@parlor/auth 0.1.0 → 0.3.0

package/dist/account.d.ts

@@ -1,6 +1,6 @@
 import { type ActionContext, type UserPrincipal } from "@parlor/core";
 import { type ActionsOf } from "@parlor/core/registry";
-import type { PluginHost } from "@parlor/server";
+import type { PluginCaller, PluginHost } from "@parlor/server";
 import { z } from "zod";
 import type { DeviceAccountActions } from "./devices.js";
 import type { HostAccountActions } from "./hosts.js";
@@ -29,6 +29,13 @@ interface AccountDeps {
     readonly revoke: (notice: RevocationNotice) => Promise<void>;
 }
 export declare function signedIn(ctx: ActionContext): UserPrincipal;
+/**
+ * Computers and device keys exist only for the chat, so a user its `access` refuses can
+ * pair neither; removing what they already have stays open.
+ */
+export declare function chatAllows(host: PluginHost, caller: PluginCaller): Promise<boolean>;
+export declare const CHAT_REFUSED = "This account cannot use the agent.";
+export declare function requireChat(host: PluginHost, ctx: ActionContext): Promise<void>;
 /**
  * Plugin actions at `/_parlor/auth/actions/<name>`. Better Auth writes through its own
  * connection, so these never run inside an action transaction (on PGlite that would

package/dist/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,SAAS,EAAkB,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,YAAY,yBAAyB,CAAC;AACnD,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAaD,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,GACvE,kBAAkB,GAClB,oBAAoB,CAAC;AAEvB,UAAU,WAAW;IACnB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAK1D;AAKD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW;;;;;;;;;;;;;GAiGrE"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,SAAS,EAAkB,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,YAAY,yBAAyB,CAAC;AACnD,eAAO,MAAM,UAAU,uBAAuB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAaD,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,GACvE,kBAAkB,GAClB,oBAAoB,CAAC;AAEvB,UAAU,WAAW;IACnB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAK1D;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,eAAO,MAAM,YAAY,uCAAuC,CAAC;AAEjE,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;AAKD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW;;;;;;;;;;;;;GAiGrE"}

package/dist/account.js

@@ -1,3 +1,4 @@
+import { CHAT_PLUGIN } from "@parlor/chat";
 import { ActionError, defineAction, } from "@parlor/core";
 import { createRegistry } from "@parlor/core/registry";
 import { z } from "zod";
@@ -10,6 +11,18 @@ export function signedIn(ctx) {
     }
     return ctx.principal;
 }
+/**
+ * Computers and device keys exist only for the chat, so a user its `access` refuses can
+ * pair neither; removing what they already have stays open.
+ */
+export async function chatAllows(host, caller) {
+    return (await host.allows?.(CHAT_PLUGIN, caller)) ?? true;
+}
+export const CHAT_REFUSED = "This account cannot use the agent.";
+export async function requireChat(host, ctx) {
+    if (!(await chatAllows(host, ctx)))
+        throw new ActionError("forbidden", CHAT_REFUSED);
+}
 const scopesOf = (scopes) => typeof scopes === "string" ? scopes.split(" ").filter(Boolean) : [...scopes];
 /**
  * Plugin actions at `/_parlor/auth/actions/<name>`. Better Auth writes through its own

package/dist/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAEX,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AACnD,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAuC/C,MAAM,UAAU,QAAQ,CAAC,GAAkB;IACzC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,CAAC;AACvB,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,EAAE,CAC3C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAe;IACpE,OAAO,cAAc,CAAC;QACpB,QAAQ,EAAE,YAAY,CAAC;YACrB,WAAW,EAAE,4CAA4C;YACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA8B,EAAE;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,OAAO,QAAQ;qBACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;qBAC7D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;qBAC7D,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS;oBACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;oBAC1C,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC9C,CAAC,CAAC,CAAC;YACR,CAAC;SACF,CAAC;QACF,aAAa,EAAE,YAAY,CAAC;YAC1B,WAAW,EAAE,iEAAiE;YAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;gBACrE,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;SACF,CAAC;QACF,MAAM,EAAE,YAAY,CAAC;YACnB,WAAW,EAAE,sDAAsD;YACnE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA6B,EAAE;gBACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAClD,OAAO,CAAC,QAAQ,CAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC/D,OAAO,CAAC,QAAQ,CAAuB;wBACrC,KAAK,EAAE,mBAAmB;wBAC1B,KAAK,EAAE,IAAI;qBACZ,CAAC;iBACH,CAAC,CAAC;gBACH,iFAAiF;gBACjF,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;gBACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;gBACxC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS;wBAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;oBACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAA2B;wBAC7D,KAAK,EAAE,aAAa;wBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;qBACtD,CAAC,CAAC;oBACH,OAAO;wBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ;wBACpC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;wBAC9B,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC3C,CAAC;gBACJ,CAAC,CAAC,CACH,CAAC;YACJ,CAAC;SACF,CAAC;QACF,WAAW,EAAE,YAAY,CAAC;YACxB,WAAW,EAAE,4DAA4D;YACzE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,MAAM,KAAK,GAAG;oBACZ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;oBACvC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;iBACvC,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBAC9E,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YAC1B,CAAC;SACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,WAAW,EAEX,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAkB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AACnD,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAuC/C,MAAM,UAAU,QAAQ,CAAC,GAAkB;IACzC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAgB,EAChB,MAAoB;IAEpB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAkB;IACpE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,EAAE,CAC3C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAe;IACpE,OAAO,cAAc,CAAC;QACpB,QAAQ,EAAE,YAAY,CAAC;YACrB,WAAW,EAAE,4CAA4C;YACzD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,YAAY,CAAC;YACrB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA8B,EAAE;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,OAAO,QAAQ;qBACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;qBAC7D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;qBAC7D,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS;oBACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;oBACpC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;oBAC1C,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC9C,CAAC,CAAC,CAAC;YACR,CAAC;SACF,CAAC;QACF,aAAa,EAAE,YAAY,CAAC;YAC1B,WAAW,EAAE,iEAAiE;YAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;gBACrE,MAAM,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrD,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;SACF,CAAC;QACF,MAAM,EAAE,YAAY,CAAC;YACnB,WAAW,EAAE,sDAAsD;YACnE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAA6B,EAAE;gBACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACvD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAClD,OAAO,CAAC,QAAQ,CAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBAC/D,OAAO,CAAC,QAAQ,CAAuB;wBACrC,KAAK,EAAE,mBAAmB;wBAC1B,KAAK,EAAE,IAAI;qBACZ,CAAC;iBACH,CAAC,CAAC;gBACH,iFAAiF;gBACjF,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;gBACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;gBACxC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS;wBAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;oBACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAA2B;wBAC7D,KAAK,EAAE,aAAa;wBACpB,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;qBACtD,CAAC,CAAC;oBACH,OAAO;wBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ;wBACpC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;wBAC9B,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;qBAC3C,CAAC;gBACJ,CAAC,CAAC,CACH,CAAC;YACJ,CAAC;SACF,CAAC;QACF,WAAW,EAAE,YAAY,CAAC;YACxB,WAAW,EAAE,4DAA4D;YACzE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBAC5C,MAAM,KAAK,GAAG;oBACZ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;oBACvC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;iBACvC,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;oBAC9E,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YAC1B,CAAC;SACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { CHAT_PLUGIN } from \"@parlor/chat\";\nimport {\n  ActionError,\n  type ActionContext,\n  defineAction,\n  type UserPrincipal,\n} from \"@parlor/core\";\nimport { type ActionsOf, createRegistry } from \"@parlor/core/registry\";\nimport type { PluginCaller, PluginHost } from \"@parlor/server\";\nimport { z } from \"zod\";\n\nimport type { DeviceAccountActions } from \"./devices.js\";\nimport { grantIdOf } from \"./grants.js\";\nimport type { HostAccountActions } from \"./hosts.js\";\nimport type { BetterAuthInstance } from \"./provider.js\";\nimport type { RevocationNotice } from \"./revocation.js\";\n\nexport const SESSIONS_TAG = \"parlor_auth_sessions\";\nexport const AGENTS_TAG = \"parlor_auth_agents\";\n\nexport interface SignedInSession {\n  readonly id: string;\n  readonly current: boolean;\n  readonly userAgent: string | null;\n  readonly ipAddress: string | null;\n  readonly createdAt: string;\n  readonly lastActiveAt: string;\n}\n\nexport interface ConnectedAgent {\n  readonly clientId: string;\n  readonly name: string;\n  readonly scopes: readonly string[];\n  readonly connectedAt: string;\n}\n\ninterface Grant {\n  readonly clientId: string;\n  readonly scopes: string | readonly string[];\n  readonly createdAt: Date;\n}\n\ninterface RefreshToken {\n  readonly revoked?: Date | null;\n  readonly expiresAt: Date;\n}\n\nexport type AccountActions = ActionsOf<ReturnType<typeof accountActions>> &\n  HostAccountActions &\n  DeviceAccountActions;\n\ninterface AccountDeps {\n  readonly instance: BetterAuthInstance;\n  readonly host: PluginHost;\n  readonly revoke: (notice: RevocationNotice) => Promise<void>;\n}\n\nexport function signedIn(ctx: ActionContext): UserPrincipal {\n  if (ctx.principal.kind !== \"user\") {\n    throw new ActionError(\"forbidden\", \"Only a signed-in user manages the account.\");\n  }\n  return ctx.principal;\n}\n\n/**\n * Computers and device keys exist only for the chat, so a user its `access` refuses can\n * pair neither; removing what they already have stays open.\n */\nexport async function chatAllows(\n  host: PluginHost,\n  caller: PluginCaller,\n): Promise<boolean> {\n  return (await host.allows?.(CHAT_PLUGIN, caller)) ?? true;\n}\n\nexport const CHAT_REFUSED = \"This account cannot use the agent.\";\n\nexport async function requireChat(host: PluginHost, ctx: ActionContext): Promise<void> {\n  if (!(await chatAllows(host, ctx))) throw new ActionError(\"forbidden\", CHAT_REFUSED);\n}\n\nconst scopesOf = (scopes: Grant[\"scopes\"]) =>\n  typeof scopes === \"string\" ? scopes.split(\" \").filter(Boolean) : [...scopes];\n\n/**\n * Plugin actions at `/_parlor/auth/actions/<name>`. Better Auth writes through its own\n * connection, so these never run inside an action transaction (on PGlite that would\n * deadlock) and announce their changes afterwards instead of declaring `writes`.\n */\nexport function accountActions({ instance, host, revoke }: AccountDeps) {\n  return createRegistry({\n    sessions: defineAction({\n      description: \"List the places this account is signed in.\",\n      input: z.object({}),\n      reads: [SESSIONS_TAG],\n      run: async (_input, ctx): Promise<SignedInSession[]> => {\n        const user = signedIn(ctx);\n        const { internalAdapter } = await instance.$context;\n        const sessions = await internalAdapter.listSessions(user.userId);\n        return sessions\n          .filter((session) => session.expiresAt.getTime() > Date.now())\n          .sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())\n          .map((session) => ({\n            id: session.id,\n            current: session.id === user.sessionId,\n            userAgent: session.userAgent ?? null,\n            ipAddress: session.ipAddress ?? null,\n            createdAt: session.createdAt.toISOString(),\n            lastActiveAt: session.updatedAt.toISOString(),\n          }));\n      },\n    }),\n    revokeSession: defineAction({\n      description: \"Sign this account out of one place; its open connections close.\",\n      input: z.object({ id: z.string().min(1) }),\n      run: async ({ id }, ctx) => {\n        const user = signedIn(ctx);\n        const { internalAdapter } = await instance.$context;\n        const sessions = await internalAdapter.listSessions(user.userId);\n        const session = sessions.find((candidate) => candidate.id === id);\n        if (!session) throw new ActionError(\"not_found\", `No session ${id}`);\n        await internalAdapter.deleteSession(session.token);\n        await host.announce(ctx.scope, [[SESSIONS_TAG, id]]);\n        return { id };\n      },\n    }),\n    agents: defineAction({\n      description: \"List the agents this account authorized through MCP.\",\n      input: z.object({}),\n      reads: [AGENTS_TAG],\n      run: async (_input, ctx): Promise<ConnectedAgent[]> => {\n        const user = signedIn(ctx);\n        const { adapter } = await instance.$context;\n        const mine = [{ field: \"userId\", value: user.userId }];\n        const [consents, refreshTokens] = await Promise.all([\n          adapter.findMany<Grant>({ model: \"oauthConsent\", where: mine }),\n          adapter.findMany<Grant & RefreshToken>({\n            model: \"oauthRefreshToken\",\n            where: mine,\n          }),\n        ]);\n        // A trusted client skips consent, so its live refresh tokens are its only trace.\n        const live = refreshTokens.filter(\n          (token) => !token.revoked && token.expiresAt.getTime() > Date.now(),\n        );\n        const grants = new Map<string, Grant>();\n        for (const grant of [...live, ...consents]) {\n          const known = grants.get(grant.clientId);\n          if (!known || grant.createdAt < known.createdAt)\n            grants.set(grant.clientId, grant);\n        }\n        return Promise.all(\n          [...grants.values()].map(async (grant) => {\n            const client = await adapter.findOne<{ name?: string | null }>({\n              model: \"oauthClient\",\n              where: [{ field: \"clientId\", value: grant.clientId }],\n            });\n            return {\n              clientId: grant.clientId,\n              name: client?.name || grant.clientId,\n              scopes: scopesOf(grant.scopes),\n              connectedAt: grant.createdAt.toISOString(),\n            };\n          }),\n        );\n      },\n    }),\n    revokeAgent: defineAction({\n      description: \"Revoke an agent's access; its tokens stop working at once.\",\n      input: z.object({ clientId: z.string().min(1) }),\n      run: async ({ clientId }, ctx) => {\n        const user = signedIn(ctx);\n        await revoke({ kind: \"grant\", id: grantIdOf(user.userId, clientId) });\n        const { adapter } = await instance.$context;\n        const where = [\n          { field: \"userId\", value: user.userId },\n          { field: \"clientId\", value: clientId },\n        ];\n        for (const model of [\"oauthConsent\", \"oauthRefreshToken\", \"oauthAccessToken\"]) {\n          await adapter.deleteMany({ model, where });\n        }\n        await host.announce(ctx.scope, [[AGENTS_TAG, clientId]]);\n        return { id: clientId };\n      },\n    }),\n  });\n}\n"]}

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,EAAE,EAAE,iBAAiB;IACrB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA8B6D;CACnE,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,SAAS,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAe;IAC9D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,KAAK,CAAC,KAAkB;IAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC3E,MAAM,KAAK,GACT,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QACrD,CAAC,CAAC,SAAS,CAAC,OAAO;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IACzE,OAAO,GAAG,CAAA,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI;MAC9E,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI;MAC9B,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;MACtD,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;MAC/D,IAAI,IAAI,IAAI;MACZ,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;MACxD,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;MAC5D,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,IAAI,IAAI;MAC/C,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO;MACpF,KAAK,CAAC,YAAY,IAAI,IAAI,GAAG,CAAC;AACpC,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,QAAsB;IACnD,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC;QACrB,MAAM,GAAG,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACtC,MAAO,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;;;;mBAKvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,GAAG,SAAS,CAAC;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO;YAAE,OAAO;QAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,KAAK,GAAG,SAAS,CAAC;YAClB,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC/B,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;gBACjE,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,KAAK;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC/B,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;oBACjE,QAAQ,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,KAAK;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,CAAC,MAAM,eAAe,GAAc;IACxC,EAAE,EAAE,iBAAiB;IACrB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEA8B6D;CACnE,CAAC;AAEF,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,SAAS,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAe;IAC9D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,KAAK,CAAC,KAAkB;IAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC3E,MAAM,KAAK,GACT,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QACrD,CAAC,CAAC,SAAS,CAAC,OAAO;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IACzE,OAAO,GAAG,CAAA,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI;MAC9E,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI;MAC9B,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;MACtD,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;MAC/D,IAAI,IAAI,IAAI;MACZ,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;MACxD,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;MAC5D,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,IAAI,IAAI;MAC/C,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO;MACpF,KAAK,CAAC,YAAY,IAAI,IAAI,GAAG,CAAC;AACpC,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,QAAsB;IACnD,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC;QACrB,MAAM,GAAG,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACtC,MAAO,EAAe,CAAC,OAAO,CAAC,GAAG,CAAA;;;;;mBAKvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAA,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,GAAG,SAAS,CAAC;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO;YAAE,OAAO;QAC3C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,KAAK,GAAG,SAAS,CAAC;YAClB,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC/B,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;gBACjE,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,KAAK;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC/B,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;oBACjE,QAAQ,EAAE,CAAC;gBACb,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,KAAK;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DataProvider } from \"@parlor/core\";\nimport type { ActionAudit, Migration } from \"@parlor/server\";\nimport { type SQL, sql } from \"drizzle-orm\";\n\nimport type { Database } from \"./database.js\";\n\nexport const AUDIT_MIGRATION: Migration = {\n  id: \"auth/0006_audit\",\n  sql: `\n    create table parlor_auth_audit (\n      id bigint generated always as identity primary key,\n      at timestamptz not null,\n      action text not null,\n      actor_kind text not null,\n      user_id text,\n      grant_id text,\n      session_id text,\n      device_id text,\n      host_id text,\n      agent_name text,\n      agent_verified boolean,\n      thread_id text,\n      turn_id text,\n      source text not null,\n      scope text not null,\n      input_digest text not null,\n      stage text not null,\n      outcome text not null,\n      confirmation text\n    );\n    create index parlor_auth_audit_by_user on parlor_auth_audit (user_id, at);\n    create function parlor_auth_audit_append_only() returns trigger language plpgsql as $$\n    begin\n      raise exception 'parlor_auth_audit is append-only';\n    end\n    $$;\n    create trigger parlor_auth_audit_append_only\n      before update or delete on parlor_auth_audit\n      for each row execute function parlor_auth_audit_append_only()`,\n};\n\nconst FLUSH_MS = 250;\nconst FLUSH_AT = 100;\nconst KEEP_AT_MOST = 10_000;\n\nfunction audited({ principal, stage, confirmation }: ActionAudit): boolean {\n  return principal.kind === \"agent\" || stage === \"refused\" || confirmation !== undefined;\n}\n\nfunction rowOf(audit: ActionAudit): SQL {\n  const { principal } = audit;\n  const user = principal.kind === \"anonymous\" ? undefined : principal.userId;\n  const grant =\n    principal.kind === \"agent\" || principal.kind === \"host\"\n      ? principal.grantId\n      : undefined;\n  const turn = principal.kind === \"agent\" ? principal.turn : undefined;\n  const host = principal.kind === \"host\" ? principal.hostId : turn?.hostId;\n  return sql`(${new Date(audit.at).toISOString()}, ${audit.action}, ${principal.kind},\n    ${user ?? null}, ${grant ?? null},\n    ${principal.kind === \"user\" ? principal.sessionId : null},\n    ${principal.kind === \"user\" ? (principal.deviceId ?? null) : null},\n    ${host ?? null},\n    ${principal.kind === \"agent\" ? principal.agent.name : null},\n    ${principal.kind === \"agent\" ? principal.agent.verified : null},\n    ${turn?.threadId ?? null}, ${turn?.turnId ?? null},\n    ${audit.source}, ${audit.scope}, ${audit.inputDigest}, ${audit.stage}, ${audit.outcome},\n    ${audit.confirmation ?? null})`;\n}\n\nexport interface AuditLog {\n  record(audit: ActionAudit): void;\n  flush(): Promise<void>;\n  stop(): Promise<void>;\n}\n\nexport function createAuditLog(database: DataProvider): AuditLog {\n  let queued: ActionAudit[] = [];\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  let writing: Promise<void> = Promise.resolve();\n  let stopped = false;\n\n  const write = async () => {\n    if (queued.length === 0) return;\n    const batch = queued;\n    queued = [];\n    try {\n      await database.transaction(async (tx) => {\n        await (tx as Database).execute(sql`\n          insert into parlor_auth_audit\n            (at, action, actor_kind, user_id, grant_id, session_id, device_id, host_id,\n             agent_name, agent_verified, thread_id, turn_id, source, scope, input_digest,\n             stage, outcome, confirmation)\n          values ${sql.join(batch.map(rowOf), sql`, `)}`);\n      });\n    } catch (error) {\n      queued = [...batch, ...queued].slice(-KEEP_AT_MOST);\n      throw error;\n    }\n  };\n\n  const flush = () => {\n    if (timer !== undefined) clearTimeout(timer);\n    timer = undefined;\n    const next = writing.then(write, write);\n    writing = next.catch(() => {});\n    return next;\n  };\n\n  const schedule = () => {\n    if (timer !== undefined || stopped) return;\n    timer = setTimeout(() => {\n      timer = undefined;\n      flush().catch((error: unknown) => {\n        console.error(\"[parlor] audit write failed, will retry:\", error);\n        schedule();\n      });\n    }, FLUSH_MS);\n    timer.unref?.();\n  };\n\n  return {\n    record(audit) {\n      if (!audited(audit)) return;\n      queued.push(audit);\n      if (queued.length >= FLUSH_AT) {\n        flush().catch((error: unknown) => {\n          console.error(\"[parlor] audit write failed, will retry:\", error);\n          schedule();\n        });\n      } else {\n        schedule();\n      }\n    },\n    flush,\n    async stop() {\n      stopped = true;\n      await flush().catch((error: unknown) => {\n        console.error(\"[parlor] audit write failed on shutdown:\", error);\n      });\n    },\n  };\n}\n"]}

package/dist/better-auth.d.ts

@@ -16,6 +16,11 @@ export interface ParlorAuthOptions extends Omit<BetterAuthOptions, "basePath" |
      * resumes once the user signs in through `@parlor/auth/client`.
      */
     readonly signInPage: string;
+    /**
+     * The app's URL scheme, `app.scheme`, where social sign-in in a native shell returns.
+     * Defaults to `PARLOR_APP_SCHEME`, which `parlor dev` and `parlor build` set from it.
+     */
+    readonly scheme?: string | undefined;
 }
 export interface ParlorAuthSettings {
     readonly appName?: string | undefined;

package/dist/better-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,aAAa,CAAC;AAGvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,WAAW,SAAS,CAAC;AAClC,eAAO,MAAM,cAAc,kBAAwC,CAAC;AACpE,eAAO,MAAM,SAAS,QAAQ,CAAC;AAC/B,eAAO,MAAM,YAAY,aAAa,CAAC;AAGvC,eAAO,MAAM,kBAAkB,QAA2C,CAAC;AAa3E,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,iBAAiB,EACjB,UAAU,GAAG,SAAS,CACvB;IACC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,MAAM;IACd,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACpE;AA8BD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAQ3D;AAED,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,MAAM,EAAE,CAMlF;AAWD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CA4BxE"}
+{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAoB,MAAM,aAAa,CAAC;AAIvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,eAAO,MAAM,WAAW,SAAS,CAAC;AAClC,eAAO,MAAM,cAAc,kBAAwC,CAAC;AACpE,eAAO,MAAM,SAAS,QAAQ,CAAC;AAC/B,eAAO,MAAM,YAAY,aAAa,CAAC;AAGvC,eAAO,MAAM,kBAAkB,QAA2C,CAAC;AAa3E,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,iBAAiB,EACjB,UAAU,GAAG,SAAS,CACvB;IACC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,MAAM;IACd,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACpE;AA8BD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAQ3D;AAED,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,MAAM,EAAE,CAMlF;AAWD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CA4BxE"}

package/dist/better-auth.js

@@ -3,6 +3,7 @@ import { fetchClientMetadataResource } from "@better-auth/cimd/node";
 import { mcp } from "@better-auth/mcp";
 import { DEFAULT_BASE_PATH, REVOCATION_HORIZON_MS, SHELL_ORIGINS } from "@parlor/server";
 import { bearer, jwt } from "better-auth/plugins";
+import { nativeSignIn } from "./native-sign-in.js";
 export const AUTH_PLUGIN = "auth";
 export const AUTH_BASE_PATH = `${DEFAULT_BASE_PATH}/${AUTH_PLUGIN}`;
 export const MCP_SCOPE = "mcp";
@@ -72,7 +73,7 @@ function originOf(options) {
  * PKCE, tokens bound to `/_parlor/mcp`).
  */
 export function parlorAuth(options) {
-    const { origin: _origin, signInPage, ...rest } = options;
+    const { origin: _origin, signInPage, scheme, ...rest } = options;
     const origin = originOf(options);
     const baseURL = `${origin}${AUTH_BASE_PATH}`;
     const resource = `${origin}${DEFAULT_BASE_PATH}/mcp`;
@@ -95,12 +96,12 @@ export function parlorAuth(options) {
         disabledPaths: [...DISABLED_PATHS, ...(rest.disabledPaths ?? [])],
         plugins: [
             ...(rest.plugins ?? []),
-            ...frameworkPlugins(resource, signInPage),
+            ...frameworkPlugins(resource, signInPage, scheme ?? process.env.PARLOR_APP_SCHEME),
             bridgePlugin(bridge),
         ],
     };
 }
-function frameworkPlugins(resource, signInPage) {
+function frameworkPlugins(resource, signInPage, scheme) {
     // Better Auth's plugin types are not written for exactOptionalPropertyTypes.
     return [
         bearer(),
@@ -113,6 +114,7 @@ function frameworkPlugins(resource, signInPage) {
             accessTokenExpiresIn: ACCESS_TOKEN_TTL_S,
         }),
         cimd({ fetchClientMetadataResource, metadataProfile: "mcp-2026-07-28" }),
+        nativeSignIn({ scheme: scheme || undefined }),
     ];
 }
 //# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEzF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAIlD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,iBAAiB,IAAI,WAAW,EAAE,CAAC;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAC/B,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AACvC,+EAA+E;AAC/E,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,qBAAqB,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;AAE3E,uFAAuF;AACvF,MAAM,cAAc,GAAG;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,8BAA8B;IAC9B,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;AA8BF,MAAM,aAAa,GAAG,QAAQ,CAAC;AAM/B,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,KAAK,EAAE,MAAwB,EAAE,EAAE;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,MAAM;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACX,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE;qBAC3E;iBACF;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA0B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAQ,MAAuB,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAClC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,iBAAiB,MAAM,CAAC;IACrD,MAAM,MAAM,GAAW;QACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC/D,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;IACpC,OAAO;QACL,GAAG,IAAI;QACP,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACpC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC;YACzD,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;gBACjB,MAAM;gBACN,GAAG,aAAa;gBAChB,GAAG,UAAU,EAAE;gBACf,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;QACL,aAAa,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACvB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC;YACzC,YAAY,CAAC,MAAM,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;IAC5D,6EAA6E;IAC7E,OAAO;QACL,MAAM,EAAE;QACR,GAAG,EAAE;QACL,GAAG,CAAC;YACF,QAAQ;YACR,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,GAAG,cAAc,GAAG,YAAY,EAAE;YAC/C,MAAM,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC;YACrC,oBAAoB,EAAE,kBAAkB;SACzC,CAAC;QACF,IAAI,CAAC,EAAE,2BAA2B,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;KACnD,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEzF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,iBAAiB,IAAI,WAAW,EAAE,CAAC;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAC/B,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AACvC,+EAA+E;AAC/E,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,qBAAqB,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;AAE3E,uFAAuF;AACvF,MAAM,cAAc,GAAG;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,8BAA8B;IAC9B,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;AAmCF,MAAM,aAAa,GAAG,QAAQ,CAAC;AAM/B,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,KAAK,EAAE,MAAwB,EAAE,EAAE;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,MAAM;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACX,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,OAAO,EAAE;wBACP,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE;qBAC3E;iBACF;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA0B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAQ,MAAuB,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAClC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACjE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,iBAAiB,MAAM,CAAC;IACrD,MAAM,MAAM,GAAW;QACrB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC/D,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;IACpC,OAAO;QACL,GAAG,IAAI;QACP,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACpC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC;YACzD,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;gBACjB,MAAM;gBACN,GAAG,aAAa;gBAChB,GAAG,UAAU,EAAE;gBACf,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;QACL,aAAa,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACvB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClF,YAAY,CAAC,MAAM,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,UAAkB,EAClB,MAA0B;IAE1B,6EAA6E;IAC7E,OAAO;QACL,MAAM,EAAE;QACR,GAAG,EAAE;QACL,GAAG,CAAC;YACF,QAAQ;YACR,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,GAAG,cAAc,GAAG,YAAY,EAAE;YAC/C,MAAM,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC;YACrC,oBAAoB,EAAE,kBAAkB;SACzC,CAAC;QACF,IAAI,CAAC,EAAE,2BAA2B,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;QACxE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;KACxB,CAAC;AAC1B,CAAC","sourcesContent":["import { cimd } from \"@better-auth/cimd\";\nimport { fetchClientMetadataResource } from \"@better-auth/cimd/node\";\nimport { mcp } from \"@better-auth/mcp\";\nimport { DEFAULT_BASE_PATH, REVOCATION_HORIZON_MS, SHELL_ORIGINS } from \"@parlor/server\";\nimport type { BetterAuthOptions, BetterAuthPlugin } from \"better-auth\";\nimport { bearer, jwt } from \"better-auth/plugins\";\n\nimport { nativeSignIn } from \"./native-sign-in.js\";\nimport type { RevocationNotice } from \"./revocation.js\";\n\nexport const AUTH_PLUGIN = \"auth\";\nexport const AUTH_BASE_PATH = `${DEFAULT_BASE_PATH}/${AUTH_PLUGIN}`;\nexport const MCP_SCOPE = \"mcp\";\nexport const CONSENT_PATH = \"/consent\";\n/** Clock skew a revocation must outlast beyond a credential's own lifetime. */\nconst SKEW_MS = 60_000;\nexport const ACCESS_TOKEN_TTL_S = (REVOCATION_HORIZON_MS - SKEW_MS) / 1000;\n\n/** Better Auth endpoints that would let a user bypass Parlor's own account actions. */\nconst DISABLED_PATHS = [\n  \"/oauth2/create-client\",\n  \"/oauth2/update-client\",\n  \"/oauth2/delete-client\",\n  \"/oauth2/client/rotate-secret\",\n  \"/oauth2/get-clients\",\n  \"/oauth2/delete-consent\",\n  \"/oauth2/update-consent\",\n];\n\nexport interface ParlorAuthOptions extends Omit<\n  BetterAuthOptions,\n  \"basePath\" | \"baseURL\"\n> {\n  /**\n   * The app's public origin, which serves its pages and `/_parlor`. Defaults to\n   * `PARLOR_ORIGIN`, then to the web origin `parlor dev` sets.\n   */\n  readonly origin?: string | undefined;\n  /**\n   * The app page that signs a user in. An MCP client's authorization lands there and\n   * resumes once the user signs in through `@parlor/auth/client`.\n   */\n  readonly signInPage: string;\n  /**\n   * The app's URL scheme, `app.scheme`, where social sign-in in a native shell returns.\n   * Defaults to `PARLOR_APP_SCHEME`, which `parlor dev` and `parlor build` set from it.\n   */\n  readonly scheme?: string | undefined;\n}\n\nexport interface ParlorAuthSettings {\n  readonly appName?: string | undefined;\n  readonly origin: string;\n  readonly baseURL: string;\n  readonly resource: string;\n}\n\ninterface Bridge {\n  settings: ParlorAuthSettings;\n  revoke?: ((notice: RevocationNotice) => Promise<void>) | undefined;\n}\n\nconst BRIDGE_PLUGIN = \"parlor\";\n\ninterface BridgePlugin extends BetterAuthPlugin {\n  readonly bridge: Bridge;\n}\n\nfunction bridgePlugin(bridge: Bridge): BridgePlugin {\n  const ended = async (notice: RevocationNotice) => {\n    if (!bridge.revoke) {\n      throw new Error(\"Install betterAuthProvider() in createServer({ auth }).\");\n    }\n    await bridge.revoke(notice);\n  };\n  return {\n    id: BRIDGE_PLUGIN,\n    bridge,\n    init: () => ({\n      options: {\n        databaseHooks: {\n          session: {\n            delete: { after: (session) => ended({ kind: \"session\", id: session.id }) },\n          },\n        },\n      },\n    }),\n  };\n}\n\nexport function bridgeOf(options: BetterAuthOptions): Bridge {\n  const plugin = options.plugins?.find((candidate) => candidate.id === BRIDGE_PLUGIN);\n  if (!plugin) {\n    throw new Error(\n      \"Pass the Better Auth options through parlorAuth() before betterAuth().\",\n    );\n  }\n  return (plugin as BridgePlugin).bridge;\n}\n\n/** The other frontends one `parlor dev` serves next to the web target, each on its own port. */\nexport function devOrigins(env: NodeJS.ProcessEnv = process.env): readonly string[] {\n  if (env.PARLOR_DEV !== \"1\") return [];\n  return (env.PARLOR_DEV_ORIGINS ?? \"\")\n    .split(\",\")\n    .map((origin) => origin.trim())\n    .filter((origin) => /^https?:\\/\\//.test(origin));\n}\n\nfunction originOf(options: ParlorAuthOptions): string {\n  const origin =\n    options.origin ?? process.env.PARLOR_ORIGIN ?? process.env.PARLOR_WEB_ORIGIN;\n  if (!origin) {\n    throw new Error(\"Set PARLOR_ORIGIN to the app's public origin, or pass `origin`.\");\n  }\n  return new URL(origin).origin;\n}\n\n/**\n * The Better Auth options Parlor needs, merged into the app's own: sessions as a cookie\n * on the web and a bearer token in native shells, and an OAuth authorization server for\n * MCP clients (MCP 2026-07-28: protected resource metadata, Client ID Metadata Documents,\n * PKCE, tokens bound to `/_parlor/mcp`).\n */\nexport function parlorAuth(options: ParlorAuthOptions): BetterAuthOptions {\n  const { origin: _origin, signInPage, scheme, ...rest } = options;\n  const origin = originOf(options);\n  const baseURL = `${origin}${AUTH_BASE_PATH}`;\n  const resource = `${origin}${DEFAULT_BASE_PATH}/mcp`;\n  const bridge: Bridge = {\n    settings: { appName: rest.appName, origin, baseURL, resource },\n  };\n  const trusted = rest.trustedOrigins;\n  return {\n    ...rest,\n    baseURL,\n    basePath: AUTH_BASE_PATH,\n    trustedOrigins: Array.isArray(trusted)\n      ? [origin, ...SHELL_ORIGINS, ...devOrigins(), ...trusted]\n      : async (request) => [\n          origin,\n          ...SHELL_ORIGINS,\n          ...devOrigins(),\n          ...(typeof trusted === \"function\" ? await trusted(request) : []),\n        ],\n    disabledPaths: [...DISABLED_PATHS, ...(rest.disabledPaths ?? [])],\n    plugins: [\n      ...(rest.plugins ?? []),\n      ...frameworkPlugins(resource, signInPage, scheme ?? process.env.PARLOR_APP_SCHEME),\n      bridgePlugin(bridge),\n    ],\n  };\n}\n\nfunction frameworkPlugins(\n  resource: string,\n  signInPage: string,\n  scheme: string | undefined,\n): BetterAuthPlugin[] {\n  // Better Auth's plugin types are not written for exactOptionalPropertyTypes.\n  return [\n    bearer(),\n    jwt(),\n    mcp({\n      resource,\n      loginPage: signInPage,\n      consentPage: `${AUTH_BASE_PATH}${CONSENT_PATH}`,\n      scopes: [MCP_SCOPE, \"offline_access\"],\n      accessTokenExpiresIn: ACCESS_TOKEN_TTL_S,\n    }),\n    cimd({ fetchClientMetadataResource, metadataProfile: \"mcp-2026-07-28\" }),\n    nativeSignIn({ scheme: scheme || undefined }),\n  ] as BetterAuthPlugin[];\n}\n"]}

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { type DeviceKey, type SessionStore } from "@parlor/capabilities";
-import { type ActionClient, type DeviceLinker, type DeviceSource, type HostAuthorizer, type SessionDevice, type SessionSource } from "@parlor/client";
+import { type AuthBrowser, type DeviceKey, type SessionStore } from "@parlor/capabilities";
+import { type ActionClient, type ComputerDisconnector, type DeviceLinker, type DeviceSource, type HostAuthorizer, type SessionDevice, type SessionSource } from "@parlor/client";
 import type { AccountActions } from "../account.js";
 export interface AuthClientOptions {
     /** The backend origin; defaults to the shell's `server.url`, or this page's origin. */
@@ -12,6 +12,10 @@ export interface AuthClientOptions {
     readonly session?: SessionStore | undefined;
     /** Where this device's signing keys live. Defaults to the `deviceKey` capability. */
     readonly deviceKey?: DeviceKey | undefined;
+    /** Where social sign-in runs. Defaults to the `authBrowser` capability. */
+    readonly browser?: AuthBrowser | undefined;
+    /** The app's URL scheme, where social sign-in returns in a native shell. Defaults to `app.scheme`. */
+    readonly scheme?: string | undefined;
     readonly fetch?: typeof fetch | undefined;
 }
 export declare class AuthClientError extends Error {
@@ -21,7 +25,15 @@ export declare class AuthClientError extends Error {
     constructor(message: string, status: number, code: string | undefined);
 }
 export type DeviceHandle = SessionDevice;
-export interface AuthClient extends SessionSource, DeviceSource, HostAuthorizer, DeviceLinker {
+export interface SocialSignInInput {
+    /** A provider in Better Auth's `socialProviders`, or a `genericOAuth` provider id. */
+    readonly provider: string;
+    /** On the web, the page the provider returns to once signed in. Defaults to `/`. */
+    readonly callbackURL?: string | undefined;
+    /** On the web, the page a failed sign-in returns to with `?error=`. Defaults to this page. */
+    readonly errorCallbackURL?: string | undefined;
+}
+export interface AuthClient extends SessionSource, DeviceSource, HostAuthorizer, DeviceLinker, ComputerDisconnector {
     deviceSetup(): Promise<"needed" | "ready">;
     /** Plug into `createActionClient({ headers })` so every surface carries the session. */
     readonly headers: () => Promise<HeadersInit>;
@@ -35,9 +47,33 @@ export interface AuthClient extends SessionSource, DeviceSource, HostAuthorizer,
         readonly password: string;
     }): Promise<void>;
     signOut(): Promise<void>;
+    /** Sign-in with a one-time code sent by email, through Better Auth's `emailOTP` plugin. */
+    readonly emailOtp: {
+        send(input: {
+            readonly email: string;
+        }): Promise<void>;
+        /** Signs in, creating the account on first use unless the plugin disables sign-up. */
+        signIn(input: {
+            readonly email: string;
+            readonly otp: string;
+            readonly name?: string | undefined;
+        }): Promise<void>;
+    };
+    /** Sign-in with a provider such as Google, through Better Auth's `socialProviders`. */
+    readonly social: {
+        /** Whether this platform can run it: false in a native shell without the `authBrowser` capability. */
+        available(): Promise<boolean>;
+        /**
+         * On the web the page leaves for the provider and comes back to `callbackURL`, so this
+         * never resolves. In a native shell the provider opens in the system's sign-in browser
+         * and this resolves once the app is signed in; it throws `AuthClientError` with code
+         * `CANCELLED` when the user closes it.
+         */
+        signIn(input: SocialSignInInput): Promise<void>;
+    };
     /** The account actions: `sessions`, `revokeSession`, `agents`, `revokeAgent`. */
     readonly account: ActionClient<AccountActions>;
 }
 export declare function createAuthClient(options?: AuthClientOptions): AuthClient;
-export type { HostPairing, SessionStore } from "@parlor/capabilities";
+export type { AuthBrowser, HostPairing, SessionStore } from "@parlor/capabilities";
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,SAAS,EAKd,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,YAAY,EAGjB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,cAAc,EAGnB,KAAK,aAAa,EAElB,KAAK,aAAa,EAEnB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA4BpD,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;CAC3C;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAItC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;IAJnC,SAAkB,IAAI,qBAAqB;IAC3C,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EAGlC;CACF;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC,MAAM,WAAW,UACf,SAAQ,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY;IACjE,WAAW,IAAI,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;CAChD;AA+HD,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAkX5E;AAED,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,WAAW,EAGhB,KAAK,SAAS,EAKd,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,KAAK,YAAY,EAEjB,KAAK,oBAAoB,EAEzB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,cAAc,EAGnB,KAAK,aAAa,EAElB,KAAK,aAAa,EAEnB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAuDpD,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC3C,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,GAAG,SAAS,CAAC;CAC3C;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAItC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;IAJnC,SAAkB,IAAI,qBAAqB;IAC3C,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,EAGlC;CACF;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,8FAA8F;IAC9F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,UACf,SACE,aAAa,EACb,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,oBAAoB;IACtB,WAAW,IAAI,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE;QACjB,IAAI,CAAC,KAAK,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,sFAAsF;QACtF,MAAM,CAAC,KAAK,EAAE;YACZ,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;SACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACnB,CAAC;IACF,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE;QACf,sGAAsG;QACtG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B;;;;;WAKG;QACH,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACjD,CAAC;IACF,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;CAChD;AAuID,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAod5E;AAED,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/client/index.js

@@ -1,21 +1,38 @@
 import { oauthProviderClient } from "@better-auth/oauth-provider/client";
-import { detectPlatform, deviceKey, resolveCapability, sessionStore, } from "@parlor/capabilities";
-import { decodeBase64url } from "@parlor/capabilities/encoding";
+import { authBrowser, detectPlatform, deviceKey, resolveCapability, sessionStore, } from "@parlor/capabilities";
+import { decodeBase64url, encodeBase64url } from "@parlor/capabilities/encoding";
 import { appOrigin, createActionClient, LinkOnComputer, } from "@parlor/client";
 import { ActionError } from "@parlor/core";
 import { createAuthClient as createBetterAuthClient } from "better-auth/client";
-import { answerStatement, deviceCommitment, HOST_PAIRING_FRAGMENT, linkCode, normalizeLinkCode, pairingProof, promptStatement, removeStatement, statementBytes, vouchStatement, } from "../statements.js";
+import { emailOTPClient } from "better-auth/client/plugins";
+import { answerStatement, deviceCommitment, HOST_PAIRING_FRAGMENT, HOST_PAIRING_KEY, linkCode, normalizeLinkCode, pairingProof, promptStatement, removeStatement, statementBytes, vouchStatement, } from "../statements.js";
 const DEFAULT_BASE_PATH = "/_parlor";
 const RETRY_BASE_MS = 1000;
 const RETRY_MAX_MS = 30_000;
 const TOKEN_HEADER = "set-auth-token";
 const HOST_IPC_REDIRECT = "urn:parlor:ipc";
 const DEBUG_KEY = "parlor:debug";
-const HOST_PAIRING_KEY = "parlor:host-pairing";
+const NATIVE_CALLBACK = "//_parlor/auth/callback";
 function injectedServerUrl() {
     const env = import.meta.env;
     return env?.PARLOR_SERVER_URL ?? "";
 }
+function injectedScheme() {
+    const env = import.meta.env;
+    return env?.PARLOR_APP_SCHEME ?? "";
+}
+const nativeSignInClient = {
+    id: "parlor-native-sign-in",
+    $InferServerPlugin: {},
+    atomListeners: [
+        { matcher: (path) => path === "/native/token", signal: "$sessionSignal" },
+    ],
+};
+const randomText = (bytes) => encodeBase64url(crypto.getRandomValues(new Uint8Array(bytes)));
+async function pkceChallenge(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return encodeBase64url(new Uint8Array(digest));
+}
 export class AuthClientError extends Error {
     status;
     code;
@@ -90,6 +107,14 @@ function keepHostPairing() {
     }
     catch { }
 }
+function watchHostPairing(listener) {
+    const changed = (event) => {
+        if (event.key === HOST_PAIRING_KEY || event.key === null)
+            listener();
+    };
+    globalThis.addEventListener?.("storage", changed);
+    return () => globalThis.removeEventListener?.("storage", changed);
+}
 function hostPairing() {
     try {
         return globalThis.localStorage?.getItem(HOST_PAIRING_KEY) ?? undefined;
@@ -145,7 +170,7 @@ export function createAuthClient(options = {}) {
     let client;
     const connect = () => createBetterAuthClient({
         baseURL: `${baseUrl || globalThis.location.origin}${basePath}/auth`,
-        plugins: [oauthProviderClient()],
+        plugins: [oauthProviderClient(), emailOTPClient(), nativeSignInClient],
         fetchOptions: {
             ...(options.fetch ? { customFetchImpl: options.fetch } : {}),
             onRequest: async (context) => {
@@ -211,6 +236,60 @@ export function createAuthClient(options = {}) {
         basePath: `${basePath}/auth`,
         headers,
     });
+    const signInBrowser = async () => {
+        if (options.browser)
+            return options.browser;
+        const handle = await resolveCapability(authBrowser);
+        return handle.available ? handle.api : undefined;
+    };
+    const signInOnThePage = async (browser, input) => {
+        const page = new URL(globalThis.location.href);
+        const callbackURL = new URL(input.callbackURL ?? "/", page).href;
+        const errorPage = new URL(input.errorCallbackURL ?? page, page);
+        errorPage.searchParams.delete("error");
+        errorPage.searchParams.delete("error_description");
+        const result = await betterAuth().signIn.social({
+            provider: input.provider,
+            callbackURL,
+            errorCallbackURL: errorPage.href,
+            disableRedirect: true,
+        });
+        settle(result);
+        const url = result.data?.url;
+        if (!url)
+            throw new AuthClientError("The provider gave no sign-in page.", 500, undefined);
+        await browser.open(url, callbackURL);
+    };
+    const signInInTheApp = async (browser, provider) => {
+        const scheme = options.scheme ?? injectedScheme();
+        if (!scheme) {
+            throw new AuthClientError("Set app.scheme in parlor.config.ts to sign in with a provider in the app.", 0, "NO_SCHEME");
+        }
+        const callback = `${scheme}:${NATIVE_CALLBACK}`;
+        const verifier = randomText(32);
+        const state = randomText(16);
+        const start = new URL(`${baseUrl || globalThis.location.origin}${basePath}/auth/native/sign-in/social`);
+        start.search = new URLSearchParams({
+            provider,
+            redirect_uri: callback,
+            code_challenge: await pkceChallenge(verifier),
+            code_challenge_method: "S256",
+            state,
+        }).toString();
+        const returned = await browser.open(start.href, callback);
+        if (!returned)
+            throw new AuthClientError("Sign-in was cancelled.", 0, "CANCELLED");
+        const answer = new URL(returned).searchParams;
+        if (answer.get("state") !== state) {
+            throw new AuthClientError("This sign-in was not started here.", 0, "STATE_MISMATCH");
+        }
+        const failed = answer.get("error");
+        const code = answer.get("code");
+        if (failed || !code) {
+            throw new AuthClientError(answer.get("error_description") || `Sign-in failed (${failed ?? "no code"}).`, 400, failed ?? undefined);
+        }
+        settle(await betterAuth().native.token({ code, code_verifier: verifier }));
+    };
     const keysOfThisPlatform = async () => {
         const handle = await resolveCapability(deviceKey);
         return handle.available ? handle.api : undefined;
@@ -315,6 +394,23 @@ export function createAuthClient(options = {}) {
         },
         signIn: async (input) => settle(await betterAuth().signIn.email(input)),
         signUp: async (input) => settle(await betterAuth().signUp.email(input)),
+        emailOtp: {
+            send: async ({ email }) => settle(await betterAuth().emailOtp.sendVerificationOtp({ email, type: "sign-in" })),
+            signIn: async ({ email, otp, name }) => settle(await betterAuth().signIn.emailOtp({ email, otp, ...(name ? { name } : {}) })),
+        },
+        social: {
+            available: async () => (await signInBrowser()) !== undefined,
+            signIn: async (input) => {
+                const browser = await signInBrowser();
+                if (!browser) {
+                    throw new AuthClientError(`Signing in with ${input.provider} is not available here.`, 0, "UNSUPPORTED");
+                }
+                if (await store)
+                    await signInInTheApp(browser, input.provider);
+                else
+                    await signInOnThePage(browser, input);
+            },
+        },
         signOut: async () => {
             try {
                 settle(await betterAuth().signOut());
@@ -323,6 +419,7 @@ export function createAuthClient(options = {}) {
                 await (await store)?.set(undefined);
             }
         },
+        subscribeLink: watchHostPairing,
         linkState: async () => {
             const pairing = hostPairing() !== undefined;
             const session = current();
@@ -374,6 +471,9 @@ export function createAuthClient(options = {}) {
                 code: linkCode(commitment),
             };
         },
+        disconnectComputer: async (hostId) => {
+            await account.call("revokeHost", { hostId });
+        },
         listDevices: async () => {
             const session = current();
             if (session.status !== "signed-in")