npm - @parlor/auth - Versions diffs - 0.4.0 → 0.4.2 - Mend

@parlor/auth 0.4.0 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/tokens.d.ts CHANGED Viewed

@@ -59,6 +59,8 @@ export interface TurnTokenClaims {
     /** the client the prompt came from; `ui_*` binds to it */
     readonly cid: string;
     readonly agt: string;
+    /** the conversation's scope, the only one the turn's agent acts in */
+    readonly scp?: string | undefined;
     readonly iat: number;
     /** as long as the turn's lease */
     readonly exp: number;

package/dist/tokens.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAEf,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAIxB,kFAAkF;AAClF,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,sFAAsF;AACtF,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AACpD,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,4FAA4F;AAC5F,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAIlD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAwC,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,GAAG,OAAO,aAAa,CAAC;AAExE,OAAO,CAAC,MAAM,QAAQ,EAAE,OAAO,MAAM,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,aAAa,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;AAClD,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAC1C,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,GAAG;IAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEvF,kGAAkG;AAClG,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,aAAa,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,cAAc;IACd,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACrD;AAgBD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,UAAU,GAAG,SAAS,CA0BxB;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,~~CAqBrB~~;~~AAgBD~~,gGAAgG;AAChG,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,GACtB,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,~~CAajD~~;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,OAAO,aAAa,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,wGAAwG;AACxG,wBAAsB,aAAa,CACjC,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAaD,gGAAgG;AAChG,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc,CAOhF"}
1	+ {"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAEf,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAIxB,kFAAkF;AAClF,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,sFAAsF;AACtF,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AACpD,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,4FAA4F;AAC5F,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAIlD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAwC,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,GAAG,OAAO,aAAa,CAAC;AAExE,OAAO,CAAC,MAAM,QAAQ,EAAE,OAAO,MAAM,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,aAAa,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;AAClD,OAAO,CAAC,MAAM,YAAY,EAAE,OAAO,MAAM,CAAC;AAC1C,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,aAAa,CAAC,GAAG;IAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEvF,kGAAkG;AAClG,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,aAAa,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,cAAc;IACd,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACrD;AAgBD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,UAAU,GAAG,SAAS,CA0BxB;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAiBD,gGAAgG;AAChG,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,CAAC,CAgC1B;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,GACtB,cAAc,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAcjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,OAAO,aAAa,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,wGAAwG;AACxG,wBAAsB,aAAa,CACjC,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAaD,gGAAgG;AAChG,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,cAAc,CAOhF"}

package/dist/tokens.js CHANGED Viewed

@@ -77,6 +77,7 @@ export async function delegate(keys, host, turn, now) {
         trn: turn.turnId,
         cid: turn.clientId,
         agt: turn.agent,
+        ...(turn.scope === undefined ? {} : { scp: turn.scope }),
         iat,
         exp,
     };
@@ -95,6 +96,7 @@ const claimsSchema = z.object({
     trn: z.string().min(1),
     cid: z.string(),
     agt: z.string().min(1),
+    scp: z.string().min(1).optional(),
     iat: z.number().int(),
     exp: z.number().int(),
 });
@@ -141,6 +143,7 @@ export function agentPrincipalOf(claims) {
             turnId: asId("turn", claims.trn),
             hostId: asId("host", claims.hid),
             clientId: claims.cid,
+            ...(claims.scp === undefined ? {} : { scope: claims.scp }),
         },
     };
 }

package/dist/tokens.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,IAAI,GAGL,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,WAAW,EAEX,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAC3C,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,GAAG,aAAa,CAAC;AAgD3E,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAE7C,SAAS,KAAK,CAA0B,OAAe;IACrD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,aAA4B,EAC5B,SAAkB;IAElB,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAuB,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACrE,QAAQ,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAuB,KAAK,CAAC,EAAE,CAAC;QACrE,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAuB,KAAK,CAAe,EAAE,CAAC;QACpF;YACE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAmB,EACnB,IAAmB,EACnB,IAAoB,EACpB,GAAW;IAEX,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,MAAM,GAAoB;QAC9B,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,KAAK;QACf,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;SAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,KAAgB,EAChB,GAAW;IAEX,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,GAAG,GACP,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC,EACD;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SAC3B,CACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,GAAG,GAAG,GAAG,qBAAqB,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3C,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG;SACrB;KACF,CAAC;AACJ,CAAC;AAaD,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB,EACnB,IAAmB,EACnB,KAAsB,EACtB,GAAW;IAEX,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IACjF,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,KAAK,CAAC,KAAK;QAChB,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;SAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAmB,EACnB,KAAiB,EACjB,GAAW;IAEX,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,GAAG,GACP,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC,EACD;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SAC3B,CACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,GAAG,GAAG,GAAG,qBAAqB,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,6CAA6C,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,uBAAuB,CAAC,MAAwB;IAC9D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5C,CAAC;AACJ,CAAC","sourcesContent":["import {\n type AgentPrincipal,\n asId,\n type HostPrincipal,\n type TurnBinding,\n} from \"@parlor/core\";\nimport {\n type AgentDelegation,\n AuthFailure,\n type Delegation,\n REVOCATION_HORIZON_MS,\n type TurnDelegation,\n} from \"@parlor/server\";\nimport { decodeProtectedHeader, errors, jwtVerify, SignJWT } from \"jose\";\nimport { z } from \"zod\";\n\n/** A host assertion's audience: signed by the computer's own key, per request. /\nexport const HOST_AUDIENCE = \"parlor:host\";\n/* A turn token's audience: signed by the server, carried by the host's MCP proxy. /\nexport const TURN_AUDIENCE = \"parlor:mcp\";\n\nexport const HOST_ASSERTION_TYP = \"parlor-host+jwt\";\nexport const TURN_TOKEN_TYP = \"parlor-turn+jwt\";\n/* An agent on the host's computer outside any turn: Claude Code or Codex in a terminal. /\nexport const AGENT_TOKEN_TYP = \"parlor-agent+jwt\";\n\nconst CLOCK_SKEW_MS = 60_000;\n\n/\n A turn token never outlives the revocation horizon, or a revoked grant's token could\n * verify after `RevocationSet` forgot the revocation.\n /\nexport const MAX_TURN_TOKEN_TTL_MS = REVOCATION_HORIZON_MS - CLOCK_SKEW_MS;\n\nexport type TokenAudience = typeof HOST_AUDIENCE \| typeof TURN_AUDIENCE;\n\ndeclare const audience: unique symbol;\n\n/* A compact JWS whose audience is known from the scheme it arrived under; never swapped. /\nexport type Jws<A extends TokenAudience> = string & { readonly [audience]: A };\nexport type HostAssertion = Jws<typeof HOST_AUDIENCE>;\nexport type TurnToken = Jws<typeof TURN_AUDIENCE>;\ndeclare const outsideTurns: unique symbol;\n/* Same audience as a turn token, never mistaken for one: no turn, so no screen to drive. /\nexport type AgentToken = Jws<typeof TURN_AUDIENCE> & { readonly [outsideTurns]: true };\n\n/* What an `authorization` header carries, sorted by scheme and shape before any verification. /\nexport type Credential =\n \| { readonly kind: \"host\"; readonly assertion: HostAssertion }\n \| { readonly kind: \"turn\"; readonly token: TurnToken }\n \| { readonly kind: \"agent\"; readonly token: AgentToken }\n \| { readonly kind: \"access\"; readonly token: string }\n \| { readonly kind: \"session\"; readonly token: string }\n \| { readonly kind: \"key\"; readonly secret: string };\n\nexport interface TurnTokenClaims {\n readonly aud: typeof TURN_AUDIENCE;\n readonly iss: string;\n /* user id /\n readonly sub: string;\n /* grant id: revoking the grant kills the token /\n readonly gid: string;\n readonly hid: string;\n readonly thr: string;\n readonly trn: string;\n /* the client the prompt came from; `ui_` binds to it /\n readonly cid: string;\n readonly agt: string;\n readonly iat: number;\n /** as long as the turn's lease /\n readonly exp: number;\n}\n\nexport interface TurnTokenKeys {\n readonly issuer: string;\n readonly kid: string;\n readonly privateKey: CryptoKey;\n readonly publicKeys: ReadonlyMap<string, CryptoKey>;\n}\n\nconst JWS_SHAPE = /^[\\w-]+\\.[\\w-]+\\.[\\w-]+$/;\n\nfunction brand<A extends TokenAudience>(compact: string): Jws<A> {\n return compact as Jws<A>;\n}\n\nfunction typOf(jws: string): string \| undefined {\n try {\n return decodeProtectedHeader(jws).typ;\n } catch {\n throw new AuthFailure(\"invalid\", \"The token is malformed.\");\n }\n}\n\n/\n `ParlorHost <jws>` is a host; a `Bearer` token that starts with `keyPrefix` is an API key,\n * whatever its shape; a `Bearer` JWS whose header says `typ: parlor-turn+jwt` is a turn.\n /\nexport function credentialOf(\n authorization: string \| null,\n keyPrefix?: string,\n): Credential \| undefined {\n if (authorization === null) return undefined;\n const match = /^([A-Za-z]+)\\s+(\\S+)$/.exec(authorization);\n const scheme = match?.[1]?.toLowerCase();\n const value = match?.[2];\n if (value === undefined \|\| (scheme !== \"bearer\" && scheme !== \"parlorhost\")) {\n throw new AuthFailure(\"invalid\", \"Use a Bearer token.\");\n }\n if (scheme === \"parlorhost\") {\n if (!JWS_SHAPE.test(value)) {\n throw new AuthFailure(\"invalid\", \"The host assertion is malformed.\");\n }\n return { kind: \"host\", assertion: brand<typeof HOST_AUDIENCE>(value) };\n }\n if (keyPrefix !== undefined && value.startsWith(keyPrefix)) {\n return { kind: \"key\", secret: value };\n }\n if (!JWS_SHAPE.test(value)) return { kind: \"session\", token: value };\n switch (typOf(value)) {\n case TURN_TOKEN_TYP:\n return { kind: \"turn\", token: brand<typeof TURN_AUDIENCE>(value) };\n case AGENT_TOKEN_TYP:\n return { kind: \"agent\", token: brand<typeof TURN_AUDIENCE>(value) as AgentToken };\n default:\n return { kind: \"access\", token: value };\n }\n}\n\n/* Mints a turn token for `host`'s grant; the provider's `delegate`. /\nexport async function delegate(\n keys: TurnTokenKeys,\n host: HostPrincipal,\n turn: TurnDelegation,\n now: number,\n): Promise<Delegation> {\n if (!(turn.ttlMs > 0)) throw new RangeError(\"A turn token needs a positive lifetime.\");\n const iat = Math.floor(now / 1000);\n const exp = iat + Math.ceil(Math.min(turn.ttlMs, MAX_TURN_TOKEN_TTL_MS) / 1000);\n const claims: TurnTokenClaims = {\n aud: TURN_AUDIENCE,\n iss: keys.issuer,\n sub: host.userId,\n gid: host.grantId,\n hid: host.hostId,\n thr: turn.threadId,\n trn: turn.turnId,\n cid: turn.clientId,\n agt: turn.agent,\n iat,\n exp,\n };\n const token = await new SignJWT({ ...claims })\n .setProtectedHeader({ alg: \"ES256\", typ: TURN_TOKEN_TYP, kid: keys.kid })\n .sign(keys.privateKey);\n return { token, expiresAt: exp 1000 };\n}\n\nconst claimsSchema = z.object({\n aud: z.literal(TURN_AUDIENCE),\n iss: z.string().min(1),\n sub: z.string().min(1),\n gid: z.string().min(1),\n hid: z.string().min(1),\n thr: z.string().min(1),\n trn: z.string().min(1),\n cid: z.string(),\n agt: z.string().min(1),\n iat: z.number().int(),\n exp: z.number().int(),\n});\n\n/** Signature, `aud`, `iss` and `exp` only; the caller then asks `RevocationSet` about `gid`. /\nexport async function verifyTurnToken(\n keys: TurnTokenKeys,\n token: TurnToken,\n now: number,\n): Promise<TurnTokenClaims> {\n let payload: unknown;\n try {\n ({ payload } = await jwtVerify(\n token,\n (header) => {\n const key =\n header.kid === undefined ? undefined : keys.publicKeys.get(header.kid);\n if (!key) throw new errors.JWKSNoMatchingKey();\n return key;\n },\n {\n algorithms: [\"ES256\"],\n typ: TURN_TOKEN_TYP,\n issuer: keys.issuer,\n audience: TURN_AUDIENCE,\n currentDate: new Date(now),\n },\n ));\n } catch (error) {\n if (error instanceof errors.JWTExpired) {\n throw new AuthFailure(\"expired\", \"The turn token expired.\");\n }\n throw new AuthFailure(\"invalid\", \"The turn token is invalid.\");\n }\n const claims = claimsSchema.safeParse(payload);\n if (!claims.success) throw new AuthFailure(\"invalid\", \"The turn token is malformed.\");\n const { iat, exp } = claims.data;\n if (exp - iat > MAX_TURN_TOKEN_TTL_MS / 1000 \|\| iat 1000 > now + CLOCK_SKEW_MS) {\n throw new AuthFailure(\"invalid\", \"The turn token has an impossible lifetime.\");\n }\n return claims.data;\n}\n\nexport function agentPrincipalOf(\n claims: TurnTokenClaims,\n): AgentPrincipal & { readonly turn: TurnBinding } {\n return {\n kind: \"agent\",\n userId: asId(\"user\", claims.sub),\n grantId: asId(\"grant\", claims.gid),\n agent: { name: claims.agt, verified: true },\n turn: {\n threadId: asId(\"thread\", claims.thr),\n turnId: asId(\"turn\", claims.trn),\n hostId: asId(\"host\", claims.hid),\n clientId: claims.cid,\n },\n };\n}\n\nexport interface AgentTokenClaims {\n readonly aud: typeof TURN_AUDIENCE;\n readonly iss: string;\n readonly sub: string;\n readonly gid: string;\n readonly hid: string;\n readonly agt: string;\n readonly iat: number;\n readonly exp: number;\n}\n\n/** Mints a token for an agent on `host`'s computer outside any turn; the provider's `delegateAgent`. /\nexport async function delegateAgent(\n keys: TurnTokenKeys,\n host: HostPrincipal,\n agent: AgentDelegation,\n now: number,\n): Promise<Delegation> {\n if (!(agent.ttlMs > 0))\n throw new RangeError(\"An agent token needs a positive lifetime.\");\n const iat = Math.floor(now / 1000);\n const exp = iat + Math.ceil(Math.min(agent.ttlMs, MAX_TURN_TOKEN_TTL_MS) / 1000);\n const claims: AgentTokenClaims = {\n aud: TURN_AUDIENCE,\n iss: keys.issuer,\n sub: host.userId,\n gid: host.grantId,\n hid: host.hostId,\n agt: agent.agent,\n iat,\n exp,\n };\n const token = await new SignJWT({ ...claims })\n .setProtectedHeader({ alg: \"ES256\", typ: AGENT_TOKEN_TYP, kid: keys.kid })\n .sign(keys.privateKey);\n return { token, expiresAt: exp 1000 };\n}\n\nconst agentClaimsSchema = z.object({\n aud: z.literal(TURN_AUDIENCE),\n iss: z.string().min(1),\n sub: z.string().min(1),\n gid: z.string().min(1),\n hid: z.string().min(1),\n agt: z.string().min(1),\n iat: z.number().int(),\n exp: z.number().int(),\n});\n\n/** Signature, `aud`, `iss` and `exp` only; the caller then asks `RevocationSet` about `gid`. /\nexport async function verifyAgentToken(\n keys: TurnTokenKeys,\n token: AgentToken,\n now: number,\n): Promise<AgentTokenClaims> {\n let payload: unknown;\n try {\n ({ payload } = await jwtVerify(\n token,\n (header) => {\n const key =\n header.kid === undefined ? undefined : keys.publicKeys.get(header.kid);\n if (!key) throw new errors.JWKSNoMatchingKey();\n return key;\n },\n {\n algorithms: [\"ES256\"],\n typ: AGENT_TOKEN_TYP,\n issuer: keys.issuer,\n audience: TURN_AUDIENCE,\n currentDate: new Date(now),\n },\n ));\n } catch (error) {\n if (error instanceof errors.JWTExpired) {\n throw new AuthFailure(\"expired\", \"The agent token expired.\");\n }\n throw new AuthFailure(\"invalid\", \"The agent token is invalid.\");\n }\n const claims = agentClaimsSchema.safeParse(payload);\n if (!claims.success) throw new AuthFailure(\"invalid\", \"The agent token is malformed.\");\n const { iat, exp } = claims.data;\n if (exp - iat > MAX_TURN_TOKEN_TTL_MS / 1000 \|\| iat 1000 > now + CLOCK_SKEW_MS) {\n throw new AuthFailure(\"invalid\", \"The agent token has an impossible lifetime.\");\n }\n return claims.data;\n}\n\n/** An external agent of the user: no turn, so `ui_` reaches no screen and confirms go to the app. /\nexport function outsideAgentPrincipalOf(claims: AgentTokenClaims): AgentPrincipal {\n return {\n kind: \"agent\",\n userId: asId(\"user\", claims.sub),\n grantId: asId(\"grant\", claims.gid),\n agent: { name: claims.agt, verified: true },\n };\n}\n"]}
1	+ {"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,IAAI,GAGL,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,WAAW,EAEX,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAC3C,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAElD,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,GAAG,aAAa,CAAC;AAkD3E,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAE7C,SAAS,KAAK,CAA0B,OAAe;IACrD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,aAA4B,EAC5B,SAAkB;IAElB,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAuB,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACrE,QAAQ,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,cAAc;YACjB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAuB,KAAK,CAAC,EAAE,CAAC;QACrE,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAuB,KAAK,CAAe,EAAE,CAAC;QACpF;YACE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAmB,EACnB,IAAmB,EACnB,IAAoB,EACpB,GAAW;IAEX,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,MAAM,GAAoB;QAC9B,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,KAAK;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;SAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,KAAgB,EAChB,GAAW;IAEX,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,GAAG,GACP,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC,EACD;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,cAAc;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SAC3B,CACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,GAAG,GAAG,GAAG,qBAAqB,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3C,IAAI,EAAE;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;SAC3D;KACF,CAAC;AACJ,CAAC;AAaD,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB,EACnB,IAAmB,EACnB,KAAsB,EACtB,GAAW;IAEX,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IACjF,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,KAAK,CAAC,KAAK;QAChB,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;SAC3C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAmB,EACnB,KAAiB,EACjB,GAAW;IAEX,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,GAAG,GACP,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC;QACb,CAAC,EACD;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;SAC3B,CACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,IAAI,GAAG,GAAG,GAAG,GAAG,qBAAqB,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,aAAa,EAAE,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,6CAA6C,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,uBAAuB,CAAC,MAAwB;IAC9D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5C,CAAC;AACJ,CAAC","sourcesContent":["import {\n type AgentPrincipal,\n asId,\n type HostPrincipal,\n type TurnBinding,\n} from \"@parlor/core\";\nimport {\n type AgentDelegation,\n AuthFailure,\n type Delegation,\n REVOCATION_HORIZON_MS,\n type TurnDelegation,\n} from \"@parlor/server\";\nimport { decodeProtectedHeader, errors, jwtVerify, SignJWT } from \"jose\";\nimport { z } from \"zod\";\n\n/** A host assertion's audience: signed by the computer's own key, per request. /\nexport const HOST_AUDIENCE = \"parlor:host\";\n/* A turn token's audience: signed by the server, carried by the host's MCP proxy. /\nexport const TURN_AUDIENCE = \"parlor:mcp\";\n\nexport const HOST_ASSERTION_TYP = \"parlor-host+jwt\";\nexport const TURN_TOKEN_TYP = \"parlor-turn+jwt\";\n/* An agent on the host's computer outside any turn: Claude Code or Codex in a terminal. /\nexport const AGENT_TOKEN_TYP = \"parlor-agent+jwt\";\n\nconst CLOCK_SKEW_MS = 60_000;\n\n/\n A turn token never outlives the revocation horizon, or a revoked grant's token could\n * verify after `RevocationSet` forgot the revocation.\n /\nexport const MAX_TURN_TOKEN_TTL_MS = REVOCATION_HORIZON_MS - CLOCK_SKEW_MS;\n\nexport type TokenAudience = typeof HOST_AUDIENCE \| typeof TURN_AUDIENCE;\n\ndeclare const audience: unique symbol;\n\n/* A compact JWS whose audience is known from the scheme it arrived under; never swapped. /\nexport type Jws<A extends TokenAudience> = string & { readonly [audience]: A };\nexport type HostAssertion = Jws<typeof HOST_AUDIENCE>;\nexport type TurnToken = Jws<typeof TURN_AUDIENCE>;\ndeclare const outsideTurns: unique symbol;\n/* Same audience as a turn token, never mistaken for one: no turn, so no screen to drive. /\nexport type AgentToken = Jws<typeof TURN_AUDIENCE> & { readonly [outsideTurns]: true };\n\n/* What an `authorization` header carries, sorted by scheme and shape before any verification. /\nexport type Credential =\n \| { readonly kind: \"host\"; readonly assertion: HostAssertion }\n \| { readonly kind: \"turn\"; readonly token: TurnToken }\n \| { readonly kind: \"agent\"; readonly token: AgentToken }\n \| { readonly kind: \"access\"; readonly token: string }\n \| { readonly kind: \"session\"; readonly token: string }\n \| { readonly kind: \"key\"; readonly secret: string };\n\nexport interface TurnTokenClaims {\n readonly aud: typeof TURN_AUDIENCE;\n readonly iss: string;\n /* user id /\n readonly sub: string;\n /* grant id: revoking the grant kills the token /\n readonly gid: string;\n readonly hid: string;\n readonly thr: string;\n readonly trn: string;\n /* the client the prompt came from; `ui_` binds to it /\n readonly cid: string;\n readonly agt: string;\n /** the conversation's scope, the only one the turn's agent acts in /\n readonly scp?: string \| undefined;\n readonly iat: number;\n /* as long as the turn's lease /\n readonly exp: number;\n}\n\nexport interface TurnTokenKeys {\n readonly issuer: string;\n readonly kid: string;\n readonly privateKey: CryptoKey;\n readonly publicKeys: ReadonlyMap<string, CryptoKey>;\n}\n\nconst JWS_SHAPE = /^[\\w-]+\\.[\\w-]+\\.[\\w-]+$/;\n\nfunction brand<A extends TokenAudience>(compact: string): Jws<A> {\n return compact as Jws<A>;\n}\n\nfunction typOf(jws: string): string \| undefined {\n try {\n return decodeProtectedHeader(jws).typ;\n } catch {\n throw new AuthFailure(\"invalid\", \"The token is malformed.\");\n }\n}\n\n/\n `ParlorHost <jws>` is a host; a `Bearer` token that starts with `keyPrefix` is an API key,\n * whatever its shape; a `Bearer` JWS whose header says `typ: parlor-turn+jwt` is a turn.\n /\nexport function credentialOf(\n authorization: string \| null,\n keyPrefix?: string,\n): Credential \| undefined {\n if (authorization === null) return undefined;\n const match = /^([A-Za-z]+)\\s+(\\S+)$/.exec(authorization);\n const scheme = match?.[1]?.toLowerCase();\n const value = match?.[2];\n if (value === undefined \|\| (scheme !== \"bearer\" && scheme !== \"parlorhost\")) {\n throw new AuthFailure(\"invalid\", \"Use a Bearer token.\");\n }\n if (scheme === \"parlorhost\") {\n if (!JWS_SHAPE.test(value)) {\n throw new AuthFailure(\"invalid\", \"The host assertion is malformed.\");\n }\n return { kind: \"host\", assertion: brand<typeof HOST_AUDIENCE>(value) };\n }\n if (keyPrefix !== undefined && value.startsWith(keyPrefix)) {\n return { kind: \"key\", secret: value };\n }\n if (!JWS_SHAPE.test(value)) return { kind: \"session\", token: value };\n switch (typOf(value)) {\n case TURN_TOKEN_TYP:\n return { kind: \"turn\", token: brand<typeof TURN_AUDIENCE>(value) };\n case AGENT_TOKEN_TYP:\n return { kind: \"agent\", token: brand<typeof TURN_AUDIENCE>(value) as AgentToken };\n default:\n return { kind: \"access\", token: value };\n }\n}\n\n/* Mints a turn token for `host`'s grant; the provider's `delegate`. /\nexport async function delegate(\n keys: TurnTokenKeys,\n host: HostPrincipal,\n turn: TurnDelegation,\n now: number,\n): Promise<Delegation> {\n if (!(turn.ttlMs > 0)) throw new RangeError(\"A turn token needs a positive lifetime.\");\n const iat = Math.floor(now / 1000);\n const exp = iat + Math.ceil(Math.min(turn.ttlMs, MAX_TURN_TOKEN_TTL_MS) / 1000);\n const claims: TurnTokenClaims = {\n aud: TURN_AUDIENCE,\n iss: keys.issuer,\n sub: host.userId,\n gid: host.grantId,\n hid: host.hostId,\n thr: turn.threadId,\n trn: turn.turnId,\n cid: turn.clientId,\n agt: turn.agent,\n ...(turn.scope === undefined ? {} : { scp: turn.scope }),\n iat,\n exp,\n };\n const token = await new SignJWT({ ...claims })\n .setProtectedHeader({ alg: \"ES256\", typ: TURN_TOKEN_TYP, kid: keys.kid })\n .sign(keys.privateKey);\n return { token, expiresAt: exp 1000 };\n}\n\nconst claimsSchema = z.object({\n aud: z.literal(TURN_AUDIENCE),\n iss: z.string().min(1),\n sub: z.string().min(1),\n gid: z.string().min(1),\n hid: z.string().min(1),\n thr: z.string().min(1),\n trn: z.string().min(1),\n cid: z.string(),\n agt: z.string().min(1),\n scp: z.string().min(1).optional(),\n iat: z.number().int(),\n exp: z.number().int(),\n});\n\n/** Signature, `aud`, `iss` and `exp` only; the caller then asks `RevocationSet` about `gid`. /\nexport async function verifyTurnToken(\n keys: TurnTokenKeys,\n token: TurnToken,\n now: number,\n): Promise<TurnTokenClaims> {\n let payload: unknown;\n try {\n ({ payload } = await jwtVerify(\n token,\n (header) => {\n const key =\n header.kid === undefined ? undefined : keys.publicKeys.get(header.kid);\n if (!key) throw new errors.JWKSNoMatchingKey();\n return key;\n },\n {\n algorithms: [\"ES256\"],\n typ: TURN_TOKEN_TYP,\n issuer: keys.issuer,\n audience: TURN_AUDIENCE,\n currentDate: new Date(now),\n },\n ));\n } catch (error) {\n if (error instanceof errors.JWTExpired) {\n throw new AuthFailure(\"expired\", \"The turn token expired.\");\n }\n throw new AuthFailure(\"invalid\", \"The turn token is invalid.\");\n }\n const claims = claimsSchema.safeParse(payload);\n if (!claims.success) throw new AuthFailure(\"invalid\", \"The turn token is malformed.\");\n const { iat, exp } = claims.data;\n if (exp - iat > MAX_TURN_TOKEN_TTL_MS / 1000 \|\| iat 1000 > now + CLOCK_SKEW_MS) {\n throw new AuthFailure(\"invalid\", \"The turn token has an impossible lifetime.\");\n }\n return claims.data;\n}\n\nexport function agentPrincipalOf(\n claims: TurnTokenClaims,\n): AgentPrincipal & { readonly turn: TurnBinding } {\n return {\n kind: \"agent\",\n userId: asId(\"user\", claims.sub),\n grantId: asId(\"grant\", claims.gid),\n agent: { name: claims.agt, verified: true },\n turn: {\n threadId: asId(\"thread\", claims.thr),\n turnId: asId(\"turn\", claims.trn),\n hostId: asId(\"host\", claims.hid),\n clientId: claims.cid,\n ...(claims.scp === undefined ? {} : { scope: claims.scp }),\n },\n };\n}\n\nexport interface AgentTokenClaims {\n readonly aud: typeof TURN_AUDIENCE;\n readonly iss: string;\n readonly sub: string;\n readonly gid: string;\n readonly hid: string;\n readonly agt: string;\n readonly iat: number;\n readonly exp: number;\n}\n\n/** Mints a token for an agent on `host`'s computer outside any turn; the provider's `delegateAgent`. /\nexport async function delegateAgent(\n keys: TurnTokenKeys,\n host: HostPrincipal,\n agent: AgentDelegation,\n now: number,\n): Promise<Delegation> {\n if (!(agent.ttlMs > 0))\n throw new RangeError(\"An agent token needs a positive lifetime.\");\n const iat = Math.floor(now / 1000);\n const exp = iat + Math.ceil(Math.min(agent.ttlMs, MAX_TURN_TOKEN_TTL_MS) / 1000);\n const claims: AgentTokenClaims = {\n aud: TURN_AUDIENCE,\n iss: keys.issuer,\n sub: host.userId,\n gid: host.grantId,\n hid: host.hostId,\n agt: agent.agent,\n iat,\n exp,\n };\n const token = await new SignJWT({ ...claims })\n .setProtectedHeader({ alg: \"ES256\", typ: AGENT_TOKEN_TYP, kid: keys.kid })\n .sign(keys.privateKey);\n return { token, expiresAt: exp 1000 };\n}\n\nconst agentClaimsSchema = z.object({\n aud: z.literal(TURN_AUDIENCE),\n iss: z.string().min(1),\n sub: z.string().min(1),\n gid: z.string().min(1),\n hid: z.string().min(1),\n agt: z.string().min(1),\n iat: z.number().int(),\n exp: z.number().int(),\n});\n\n/** Signature, `aud`, `iss` and `exp` only; the caller then asks `RevocationSet` about `gid`. /\nexport async function verifyAgentToken(\n keys: TurnTokenKeys,\n token: AgentToken,\n now: number,\n): Promise<AgentTokenClaims> {\n let payload: unknown;\n try {\n ({ payload } = await jwtVerify(\n token,\n (header) => {\n const key =\n header.kid === undefined ? undefined : keys.publicKeys.get(header.kid);\n if (!key) throw new errors.JWKSNoMatchingKey();\n return key;\n },\n {\n algorithms: [\"ES256\"],\n typ: AGENT_TOKEN_TYP,\n issuer: keys.issuer,\n audience: TURN_AUDIENCE,\n currentDate: new Date(now),\n },\n ));\n } catch (error) {\n if (error instanceof errors.JWTExpired) {\n throw new AuthFailure(\"expired\", \"The agent token expired.\");\n }\n throw new AuthFailure(\"invalid\", \"The agent token is invalid.\");\n }\n const claims = agentClaimsSchema.safeParse(payload);\n if (!claims.success) throw new AuthFailure(\"invalid\", \"The agent token is malformed.\");\n const { iat, exp } = claims.data;\n if (exp - iat > MAX_TURN_TOKEN_TTL_MS / 1000 \|\| iat 1000 > now + CLOCK_SKEW_MS) {\n throw new AuthFailure(\"invalid\", \"The agent token has an impossible lifetime.\");\n }\n return claims.data;\n}\n\n/** An external agent of the user: no turn, so `ui_` reaches no screen and confirms go to the app. /\nexport function outsideAgentPrincipalOf(claims: AgentTokenClaims): AgentPrincipal {\n return {\n kind: \"agent\",\n userId: asId(\"user\", claims.sub),\n grantId: asId(\"grant\", claims.gid),\n agent: { name: claims.agt, verified: true },\n };\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@parlor/auth",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "homepage": "https://cychien.github.io/parlor",
   "bugs": "https://github.com/cychien/parlor/issues",
   "license": "MIT",
@@ -36,11 +36,11 @@
     "drizzle-orm": "^0.45.4",
     "jose": "^6.2.12",
     "zod": "^4.6.5",
-    "@parlor/core": "0.4.0",
-    "@parlor/chat": "0.4.0",
-    "@parlor/client": "0.4.0",
-    "@parlor/server": "0.4.0",
-    "@parlor/capabilities": "0.4.0"
+    "@parlor/capabilities": "0.4.2",
+    "@parlor/server": "0.4.2",
+    "@parlor/chat": "0.4.2",
+    "@parlor/core": "0.4.2",
+    "@parlor/client": "0.4.2"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.3.1",
@@ -50,7 +50,7 @@
     "pg": "^8.23.1",
     "typescript": "^7.0.2",
     "vitest": "^5.0.3",
-    "@parlor/data": "0.4.0"
+    "@parlor/data": "0.4.2"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",