deepspace 0.36.0 → 0.37.0

package/dist/worker.d.ts

@@ -4479,6 +4479,18 @@ interface DeepSpaceAuthConfig {
         keyId: string;
         privateKey: string;
     };
+    /**
+     * Extra OAuth client ids whose ID tokens may sign in through Better Auth's
+     * `POST /sign-in/social` `{ provider, idToken }`: a native app's own Google
+     * iOS/web client ids, or its iOS bundle id for Sign in with Apple. Tokens
+     * are still checked for Google's or Apple's signature, issuer and expiry.
+     * A provider listed here without its web credentials above accepts ID
+     * tokens only; it can't start a browser sign-in.
+     */
+    nativeIdTokenAudiences?: {
+        google?: string[];
+        apple?: string[];
+    };
     /** Enable email/password authentication */
     emailAndPassword?: boolean;
     /** Trusted origins for CORS */
@@ -5645,6 +5657,17 @@ interface ExpoAuthBridgeOptions {
 declare function nativeAuthStart(request: Request, env: ExpoAuthWorkerEnv, options?: ExpoAuthBridgeOptions): Response;
 declare function nativeAuthCallback(request: Request, _env: ExpoAuthWorkerEnv, options?: ExpoAuthBridgeOptions): Response;
 declare function nativeAuthExchange(request: Request, env: ExpoAuthWorkerEnv): Promise<Response>;
+/**
+ * Native sign-in with the platform's own Google or Apple SDK. The app sends
+ * the ID token it received; the auth worker checks the token's signature,
+ * issuer, expiry and audience (one of the plane's configured native client
+ * ids) and accepts each token only once. A nonce, when the app sends one, is
+ * checked against the token too, but it isn't a replay defense: the app
+ * chooses it. Returns the same `{ sessionToken, accessToken }` as
+ * `nativeAuthExchange`. Apple only shares a person's name on their first
+ * sign-in, so the app may pass it along as `user.name`.
+ */
+declare function nativeAuthIdToken(request: Request, env: ExpoAuthWorkerEnv): Promise<Response>;
 declare function nativeAuthToken(request: Request, env: ExpoAuthWorkerEnv): Promise<Response>;
 declare function nativeAuthMe(request: Request, env: ExpoAuthWorkerEnv): Promise<Response>;
 declare function nativeAuthSignOut(request: Request, env: ExpoAuthWorkerEnv): Promise<Response>;
@@ -5805,4 +5828,4 @@ declare const MAX_LOG_TEXT_LENGTH: number;
  */
 declare function workerErrorHandler(prefix: string, respond?: (c: Context) => Response): ErrorHandler;
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID, ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID, AGENT_TOKEN_SCOPE, AGENT_TOOL_REQUEST_BODY_CAP, AGENT_TOOL_RESPONSE_BODY_CAP, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, AI_SDK_7_MIGRATION_ID, ALLOWED_BINDING_TYPES, ANONYMOUS_USER_ID_PREFIX, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type AgentTargetPolicy, type AgentToolAccessResult, type AgentToolRouteEnv, type AgentToolRouteOptions, type ApiErrorIssue, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMembership, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILD_INJECTED_APP_ID_MIGRATION_ID, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, type BindingJsonValue, BodyTooLargeError, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientMessage, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DeepSpaceUserCreateContext, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type ExpoAuthBridgeOptions, type ExpoAuthWorkerEnv, FILES_SESSION_COOKIE_READS_MIGRATION_ID, type GetActionData, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_BINDING_NAME_LENGTH, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_LOG_TEXT_LENGTH, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type NormalizedApiError, PLANES, PRODUCTION_OFFICIAL_AGENT_ORIGINS, type PermissionContext, type PermissionLevel, type PlaneName, type PlaneUrls, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RECORD_NOT_FOUND, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REPO_STORE_LIMIT_BYTES, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type RolePermissions, type RunMigrationsResult, SANDBOX_SCOPES, SANDBOX_SCOPE_HEADER, SDK_RUN_WORKER_FIRST, SECRET_NAME_RE, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, SESSION_COOKIE, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTIONS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, type SandboxFile, SandboxFileError, type SandboxFileList, type SandboxFilesClient, type SandboxFilesOptions, type SandboxScope, type SandboxUploadOptions, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserToolExecutorEnv, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, YjsRoom, agentTokenIssuer, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, authenticatedRoomRequest, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, callableFromSandbox, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, clientBuild, codeExecutionTool, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, createUserToolExecutor, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, epochSeconds, folderFilter, formatBytes, forwardSandboxContainer, getChat, getDeepSpaceAIModel, getMessageType, getRolePermissions, handleAwarenessMessage, handleSyncMessage, hasContent, isAnonymousUserId, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isRestrictedPlane, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, listDeepSpaceAgentModels, loadMessages, logEventText, loggableError, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, nativeAuthCallback, nativeAuthExchange, nativeAuthMe, nativeAuthSignOut, nativeAuthStart, nativeAuthToken, noopPermissionContext, normalizeAgentTargetOrigin, normalizeApiError, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readBoundedBodyText, readVarUint, readVarUint8Array, registerAgentToolRoutes, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppMembership, resolveAppName, resolveAppRole, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, resolveSessionReadAuth, reuseSandbox, rowToData, runMigrations, sandboxFiles, sandboxOutputs, sandboxUpload, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateLogText, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyAgentToken, verifyJwt, workerErrorHandler, writeVarUint, writeVarUint8Array };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, ACTION_ROUTES_BEARER_GUARD_MIGRATION_ID, ACTION_TOOLS_DELETE_WHERE_MIGRATION_ID, AGENT_TOKEN_SCOPE, AGENT_TOOL_REQUEST_BODY_CAP, AGENT_TOOL_RESPONSE_BODY_CAP, AI_CHATS_SCHEMA, AI_MESSAGES_SCHEMA, AI_SDK_7_MIGRATION_ID, ALLOWED_BINDING_TYPES, ANONYMOUS_USER_ID_PREFIX, APP_ID_RE, APP_LOG_EVENT_KEYS, APP_NAME_RULES, ASSET_NOT_FOUND_HANDLING_VALUES, AUTO_PROVISIONABLE_TYPES, AUTO_PROVISION_SENTINEL, type ActionContext, type ActionHandler, type ActionResult, type ActionTools, type AgentTargetPolicy, type AgentToolAccessResult, type AgentToolRouteEnv, type AgentToolRouteOptions, type ApiErrorIssue, type ApiWorkerEnv, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMembership, type AppMigrationIdsValidation, type AppNameResolution, type AppNameValidation, type AssetNotFoundHandling, type AuthWorkerEnv, Awareness, type AwarenessState, type AwarenessStates, BASE_USERS_SCHEMA, BROWSER_PROXY_ROUTES, BUILD_INJECTED_APP_ID_MIGRATION_ID, BUILT_IN_TOOLS, type BaseMessage, BaseRoom, type BindingJsonValue, BodyTooLargeError, CHANNELS_SCHEMA, CHANNEL_MEMBERS_SCHEMA, COST_RATES, CanvasRoom, type CanvasShape, type ChatContextConfig, type ChatMessageRow, type ChatRow, type ChatTurn, type ClientMessage, type CollectionSchema, type ColumnDefinition, type ColumnInterpretation, type ComposioToolsOptions, type ConnectionAttachment, type CronContext, type CronExecution, CronRoom, type CronRoomConfig, type CronTask, type CustomBinding, type CustomBindingManifest, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEFAULT_CONTEXT_CONFIG, DEFAULT_DELETE_WHERE_LIMIT, DEFAULT_DO_MANIFEST, DEFAULT_QUERY_LIMIT, DEPLOYED_APPS_DEFAULTS, type DOBindings, type DOManifest, type DOManifestEntry, type DeepSpaceAIEnv, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIOptions, type DeepSpaceAIProvider, type DeepSpaceAgentDiagnosticContext, DeepSpaceAgentModelError, type DeepSpaceAgentProfile, DeepSpaceAgentProfileError, type DeepSpaceAgentProfileId, type DeepSpaceAgentStream, type DeepSpaceAgentStreamOptions, type DeepSpaceAgentSupport, type DeepSpaceAuth, type DeepSpaceAuthConfig, type DeepSpaceDocumentationRouteEnv, type DeepSpaceDocumentationRouteOptions, type DeepSpaceUserCreateContext, type DoMigrationDirective, type DoMigrationPlan, type ExistingDOBinding, type ExpoAuthBridgeOptions, type ExpoAuthWorkerEnv, FILES_SESSION_COOKIE_READS_MIGRATION_ID, type GetActionData, type HandlerContext, type Job, type JobContext, JobRoom, type JobRoomConfig, type JobStatus, type JwtClaims, type JwtVerifierConfig, type KnowledgeAddOptions, type KnowledgeAddResult, type KnowledgeClient, type KnowledgeEnv, KnowledgeError, type KnowledgeItem, type KnowledgeListOptions, type KnowledgeListResult, type KnowledgeSearchChunk, type KnowledgeSearchOptions, type KnowledgeSearchResult, type KnowledgeStatus, LOG_LEVELS, type LogLevel, MAX_APP_FILE_BYTES, MAX_BINDING_NAME_LENGTH, MAX_DELETE_WHERE_LIMIT, MAX_DEPLOY_ASSET_FILE_BYTES, MAX_ENV_VAR_BYTES, MAX_LOG_TEXT_LENGTH, MAX_UPLOAD_PARTS, MAX_UPLOAD_REQUEST_BYTES, MESSAGES_SCHEMA, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MessageHandlers, type MsgType, type MutateActionData, type NormalizedApiError, PLANES, PRODUCTION_OFFICIAL_AGENT_ORIGINS, type PermissionContext, type PermissionLevel, type PlaneName, type PlaneUrls, type PlatformWorkerEnv, type PrefixResult, type PresencePeer, PresenceRoom, type ProtocolMessage, type ProxyRoute, type QueryActionData, REACTIONS_SCHEMA, READ_RECEIPTS_SCHEMA, RECORD_NOT_FOUND, REGISTRY_INSTANCE, RELEASE_STAMP_PATH, REPO_STORE_LIMIT_BYTES, REQUIRED_COMPATIBILITY_FLAGS, RESERVED_BINDING_NAMES, RESERVED_RUN_WORKER_FIRST, RESOURCE_ID_RE, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_DEFAULT, RecordRoom, type RecordRoomConfig, RegistryClientError, type ResolvedColumn, type ResolvedDeepSpaceAgentModel, type RolePermissions, type RunMigrationsResult, SANDBOX_SCOPES, SANDBOX_SCOPE_HEADER, SDK_RUN_WORKER_FIRST, SECRET_NAME_RE, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, SESSION_COOKIE, STRICT_APP_ID_RE, SYSTEM_ASSIGNED_COLUMNS, SYSTEM_COLLECTIONS, SYSTEM_MAINTAINED_COLUMNS, SYSTEM_MANAGED_COLUMNS, type SandboxFile, SandboxFileError, type SandboxFileList, type SandboxFilesClient, type SandboxFilesOptions, type SandboxScope, type SandboxUploadOptions, SchemaRegistry, type ScopeContext, type ScopedKnowledgeClient, type ScopedR2Auth, type ScopedR2Config, type ScopedR2Handler, type ScreenshotEnv, type ScreenshotResult, type ServerMessage, type StorageAdmission, type StoredRecord, type Summarizer, type SyncResult, TEST_ACCOUNT_EMAIL_SUFFIX, type TokenDebugInfo, type ToolResult, type ToolSchema, UNDECLARED_ASSET_NOT_FOUND_HANDLING, UPLOAD_PART_BYTES, USERS_COLUMNS, type User, type UserAttachment, type UserToolExecutorEnv, type ValidationError, type VerifiedAuth, type VerifyOutcome, type VerifyResult, type Viewport, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, YjsRoom, agentTokenIssuer, apiWorkerFetch, appendMessage, applyAiToolDefaults, applySlidingWindow, armCronRoom, authWorkerFetch, authenticatedRoomRequest, bindingManifestFromOutputConfig, buildCronContext, buildTableSelect, buildUiParts, callRegistry, callableFromSandbox, canCreate, canDelete, canRead, canUpdate, capToolResultSize, captureScreenshot, checkFieldPermissions, checkUnclaimedOwnerTransition, clientBuild, codeExecutionTool, coerceValue, collectionTableName, columnId, composioTools, computeDoMigration, computeHmacHex, createChat, createDecoder, createDeepSpaceAI, createDeepSpaceAuth, createEncoder, createScopedR2Handler, createUserToolExecutor, dataToColumnValues, decodeJwtPayload, deepSpaceAgentErrorSummary, deleteChatCascade, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, enqueueJob, epochSeconds, folderFilter, formatBytes, forwardSandboxContainer, getChat, getDeepSpaceAIModel, getMessageType, getRolePermissions, handleAwarenessMessage, handleSyncMessage, hasContent, isAnonymousUserId, isAssetNotFoundHandling, isAutoProvision, isFilesVerbPath, isOwner, isPlatformReservedPath, isRestrictedPlane, isTestAccountClaims, isTestAccountEmail, isTestAccountTier, knowledge, lintSchema, lintSchemaSet, lintSchemas, listDeepSpaceAgentModels, loadMessages, logEventText, loggableError, makeDefaultSummarizer, matchOrigin, meterAi, meterUsage, meterVectorize, mintAppId, mintUlid, nativeAuthCallback, nativeAuthExchange, nativeAuthIdToken, nativeAuthMe, nativeAuthSignOut, nativeAuthStart, nativeAuthToken, noopPermissionContext, normalizeAgentTargetOrigin, normalizeApiError, normalizeKnowledgeFolder, parseQuotaLimit, platformCorsPatterns, platformWorkerFetch, prepareMessagesWithCompaction, priceBindingUsageEvent, readBoundedBodyText, readVarUint, readVarUint8Array, registerAgentToolRoutes, registerDeepSpaceDocumentation, registryErrorJson, registryStub, resolveAppMembership, resolveAppName, resolveAppRole, resolveColumn, resolveCompatibilityFlags, resolveDeepSpaceAgentModel, resolveSessionReadAuth, reuseSandbox, rowToData, runMigrations, sandboxFiles, sandboxOutputs, sandboxUpload, serverBuild, storageLimitForTier, storageQuotaMessage, streamDeepSpaceAgent, timingSafeEqualHex, timingSafeEqualStrings, toUint8Array, totalChars, truncateLogText, truncateOldToolResults, turnsToCoreMessages, unwrapToolOutput, updateChat, validateAppMigrationIds, validateAppName, validateBindingManifest, validateDoManifest, verifyAgentToken, verifyJwt, workerErrorHandler, writeVarUint, writeVarUint8Array };

package/dist/worker.js

@@ -10486,8 +10486,12 @@ import { organization, twoFactor } from "better-auth/plugins";
 import { SignJWT, importPKCS8 } from "jose";
 function createDeepSpaceAuth(config) {
   const socialProviders = {};
+  const googleAudiences = config.nativeIdTokenAudiences?.google ?? [];
+  const appleAudiences = config.nativeIdTokenAudiences?.apple ?? [];
   if (config.google) {
-    socialProviders.google = config.google;
+    socialProviders.google = googleAudiences.length ? { ...config.google, clientId: [config.google.clientId, ...googleAudiences] } : config.google;
+  } else if (googleAudiences.length) {
+    socialProviders.google = { clientId: googleAudiences, clientSecret: "" };
   }
   if (config.github) {
     socialProviders.github = config.github;
@@ -10497,16 +10501,27 @@ function createDeepSpaceAuth(config) {
   }
   if (config.apple) {
     const apple = config.apple;
+    const audience = appleAudiences.length ? [apple.clientId, ...appleAudiences] : void 0;
     socialProviders.apple = async () => {
       try {
-        return { clientId: apple.clientId, clientSecret: await generateAppleClientSecret(apple) };
+        return {
+          clientId: apple.clientId,
+          clientSecret: await generateAppleClientSecret(apple),
+          ...audience ? { audience } : {}
+        };
       } catch (err) {
         console.error(
           `[deepspace] failed to mint Apple client secret; Apple sign-in disabled: ${loggableError(err)}`
         );
-        return { clientId: apple.clientId, clientSecret: "" };
+        return { clientId: apple.clientId, clientSecret: "", ...audience ? { audience } : {} };
       }
     };
+  } else if (appleAudiences.length) {
+    socialProviders.apple = {
+      clientId: appleAudiences[0],
+      clientSecret: "",
+      audience: appleAudiences
+    };
   }
   return betterAuth({
     database: config.database,
@@ -10979,13 +10994,62 @@ async function nativeAuthExchange(request2, env) {
   if (!exchanged || typeof exchanged.sessionToken !== "string") {
     return Response.json({ error: "The auth service did not issue a session." }, { status: 502 });
   }
+  return nativeSession(env, exchanged.sessionToken);
+}
+var ID_TOKEN_PROVIDERS = /* @__PURE__ */ new Set(["google", "apple"]);
+async function nativeAuthIdToken(request2, env) {
+  const body = await request2.json().catch(() => null);
+  if (!body || typeof body.provider !== "string" || !ID_TOKEN_PROVIDERS.has(body.provider) || typeof body.idToken !== "string" || body.idToken.length < 16 || body.idToken.length > 8192 || body.nonce !== void 0 && (typeof body.nonce !== "string" || body.nonce.length < 16 || body.nonce.length > 256)) {
+    return Response.json({ error: "A Google or Apple ID token is required." }, { status: 400 });
+  }
+  const name = body.user?.name;
+  const text = (value) => typeof value === "string" ? value.trim().slice(0, 100) : void 0;
+  const firstName = text(name?.firstName);
+  const lastName = text(name?.lastName);
+  let signIn;
+  try {
+    signIn = await authWorkerFetch(env, "/api/auth/sign-in/social", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        provider: body.provider,
+        idToken: {
+          token: body.idToken,
+          ...typeof body.nonce === "string" ? { nonce: body.nonce } : {},
+          ...firstName || lastName ? { user: { name: { firstName, lastName } } } : {}
+        }
+      })
+    });
+  } catch {
+    return Response.json({ error: "The authentication service is unavailable." }, { status: 502 });
+  }
+  if (!signIn.ok) {
+    if (signIn.status === 404) {
+      return Response.json({ error: "Signing in this way is not set up for this app." }, { status: 503 });
+    }
+    if (signIn.status === 429) {
+      return Response.json({ error: "Too many sign-in attempts. Try again shortly." }, { status: 429 });
+    }
+    const rejected = signIn.status >= 400 && signIn.status < 500;
+    return Response.json(
+      { error: rejected ? "That sign-in could not be verified. Please try again." : "The authentication service is unavailable." },
+      { status: rejected ? 401 : 502 }
+    );
+  }
+  const signedIn = await signIn.json().catch(() => null);
+  if (!signedIn || typeof signedIn.token !== "string") {
+    return Response.json({ error: "The auth service did not issue a session." }, { status: 502 });
+  }
+  return nativeSession(env, signedIn.token);
+}
+async function nativeSession(env, sessionToken) {
   let tokenResponse = null;
   let token = null;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       tokenResponse = await authWorkerFetch(env, "/api/auth/token", {
         method: "POST",
-        headers: { Cookie: `${SESSION_COOKIE}=${encodeURIComponent(exchanged.sessionToken)}` }
+        headers: { Cookie: `${SESSION_COOKIE}=${encodeURIComponent(sessionToken)}` }
       });
     } catch {
       tokenResponse = null;
@@ -11009,7 +11073,7 @@ async function nativeAuthExchange(request2, env) {
     return Response.json({ error: "The auth service did not issue an access token." }, { status: 502 });
   }
   return Response.json(
-    { sessionToken: exchanged.sessionToken, accessToken: token.token },
+    { sessionToken, accessToken: token.token },
     { headers: { "Cache-Control": "no-store" } }
   );
 }
@@ -11313,6 +11377,7 @@ export {
   mintUlid,
   nativeAuthCallback,
   nativeAuthExchange,
+  nativeAuthIdToken,
   nativeAuthMe,
   nativeAuthSignOut,
   nativeAuthStart,