@parlor/server 0.0.0-stage → 0.1.0

package/dist/create-server.d.ts

@@ -0,0 +1,39 @@
+import { type AgentUiOptions, type UiManifestSource } from "@parlor/agent-ui/server";
+import { type ActionMap, type DataProvider } from "@parlor/core";
+import type { ActionRegistry } from "@parlor/core/registry";
+import { type SyncTransport } from "@parlor/sync/server";
+import { type AuthProvider } from "./auth.js";
+import { type CorsConfig } from "./cors.js";
+import type { ServerPlugin } from "./plugin.js";
+import { type ScopeResolver } from "./scope.js";
+export interface SyncOptions {
+    readonly transport?: SyncTransport | undefined;
+    readonly pollIntervalMs?: number | undefined;
+}
+export interface ServerOptions<T extends ActionMap> {
+    readonly actions: ActionRegistry<T>;
+    readonly scope?: ScopeResolver | undefined;
+    /**
+     * Without it every caller is anonymous, the action source is the `x-parlor-source`
+     * header, and confirmations are a UX guard.
+     */
+    readonly auth?: AuthProvider | undefined;
+    /** Framework features with their own tables and routes, installed after `auth`. */
+    readonly plugins?: readonly ServerPlugin[] | undefined;
+    readonly basePath?: string | undefined;
+    readonly cors?: CorsConfig | false | undefined;
+    readonly database?: DataProvider | undefined;
+    readonly mcp?: {
+        readonly name?: string | undefined;
+        readonly version?: string | undefined;
+    } | false | undefined;
+    readonly sync?: SyncOptions | false | undefined;
+    readonly agentUi?: AgentUiOptions | false | undefined;
+}
+export interface FrameworkServer {
+    readonly installUiManifest?: ((source: UiManifestSource) => void) | undefined;
+    readonly fetch: (request: Request) => Promise<Response>;
+    readonly close: () => Promise<void>;
+}
+export declare function createServer<T extends ActionMap>(options: ServerOptions<T>): FrameworkServer;
+//# sourceMappingURL=create-server.d.ts.map

package/dist/create-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAQ3D,OAAO,EAAE,KAAK,UAAU,EAAkB,MAAM,WAAW,CAAC;AAI5D,OAAO,KAAK,EAKV,YAAY,EACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,SAAS;IAChD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,EACT;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC7E,KAAK,GACL,SAAS,CAAC;IACd,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC;CACvD;AAKD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9E,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AA2FD,wBAAgB,YAAY,CAAC,CAAC,SAAS,SAAS,EAC9C,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GACxB,eAAe,CAuPjB"}

package/dist/create-server.js

@@ -0,0 +1,315 @@
+import { createAgentUi, registerAgentUiRoutes, } from "@parlor/agent-ui/server";
+import { ActionError, } from "@parlor/core";
+import { ensureSyncTables, recordSyncEvent, registerSyncRoutes, SyncHub, } from "@parlor/sync/server";
+import { H3, readBody } from "h3";
+import { admits, requireAccess, requireSurface } from "./access.js";
+import { createActionRunner } from "./actions.js";
+import { AuthFailure } from "./auth.js";
+import { clientOf, createCallerResolver, sourceOf, } from "./caller.js";
+import { corsMiddleware } from "./cors.js";
+import { devAuth } from "./dev-auth.js";
+import { createMcpHandler } from "./mcp.js";
+import { applyMigrations, checkMigrations } from "./migrations.js";
+import { DEFAULT_BASE_PATH, PROTOCOL_VERSION } from "./protocol.js";
+import { defaultScope } from "./scope.js";
+const STATUS_BY_CODE = {
+    not_found: 404,
+    invalid_input: 400,
+    declined: 403,
+    confirmation_timeout: 504,
+    confirmation_unavailable: 503,
+    unauthenticated: 401,
+    forbidden: 403,
+    internal: 500,
+};
+const isAbort = (error) => error instanceof Error && error.name === "AbortError";
+function toActionError(error) {
+    if (error instanceof ActionError)
+        return error;
+    if (error instanceof AuthFailure)
+        return new ActionError("unauthenticated", error.message);
+    if (!isAbort(error))
+        console.error("[parlor] action failed:", error);
+    return new ActionError("internal", "Internal error", { cause: error });
+}
+function errorBody(event, error) {
+    const actionError = toActionError(error);
+    event.res.status = STATUS_BY_CODE[actionError.code];
+    return actionError.toBody();
+}
+function errorResponse(error) {
+    const actionError = toActionError(error);
+    return Response.json(actionError.toBody(), {
+        status: STATUS_BY_CODE[actionError.code],
+    });
+}
+const PLUGIN_NAME = /^[a-z][a-z0-9-]*$/;
+const RESERVED_NAMES = new Set([
+    "actions",
+    "manifest",
+    "mcp",
+    "sync",
+    "ui",
+]);
+function checkPlugins(plugins, database) {
+    const names = new Set();
+    for (const plugin of plugins) {
+        if (!PLUGIN_NAME.test(plugin.name) || RESERVED_NAMES.has(plugin.name)) {
+            throw new Error(`"${plugin.name}" cannot name a plugin.`);
+        }
+        if (names.has(plugin.name))
+            throw new Error(`Two plugins are named "${plugin.name}".`);
+        names.add(plugin.name);
+        checkMigrations(plugin);
+        if (plugin.migrations?.length && !database) {
+            throw new Error(`The "${plugin.name}" plugin needs a database.`);
+        }
+    }
+}
+function auditAll(runtimes) {
+    const hooks = runtimes.filter((runtime) => runtime.audit);
+    if (hooks.length === 0)
+        return undefined;
+    return (record) => {
+        for (const runtime of hooks)
+            runtime.audit?.(record);
+    };
+}
+function guard(callers, surface) {
+    return async (request) => requireSurface(await callers(request), surface, callers.enforcing);
+}
+function refuseUnless(callers, surface) {
+    const check = guard(callers, surface);
+    return async (event) => {
+        try {
+            await check(event.req);
+            return undefined;
+        }
+        catch (error) {
+            return errorResponse(error);
+        }
+    };
+}
+export function createServer(options) {
+    const { actions, scope = defaultScope, plugins = [], basePath = DEFAULT_BASE_PATH, cors = {}, database, mcp = {}, sync = {}, agentUi: agentUiOptions = {}, } = options;
+    const auth = options.auth ?? (process.env.PARLOR_DEV === "1" ? devAuth() : undefined);
+    const app = new H3();
+    const appName = process.env.PARLOR_APP_NAME || undefined;
+    const syncOptions = sync === false ? undefined : sync;
+    const syncEnabled = syncOptions !== undefined && database !== undefined;
+    const installed = [...(auth ? [auth] : []), ...plugins];
+    checkPlugins(installed, database);
+    let prepared;
+    const ready = () => (prepared ??= (async () => {
+        if (!database)
+            return;
+        if (syncEnabled)
+            await ensureSyncTables(database.read());
+        await applyMigrations(database, installed);
+    })());
+    const callers = createCallerResolver(auth, scope, ready);
+    const host = {
+        basePath,
+        database,
+        ...(auth ? { auth } : {}),
+        authMisconfigured: "auth" in options && auth === undefined,
+        callerOf: callers,
+        ready,
+        announce: async (target, tags, within) => {
+            if (!syncEnabled || !database || tags.length === 0)
+                return;
+            if (within !== undefined) {
+                await recordSyncEvent(within, { scope: target, tags });
+                return;
+            }
+            await ready();
+            await database.transaction((tx) => recordSyncEvent(tx, { scope: target, tags }));
+        },
+    };
+    const runtimes = installed.map((plugin) => ({ plugin, runtime: plugin.setup(host) }));
+    const audit = auditAll(runtimes.map(({ runtime }) => runtime));
+    const agentUi = agentUiOptions === false
+        ? undefined
+        : createAgentUi({
+            ...agentUiOptions,
+            audience: async (request) => (await callers(request)).audience,
+        });
+    const runnerFor = (registry) => createActionRunner({
+        actions: registry,
+        scope,
+        callers,
+        database,
+        sync: syncEnabled,
+        onClient: agentUi?.touch,
+        confirm: agentUi?.confirm,
+        audit,
+        ready,
+    });
+    const runner = runnerFor(actions);
+    const hub = database ? new SyncHub(database) : undefined;
+    const inflight = new Set();
+    let closing;
+    if (cors !== false)
+        app.use(corsMiddleware(cors));
+    app.get(`${basePath}/manifest`, async (event) => {
+        let caller;
+        try {
+            caller = await callers(event.req);
+        }
+        catch (error) {
+            return errorResponse(error);
+        }
+        const summary = {
+            protocol: PROTOCOL_VERSION,
+            ...(appName ? { app: { name: appName } } : {}),
+        };
+        if (!admits("manifest", caller, callers.enforcing))
+            return summary;
+        const ui = agentUi?.manifest();
+        return { ...summary, actions: actions.describe(), ...(ui ? { ui } : {}) };
+    });
+    app.post(`${basePath}/actions/:name`, async (event) => {
+        const name = event.context.params?.name ?? "";
+        try {
+            const input = await readBody(event).catch(() => {
+                throw new ActionError("invalid_input", "Request body must be JSON");
+            });
+            const result = await runner.run(name, input, event.req, sourceOf(event.req), {
+                surface: "actions",
+            });
+            return { data: result.data, tags: result.reads };
+        }
+        catch (error) {
+            return errorBody(event, error);
+        }
+    });
+    const handleRoute = async (route, request) => {
+        if (route.access === "public")
+            return route.handle(request);
+        const caller = requireAccess(await callers(request), route.access, callers.enforcing);
+        return route.handle(request, caller);
+    };
+    for (const { plugin, runtime } of runtimes) {
+        const root = `${basePath}/${plugin.name}`;
+        if (runtime.actions) {
+            const pluginRunner = runnerFor(runtime.actions);
+            app.post(`${root}/actions/:name`, async (event) => {
+                const name = event.context.params?.name ?? "";
+                try {
+                    const input = await readBody(event).catch(() => {
+                        throw new ActionError("invalid_input", "Request body must be JSON");
+                    });
+                    const result = await pluginRunner.run(name, input, event.req, sourceOf(event.req), { surface: "pluginActions" });
+                    return { data: result.data, tags: result.reads };
+                }
+                catch (error) {
+                    return errorBody(event, error);
+                }
+            });
+        }
+        for (const route of runtime.routes ?? []) {
+            const path = route.path.startsWith("/.well-known/")
+                ? route.path
+                : root + route.path;
+            app.on(route.method, path, async (event) => {
+                try {
+                    await ready();
+                    return await handleRoute(route, event.req);
+                }
+                catch (error) {
+                    return errorResponse(error);
+                }
+            });
+        }
+    }
+    if (mcp !== false) {
+        const mcpApp = appName
+            ? {
+                name: appName,
+                ...(process.env.PARLOR_APP_DESCRIPTION
+                    ? { description: process.env.PARLOR_APP_DESCRIPTION }
+                    : {}),
+            }
+            : undefined;
+        const handler = createMcpHandler({
+            actions,
+            runner,
+            agentUi,
+            callers,
+            app: mcpApp,
+            ...mcp,
+        });
+        const guardMcp = guard(callers, "mcp");
+        app.all(`${basePath}/mcp`, async (event) => {
+            try {
+                await guardMcp(event.req);
+            }
+            catch (error) {
+                const refusal = toActionError(error);
+                const challenged = refusal.code === "unauthenticated" ||
+                    (await callers(event.req).then(({ principal }) => principal.kind === "host", () => false));
+                return challenged && auth ? auth.challenge(event.req) : errorResponse(refusal);
+            }
+            return handler.fetch(event.req);
+        });
+    }
+    if (syncEnabled && database && hub) {
+        app.use(`${basePath}/sync/**`, refuseUnless(callers, "sync"));
+        app.use(`${basePath}/sync/**`, async () => {
+            await ready();
+        });
+        registerSyncRoutes(app, {
+            basePath,
+            data: database,
+            hub,
+            scope: async (request) => (await callers(request)).scope,
+            audience: async (request) => (await callers(request)).audience,
+            authority: async (request) => {
+                const caller = await callers(request);
+                const { principal } = caller;
+                return {
+                    principal,
+                    channels: admits("channels", caller, callers.enforcing),
+                    ...(auth && principal.kind !== "anonymous"
+                        ? { revoked: auth.revoked(principal) }
+                        : {}),
+                };
+            },
+            transport: syncOptions?.transport,
+            pollIntervalMs: syncOptions?.pollIntervalMs,
+            channels: [
+                ...(agentUi ? [agentUi.channel] : []),
+                ...runtimes.flatMap(({ runtime }) => runtime.channel ? [runtime.channel] : []),
+            ],
+            clientId: clientOf,
+        });
+    }
+    if (agentUi) {
+        app.use(`${basePath}/ui`, refuseUnless(callers, "ui"));
+        registerAgentUiRoutes(app, {
+            basePath,
+            agentUi,
+            audience: async (request) => (await callers(request)).audience,
+            clientId: clientOf,
+        });
+    }
+    return {
+        ...(agentUi
+            ? { installUiManifest: (source) => agentUi.install(source) }
+            : {}),
+        fetch: (request) => {
+            const response = Promise.resolve(app.fetch(request));
+            const settled = () => void inflight.delete(response);
+            inflight.add(response);
+            response.then(settled, settled);
+            return response;
+        },
+        close: () => (closing ??= (async () => {
+            agentUi?.close();
+            await Promise.allSettled(runtimes.map(({ runtime }) => runtime.close?.()));
+            await Promise.all([hub?.stop(), Promise.allSettled([...inflight])]);
+            await database?.close?.();
+        })()),
+    };
+}
+//# sourceMappingURL=create-server.js.map

package/dist/create-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EACb,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,GAIZ,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAElB,OAAO,GAER,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,EAAE,EAAgB,QAAQ,EAAE,MAAM,IAAI,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAgB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAqB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,WAAW,EAAqB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAGL,QAAQ,EACR,oBAAoB,EACpB,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAQnE,OAAO,EAAE,iBAAiB,EAAiB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,YAAY,EAAsB,MAAM,YAAY,CAAC;AAqC9D,MAAM,cAAc,GAAG;IACrB,SAAS,EAAE,GAAG;IACd,aAAa,EAAE,GAAG;IAClB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,wBAAwB,EAAE,GAAG;IAC7B,eAAe,EAAE,GAAG;IACpB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;CACqC,CAAC;AAErD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAE1F,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,KAAK,YAAY,WAAW;QAC9B,OAAO,IAAI,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,IAAI,WAAW,CAAC,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAc;IAC/C,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,WAAW,CAAC,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,EAAE,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,SAAS;IACT,UAAU;IACV,KAAK;IACL,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH,SAAS,YAAY,CACnB,OAAgC,EAChC,QAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7D,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,eAAe,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,QAAkC;IAElC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,KAAK,MAAM,OAAO,IAAI,KAAK;YAAE,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,OAAuB,EAAE,OAAgB;IACtD,OAAO,KAAK,EAAE,OAAgB,EAAmB,EAAE,CACjD,cAAc,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB,EAAE,OAAgB;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,KAAK,EAAE,KAAc,EAAiC,EAAE;QAC7D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAAyB;IAEzB,MAAM,EACJ,OAAO,EACP,KAAK,GAAG,YAAY,EACpB,OAAO,GAAG,EAAE,EACZ,QAAQ,GAAG,iBAAiB,EAC5B,IAAI,GAAG,EAAE,EACT,QAAQ,EACR,GAAG,GAAG,EAAE,EACR,IAAI,GAAG,EAAE,EACT,OAAO,EAAE,cAAc,GAAG,EAAE,GAC7B,GAAG,OAAO,CAAC;IACZ,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC;IACxE,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACxD,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,QAAmC,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,WAAW;YAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAkB,CAAC,CAAC;QACzE,MAAM,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,EAAE,CAAC,CAAC;IACR,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,IAAI,GAAe;QACvB,QAAQ;QACR,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,iBAAiB,EAAE,MAAM,IAAI,OAAO,IAAI,IAAI,KAAK,SAAS;QAC1D,QAAQ,EAAE,OAAO;QACjB,KAAK;QACL,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACvC,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,eAAe,CAAC,MAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAChC,eAAe,CAAC,EAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;QACJ,CAAC;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GACX,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,aAAa,CAAC;YACZ,GAAG,cAAc;YACjB,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;SAC/D,CAAC,CAAC;IACT,MAAM,SAAS,GAAG,CAAC,QAAwB,EAAgB,EAAE,CAC3D,kBAAkB,CAAC;QACjB,OAAO,EAAE,QAAQ;QACjB,KAAK;QACL,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO,EAAE,KAAK;QACxB,OAAO,EAAE,OAAO,EAAE,OAAO;QACzB,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,IAAI,OAAkC,CAAC;IAEvC,IAAI,IAAI,KAAK,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,WAAW,EAAE,KAAK,EAAE,KAAK,EAA0B,EAAE;QACtE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAoB;YAC/B,QAAQ,EAAE,gBAAgB;YAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,OAAO,CAAC;QACnE,MAAM,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7C,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3E,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,EAAE,KAAqB,EAAE,OAAgB,EAAE,EAAE;QACpE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBAC7C,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;oBACtE,CAAC,CAAC,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CACnC,IAAI,EACJ,KAAK,EACL,KAAK,CAAC,GAAG,EACT,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EACnB,EAAE,OAAO,EAAE,eAAe,EAAE,CAC7B,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBACjD,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzC,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,CAAC;oBACd,OAAO,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC;gBACE,IAAI,EAAE,OAAO;gBACb,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB;oBACpC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,OAAO;YACP,MAAM;YACN,OAAO;YACP,OAAO;YACP,GAAG,EAAE,MAAM;YACX,GAAG,GAAG;SACP,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,KAAK,iBAAiB;oBAClC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAC5B,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAC5C,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC,CAAC;gBACL,OAAO,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,UAAU,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,kBAAkB,CAAC,GAAG,EAAE;YACtB,QAAQ;YACR,IAAI,EAAE,QAAQ;YACd,GAAG;YACH,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;YACxD,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC9D,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;gBAC7B,OAAO;oBACL,SAAS;oBACT,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC;oBACvD,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;wBACxC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;wBACtC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC;YACD,SAAS,EAAE,WAAW,EAAE,SAAS;YACjC,cAAc,EAAE,WAAW,EAAE,cAAc;YAC3C,QAAQ,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAmB,EAAE,CACnD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CACzC;aACF;YACD,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,qBAAqB,CAAC,GAAG,EAAE;YACzB,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC9D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,GAAG,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,MAAwB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;YACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CACV,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YACvB,OAAO,EAAE,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/dev-auth.d.ts

@@ -0,0 +1,17 @@
+import { DEV_USER_ID } from "@parlor/core";
+import { type AuthProvider } from "./auth.js";
+export declare const DEV_AUTH_PLUGIN = "dev-auth";
+export { DEV_USER_ID };
+/** `POST /_parlor/dev-auth/host`: mints the dev host token for a loopback caller. */
+export declare const DEV_HOST_PATH = "/host";
+export interface DevAuthOptions {
+    readonly secret?: Uint8Array | undefined;
+}
+/**
+ * What `parlor dev` installs when the app has no auth provider. Not enforcing, so the
+ * browser and external MCP clients keep today's anonymous, header-declared behavior; it
+ * only adds the host and turn tokens the local inline agent needs. Both are signed with a
+ * per-process secret, so restarting the server revokes them all.
+ */
+export declare function devAuth(options?: DevAuthOptions): AuthProvider;
+//# sourceMappingURL=dev-auth.d.ts.map

package/dist/dev-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-auth.d.ts","sourceRoot":"","sources":["../src/dev-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,WAAW,EAGZ,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAe,KAAK,YAAY,EAAuB,MAAM,WAAW,CAAC;AAEhF,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,qFAAqF;AACrF,eAAO,MAAM,aAAa,UAAU,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAC1C;AA4CD;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,YAAY,CAiHlE"}

package/dist/dev-auth.js

@@ -0,0 +1,146 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { ANONYMOUS, asId, DEV_USER_ID, } from "@parlor/core";
+import { AuthFailure } from "./auth.js";
+export const DEV_AUTH_PLUGIN = "dev-auth";
+export { DEV_USER_ID };
+/** `POST /_parlor/dev-auth/host`: mints the dev host token for a loopback caller. */
+export const DEV_HOST_PATH = "/host";
+const HOST_TYP = "parlor-dev-host+jwt";
+const TURN_TYP = "parlor-turn+jwt";
+const HOST_AUDIENCE = "parlor:host";
+const TURN_AUDIENCE = "parlor:mcp";
+const DEV_GRANT = asId("grant", "dev");
+const DEV_HOST = asId("host", "dev");
+const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+function decode(segment) {
+    if (!segment)
+        return undefined;
+    try {
+        const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+        return typeof value === "object" && value !== null ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isLoopback(ip) {
+    if (ip === undefined)
+        return false;
+    return ip === "::1" || ip.startsWith("127.") || ip.startsWith("::ffff:127.");
+}
+const refuse = (message) => Response.json({ error: { code: "forbidden", message } }, { status: 403 });
+/**
+ * What `parlor dev` installs when the app has no auth provider. Not enforcing, so the
+ * browser and external MCP clients keep today's anonymous, header-declared behavior; it
+ * only adds the host and turn tokens the local inline agent needs. Both are signed with a
+ * per-process secret, so restarting the server revokes them all.
+ */
+export function devAuth(options = {}) {
+    const secret = options.secret ?? randomBytes(32);
+    const mac = (input) => createHmac("sha256", secret).update(input).digest("base64url");
+    const sign = (typ, claims) => {
+        const input = `${encode({ alg: "HS256", typ })}.${encode(claims)}`;
+        return `${input}.${mac(input)}`;
+    };
+    const verify = (token, typ) => {
+        const [header, payload, signature, ...rest] = token.split(".");
+        if (rest.length > 0 || !header || !payload || !signature)
+            return undefined;
+        const expected = Buffer.from(mac(`${header}.${payload}`));
+        const given = Buffer.from(signature);
+        if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
+            return undefined;
+        }
+        return decode(header)?.typ === typ ? decode(payload) : undefined;
+    };
+    const typOf = (token) => decode(token.split(".")[0])?.typ;
+    const hostOf = (token) => {
+        if (verify(token, HOST_TYP)?.aud !== HOST_AUDIENCE) {
+            throw new AuthFailure("invalid", "This computer is not connected.");
+        }
+        return { kind: "host", userId: DEV_USER_ID, grantId: DEV_GRANT, hostId: DEV_HOST };
+    };
+    const agentOf = (token) => {
+        const claims = verify(token, TURN_TYP);
+        if (claims?.aud !== TURN_AUDIENCE ||
+            typeof claims.exp !== "number" ||
+            !claims.hid ||
+            !claims.thr ||
+            !claims.trn ||
+            typeof claims.cid !== "string" ||
+            !claims.agt) {
+            throw new AuthFailure("invalid", "The turn token is not valid.");
+        }
+        if (claims.exp * 1000 <= Date.now()) {
+            throw new AuthFailure("expired", "The turn is over.");
+        }
+        return {
+            kind: "agent",
+            userId: DEV_USER_ID,
+            grantId: DEV_GRANT,
+            agent: { name: claims.agt, verified: true },
+            turn: {
+                threadId: asId("thread", claims.thr),
+                turnId: asId("turn", claims.trn),
+                hostId: asId("host", claims.hid),
+                clientId: claims.cid,
+            },
+        };
+    };
+    return {
+        name: DEV_AUTH_PLUGIN,
+        enforcing: false,
+        setup: () => ({
+            routes: [
+                {
+                    method: "POST",
+                    path: DEV_HOST_PATH,
+                    access: "public",
+                    handle: async (request) => {
+                        if (request.headers.has("origin")) {
+                            return refuse("The dev host token is not for web pages.");
+                        }
+                        if (!isLoopback(request.ip)) {
+                            return refuse("The dev host token is only for this computer.");
+                        }
+                        return Response.json({
+                            token: sign(HOST_TYP, { aud: HOST_AUDIENCE, hid: DEV_HOST }),
+                            hostId: DEV_HOST,
+                        });
+                    },
+                },
+            ],
+        }),
+        authenticate: async (request) => {
+            const match = /^(\w+)\s+(\S+)$/.exec(request.headers.get("authorization") ?? "");
+            const scheme = match?.[1]?.toLowerCase();
+            const token = match?.[2];
+            if (!token)
+                return ANONYMOUS;
+            if (scheme === "parlorhost")
+                return hostOf(token);
+            if (scheme === "bearer" && typOf(token) === TURN_TYP)
+                return agentOf(token);
+            return ANONYMOUS;
+        },
+        challenge: () => Response.json({ error: { code: "unauthenticated", message: "The turn is over." } }, { status: 401 }),
+        revoked: () => new AbortController().signal,
+        delegate: async (host, turn) => {
+            const iat = Math.floor(Date.now() / 1000);
+            const exp = iat + Math.ceil(turn.ttlMs / 1000);
+            const claims = {
+                aud: TURN_AUDIENCE,
+                sub: host.userId,
+                hid: host.hostId,
+                thr: turn.threadId,
+                trn: turn.turnId,
+                cid: turn.clientId,
+                agt: turn.agent,
+                iat,
+                exp,
+            };
+            return { token: sign(TURN_TYP, claims), expiresAt: exp * 1000 };
+        },
+    };
+}
+//# sourceMappingURL=dev-auth.js.map

package/dist/dev-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-auth.js","sourceRoot":"","sources":["../src/dev-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EACL,SAAS,EAET,IAAI,EACJ,WAAW,GAGZ,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,WAAW,EAA0C,MAAM,WAAW,CAAC;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,qFAAqF;AACrF,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AAMrC,MAAM,QAAQ,GAAG,qBAAqB,CAAC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAgBrC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE3D,SAAS,MAAM,CAAC,OAA2B;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,EAAsB;IACxC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,OAAO,GAAmB,EAAE;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAC5B,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IAClC,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,GAAW,EAAsB,EAAE;QAChE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAElE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAiB,EAAE;QAC9C,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,aAAa,EAAE,CAAC;YACnD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrF,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAkB,EAAE;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAoC,CAAC;QAC1E,IACE,MAAM,EAAE,GAAG,KAAK,aAAa;YAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,GAAG;YACX,CAAC,MAAM,CAAC,GAAG;YACX,CAAC,MAAM,CAAC,GAAG;YACX,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,GAAG,EACX,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC3C,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;gBAChC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;gBAChC,QAAQ,EAAE,MAAM,CAAC,GAAG;aACrB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACZ,MAAM,EAAE;gBACN;oBACE,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;wBACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAClC,OAAO,MAAM,CAAC,0CAA0C,CAAC,CAAC;wBAC5D,CAAC;wBACD,IAAI,CAAC,UAAU,CAAE,OAA8C,CAAC,EAAE,CAAC,EAAE,CAAC;4BACpE,OAAO,MAAM,CAAC,+CAA+C,CAAC,CAAC;wBACjE,CAAC;wBACD,OAAO,QAAQ,CAAC,IAAI,CAAC;4BACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;4BAC5D,MAAM,EAAE,QAAQ;yBACjB,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF,CAAC;QACF,YAAY,EAAE,KAAK,EAAE,OAAO,EAAsB,EAAE;YAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,MAAM,KAAK,YAAY;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CACd,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;QACH,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC,MAAM;QAC3C,QAAQ,EAAE,KAAK,EAAE,IAAmB,EAAE,IAAoB,EAAE,EAAE;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAe;gBACzB,GAAG,EAAE,aAAa;gBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;gBAChB,GAAG,EAAE,IAAI,CAAC,MAAM;gBAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;gBAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,KAAK;gBACf,GAAG;gBACH,GAAG;aACJ,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { type CallerOf, type KindsOf, requireAccess, requireSurface, ROUTE_ACCESS, type Surface, } from "./access.js";
+export { type ActionRunner, type Confirm, createActionRunner, type RunOptions, } from "./actions.js";
+export { type AccountProfile, AuthFailure, type AuthFailureReason, type AuthProvider, type Delegation, type DeviceKeys, type DeviceVouch, HOST_GRANTS_TAG, type PresenceKey, type TurnDelegation, } from "./auth.js";
+export { readBoundedText } from "./body.js";
+export { REVOCATION_HORIZON_MS } from "./revocation-horizon.js";
+export { type Caller, type CallerResolver, clientOf, createCallerResolver, sourceFor, sourceOf, } from "./caller.js";
+export { type CorsConfig, isAllowedOrigin, SHELL_ORIGINS } from "./cors.js";
+export { createServer, type FrameworkServer, type ServerOptions, type SyncOptions, } from "./create-server.js";
+export { DEV_AUTH_PLUGIN, DEV_HOST_PATH, DEV_USER_ID, devAuth, type DevAuthOptions, } from "./dev-auth.js";
+export { createMcpHandler, type McpOptions } from "./mcp.js";
+export { type ActionAudit, type AnyPluginRoute, type ConfirmationAnswer, type Migration, type PluginHost, type PluginRoute, pluginRoute, type PluginRuntime, type PublicPluginRoute, type ServerPlugin, } from "./plugin.js";
+export { CLIENT_HEADER, DEFAULT_BASE_PATH, type Manifest, PROTOCOL_VERSION, SESSION_TOKEN_HEADER, SOURCE_HEADER, } from "./protocol.js";
+export { DEFAULT_SCOPE, defaultScope, type ScopeResolver } from "./scope.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,aAAa,EACb,cAAc,EACd,YAAY,EACZ,KAAK,OAAO,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,kBAAkB,EAClB,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,QAAQ,EACR,oBAAoB,EACpB,SAAS,EACT,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EACL,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,EACX,OAAO,EACP,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,QAAQ,EACb,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+export { requireAccess, requireSurface, ROUTE_ACCESS, } from "./access.js";
+export { createActionRunner, } from "./actions.js";
+export { AuthFailure, HOST_GRANTS_TAG, } from "./auth.js";
+export { readBoundedText } from "./body.js";
+export { REVOCATION_HORIZON_MS } from "./revocation-horizon.js";
+export { clientOf, createCallerResolver, sourceFor, sourceOf, } from "./caller.js";
+export { isAllowedOrigin, SHELL_ORIGINS } from "./cors.js";
+export { createServer, } from "./create-server.js";
+export { DEV_AUTH_PLUGIN, DEV_HOST_PATH, DEV_USER_ID, devAuth, } from "./dev-auth.js";
+export { createMcpHandler } from "./mcp.js";
+export { pluginRoute, } from "./plugin.js";
+export { CLIENT_HEADER, DEFAULT_BASE_PATH, PROTOCOL_VERSION, SESSION_TOKEN_HEADER, SOURCE_HEADER, } from "./protocol.js";
+export { DEFAULT_SCOPE, defaultScope } from "./scope.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,aAAa,EACb,cAAc,EACd,YAAY,GAEb,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,WAAW,EAMX,eAAe,GAGhB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAGL,QAAQ,EACR,oBAAoB,EACpB,SAAS,EACT,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EACL,YAAY,GAIb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,EACX,OAAO,GAER,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAmB,MAAM,UAAU,CAAC;AAC7D,OAAO,EAOL,WAAW,GAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,iBAAiB,EAEjB,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAsB,MAAM,YAAY,CAAC"}

package/dist/mcp-calls.d.ts

@@ -0,0 +1,7 @@
+import type { RequestId } from "@modelcontextprotocol/server";
+export declare class McpCalls {
+    #private;
+    run<T>(request: Request | undefined, id: RequestId, signals: readonly AbortSignal[], work: (signal: AbortSignal) => Promise<T>): Promise<T>;
+    cancel(request: Request, id: RequestId, reason: unknown): void;
+}
+//# sourceMappingURL=mcp-calls.d.ts.map

package/dist/mcp-calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-calls.d.ts","sourceRoot":"","sources":["../src/mcp-calls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,qBAAa,QAAQ;;IAGb,GAAG,CAAC,CAAC,EACT,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAaZ;IAED,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAG7D;CACF"}

package/dist/mcp-calls.js

@@ -0,0 +1,30 @@
+export class McpCalls {
+    #inFlight = new Map();
+    async run(request, id, signals, work) {
+        if (!request)
+            return work(AbortSignal.any([...signals]));
+        const key = keyOf(request, id);
+        const cancellation = new AbortController();
+        const calls = this.#inFlight.get(key) ?? new Set();
+        calls.add(cancellation);
+        this.#inFlight.set(key, calls);
+        try {
+            return await work(AbortSignal.any([...signals, cancellation.signal]));
+        }
+        finally {
+            calls.delete(cancellation);
+            if (calls.size === 0)
+                this.#inFlight.delete(key);
+        }
+    }
+    cancel(request, id, reason) {
+        for (const call of this.#inFlight.get(keyOf(request, id)) ?? [])
+            call.abort(reason ?? new DOMException("The call was cancelled.", "AbortError"));
+    }
+}
+const IDENTIFYING_HEADERS = ["authorization", "mcp-session-id", "user-agent"];
+const keyOf = (request, id) => JSON.stringify([
+    ...IDENTIFYING_HEADERS.map((header) => request.headers.get(header) ?? ""),
+    id,
+]);
+//# sourceMappingURL=mcp-calls.js.map