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAgB;YAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAkB;YAC7C,MAAM,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;YAC5E,OAAO;gBACL,EAAE;gBACF,IAAI;gBACJ,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAc;YAC1B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAkC;gBAClE,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,SAAiC;YACvC,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,MAAM;gBACvB,CAAC,CAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAY;gBACzD,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,OAAO,EAAY,CAAC;YAC1D,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type AgentPrincipal,\n  ANONYMOUS,\n  asId,\n  type AuthenticatedPrincipal,\n  type DeviceId,\n  type GrantId,\n  type HostPrincipal,\n  type Principal,\n  type UserId,\n  type UserPrincipal,\n} from \"@parlor/core\";\nimport { createRegistry } from \"@parlor/core/registry\";\nimport {\n  type AccountProfile,\n  AuthFailure,\n  type AuthProvider,\n  type Delegation,\n  type DeviceKeys,\n  type PluginHost,\n  REVOCATION_HORIZON_MS,\n  type TurnDelegation,\n} from \"@parlor/server\";\nimport { betterAuth, type BetterAuthOptions } from \"better-auth\";\nimport {\n  createLocalJWKSet,\n  decodeProtectedHeader,\n  errors,\n  type JSONWebKeySet,\n  type JWTPayload,\n  jwtVerify,\n} from \"jose\";\n\nimport { accountActions } from \"./account.js\";\nimport { AUDIT_MIGRATION, createAuditLog } from \"./audit.js\";\nimport {\n  AUTH_PLUGIN,\n  bridgeOf,\n  MCP_SCOPE,\n  type ParlorAuthSettings,\n} from \"./better-auth.js\";\nimport {\n  createDeviceRegistry,\n  type DeviceRegistry,\n  deviceAccountActions,\n  DEVICE_LINKING_MIGRATION,\n  DEVICES_MIGRATION,\n} from \"./devices.js\";\nimport { grantIdOf } from \"./grants.js\";\nimport {\n  createGrantKeys,\n  type GrantKeys,\n  hostAccountActions,\n  hostPrincipalOf,\n  HOSTS_MIGRATION,\n  hostRoutes,\n  verifyHostAssertion,\n} from \"./hosts.js\";\nimport { AUTH_MIGRATIONS } from \"./migrations.js\";\nimport { RevocationSet } from \"./revocation.js\";\nimport { authRoutes } from \"./routes.js\";\nimport {\n  agentPrincipalOf,\n  credentialOf,\n  delegate,\n  type HostAssertion,\n  type TurnToken,\n  verifyTurnToken,\n} from \"./tokens.js\";\nimport {\n  createTurnKeyStore,\n  TURN_KEYS_MIGRATION,\n  type TurnKeyStore,\n} from \"./turn-keys.js\";\n\n/** The slice of a Better Auth instance Parlor relies on. */\nexport interface BetterAuthInstance {\n  readonly options: BetterAuthOptions;\n  handler(request: Request): Promise<Response>;\n  readonly api: {\n    getSession(input: { headers: Headers }): Promise<{\n      readonly session: { readonly id: string; readonly userId: string };\n      readonly user: {\n        readonly id: string;\n        readonly name: string;\n        readonly email: string;\n      };\n    } | null>;\n  };\n  readonly $context: Promise<BetterAuthContext>;\n}\n\ninterface Where {\n  readonly field: string;\n  readonly value: string;\n}\n\nexport interface BetterAuthContext {\n  readonly authCookies: { readonly sessionToken: { readonly name: string } };\n  readonly adapter: {\n    findMany<T>(input: { model: string; where?: Where[] }): Promise<T[]>;\n    findOne<T>(input: { model: string; where: Where[] }): Promise<T | null>;\n    deleteMany(input: { model: string; where: Where[] }): Promise<number>;\n  };\n  readonly secret: string;\n  readonly internalAdapter: {\n    listSessions(userId: string): Promise<StoredSession[]>;\n    deleteSession(token: string): Promise<void>;\n  };\n}\n\nexport interface StoredSession {\n  readonly id: string;\n  readonly token: string;\n  readonly userId: string;\n  readonly createdAt: Date;\n  readonly updatedAt: Date;\n  readonly expiresAt: Date;\n  readonly ipAddress?: string | null | undefined;\n  readonly userAgent?: string | null | undefined;\n}\n\nexport type BetterAuthProviderOptions =\n  | { readonly instance: BetterAuthInstance }\n  | {\n      /**\n       * The options for `betterAuth()`, which the provider calls on the first request.\n       * Better Auth starts querying the database as soon as it is created, and some\n       * runtimes, such as Cloudflare's, allow no I/O while the app loads.\n       */\n      readonly options: BetterAuthOptions;\n    };\n\n/** Stands in for the instance until the first call needs it. */\nfunction deferredInstance(options: BetterAuthOptions): BetterAuthInstance {\n  let created: BetterAuthInstance | undefined;\n  const current = () =>\n    (created ??= betterAuth(options) as unknown as BetterAuthInstance);\n  return {\n    options,\n    handler: (request) => current().handler(request),\n    api: { getSession: (input) => current().api.getSession(input) },\n    get $context() {\n      return current().$context;\n    },\n  };\n}\n\nfunction hasCookie(request: Request, name: string): boolean {\n  const cookie = request.headers.get(\"cookie\");\n  if (!cookie) return false;\n  return cookie.split(\";\").some((part) => part.trim().startsWith(`${name}=`));\n}\n\n/**\n * Sessions become user principals: a cookie on the same-origin web, a bearer token in\n * native shells. Access tokens Better Auth issued to MCP clients become agent principals\n * without a turn.\n */\nexport function betterAuthProvider(provided: BetterAuthProviderOptions): AuthProvider {\n  const instance =\n    \"instance\" in provided ? provided.instance : deferredInstance(provided.options);\n  const bridge = bridgeOf(instance.options);\n  const settings: ParlorAuthSettings = bridge.settings;\n  let revocations: RevocationSet | undefined;\n  let keys: ReturnType<typeof createLocalJWKSet> | undefined;\n  let grantKeys: GrantKeys | undefined;\n  let turnKeys: TurnKeyStore | undefined;\n  let devices: DeviceRegistry | undefined;\n  const clientNames = new Map<string, Promise<string>>();\n  const authenticatedAt = new WeakMap<object, number>();\n\n  const installed = () => {\n    if (!grantKeys || !turnKeys || !devices) {\n      throw new Error(\"The auth provider is not installed.\");\n    }\n    return { grantKeys, turnKeys, devices };\n  };\n\n  const started = () => {\n    if (!revocations) throw new Error(\"The auth provider is not installed.\");\n    return revocations;\n  };\n\n  let preparingTurnKeys = false;\n  const ready = async (): Promise<void> => {\n    await started().ready();\n    if (!preparingTurnKeys) {\n      preparingTurnKeys = true;\n      installed()\n        .turnKeys.keys()\n        .catch(() => {\n          preparingTurnKeys = false;\n        });\n    }\n  };\n\n  const loadKeys = async () => {\n    const response = await instance.handler(new Request(`${settings.baseURL}/jwks`));\n    if (!response.ok)\n      throw new Error(`Better Auth answered /jwks with ${response.status}`);\n    return createLocalJWKSet((await response.json()) as JSONWebKeySet);\n  };\n\n  const verify = async (token: string): Promise<JWTPayload> => {\n    const options = {\n      issuer: settings.baseURL,\n      audience: settings.resource,\n      typ: \"at+jwt\",\n    };\n    keys ??= await loadKeys();\n    try {\n      return (await jwtVerify(token, keys, options)).payload;\n    } catch (error) {\n      if (!(error instanceof errors.JWKSNoMatchingKey)) throw error;\n      keys = await loadKeys();\n      return (await jwtVerify(token, keys, options)).payload;\n    }\n  };\n\n  const clientName = (clientId: string): Promise<string> => {\n    let name = clientNames.get(clientId);\n    if (!name) {\n      name = instance.$context\n        .then((context) =>\n          context.adapter.findOne<{ name?: string | null }>({\n            model: \"oauthClient\",\n            where: [{ field: \"clientId\", value: clientId }],\n          }),\n        )\n        .then((client) => client?.name || clientId);\n      name.catch(() => clientNames.delete(clientId));\n      clientNames.set(clientId, name);\n    }\n    return name;\n  };\n\n  const agentOf = async (token: string): Promise<AgentPrincipal> => {\n    let payload: JWTPayload;\n    try {\n      payload = await verify(token);\n    } catch (error) {\n      if (error instanceof errors.JWTExpired) {\n        throw new AuthFailure(\"expired\", \"The access token expired.\");\n      }\n      throw new AuthFailure(\"invalid\", \"The access token is invalid.\");\n    }\n    const { sub, iat } = payload;\n    const clientId = payload.client_id;\n    const scopes = typeof payload.scope === \"string\" ? payload.scope.split(\" \") : [];\n    if (typeof sub !== \"string\" || typeof clientId !== \"string\" || iat === undefined) {\n      throw new AuthFailure(\"invalid\", \"The access token is missing claims.\");\n    }\n    if (!scopes.includes(MCP_SCOPE)) {\n      throw new AuthFailure(\n        \"invalid\",\n        `The access token lacks the \"${MCP_SCOPE}\" scope.`,\n      );\n    }\n    const grantId = grantIdOf(sub, clientId);\n    if (await started().isRevoked({ kind: \"grant\", id: grantId }, iat * 1000)) {\n      throw new AuthFailure(\"revoked\", \"Access for this agent was revoked.\");\n    }\n    return {\n      kind: \"agent\",\n      userId: asId(\"user\", sub),\n      grantId,\n      agent: {\n        name: await clientName(clientId),\n        verified: clientId.startsWith(\"https://\"),\n      },\n    };\n  };\n\n  const userOf = async (request: Request): Promise<UserPrincipal | undefined> => {\n    const found = await instance.api.getSession({ headers: request.headers });\n    if (!found) return undefined;\n    return {\n      kind: \"user\",\n      userId: asId(\"user\", found.user.id),\n      sessionId: found.session.id,\n    };\n  };\n\n  const publicUrlOf = (request: Request): string =>\n    new URL(new URL(request.url).pathname, settings.origin).href;\n\n  const hostOf = async (\n    request: Request,\n    assertion: HostAssertion,\n  ): Promise<HostPrincipal> => {\n    const grant = await verifyHostAssertion(\n      assertion,\n      { method: request.method, url: publicUrlOf(request) },\n      installed().grantKeys,\n      Date.now(),\n    );\n    if (await started().isRevoked({ kind: \"grant\", id: grant.grantId })) {\n      throw new AuthFailure(\"revoked\", \"This computer was disconnected.\");\n    }\n    return hostPrincipalOf(grant);\n  };\n\n  const turnOf = async (token: TurnToken): Promise<AgentPrincipal> => {\n    const store = installed().turnKeys;\n    let turnTokenKeys = await store.keys();\n    const kid = decodeProtectedHeader(token).kid;\n    if (kid !== undefined && !turnTokenKeys.publicKeys.has(kid)) {\n      turnTokenKeys = await store.refresh();\n    }\n    const claims = await verifyTurnToken(turnTokenKeys, token, Date.now());\n    if (await started().isRevoked({ kind: \"grant\", id: claims.gid })) {\n      throw new AuthFailure(\"revoked\", \"This computer was disconnected.\");\n    }\n    return agentPrincipalOf(claims);\n  };\n\n  const authenticateRequest = async (request: Request): Promise<Principal> => {\n    await ready();\n    const credential = credentialOf(request.headers.get(\"authorization\"));\n    switch (credential?.kind) {\n      case \"host\":\n        return hostOf(request, credential.assertion);\n      case \"turn\":\n        return turnOf(credential.token);\n      case \"access\":\n        return agentOf(credential.token);\n      case \"session\": {\n        const user = await userOf(request);\n        if (!user)\n          throw new AuthFailure(\"invalid\", \"The session is invalid or has ended.\");\n        return user;\n      }\n      case undefined:\n        break;\n    }\n    const { authCookies } = await instance.$context;\n    if (!hasCookie(request, authCookies.sessionToken.name)) return ANONYMOUS;\n    return (await userOf(request)) ?? ANONYMOUS;\n  };\n\n  return {\n    name: AUTH_PLUGIN,\n    migrations: [\n      ...AUTH_MIGRATIONS,\n      HOSTS_MIGRATION,\n      DEVICES_MIGRATION,\n      TURN_KEYS_MIGRATION,\n      AUDIT_MIGRATION,\n      DEVICE_LINKING_MIGRATION,\n    ],\n    enforcing: true,\n    setup(host: PluginHost) {\n      const { database } = host;\n      if (!database) throw new Error(\"The auth plugin needs a database.\");\n      const set = new RevocationSet({\n        database,\n        horizonMs: REVOCATION_HORIZON_MS,\n      });\n      revocations = set;\n      const auditLog = createAuditLog(database);\n      bridge.revoke = (notice) =>\n        database.transaction((tx) => RevocationSet.revoke(tx, notice));\n      grantKeys = createGrantKeys(database);\n      devices = createDeviceRegistry(database);\n      turnKeys = createTurnKeyStore({\n        database,\n        issuer: settings.baseURL,\n        secret: async () => (await instance.$context).secret,\n      });\n      const hostDeps = {\n        host,\n        settings,\n      };\n      return {\n        actions: createRegistry({\n          ...accountActions({ instance, host, revoke: bridge.revoke }).actions,\n          ...hostAccountActions(hostDeps).actions,\n          ...deviceAccountActions({ host, registry: devices }).actions,\n        }),\n        routes: [...authRoutes({ instance, settings, host }), ...hostRoutes(hostDeps)],\n        audit: (record) => auditLog.record(record),\n        close: async () => {\n          await Promise.all([set.stop(), auditLog.stop()]);\n        },\n      };\n    },\n    async authenticate(request: Request): Promise<Principal> {\n      const startedAt = Date.now();\n      const principal = await authenticateRequest(request);\n      if (principal.kind !== \"anonymous\") authenticatedAt.set(principal, startedAt);\n      return principal;\n    },\n    challenge(): Response {\n      const metadata = `${settings.origin}/.well-known/oauth-protected-resource${new URL(settings.resource).pathname}`;\n      return Response.json(\n        { error: { code: \"unauthenticated\", message: \"Sign in through OAuth first.\" } },\n        {\n          status: 401,\n          headers: {\n            \"www-authenticate\": `Bearer resource_metadata=\"${metadata}\", scope=\"${MCP_SCOPE}\"`,\n          },\n        },\n      );\n    },\n    async delegate(host: HostPrincipal, turn: TurnDelegation): Promise<Delegation> {\n      await ready();\n      return delegate(await installed().turnKeys.keys(), host, turn, Date.now());\n    },\n    async hostActive(grantId: GrantId): Promise<boolean> {\n      const revoked = await started().isRevoked({ kind: \"grant\", id: grantId });\n      return !revoked && (await installed().grantKeys.get(grantId)) !== undefined;\n    },\n    async device(userId: UserId, deviceId: DeviceId): Promise<DeviceKeys | undefined> {\n      const registered = await installed().devices.get(userId, deviceId);\n      if (!registered) return undefined;\n      const { id, name, platform, signingKey, presenceKey, vouches } = registered;\n      return {\n        id,\n        name,\n        platform,\n        signingKey,\n        presenceKey,\n        ...(vouches ? { vouches } : {}),\n      };\n    },\n    async account(userId: UserId): Promise<AccountProfile | undefined> {\n      const { adapter } = await instance.$context;\n      const user = await adapter.findOne<{ name: string; email: string }>({\n        model: \"user\",\n        where: [{ field: \"id\", value: userId }],\n      });\n      return user ? { name: user.name, email: user.email } : undefined;\n    },\n    revoked(principal: AuthenticatedPrincipal): AbortSignal {\n      const notice =\n        principal.kind === \"user\"\n          ? ({ kind: \"session\", id: principal.sessionId } as const)\n          : ({ kind: \"grant\", id: principal.grantId } as const);\n      return started().signal([notice], authenticatedAt.get(principal));\n    },\n  };\n}\n"]}

package/dist/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAiB,MAAM,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AA+BhD,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAoB,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AAOlE,MAAM,KAAK,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,SAAS,CAAe;IACxB,UAAU,CAAS;IACnB,IAAI,CAAe;IACnB,eAAe,CAAS;IACxB,cAAc,CAAS;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpC,OAAO,GAAG,IAAI,oBAAoB,CAAS,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,KAAK,GAAmB,UAAU,CAAC;IACnC,MAAM,CAA4B;IAClC,WAAW,GAAG,CAAC,CAAC;IAChB,SAAS,CAAoC;IAC7C,aAAa,GAAG,KAAK,CAAC;IACtB,MAAM,CAA4C;IAClD,QAAQ,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,OAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACtD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACxD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACrD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAwB,EAAE,QAAQ,GAAG,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,WAAW;YACxB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAoC,EAAE,KAAK,GAAW,IAAI,CAAC,IAAI,EAAE;QACtE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;gBACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,EAAW,EACX,MAAwB,EACxB,EAAE,GAAW,IAAI,CAAC,GAAG,EAAE;QAEvB,MAAM,EAAE,GAAG,EAAc,CAAC;QAC1B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;gBAER,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;4EACI,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QACrE,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,oBAAoB,kBAAkB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAO,CAC3C,kBAAkB,EAClB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CACzC,CAAC;QACF,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO;QAC5C,KAAK,MAAM,UAAU,IAAI,WAAW;YAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACzC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAsB;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK;YAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAED,eAAe,CACb,UAA2B,EAC3B,OAAoC,EACpC,KAAa;QAEb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CACtB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAC9D,CAAC;YACF,IAAI,GAAG;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7D,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,KAAK,CAAC;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9E,CAAC,EACD,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,aAAa;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrF,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAwB;QACpC,MAAM,IAAI,GAAG,MAAM,CACjB,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;uBAEpC,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC,CACtD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,MAAM,IAAI,GAAG,MAAM,CAKjB,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;8BAE7B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CACzD,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;SACvC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAC/C,GAAG,CAAA,0DAA0D,MAAM,EAAE,CACtE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAiB,MAAM,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AA+BhD,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAoB,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;AAOlE,MAAM,KAAK,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,SAAS,CAAe;IACxB,UAAU,CAAS;IACnB,IAAI,CAAe;IACnB,eAAe,CAAS;IACxB,cAAc,CAAS;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpC,OAAO,GAAG,IAAI,oBAAoB,CAAS,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,KAAK,GAAmB,UAAU,CAAC;IACnC,MAAM,CAA4B;IAClC,WAAW,GAAG,CAAC,CAAC;IAChB,SAAS,CAAoC;IAC7C,aAAa,GAAG,KAAK,CAAC;IACtB,MAAM,CAA4C;IAClD,QAAQ,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,OAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACtD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACxD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACrD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAAwB,EAAE,QAAQ,GAAG,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,WAAW;YACxB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAoC,EAAE,KAAK,GAAW,IAAI,CAAC,IAAI,EAAE;QACtE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;gBACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,EAAW,EACX,MAAwB,EACxB,EAAE,GAAW,IAAI,CAAC,GAAG,EAAE;QAEvB,MAAM,EAAE,GAAG,EAAc,CAAC;QAC1B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;gBAER,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;4EACI,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QACrE,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,oBAAoB,kBAAkB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,MAAM,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAO,CAC3C,kBAAkB,EAClB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CACzC,CAAC;QACF,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO;QAC5C,KAAK,MAAM,UAAU,IAAI,WAAW;YAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACzC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAsB;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK;YAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAED,eAAe,CACb,UAA2B,EAC3B,OAAoC,EACpC,KAAa;QAEb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CACtB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAC9D,CAAC;YACF,IAAI,GAAG;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7D,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,KAAK,CAAC;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAC9E,CAAC,EACD,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,aAAa;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;YAAE,OAAO;QAClD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrF,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAwB;QACpC,MAAM,IAAI,GAAG,MAAM,CACjB,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;uBAEpC,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC,CACtD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,MAAM,IAAI,GAAG,MAAM,CAKjB,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;8BAE7B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CACzD,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;SACvC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,MAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAe,CAAC,OAAO,CAC/C,GAAG,CAAA,0DAA0D,MAAM,EAAE,CACtE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { DataProvider } from \"@parlor/core\";\nimport { sql } from \"drizzle-orm\";\n\nimport { type Database, rowsOf } from \"./database.js\";\n\nexport const REVOCATION_CHANNEL = \"parlor_auth\";\n\n/** NOTIFY payload. Ids only, never content. */\nexport interface RevocationNotice {\n  readonly kind: \"session\" | \"grant\";\n  readonly id: string;\n}\n\ninterface Revocation extends RevocationNotice {\n  readonly at: number;\n}\n\nexport interface RevocationSetOptions {\n  readonly database: DataProvider;\n  /**\n   * The longest any credential this set guards stays valid. Older revocations are\n   * forgotten: nothing they revoke can still verify.\n   */\n  readonly horizonMs: number;\n  readonly now?: (() => number) | undefined;\n  readonly relistenBaseMs?: number | undefined;\n  readonly relistenMaxMs?: number | undefined;\n}\n\n/**\n * `following` answers from memory, kept current by NOTIFY. `checking` answers with one\n * primary-key lookup per call: poll-only providers always do, and a following set falls\n * back to it while its LISTEN connection is down.\n */\nexport type RevocationMode = \"starting\" | \"following\" | \"checking\";\n\nconst keyOf = ({ kind, id }: RevocationNotice) => `${kind}:${id}`;\n\ninterface Watch {\n  readonly controllers: Set<WeakRef<AbortController>>;\n  since: number;\n}\n\nconst owner = Symbol(\"parlor.revocation.owner\");\n\n/**\n * Every instance's view of what was revoked within the horizon. It loads before it\n * admits anyone, and whenever its LISTEN connection drops it checks the table per call\n * until it listens again and reloads, because a NOTIFY sent meanwhile is lost.\n */\nexport class RevocationSet {\n  readonly #database: DataProvider;\n  readonly #horizonMs: number;\n  readonly #now: () => number;\n  readonly #relistenBaseMs: number;\n  readonly #relistenMaxMs: number;\n  readonly #revoked = new Map<string, number>();\n  readonly #watches = new Map<string, Watch>();\n  readonly #forget = new FinalizationRegistry<string>((key) => this.#sweepWatch(key));\n  #mode: RevocationMode = \"starting\";\n  #ready: Promise<void> | undefined;\n  #generation = 0;\n  #unlisten: (() => Promise<void>) | undefined;\n  #reconnecting = false;\n  #retry: ReturnType<typeof setTimeout> | undefined;\n  #sweptAt = 0;\n  #stopped = false;\n\n  constructor(options: RevocationSetOptions) {\n    this.#database = options.database;\n    this.#horizonMs = options.horizonMs;\n    this.#now = options.now ?? Date.now;\n    this.#relistenBaseMs = options.relistenBaseMs ?? 1000;\n    this.#relistenMaxMs = options.relistenMaxMs ?? 30_000;\n  }\n\n  get mode(): RevocationMode {\n    return this.#mode;\n  }\n\n  /** Resolves once the set can answer; a failed start is retried by the next call. */\n  ready(): Promise<void> {\n    this.#ready ??= this.#start().catch((error: unknown) => {\n      this.#ready = undefined;\n      throw error;\n    });\n    return this.#ready;\n  }\n\n  /**\n   * Revoked when a revocation of the notice is at or after `issuedAt`; without it, when\n   * any revocation of the notice is within the horizon.\n   */\n  async isRevoked(notice: RevocationNotice, issuedAt = 0): Promise<boolean> {\n    await this.ready();\n    const at =\n      this.#mode === \"following\"\n        ? this.#revoked.get(keyOf(notice))\n        : await this.#lookup(notice);\n    return at !== undefined && at >= Math.max(issuedAt, this.#now() - this.#horizonMs);\n  }\n\n  /**\n   * Aborts when any of the notices is revoked at or after `since` (default: now). The\n   * watch is registered first and the revocations already known are checked after, so one\n   * that landed between `since` and this call still aborts it.\n   */\n  signal(notices: readonly RevocationNotice[], since: number = this.#now()): AbortSignal {\n    const controller = new AbortController();\n    // The signal pins its controller, so a watch lives exactly as long as its holder.\n    Object.defineProperty(controller.signal, owner, { value: controller });\n    for (const notice of notices) {\n      const key = keyOf(notice);\n      const watch = this.#watches.get(key);\n      if (watch) watch.since = Math.min(watch.since, since);\n      else this.#watches.set(key, { controllers: new Set(), since });\n      this.#watches.get(key)!.controllers.add(new WeakRef(controller));\n      this.#forget.register(controller.signal, key);\n    }\n    this.#abortIfRevoked(controller, notices, since);\n    return controller.signal;\n  }\n\n  /** Records the revocation in the caller's transaction; the NOTIFY goes out on commit. */\n  static async revoke(\n    tx: unknown,\n    notice: RevocationNotice,\n    at: number = Date.now(),\n  ): Promise<void> {\n    const db = tx as Database;\n    await db.execute(sql`\n      insert into parlor_auth_revocations (kind, id, revoked_at)\n      values (${notice.kind}, ${notice.id}, ${new Date(at).toISOString()})\n      on conflict (kind, id) do update set revoked_at = excluded.revoked_at`);\n    const payload: Revocation = { kind: notice.kind, id: notice.id, at };\n    await db.execute(\n      sql`select pg_notify(${REVOCATION_CHANNEL}, ${JSON.stringify(payload)})`,\n    );\n  }\n\n  async stop(): Promise<void> {\n    this.#stopped = true;\n    this.#generation += 1;\n    if (this.#retry !== undefined) clearTimeout(this.#retry);\n    const unlisten = this.#unlisten;\n    this.#unlisten = undefined;\n    await unlisten?.().catch(() => {});\n  }\n\n  async #start(): Promise<void> {\n    await this.#prune();\n    if (!this.#database.listen) {\n      this.#mode = \"checking\";\n      return;\n    }\n    try {\n      await this.#connect(this.#now() - this.#horizonMs);\n    } catch (error) {\n      console.warn(\"[parlor] revocations: LISTEN failed, checking per call:\", error);\n      this.#mode = \"checking\";\n      this.#reconnect(this.#now());\n    }\n  }\n\n  async #connect(since: number): Promise<void> {\n    const generation = ++this.#generation;\n    const unlisten = await this.#database.listen!(\n      REVOCATION_CHANNEL,\n      (payload) => this.#receive(payload),\n      { onLost: () => this.#lost(generation) },\n    );\n    if (generation !== this.#generation) {\n      await unlisten().catch(() => {});\n      return;\n    }\n    this.#unlisten = unlisten;\n    const revocations = await this.#load(since);\n    if (generation !== this.#generation) return;\n    for (const revocation of revocations) this.#apply(revocation);\n    this.#mode = \"following\";\n  }\n\n  #lost(generation: number): void {\n    if (generation !== this.#generation || this.#stopped) return;\n    this.#generation += 1;\n    this.#unlisten = undefined;\n    this.#mode = \"checking\";\n    this.#reconnect(this.#now());\n  }\n\n  #reconnect(lostAt: number): void {\n    if (this.#reconnecting) return;\n    this.#reconnecting = true;\n    let delay = this.#relistenBaseMs;\n    const attempt = async () => {\n      this.#retry = undefined;\n      if (this.#stopped) return;\n      try {\n        await this.#connect(Math.min(lostAt, this.#now() - this.#horizonMs));\n        this.#reconnecting = false;\n      } catch (error) {\n        console.warn(\"[parlor] revocations: LISTEN failed, retrying:\", error);\n        this.#retry = setTimeout(attempt, delay);\n        delay = Math.min(delay * 2, this.#relistenMaxMs);\n      }\n    };\n    this.#retry = setTimeout(attempt, 0);\n  }\n\n  #receive(payload: string): void {\n    try {\n      this.#apply(JSON.parse(payload) as Revocation);\n    } catch {\n      console.warn(\"[parlor] revocations: ignored a malformed notice\");\n    }\n  }\n\n  #apply(revocation: Revocation): void {\n    const key = keyOf(revocation);\n    const known = this.#revoked.get(key);\n    if (known === undefined || revocation.at > known)\n      this.#revoked.set(key, revocation.at);\n    this.#sweepExpired();\n    const watch = this.#watches.get(key);\n    if (!watch || revocation.at < watch.since) return;\n    this.#watches.delete(key);\n    for (const ref of watch.controllers) ref.deref()?.abort();\n  }\n\n  #abortIfRevoked(\n    controller: AbortController,\n    notices: readonly RevocationNotice[],\n    since: number,\n  ): void {\n    const floor = Math.max(since, this.#now() - this.#horizonMs);\n    if (this.#mode === \"following\") {\n      const hit = notices.some(\n        (notice) => (this.#revoked.get(keyOf(notice)) ?? -1) >= floor,\n      );\n      if (hit) controller.abort();\n      return;\n    }\n    Promise.all(notices.map((notice) => this.#lookup(notice))).then(\n      (found) => {\n        if (found.some((at) => at !== undefined && at >= floor)) controller.abort();\n      },\n      () => controller.abort(),\n    );\n  }\n\n  #sweepExpired(): void {\n    const now = this.#now();\n    if (now - this.#sweptAt < this.#horizonMs) return;\n    this.#sweptAt = now;\n    for (const [key, at] of this.#revoked) {\n      if (at < now - this.#horizonMs) this.#revoked.delete(key);\n    }\n  }\n\n  #sweepWatch(key: string): void {\n    const watch = this.#watches.get(key);\n    if (!watch) return;\n    for (const ref of watch.controllers) if (!ref.deref()) watch.controllers.delete(ref);\n    if (watch.controllers.size === 0) this.#watches.delete(key);\n  }\n\n  async #lookup(notice: RevocationNotice): Promise<number | undefined> {\n    const rows = rowsOf<{ revoked_at: string | Date }>(\n      await (this.#database.read() as Database).execute(sql`\n        select revoked_at from parlor_auth_revocations\n        where kind = ${notice.kind} and id = ${notice.id}`),\n    );\n    const row = rows[0];\n    return row ? new Date(row.revoked_at).getTime() : undefined;\n  }\n\n  async #load(since: number): Promise<Revocation[]> {\n    const rows = rowsOf<{\n      kind: Revocation[\"kind\"];\n      id: string;\n      revoked_at: string | Date;\n    }>(\n      await (this.#database.read() as Database).execute(sql`\n        select kind, id, revoked_at from parlor_auth_revocations\n        where revoked_at >= ${new Date(since).toISOString()}`),\n    );\n    return rows.map((row) => ({\n      kind: row.kind,\n      id: row.id,\n      at: new Date(row.revoked_at).getTime(),\n    }));\n  }\n\n  async #prune(): Promise<void> {\n    const cutoff = new Date(this.#now() - this.#horizonMs).toISOString();\n    await (this.#database.read() as Database).execute(\n      sql`delete from parlor_auth_revocations where revoked_at < ${cutoff}`,\n    );\n  }\n}\n"]}

package/dist/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,YAAY,EAA2B,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AASnD,yFAAyF;AACzF,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAClC,OAAO,yDAAyD,CAAC;IACnE,OAAO,wBAAwB,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAa;IAChE,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,IAAkB,EAAqB,EAAE,CAAC,CAAC;QAClF,MAAM;QACN,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAEhF,MAAM,WAAW,GAAG,WAAW,CAAC;QAC9B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;YAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,OAAO,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAA2B;gBAC7D,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG;YACP,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC;KAC1C,WAAW,CAAC,QAAQ,CAAC;0BACA,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;;uCAEb,MAAM,CAAC,GAAG,CAAC;MAC5C,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,sCAAsC;uCACpF,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;;8BAErC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,GAAG,YAAY,EAAE,CAAC;iDACrC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;;;QAGjE,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,WAAW,CAAC;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,iBAAiB,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAC7E,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE7C,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,YAAY,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,OAAO,CACZ,MAAM,EAAE,OAAO,IAAI,2CAA2C,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACrB,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QACtB,OAAO,CAAC,KAAK,EAAE,uCAAuC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,0CAA0C,CAAC;QAC1D,OAAO,CAAC,KAAK,EAAE,4CAA4C,CAAC;QAC5D,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,YAAY,EAA2B,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AASnD,yFAAyF;AACzF,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAClC,OAAO,yDAAyD,CAAC;IACnE,OAAO,wBAAwB,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAa;IAChE,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,IAAkB,EAAqB,EAAE,CAAC,CAAC;QAClF,MAAM;QACN,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAEhF,MAAM,WAAW,GAAG,WAAW,CAAC;QAC9B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;YAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,OAAO,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAA2B;gBAC7D,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG;YACP,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC;KAC1C,WAAW,CAAC,QAAQ,CAAC;0BACA,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;;uCAEb,MAAM,CAAC,GAAG,CAAC;MAC5C,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,sCAAsC;uCACpF,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;;8BAErC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,GAAG,YAAY,EAAE,CAAC;iDACrC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;;;QAGjE,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,WAAW,CAAC;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,IAAI,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,iBAAiB,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAC7E,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAE7C,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,YAAY,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,OAAO,CACZ,MAAM,EAAE,OAAO,IAAI,2CAA2C,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACrB,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QACtB,OAAO,CAAC,KAAK,EAAE,uCAAuC,CAAC;QACvD,OAAO,CAAC,KAAK,EAAE,0CAA0C,CAAC;QAC1D,OAAO,CAAC,KAAK,EAAE,4CAA4C,CAAC;QAC5D,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type AnyPluginRoute,\n  type PluginHost,\n  pluginRoute,\n  type PublicPluginRoute,\n} from \"@parlor/server\";\n\nimport { AUTH_PLUGIN, CONSENT_PATH, type ParlorAuthSettings } from \"./better-auth.js\";\nimport { escape, failure, page } from \"./pages.js\";\nimport type { BetterAuthInstance } from \"./provider.js\";\n\ninterface RouteDeps {\n  readonly instance: BetterAuthInstance;\n  readonly settings: ParlorAuthSettings;\n  readonly host: PluginHost;\n}\n\n/** A client's name is self-declared; only an https client id proves who publishes it. */\nfunction publisherOf(clientId: string): string {\n  if (!clientId.startsWith(\"https://\"))\n    return \"This agent named itself; its publisher is not verified.\";\n  return `Published by <strong>${escape(new URL(clientId).host)}</strong>.`;\n}\n\nfunction redirectOrigin(query: URLSearchParams): string | undefined {\n  try {\n    return new URL(query.get(\"redirect_uri\") ?? \"\").origin;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Better Auth's endpoints under `/_parlor/auth`, the OAuth discovery documents MCP clients\n * read at the origin root, and the consent page an MCP client's authorization stops at.\n */\nexport function authRoutes({ instance, settings, host }: RouteDeps): AnyPluginRoute[] {\n  const forward = (method: \"GET\" | \"POST\", path: `/${string}`): PublicPluginRoute => ({\n    method,\n    path,\n    access: \"public\",\n    handle: (request) => instance.handler(request),\n  });\n  const appName = () => instance.options.appName ?? new URL(settings.origin).host;\n\n  const consentPage = pluginRoute({\n    method: \"GET\",\n    path: CONSENT_PATH,\n    access: [\"user\"],\n    handle: async (request) => {\n      const query = new URL(request.url).searchParams;\n      const clientId = query.get(\"client_id\");\n      const target = redirectOrigin(query);\n      if (!clientId || !target || !query.get(\"sig\")) {\n        return failure(\"This authorization request is incomplete.\", 400);\n      }\n      const session = await instance.api.getSession({ headers: request.headers });\n      if (!session) return failure(\"Sign in again to continue.\", 401);\n      const { adapter } = await instance.$context;\n      const client = await adapter.findOne<{ name?: string | null }>({\n        model: \"oauthClient\",\n        where: [{ field: \"clientId\", value: clientId }],\n      });\n      if (!client) return failure(\"This agent is not registered.\", 400);\n      const agent = client.name || clientId;\n      const app = appName();\n      const offline = (query.get(\"scope\") ?? \"\").split(\" \").includes(\"offline_access\");\n      const body = `\n<h1>Allow ${escape(agent)} to use ${escape(app)}?</h1>\n<p>${publisherOf(clientId)}</p>\n<p>Signed in as <strong>${escape(session.user.email)}</strong>.</p>\n<ul>\n<li>It can do anything you can do in ${escape(app)}, as you. Actions that ask for confirmation still ask you first.</li>\n<li>${offline ? \"It stays connected until you revoke it in your account settings.\" : \"Its access ends after a few minutes.\"}</li>\n<li>You will be sent back to <strong>${escape(new URL(target).host)}</strong>.</li>\n</ul>\n<form method=\"post\" action=\"${escape(`${host.basePath}/${AUTH_PLUGIN}${CONSENT_PATH}`)}\">\n<input type=\"hidden\" name=\"oauth_query\" value=\"${escape(query.toString())}\">\n<button type=\"submit\" name=\"accept\" value=\"false\">Deny</button>\n<button type=\"submit\" name=\"accept\" value=\"true\" autofocus>Allow</button>\n</form>`;\n      return page(`Allow ${agent}?`, body, [\"'self'\", target]);\n    },\n  });\n\n  const consentAnswer = pluginRoute({\n    method: \"POST\",\n    path: CONSENT_PATH,\n    access: [\"user\"],\n    handle: async (request) => {\n      if (request.headers.get(\"origin\") !== settings.origin) {\n        return failure(\"This answer did not come from the consent page.\", 403);\n      }\n      const form = new URLSearchParams(await request.text());\n      const oauthQuery = form.get(\"oauth_query\");\n      const accept = form.get(\"accept\");\n      if (!oauthQuery || (accept !== \"true\" && accept !== \"false\")) {\n        return failure(\"This answer is incomplete.\", 400);\n      }\n      const headers = new Headers({\n        \"content-type\": \"application/json\",\n        accept: \"application/json\",\n        origin: settings.origin,\n      });\n      const cookie = request.headers.get(\"cookie\");\n      if (cookie) headers.set(\"cookie\", cookie);\n      const answer = await instance.handler(\n        new Request(`${settings.baseURL}/oauth2/consent`, {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({ accept: accept === \"true\", oauth_query: oauthQuery }),\n        }),\n      );\n      const result = (await answer.json().catch(() => undefined)) as\n        | { url?: string; redirect_uri?: string; message?: string }\n        | undefined;\n      const location = result?.url ?? result?.redirect_uri;\n      if (!answer.ok || !location) {\n        return failure(\n          result?.message ?? \"The authorization could not be completed.\",\n          400,\n        );\n      }\n      return new Response(null, { status: 303, headers: { location } });\n    },\n  });\n\n  return [\n    forward(\"GET\", \"/**\"),\n    forward(\"POST\", \"/**\"),\n    forward(\"GET\", \"/.well-known/oauth-protected-resource\"),\n    forward(\"GET\", \"/.well-known/oauth-protected-resource/**\"),\n    forward(\"GET\", \"/.well-known/oauth-authorization-server/**\"),\n    consentPage,\n    consentAnswer,\n  ];\n}\n"]}