@parlor/server 0.0.0-stage → 0.1.0

package/dist/mcp-calls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-calls.js","sourceRoot":"","sources":["../src/mcp-calls.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,QAAQ;IACV,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAE7D,KAAK,CAAC,GAAG,CACP,OAA4B,EAC5B,EAAa,EACb,OAA+B,EAC/B,IAAyC;QAEzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAmB,CAAC;QACpE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAgB,EAAE,EAAa,EAAE,MAAe;QACrD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;YAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;IACpF,CAAC;CACF;AAED,MAAM,mBAAmB,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,YAAY,CAAU,CAAC;AAEvF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAa,EAAU,EAAE,CACxD,IAAI,CAAC,SAAS,CAAC;IACb,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzE,EAAE;CACH,CAAC,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,29 @@
+import { type McpHttpHandler, type ServerContext } from "@modelcontextprotocol/server";
+import type { AgentOrigin } from "@parlor/agent-ui";
+import { type AgentUi } from "@parlor/agent-ui/server";
+import { type ActionMap } from "@parlor/core";
+import type { ActionRegistry } from "@parlor/core/registry";
+import type { ActionRunner } from "./actions.js";
+import type { CallerResolver } from "./caller.js";
+export interface McpOptions<T extends ActionMap> {
+    readonly actions: ActionRegistry<T>;
+    readonly runner: ActionRunner;
+    readonly name?: string | undefined;
+    readonly version?: string | undefined;
+    /**
+     * Which app these tools belong to, told to every MCP client, so an agent connected to
+     * several Parlor apps keeps them apart.
+     */
+    readonly app?: {
+        readonly name: string;
+        readonly description?: string | undefined;
+    } | undefined;
+    readonly agentUi?: AgentUi | undefined;
+    readonly callers?: CallerResolver | undefined;
+}
+export declare function appIdentity(app: McpOptions<ActionMap>["app"], origin: string | undefined): string;
+export declare const PROGRESS_INTERVAL_MS = 10000;
+export declare function originOf(ctx: ServerContext): AgentOrigin;
+export declare function withProgress<T>(ctx: ServerContext, work: () => Promise<T>, intervalMs?: number): Promise<T>;
+export declare function createMcpHandler<T extends ActionMap>(options: McpOptions<T>): McpHttpHandler;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EAGnB,KAAK,aAAa,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAmC,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS;IAC7C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EACT;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACpE,SAAS,CAAC;IACd,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC/C;AASD,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EACjC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,CAKR;AA+DD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AA4B3C,wBAAgB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,WAAW,CAQxD;AAED,wBAAsB,YAAY,CAAC,CAAC,EAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,UAAU,GAAE,MAA6B,GACxC,OAAO,CAAC,CAAC,CAAC,CAqBZ;AAED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,SAAS,EAClD,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GACrB,cAAc,CAiIhB"}

package/dist/mcp.js

@@ -0,0 +1,198 @@
+import { CLIENT_INFO_META_KEY, createMcpHandler as createSdkHandler, McpServer, } from "@modelcontextprotocol/server";
+import { UI_MANIFEST_RESOURCE, UiFailure } from "@parlor/agent-ui/server";
+import { ActionError, isMutating, } from "@parlor/core";
+import { McpCalls } from "./mcp-calls.js";
+/** The public origin first, then the one `parlor dev` serves the app on, then the request's. */
+function appOrigin(request) {
+    const configured = process.env.PARLOR_ORIGIN || process.env.PARLOR_WEB_ORIGIN;
+    if (configured)
+        return new URL(configured).origin;
+    return request ? new URL(request.url).origin : undefined;
+}
+export function appIdentity(app, origin) {
+    const where = origin ? ` at ${origin}` : "";
+    const what = app?.description ? ` ${app.description.trim()}` : "";
+    const who = app ? app.name : "this app";
+    return `These tools belong to ${who}${where}.${what} They act only on ${who}, as the signed-in user; any other app's tools are a separate server.`;
+}
+function toolResult(result) {
+    const text = result === undefined ? "ok" : JSON.stringify(result, null, 2);
+    return {
+        content: [{ type: "text", text }],
+        ...(result !== null && typeof result === "object" && !Array.isArray(result)
+            ? { structuredContent: result }
+            : {}),
+    };
+}
+function errorBodyOf(error) {
+    if (error instanceof UiFailure)
+        return error.error;
+    if (error instanceof ActionError) {
+        return {
+            code: error.code,
+            message: error.message,
+            ...(error.issues
+                ? {
+                    issues: error.issues.map((issue) => ({
+                        path: issue.path.join("."),
+                        message: issue.message,
+                    })),
+                }
+                : {}),
+        };
+    }
+    return { code: "internal", message: "Internal error" };
+}
+function toolError(error) {
+    return {
+        isError: true,
+        content: [
+            { type: "text", text: JSON.stringify({ error: errorBodyOf(error) }, null, 2) },
+        ],
+    };
+}
+/**
+ * The SDK answers bad arguments in plain text before the handler runs. A schema that lists
+ * as the original but accepts anything leaves the check to the handler, which fails in the
+ * one error body.
+ */
+function unvalidated(schema) {
+    return { "~standard": { ...schema["~standard"], validate: (value) => ({ value }) } };
+}
+function actionDescription(action) {
+    return action.confirm
+        ? `${action.description} When an agent calls it, the user must approve it in the app first; the call waits for that answer and fails with declined, confirmation_timeout or confirmation_unavailable without running.`
+        : action.description;
+}
+export const PROGRESS_INTERVAL_MS = 10_000;
+async function verifiedOrigin(callers, request, ctx) {
+    const caller = callers && request ? await callers(request) : undefined;
+    const principal = caller?.principal;
+    if (principal?.kind === "agent" && principal.turn) {
+        return { via: "agent", name: principal.agent.name };
+    }
+    if (principal?.kind === "agent" && principal.agent.verified) {
+        return { via: "mcp", name: principal.agent.name };
+    }
+    return originOf(ctx);
+}
+async function turnClientOf(callers, request) {
+    const principal = callers && request ? (await callers(request)).principal : undefined;
+    return principal?.kind === "agent" && principal.turn
+        ? { clientId: principal.turn.clientId }
+        : undefined;
+}
+export function originOf(ctx) {
+    const envelope = ctx.mcpReq.envelope;
+    const info = envelope?.[CLIENT_INFO_META_KEY];
+    const name = typeof info === "object" && info !== null
+        ? info.name
+        : undefined;
+    return typeof name === "string" && name !== "" ? { via: "mcp", name } : { via: "mcp" };
+}
+export async function withProgress(ctx, work, intervalMs = PROGRESS_INTERVAL_MS) {
+    const progressToken = ctx.mcpReq._meta?.progressToken;
+    if (progressToken === undefined)
+        return work();
+    let progress = 0;
+    const timer = setInterval(() => {
+        ctx.mcpReq
+            .notify({
+            method: "notifications/progress",
+            params: {
+                progressToken,
+                progress: ++progress,
+                message: "Waiting for the user to approve in the app",
+            },
+        })
+            .catch(() => { });
+    }, intervalMs);
+    try {
+        return await work();
+    }
+    finally {
+        clearInterval(timer);
+    }
+}
+export function createMcpHandler(options) {
+    const { actions, runner, agentUi, callers, app, name = app?.name ?? "parlor", version = "0.0.0", } = options;
+    const calls = new McpCalls();
+    const inCall = (ctx, toolCtx, work) => calls.run(ctx.requestInfo, toolCtx.mcpReq.id, [...(ctx.requestInfo ? [ctx.requestInfo.signal] : []), toolCtx.mcpReq.signal], work);
+    const factory = (ctx) => {
+        const instructions = [
+            appIdentity(app, appOrigin(ctx.requestInfo)),
+            agentUi?.instructions("mcp"),
+        ]
+            .filter(Boolean)
+            .join("\n\n");
+        const server = new McpServer({ name, version, ...(app ? { title: app.name } : {}) }, { instructions });
+        server.server.setNotificationHandler("notifications/cancelled", (notification) => {
+            const { requestId, reason } = notification.params;
+            if (ctx.requestInfo && requestId !== undefined)
+                calls.cancel(ctx.requestInfo, requestId, reason);
+        });
+        for (const actionName of actions.names()) {
+            const action = actions.get(actionName);
+            if (!action)
+                continue;
+            server.registerTool(actionName, {
+                description: actionDescription(action),
+                inputSchema: unvalidated(action.input),
+                annotations: { readOnlyHint: !isMutating(action) },
+            }, async (args, toolCtx) => {
+                try {
+                    const origin = await verifiedOrigin(callers, ctx.requestInfo, toolCtx);
+                    const result = await inCall(ctx, toolCtx, (signal) => {
+                        const run = () => runner.run(actionName, args, ctx.requestInfo, "mcp", { signal, origin });
+                        return action.confirm ? withProgress(toolCtx, run) : run();
+                    });
+                    return toolResult(result.data);
+                }
+                catch (error) {
+                    return toolError(error);
+                }
+            });
+        }
+        const uiTools = agentUi?.tools("mcp") ?? [];
+        const uiManifest = uiTools.length > 0 ? agentUi?.manifest() : undefined;
+        if (uiManifest) {
+            server.registerResource("ui-manifest", UI_MANIFEST_RESOURCE, {
+                description: "The app's pages and the views they show, with full JSON schemas for each view's value.",
+                mimeType: "application/json",
+            }, (uri) => ({
+                contents: [
+                    {
+                        uri: uri.href,
+                        mimeType: "application/json",
+                        text: JSON.stringify(uiManifest, null, 2),
+                    },
+                ],
+            }));
+        }
+        for (const tool of uiTools) {
+            server.registerTool(tool.name, {
+                description: tool.description,
+                inputSchema: unvalidated(tool.input),
+                annotations: { readOnlyHint: tool.readOnly },
+            }, async (args, toolCtx) => {
+                try {
+                    const input = tool.input.safeParse(args);
+                    if (!input.success) {
+                        throw new ActionError("invalid_input", `Invalid input for "${tool.name}"`, {
+                            issues: input.error.issues,
+                        });
+                    }
+                    return toolResult(await inCall(ctx, toolCtx, async (signal) => tool.run(input.data, await agentUi.contextFor(ctx.requestInfo, await verifiedOrigin(callers, ctx.requestInfo, toolCtx), signal, await turnClientOf(callers, ctx.requestInfo)))));
+                }
+                catch (error) {
+                    if (!(error instanceof UiFailure))
+                        console.error("[parlor] UI tool failed:", error);
+                    return toolError(error);
+                }
+            });
+        }
+        return server;
+    };
+    return createSdkHandler(factory);
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EAEpB,gBAAgB,IAAI,gBAAgB,EAGpC,SAAS,GAGV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAgB,oBAAoB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EACL,WAAW,EAIX,UAAU,GACX,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkB1C,gGAAgG;AAChG,SAAS,SAAS,CAAC,OAA4B;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9E,IAAI,UAAU;QAAE,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAiC,EACjC,MAA0B;IAE1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACxC,OAAO,yBAAyB,GAAG,GAAG,KAAK,IAAI,IAAI,qBAAqB,GAAG,uEAAuE,CAAC;AACrJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAe;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACzE,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAiC,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAUD,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACnD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC;oBACE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBACnC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB,CAAC,CAAC;iBACJ;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;SAC/E;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAA8B;IACjD,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,OAAO,MAAM,CAAC,OAAO;QACnB,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,+LAA+L;QACtN,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,KAAK,UAAU,cAAc,CAC3B,OAAmC,EACnC,OAA4B,EAC5B,GAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAmC,EACnC,OAA4B;IAE5B,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,OAAO,SAAS,EAAE,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI;QAClD,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE;QACvC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAkB;IACzC,MAAM,QAAQ,GAAkD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;IACpF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAC9C,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QACvC,CAAC,CAAE,IAA2B,CAAC,IAAI;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,IAAsB,EACtB,UAAU,GAAW,oBAAoB;IAEzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;IACtD,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,EAAE,CAAC;IAC/C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,GAAG,CAAC,MAAM;aACP,MAAM,CAAC;YACN,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE;gBACN,aAAa;gBACb,QAAQ,EAAE,EAAE,QAAQ;gBACpB,OAAO,EAAE,4CAA4C;aACtD;SACF,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAsB;IAEtB,MAAM,EACJ,OAAO,EACP,MAAM,EACN,OAAO,EACP,OAAO,EACP,GAAG,EACH,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,QAAQ,EAC5B,OAAO,GAAG,OAAO,GAClB,GAAG,OAAO,CAAC;IAEZ,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;IAE7B,MAAM,MAAM,GAAG,CACb,GAAsB,EACtB,OAAsB,EACtB,IAAyC,EAC7B,EAAE,CACd,KAAK,CAAC,GAAG,CACP,GAAG,CAAC,WAAW,EACf,OAAO,CAAC,MAAM,CAAC,EAAE,EACjB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7E,IAAI,CACL,CAAC;IAEJ,MAAM,OAAO,GAAG,CAAC,GAAsB,EAAE,EAAE;QACzC,MAAM,YAAY,GAAG;YACnB,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;SAC7B;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACtD,EAAE,YAAY,EAAE,CACjB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,yBAAyB,EAAE,CAAC,YAAY,EAAE,EAAE;YAC/E,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC;YAClD,IAAI,GAAG,CAAC,WAAW,IAAI,SAAS,KAAK,SAAS;gBAC5C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;gBACE,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;gBACtC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtC,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;aACnD,EACD,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;oBACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;wBACnD,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;wBAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;oBAC7D,CAAC,CAAC,CAAC;oBACH,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,gBAAgB,CACrB,aAAa,EACb,oBAAoB,EACpB;gBACE,WAAW,EACT,wFAAwF;gBAC1F,QAAQ,EAAE,kBAAkB;aAC7B,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACR,QAAQ,EAAE;oBACR;wBACE,GAAG,EAAE,GAAG,CAAC,IAAI;wBACb,QAAQ,EAAE,kBAAkB;wBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC1C;iBACF;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;aAC7C,EACD,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;gBACtB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,sBAAsB,IAAI,CAAC,IAAI,GAAG,EAAE;4BACzE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;yBAC3B,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,UAAU,CACf,MAAM,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAC1C,IAAI,CAAC,GAAG,CACN,KAAK,CAAC,IAAI,EACV,MAAM,OAAQ,CAAC,UAAU,CACvB,GAAG,CAAC,WAAW,EACf,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EACvD,MAAM,EACN,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAC7C,CACF,CACF,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;wBAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;oBACnD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/migrations.d.ts

@@ -0,0 +1,10 @@
+import type { DataProvider } from "@parlor/core";
+import type { ServerPlugin } from "./plugin.js";
+export declare function checkMigrations(plugin: ServerPlugin): void;
+/**
+ * PGlite refuses several commands in one prepared statement, so a migration is run one
+ * statement at a time. Quotes, comments and dollar-quoted bodies may hold semicolons.
+ */
+export declare function splitStatements(script: string): string[];
+export declare function applyMigrations(database: DataProvider, plugins: readonly ServerPlugin[]): Promise<void>;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMhD,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAS1D;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BxD;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/dist/migrations.js

@@ -0,0 +1,81 @@
+import { sql } from "drizzle-orm";
+const MIGRATION_LOCK_KEY = 7_311_208;
+export function checkMigrations(plugin) {
+    const seen = new Set();
+    for (const { id } of plugin.migrations ?? []) {
+        if (!id.startsWith(`${plugin.name}/`)) {
+            throw new Error(`Migration "${id}" must start with "${plugin.name}/".`);
+        }
+        if (seen.has(id))
+            throw new Error(`Migration "${id}" is listed twice.`);
+        seen.add(id);
+    }
+}
+const DOLLAR_TAG = /^\$[A-Za-z_]*\$/;
+/**
+ * PGlite refuses several commands in one prepared statement, so a migration is run one
+ * statement at a time. Quotes, comments and dollar-quoted bodies may hold semicolons.
+ */
+export function splitStatements(script) {
+    const statements = [];
+    let start = 0;
+    let at = 0;
+    const skipTo = (end) => {
+        const close = script.indexOf(end, at);
+        at = close === -1 ? script.length : close + end.length;
+    };
+    while (at < script.length) {
+        const char = script[at];
+        if (char === "'" || char === '"') {
+            at += 1;
+            skipTo(char);
+        }
+        else if (script.startsWith("--", at)) {
+            skipTo("\n");
+        }
+        else if (script.startsWith("/*", at)) {
+            skipTo("*/");
+        }
+        else if (char === "$" && DOLLAR_TAG.test(script.slice(at))) {
+            const tag = DOLLAR_TAG.exec(script.slice(at))[0];
+            at += tag.length;
+            skipTo(tag);
+        }
+        else if (char === ";") {
+            statements.push(script.slice(start, at));
+            at += 1;
+            start = at;
+        }
+        else {
+            at += 1;
+        }
+    }
+    statements.push(script.slice(start));
+    return statements.map((statement) => statement.trim()).filter(Boolean);
+}
+export async function applyMigrations(database, plugins) {
+    const migrations = plugins.flatMap((plugin) => plugin.migrations ?? []);
+    if (migrations.length === 0)
+        return;
+    await database.transaction(async (handle) => {
+        const tx = handle;
+        await tx.execute(sql `select pg_advisory_xact_lock(${MIGRATION_LOCK_KEY})`);
+        await tx.execute(sql `
+      create table if not exists parlor_migrations (
+        id text primary key,
+        applied_at timestamptz not null default now()
+      )`);
+        const result = (await tx.execute(sql `select id from parlor_migrations`));
+        const rows = Array.isArray(result) ? result : (result.rows ?? []);
+        const applied = new Set(rows.map((row) => row.id));
+        for (const migration of migrations) {
+            if (applied.has(migration.id))
+                continue;
+            for (const statement of splitStatements(migration.sql)) {
+                await tx.execute(sql.raw(statement));
+            }
+            await tx.execute(sql `insert into parlor_migrations (id) values (${migration.id})`);
+        }
+    });
+}
+//# sourceMappingURL=migrations.js.map

package/dist/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAOlC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,sBAAsB,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzD,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAE,CAAC;QACzB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,EAAE,IAAI,CAAC,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;YAClD,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACzC,EAAE,IAAI,CAAC,CAAC;YACR,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAsB,EACtB,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,EAAE,GAAG,MAAkB,CAAC;QAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,gCAAgC,kBAAkB,GAAG,CAAC,CAAC;QAC3E,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;QAIhB,CAAC,CAAC;QACN,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,kCAAkC,CAAC,CAEnD,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAE,SAAS;YACxC,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,8CAA8C,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,92 @@
+import type { ActionErrorCode, ActionSource, AuthenticatedPrincipal, DataProvider, Principal, Tag } from "@parlor/core";
+import type { ActionRegistry } from "@parlor/core/registry";
+import type { ServerChannel } from "@parlor/sync";
+import type { CallerOf } from "./access.js";
+import type { AuthProvider } from "./auth.js";
+import type { Caller } from "./caller.js";
+/**
+ * A framework feature the app installs with `createServer({ plugins })`. It owns the
+ * tables prefixed `parlor_<name>_` and every path under `/_parlor/<name>/`.
+ */
+export interface ServerPlugin {
+    readonly name: string;
+    readonly migrations?: readonly Migration[] | undefined;
+    setup(host: PluginHost): PluginRuntime;
+}
+/** Applied once per database in list order. An applied id must never change. */
+export interface Migration {
+    readonly id: `${string}/${number}_${string}`;
+    readonly sql: string;
+}
+export interface PluginRuntime {
+    /**
+     * Served at `POST /_parlor/<plugin>/actions/<action>` through the same runner as the app's
+     * actions, but never listed on MCP and never callable by an agent.
+     */
+    readonly actions?: ActionRegistry | undefined;
+    readonly channel?: ServerChannel | undefined;
+    readonly routes?: readonly AnyPluginRoute[] | undefined;
+    /** Called once per action call on every surface after it settles, whatever the outcome. */
+    audit?(record: ActionAudit): void;
+    /** Runs before `close()` awaits in-flight requests, so it must end what it holds open. */
+    close?(): void | Promise<void>;
+}
+export interface ActionAudit {
+    readonly at: number;
+    readonly action: string;
+    readonly principal: Principal;
+    readonly source: ActionSource;
+    readonly scope: string;
+    /** SHA-256 of the input as received; the input itself is not kept. */
+    readonly inputDigest: string;
+    /** `ran` once `run` started; `refused` when the call stopped before it. */
+    readonly stage: "refused" | "ran";
+    readonly outcome: "ok" | "cancelled" | ActionErrorCode;
+    readonly confirmation?: ConfirmationAnswer | undefined;
+}
+export type ConfirmationAnswer = "approved" | "declined" | "timeout" | "unavailable";
+type SignedInKind = AuthenticatedPrincipal["kind"];
+/**
+ * A plain route with no transaction or sync event. `access` decides who may call it and
+ * types the caller its handler receives. An anonymous caller is admitted only when `access`
+ * lists it and no enforcing auth provider is installed.
+ */
+export interface PluginRoute<K extends SignedInKind | "anonymous"> {
+    readonly method: "GET" | "POST";
+    readonly path: `/${string}`;
+    readonly access: readonly K[];
+    handle(request: Request, caller: CallerOf<K>): Promise<Response>;
+}
+/** Callable by anyone, signed in or not: sign-in pages, OAuth endpoints. */
+export interface PublicPluginRoute {
+    readonly method: "GET" | "POST";
+    /** Absolute when it starts with `/.well-known/`. */
+    readonly path: `/${string}`;
+    readonly access: "public";
+    handle(request: Request): Promise<Response>;
+}
+export type AnyPluginRoute = PluginRoute<SignedInKind | "anonymous"> | PublicPluginRoute;
+/** Infers `K` from `access`, so the handler's caller type follows the list. */
+export declare function pluginRoute<const K extends SignedInKind | "anonymous">(route: PluginRoute<K>): PluginRoute<K>;
+export interface PluginHost {
+    readonly basePath: string;
+    readonly database: DataProvider | undefined;
+    /** The installed auth provider, for plugins that mint or look up credentials (chat). */
+    readonly auth?: AuthProvider | undefined;
+    /** `createServer` got an `auth` key whose value is undefined: a sign-in setup that failed to configure. */
+    readonly authMisconfigured?: boolean;
+    callerOf(request: Request): Promise<Caller>;
+    /**
+     * Resolves once the database holds every plugin's tables. Work a plugin starts on its own,
+     * such as a timer, waits for it; request handlers need not, as the server awaits it first.
+     */
+    ready?(): Promise<void>;
+    /**
+     * Records a sync event for writes made outside an action's transaction, such as through
+     * a library that holds its own connection. With `tx`, the event commits with that
+     * transaction instead of its own. Does nothing when sync is off.
+     */
+    announce(scope: string, tags: readonly Tag[], tx?: unknown): Promise<void>;
+}
+export {};
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACZ,sBAAsB,EACtB,YAAY,EACZ,SAAS,EACT,GAAG,EACJ,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,CAAC;IACvD,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAAC;CACxC;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC;IACxD,2FAA2F;IAC3F,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAClC,0FAA0F;IAC1F,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,WAAW,GAAG,eAAe,CAAC;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAErF,KAAK,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,YAAY,GAAG,WAAW;IAC/D,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;IAC9B,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,iBAAiB,CAAC;AAEzF,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,YAAY,GAAG,WAAW,EACpE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GACpB,WAAW,CAAC,CAAC,CAAC,CAEhB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;IAC5C,wFAAwF;IACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,2GAA2G;IAC3G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E"}

package/dist/plugin.js

@@ -0,0 +1,5 @@
+/** Infers `K` from `access`, so the handler's caller type follows the list. */
+export function pluginRoute(route) {
+    return route;
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAsFA,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CACzB,KAAqB;IAErB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/protocol.d.ts

@@ -0,0 +1,18 @@
+import type { UiManifest } from "@parlor/agent-ui";
+import type { ActionDescriptor } from "@parlor/core/registry";
+export declare const PROTOCOL_VERSION = 1;
+export declare const DEFAULT_BASE_PATH = "/_parlor";
+export declare const SOURCE_HEADER = "x-parlor-source";
+export declare const CLIENT_HEADER = "x-parlor-client";
+/** A native shell reads its bearer session from this response header after signing in. */
+export declare const SESSION_TOKEN_HEADER = "set-auth-token";
+export interface Manifest {
+    readonly protocol: typeof PROTOCOL_VERSION;
+    /** What a pairing host shows locally; filled once the server knows the app's name. */
+    readonly app?: {
+        readonly name: string;
+    } | undefined;
+    readonly actions: readonly ActionDescriptor[];
+    readonly ui?: UiManifest | undefined;
+}
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,gBAAgB,CAAC;IAC3C,sFAAsF;IACtF,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACtC"}

package/dist/protocol.js

@@ -0,0 +1,7 @@
+export const PROTOCOL_VERSION = 1;
+export const DEFAULT_BASE_PATH = "/_parlor";
+export const SOURCE_HEADER = "x-parlor-source";
+export const CLIENT_HEADER = "x-parlor-client";
+/** A native shell reads its bearer session from this response header after signing in. */
+export const SESSION_TOKEN_HEADER = "set-auth-token";
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAC5C,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC"}

package/dist/revocation-horizon.d.ts

@@ -0,0 +1,6 @@
+/**
+ * How long a revocation is remembered. Whatever it revokes must stop verifying within
+ * this long, or the revocation is forgotten while the credential still works.
+ */
+export declare const REVOCATION_HORIZON_MS: number;
+//# sourceMappingURL=revocation-horizon.d.ts.map

package/dist/revocation-horizon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation-horizon.d.ts","sourceRoot":"","sources":["../src/revocation-horizon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAc,CAAC"}

package/dist/revocation-horizon.js

@@ -0,0 +1,6 @@
+/**
+ * How long a revocation is remembered. Whatever it revokes must stop verifying within
+ * this long, or the revocation is forgotten while the credential still works.
+ */
+export const REVOCATION_HORIZON_MS = 11 * 60_000;
+//# sourceMappingURL=revocation-horizon.js.map

package/dist/revocation-horizon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation-horizon.js","sourceRoot":"","sources":["../src/revocation-horizon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,6 @@
+import { type Principal } from "@parlor/core";
+/** The tenant a request belongs to. Called once per request. */
+export type ScopeResolver = (request: Request, principal: Principal) => string | Promise<string>;
+export declare const DEFAULT_SCOPE = "default";
+export declare const defaultScope: ScopeResolver;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,cAAc,CAAC;AAEtD,gEAAgE;AAChE,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,KACjB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9B,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC,eAAO,MAAM,YAAY,EAAE,aACS,CAAC"}

package/dist/scope.js

@@ -0,0 +1,4 @@
+import { userOf } from "@parlor/core";
+export const DEFAULT_SCOPE = "default";
+export const defaultScope = (_request, principal) => userOf(principal) ?? DEFAULT_SCOPE;
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,MAAM,EAAE,MAAM,cAAc,CAAC;AAQtD,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CACjE,MAAM,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,44 @@
 {
   "name": "@parlor/server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "homepage": "https://cychien.github.io/parlor",
+  "bugs": "https://github.com/cychien/parlor/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cychien/parlor.git",
+    "directory": "packages/server"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@modelcontextprotocol/server": "^2.3.1",
+    "drizzle-orm": "^0.45.4",
+    "h3": "^2.0.1",
+    "zod": "^4.6.5",
+    "@parlor/agent-ui": "0.1.0",
+    "@parlor/core": "0.1.0",
+    "@parlor/sync": "0.1.0"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/client": "^2.3.1",
+    "@types/node": "^24.14.0",
+    "srvx": "^1.0.5",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3",
+    "@parlor/data": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }