@absolutejs/auth 0.54.4 → 0.54.6

package/dist/index.js

@@ -1946,6 +1946,7 @@ var providers = defineProviders({
     }
   },
   withings: {
+    accessTokenPath: ["body", "access_token"],
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
@@ -2800,10 +2801,21 @@ var buildOAuth2Client = async (meta, config) => {
       if (!response.ok)
         throw await createOAuth2FetchError(response);
       const tokenResponse = await response.json();
+      if (!tokenResponse || typeof tokenResponse !== "object") {
+        throw new Error("OAuth token endpoint returned a non-object response");
+      }
+      const oauthError = Reflect.get(tokenResponse, "error");
+      if (typeof oauthError === "string" && oauthError.length > 0) {
+        throw new Error(`OAuth token exchange failed: ${oauthError}`);
+      }
       const nestedToken = meta.accessTokenPath ? readPath(tokenResponse, meta.accessTokenPath) : undefined;
       if (typeof nestedToken === "string" && nestedToken.length > 0 && tokenResponse && typeof tokenResponse === "object") {
         tokenResponse.access_token = nestedToken;
       }
+      const accessToken = Reflect.get(tokenResponse, "access_token");
+      if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("OAuth token endpoint returned no access_token");
+      }
       return tokenResponse;
     }
   };
@@ -2812,7 +2824,7 @@ var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Clien
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
-import { Elysia as Elysia41 } from "elysia";
+import { Elysia as Elysia42 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -3032,6 +3044,146 @@ var apiKeysRoutes = ({
   });
 };
 
+// src/agents/routes.ts
+import { Elysia as Elysia2 } from "elysia";
+
+// src/agents/config.ts
+var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
+var agentProtectedResourceMetadata = (config) => ({
+  authorization_servers: [config.authorizationServer],
+  bearer_methods_supported: ["header"],
+  ...config.logoUri === undefined ? {} : { resource_logo_uri: config.logoUri },
+  ...config.resourceName === undefined ? {} : { resource_name: config.resourceName },
+  resource: config.resource,
+  scopes_supported: config.scopes
+});
+
+// src/agents/principal.ts
+var intersectScopes = (...sets) => {
+  if (sets.length === 0)
+    return [];
+  const [first = [], ...rest] = sets;
+  return [...new Set(first)].filter((scope) => rest.every((set) => set.includes(scope)));
+};
+var agentHasScopes = (principal, requiredScopes) => principal !== undefined && requiredScopes.every((scope) => principal.scopes.includes(scope));
+var resolveAgentPrincipal = async (request, config) => {
+  const credential = await config.verifyCredential(request);
+  if (credential === undefined)
+    return;
+  if (credential.resource !== undefined && credential.resource !== config.resource) {
+    return;
+  }
+  if (credential.expiresAt !== undefined && credential.expiresAt <= Date.now()) {
+    return;
+  }
+  const registration = await config.registrationStore.findByAgentId(credential.agentId);
+  if (registration === undefined || registration.status !== "active") {
+    return;
+  }
+  const registeredScopes = intersectScopes(credential.scopes, registration.allowedScopes, config.scopes);
+  if (credential.userId === undefined) {
+    if (config.allowUndelegated !== true)
+      return;
+    return {
+      agentId: registration.agentId,
+      kind: "agent",
+      name: registration.name,
+      scopes: registeredScopes,
+      trust: "registered"
+    };
+  }
+  const delegation = await config.delegationStore.findActiveDelegation({
+    agentId: registration.agentId,
+    organizationId: credential.organizationId,
+    userId: credential.userId
+  });
+  if (delegation === undefined)
+    return;
+  return {
+    agentId: registration.agentId,
+    authorizationDetails: delegation.authorizationDetails,
+    delegationId: delegation.delegationId,
+    kind: "agent",
+    name: registration.name,
+    organizationId: delegation.organizationId,
+    scopes: intersectScopes(registeredScopes, delegation.scopes),
+    trust: "delegated",
+    userId: delegation.userId
+  };
+};
+
+// src/agents/routes.ts
+var quoteHeaderValue = (value) => {
+  const printable = [...value].filter((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint >= 32 && codePoint !== 127;
+  }).join("");
+  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
+};
+var agentAuthChallenge = ({
+  config,
+  error,
+  requiredScopes = []
+}) => {
+  const parameters = [
+    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
+  ];
+  if (requiredScopes.length > 0) {
+    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
+  }
+  if (error !== undefined) {
+    parameters.push(`error=${quoteHeaderValue(error)}`);
+  }
+  return `Bearer ${parameters.join(", ")}`;
+};
+var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
+var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
+  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+  error_description: failure.message
+}), {
+  headers: {
+    "content-type": "application/json",
+    "www-authenticate": agentAuthChallenge({
+      config,
+      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+      requiredScopes
+    })
+  },
+  status: failure.code === "Forbidden" ? 403 : 401
+});
+var agentAuthPlugin = (config) => {
+  const plugin = new Elysia2().derive(({ request }) => ({
+    protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+      if (config === undefined) {
+        const failure = {
+          code: "Unauthorized",
+          message: "Agent is not authenticated"
+        };
+        return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
+      }
+      const principal = await resolveAgentPrincipal(request, config);
+      if (principal === undefined) {
+        const failure = {
+          code: "Unauthorized",
+          message: "Agent is not authenticated"
+        };
+        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+      }
+      if (!agentHasScopes(principal, requiredScopes)) {
+        const failure = {
+          code: "Forbidden",
+          message: "Insufficient agent scopes"
+        };
+        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+      }
+      return handleAuth(principal);
+    }
+  }));
+  if (config === undefined)
+    return plugin.as("global");
+  return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).as("global");
+};
+
 // src/audit/config.ts
 var createAuditEmitter = ({ auditStore, onAuditEvent, redact }) => async (event) => {
   const finalEvent = redact ? await redact(event) : event;
@@ -3151,7 +3303,7 @@ var composeSignOutAudit = (onSignOut, emit) => async (context) => {
 };
 
 // src/authorization/protectPermission.ts
-import { Elysia as Elysia3, t as t3 } from "elysia";
+import { Elysia as Elysia4, t as t3 } from "elysia";
 
 // src/session/access.ts
 var collectSessionEntries = (session) => Object.entries(session).filter((entry) => isUserSessionId(entry[0]));
@@ -3265,11 +3417,11 @@ var loadSessionFromSource = async ({
 };
 
 // src/session/state.ts
-import { Elysia as Elysia2 } from "elysia";
+import { Elysia as Elysia3 } from "elysia";
 var sessionStore = () => {
   const initialSession = {};
   const initialUnregisteredSession = {};
-  return new Elysia2({ name: "sessionStore" }).state({
+  return new Elysia3({ name: "sessionStore" }).state({
     session: initialSession,
     unregisteredSession: initialUnregisteredSession
   });
@@ -3291,7 +3443,7 @@ var protectPermissionPlugin = ({
   authSessionStore,
   emit,
   hasPermission
-}) => new Elysia3().use(sessionStore()).guard({ cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}) => new Elysia4().use(sessionStore()).guard({ cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectPermission: (check, handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -3328,7 +3480,7 @@ var protectPermissionPlugin = ({
 })).as("global");
 
 // src/compliance/routes.ts
-import { Elysia as Elysia4, t as t4 } from "elysia";
+import { Elysia as Elysia5, t as t4 } from "elysia";
 
 // src/utils.ts
 init_constants();
@@ -3427,6 +3579,18 @@ var resolveOAuthAuthorization = async ({
   let userIdentity;
   let accessToken = tokenResponse.access_token;
   let refreshToken = tokenResponse.refresh_token;
+  if (authProvider === "withings" && !accessToken) {
+    const body = Reflect.get(tokenResponse, "body");
+    if (body && typeof body === "object") {
+      const nestedAccessToken = Reflect.get(body, "access_token");
+      if (typeof nestedAccessToken === "string") {
+        accessToken = nestedAccessToken;
+      }
+    }
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("OAuth authorization response contains no access_token");
+  }
   if (tokenResponse.id_token) {
     userIdentity = normalizeProviderIdentity({
       identity: decodeJWT(tokenResponse.id_token),
@@ -3445,7 +3609,7 @@ var resolveOAuthAuthorization = async ({
     refreshToken = tokenResponse.body.refresh_token;
   } else {
     userIdentity = normalizeProviderIdentity({
-      identity: await providerInstance.fetchUserProfile(tokenResponse.access_token),
+      identity: await providerInstance.fetchUserProfile(accessToken),
       providerConfiguration: meta,
       source: "profile"
     });
@@ -3643,7 +3807,7 @@ var complianceRoutes = ({
   emit,
   exportUserData,
   getUserId
-}) => new Elysia4().use(sessionStore()).get(`${complianceRoute}/export`, async ({
+}) => new Elysia5().use(sessionStore()).get(`${complianceRoute}/export`, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -3699,11 +3863,11 @@ var complianceRoutes = ({
 }, { cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }) });
 
 // src/credentials/routes.ts
-import { Elysia as Elysia9 } from "elysia";
+import { Elysia as Elysia10 } from "elysia";
 
 // src/credentials/emailVerification.ts
 init_crypto();
-import { Elysia as Elysia5, t as t5 } from "elysia";
+import { Elysia as Elysia6, t as t5 } from "elysia";
 
 // src/credentials/config.ts
 init_constants();
@@ -3718,7 +3882,7 @@ var credentialsEmailVerification = ({
   onSendEmail,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   verifyEmailRoute = "/auth/verify-email"
-}) => new Elysia5().post(verifyEmailRoute, async ({ body: { token }, status }) => {
+}) => new Elysia6().post(verifyEmailRoute, async ({ body: { token }, status }) => {
   const consumed = await credentialStore.consumeVerificationToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired verification token");
@@ -3750,7 +3914,7 @@ var credentialsEmailVerification = ({
 // src/credentials/login.ts
 init_constants();
 init_crypto();
-import { Elysia as Elysia6, t as t6 } from "elysia";
+import { Elysia as Elysia7, t as t6 } from "elysia";
 
 // src/credentials/import.ts
 init_crypto();
@@ -3948,7 +4112,7 @@ var credentialsLogin = ({
   rehashOnLogin = false,
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
-}) => new Elysia6().use(sessionStore()).post(loginRoute, async ({
+}) => new Elysia7().use(sessionStore()).post(loginRoute, async ({
   body: { email, password },
   cookie: { user_session_id },
   request,
@@ -4037,7 +4201,7 @@ var credentialsLogin = ({
 
 // src/credentials/passwordReset.ts
 init_crypto();
-import { Elysia as Elysia7, t as t7 } from "elysia";
+import { Elysia as Elysia8, t as t7 } from "elysia";
 var credentialsPasswordReset = ({
   credentialStore,
   onPasswordReset,
@@ -4045,7 +4209,7 @@ var credentialsPasswordReset = ({
   passwordPolicy,
   resetPasswordRoute = "/auth/reset-password",
   resetTokenDurationMs = DEFAULT_RESET_TOKEN_TTL_MS
-}) => new Elysia7().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
+}) => new Elysia8().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && credential.status === "active") {
@@ -4096,7 +4260,7 @@ var credentialsPasswordReset = ({
 
 // src/credentials/register.ts
 init_crypto();
-import { Elysia as Elysia8, t as t8 } from "elysia";
+import { Elysia as Elysia9, t as t8 } from "elysia";
 var credentialsRegister = ({
   authSessionStore,
   cookieSecure,
@@ -4110,7 +4274,7 @@ var credentialsRegister = ({
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
-}) => new Elysia8().use(sessionStore()).post(registerRoute, async ({
+}) => new Elysia9().use(sessionStore()).post(registerRoute, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
   status,
@@ -4188,16 +4352,16 @@ var credentialsRegister = ({
 });
 
 // src/credentials/routes.ts
-var credentialRoutes = (config) => new Elysia9().use(credentialsRegister(config)).use(credentialsEmailVerification(config)).use(credentialsLogin(config)).use(credentialsPasswordReset(config));
+var credentialRoutes = (config) => new Elysia10().use(credentialsRegister(config)).use(credentialsEmailVerification(config)).use(credentialsLogin(config)).use(credentialsPasswordReset(config));
 
 // src/htmx/routes.ts
-import { Elysia as Elysia11 } from "elysia";
+import { Elysia as Elysia12 } from "elysia";
 
 // src/routes/protectRoute.ts
-import { Elysia as Elysia10, t as t9 } from "elysia";
+import { Elysia as Elysia11, t as t9 } from "elysia";
 var protectRoutePlugin = ({
   authSessionStore
-} = {}) => new Elysia10().use(sessionStore()).guard({ cookie: t9.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+} = {}) => new Elysia11().use(sessionStore()).guard({ cookie: t9.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectRoute: (handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -4306,7 +4470,7 @@ var signInPrompt = `<section class="auth-content"><h1 class="page-heading">Not a
 var createAuthHtmxRoutes = (config) => {
   const renderers = resolveAuthHtmxRenderers(config);
   const authorizationHref = config.authorizationHref ?? ((provider) => `/oauth2/${provider}/authorization`);
-  return new Elysia11().use(protectRoutePlugin({
+  return new Elysia12().use(protectRoutePlugin({
     authSessionStore: config.authSessionStore
   })).get("/htmx/login", () => html(renderers.providerLogin("Sign in with", true))).get("/htmx/link", () => html(renderers.providerLogin("Link", false))).get("/htmx/connector-links", () => html(renderers.connectorLinks())).get("/htmx/auth-menu", ({ protectRoute }) => protectRoute((user) => html(renderers.authMenu(user)), () => html(renderers.authMenu(null)))).get("/htmx/me", ({ protectRoute }) => protectRoute((user) => html(renderers.protected(user)), () => html(signInPrompt))).get("/htmx/account", ({ protectRoute }) => protectRoute((user) => html(renderers.account(user)), () => html(signInPrompt))).get("/htmx/identities", ({ protectRoute, query }) => protectRoute(async (user) => {
     const search = typeof query.query === "string" ? query.query : "";
@@ -4412,11 +4576,11 @@ var isMfaEnrolled = (enrollment) => enrollment !== undefined && (enrollment.totp
 var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(await mfaStore.getEnrollment(getUserId(user)));
 
 // src/mfa/routes.ts
-import { Elysia as Elysia16 } from "elysia";
+import { Elysia as Elysia17 } from "elysia";
 
 // src/mfa/challenge.ts
 init_crypto();
-import { Elysia as Elysia13, t as t11 } from "elysia";
+import { Elysia as Elysia14, t as t11 } from "elysia";
 
 // src/mfa/backupCodes.ts
 init_crypto();
@@ -4452,7 +4616,7 @@ var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret
 
 // src/mfa/sms.ts
 init_crypto();
-import { Elysia as Elysia12, t as t10 } from "elysia";
+import { Elysia as Elysia13, t as t10 } from "elysia";
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
@@ -4505,7 +4669,7 @@ var mfaSmsRoutes = ({
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
-}) => new Elysia12().use(sessionStore()).post(smsSetupRoute, async ({
+}) => new Elysia13().use(sessionStore()).post(smsSetupRoute, async ({
   body: { phone },
   cookie: { user_session_id },
   status,
@@ -4613,7 +4777,7 @@ var mfaChallenge = ({
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
-}) => new Elysia13().use(sessionStore()).post(challengeRoute, async ({
+}) => new Elysia14().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
   cookie: { user_session_id },
   status,
@@ -4753,7 +4917,7 @@ var mfaChallenge = ({
 });
 
 // src/mfa/management.ts
-import { Elysia as Elysia14, t as t12 } from "elysia";
+import { Elysia as Elysia15, t as t12 } from "elysia";
 var maskPhone2 = (phone) => {
   if (!phone)
     return null;
@@ -4766,7 +4930,7 @@ var mfaManagementRoutes = ({
   getUserId,
   managementRoute = "/auth/mfa",
   mfaStore
-}) => new Elysia14().use(sessionStore()).get(managementRoute, async ({
+}) => new Elysia15().use(sessionStore()).get(managementRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -4809,7 +4973,7 @@ var mfaManagementRoutes = ({
 
 // src/mfa/totp.ts
 init_crypto();
-import { Elysia as Elysia15, t as t13 } from "elysia";
+import { Elysia as Elysia16, t as t13 } from "elysia";
 var mfaTotpRoutes = ({
   authSessionStore,
   backupCodeCount = DEFAULT_BACKUP_CODE_COUNT,
@@ -4820,7 +4984,7 @@ var mfaTotpRoutes = ({
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
   totpVerifyRoute = "/auth/mfa/totp/verify"
-}) => new Elysia15().use(sessionStore()).post(totpSetupRoute, async ({
+}) => new Elysia16().use(sessionStore()).post(totpSetupRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -4897,12 +5061,12 @@ var mfaTotpRoutes = ({
 });
 
 // src/mfa/routes.ts
-var mfaRoutes = (config) => new Elysia16().use(mfaManagementRoutes(config)).use(mfaTotpRoutes(config)).use(mfaSmsRoutes(config)).use(mfaChallenge(config));
+var mfaRoutes = (config) => new Elysia17().use(mfaManagementRoutes(config)).use(mfaTotpRoutes(config)).use(mfaSmsRoutes(config)).use(mfaChallenge(config));
 
 // src/oidc/routes.ts
 init_constants();
 init_crypto();
-import { Elysia as Elysia17, t as t14 } from "elysia";
+import { Elysia as Elysia18, t as t14 } from "elysia";
 
 // src/oidc/config.ts
 init_constants();
@@ -5020,13 +5184,11 @@ var buildAccessClaims = ({
   };
   if (act !== undefined)
     claims.act = act;
-  if (dpopJkt !== undefined || clientCertThumbprint !== undefined) {
-    const cnf = {};
-    if (dpopJkt !== undefined)
-      cnf.jkt = dpopJkt;
-    if (clientCertThumbprint !== undefined) {
-      cnf["x5t#S256"] = clientCertThumbprint;
-    }
+  const cnf = {
+    ...dpopJkt === undefined ? {} : { jkt: dpopJkt },
+    ...clientCertThumbprint === undefined ? {} : { "x5t#S256": clientCertThumbprint }
+  };
+  if (Object.keys(cnf).length > 0) {
     claims.cnf = cnf;
   }
   return claims;
@@ -5253,6 +5415,13 @@ var decideDeviceAuthorization = async (config, userCode, approval) => {
     return { error: "already_decided", ok: false };
   }
   await config.deviceAuthorizationStore.updateStatus(record.deviceCodeHash, approval.status, approval.userSub);
+  if (approval.status === "approved" && approval.userSub !== undefined) {
+    await config.onDeviceAuthorizationApproved?.({
+      clientId: record.clientId,
+      scopes: record.scopes,
+      userSub: approval.userSub
+    });
+  }
   return { ok: true };
 };
 var approveDeviceAuthorization = async ({
@@ -6334,6 +6503,7 @@ var metadataToClient = (clientId, metadata, transform) => {
   const base = {
     backchannelLogoutUri: metadata.backchannel_logout_uri,
     clientId,
+    grantTypes: metadata.grant_types,
     jwks: metadata.jwks,
     jwksUri: metadata.jwks_uri,
     name: metadata.client_name ?? clientId,
@@ -6347,6 +6517,7 @@ var clientToMetadata = (client) => ({
   backchannel_logout_uri: client.backchannelLogoutUri,
   client_id: client.clientId,
   client_name: client.name,
+  grant_types: client.grantTypes,
   jwks: client.jwks,
   jwks_uri: client.jwksUri,
   post_logout_redirect_uris: client.postLogoutRedirectUris,
@@ -6418,6 +6589,7 @@ var registerClient = async ({
   initialAccessTokenStore,
   metadata,
   onClientRegistration,
+  onClientRegistered,
   presentedInitialAccessToken,
   registrationBaseUrl,
   registrationTokenStore
@@ -6438,7 +6610,8 @@ var registerClient = async ({
       return { body: { error: "invalid_token" }, ok: false, status: 401 };
     }
   }
-  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+  const requiresRedirect = metadata.grant_types === undefined || metadata.grant_types.includes("authorization_code");
+  if (requiresRedirect && (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0)) {
     return {
       body: { error: "invalid_redirect_uri" },
       ok: false,
@@ -6463,6 +6636,7 @@ var registerClient = async ({
   await clientStore.saveClient(client);
   const regToken = await mintRegistrationToken(clientId);
   await registrationTokenStore.saveToken(regToken.record);
+  await onClientRegistered?.({ client, metadata });
   return {
     body: {
       ...clientToMetadata(client),
@@ -6505,7 +6679,8 @@ var updateRegisteredClient = async ({
       status: 403
     };
   }
-  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+  const requiresRedirect = metadata.grant_types === undefined || metadata.grant_types.includes("authorization_code");
+  if (requiresRedirect && (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0)) {
     return {
       body: { error: "invalid_redirect_uri" },
       status: 400
@@ -6879,6 +7054,7 @@ var oidcProviderRoutes = (config) => {
   }
   const discovery = {
     authorization_endpoint: `${issuer}${authorizeRoute}`,
+    authorization_response_iss_parameter_supported: true,
     backchannel_logout_session_supported: false,
     backchannel_logout_supported: true,
     code_challenge_methods_supported: ["S256"],
@@ -6892,7 +7068,6 @@ var oidcProviderRoutes = (config) => {
     request_object_signing_alg_values_supported: ["ES256"],
     request_parameter_supported: true,
     require_signed_request_object_supported: true,
-    authorization_response_iss_parameter_supported: true,
     response_modes_supported: ["query", "form_post"],
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
@@ -6971,7 +7146,7 @@ var oidcProviderRoutes = (config) => {
       url.searchParams.set("state", query.state);
     return redirectTo(url.toString());
   };
-  return new Elysia17().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia18().use(sessionStore()).get(authorizeRoute, async ({
     cookie: { user_session_id },
     query,
     request,
@@ -7466,6 +7641,7 @@ var oidcProviderRoutes = (config) => {
       clientStore,
       initialAccessTokenStore: config.initialAccessTokenStore,
       metadata: body,
+      onClientRegistered: config.onClientRegistered,
       onClientRegistration: config.onClientRegistration,
       presentedInitialAccessToken: presented,
       registrationBaseUrl,
@@ -7476,6 +7652,7 @@ var oidcProviderRoutes = (config) => {
     body: t14.Object({
       backchannel_logout_uri: t14.Optional(t14.String()),
       client_name: t14.Optional(t14.String()),
+      grant_types: t14.Optional(t14.Array(t14.String())),
       jwks: t14.Optional(t14.Any()),
       jwks_uri: t14.Optional(t14.String()),
       post_logout_redirect_uris: t14.Optional(t14.Array(t14.String())),
@@ -7518,6 +7695,7 @@ var oidcProviderRoutes = (config) => {
     body: t14.Object({
       backchannel_logout_uri: t14.Optional(t14.String()),
       client_name: t14.Optional(t14.String()),
+      grant_types: t14.Optional(t14.Array(t14.String())),
       jwks: t14.Optional(t14.Any()),
       jwks_uri: t14.Optional(t14.String()),
       post_logout_redirect_uris: t14.Optional(t14.Array(t14.String())),
@@ -7588,7 +7766,7 @@ var oidcProviderRoutes = (config) => {
 };
 
 // src/organizations/routes.ts
-import { Elysia as Elysia18, t as t15 } from "elysia";
+import { Elysia as Elysia19, t as t15 } from "elysia";
 
 // src/organizations/config.ts
 init_constants();
@@ -7720,7 +7898,7 @@ var organizationRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia18().use(sessionStore()).get(organizationsRoute, async ({
+  return new Elysia19().use(sessionStore()).get(organizationsRoute, async ({
     cookie: { user_session_id },
     status,
     store: { session }
@@ -7952,7 +8130,7 @@ var organizationRoutes = ({
 
 // src/passwordless/routes.ts
 init_crypto();
-import { Elysia as Elysia19, t as t16 } from "elysia";
+import { Elysia as Elysia20, t as t16 } from "elysia";
 
 // src/passwordless/config.ts
 init_constants();
@@ -8013,7 +8191,7 @@ var passwordlessRoutes = ({
     await onPasswordlessLogin?.({ user, userSessionId });
     return userSessionId;
   };
-  const magicLink = onSendMagicLink ? new Elysia19().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, async ({ body: { email }, status }) => {
+  const magicLink = onSendMagicLink ? new Elysia20().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const token = generateSecureToken();
     const expiresAt = Date.now() + magicLinkTokenDurationMs;
@@ -8043,8 +8221,8 @@ var passwordlessRoutes = ({
       return status("Unauthorized", "No account for this email");
     }
     return status("OK", { status: "authenticated" });
-  }, { body: t16.Object({ token: t16.String() }), cookie }) : new Elysia19;
-  const otp = onSendOtp ? new Elysia19().use(sessionStore()).post(`${passwordlessRoute}/otp`, async ({ body: { email }, status }) => {
+  }, { body: t16.Object({ token: t16.String() }), cookie }) : new Elysia20;
+  const otp = onSendOtp ? new Elysia20().use(sessionStore()).post(`${passwordlessRoute}/otp`, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const code = generateOtpCode(otpLength);
     const expiresAt = Date.now() + otpDurationMs;
@@ -8081,12 +8259,12 @@ var passwordlessRoutes = ({
       email: t16.String()
     }),
     cookie
-  }) : new Elysia19;
-  return new Elysia19().use(magicLink).use(otp);
+  }) : new Elysia20;
+  return new Elysia20().use(magicLink).use(otp);
 };
 
 // src/portal/routes.ts
-import { Elysia as Elysia20, t as t17 } from "elysia";
+import { Elysia as Elysia21, t as t17 } from "elysia";
 
 // src/scim/config.ts
 init_crypto();
@@ -8181,7 +8359,7 @@ var portalRoutes = ({
 }) => {
   const loadSession = (authorization) => resolveSetupSession({ authorization, setupSessionStore });
   const oidcRedirectUri = (origin, organizationId) => `${origin}${ssoRoute}/oidc/${organizationId}/callback`;
-  return new Elysia20().get(`${portalRoute}/session`, async ({ headers, request, status }) => {
+  return new Elysia21().get(`${portalRoute}/session`, async ({ headers, request, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
       return status("Unauthorized", "Invalid or expired setup link");
@@ -8328,7 +8506,7 @@ var portalRoutes = ({
 };
 
 // src/roles/routes.ts
-import { Elysia as Elysia21, t as t18 } from "elysia";
+import { Elysia as Elysia22, t as t18 } from "elysia";
 
 // src/roles/config.ts
 var DEFAULT_ROLES_ROUTE = "/auth/roles";
@@ -8379,7 +8557,7 @@ var roleRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia21().use(sessionStore()).get(`${rolesRoute}/:organizationId`, async ({
+  return new Elysia22().use(sessionStore()).get(`${rolesRoute}/:organizationId`, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -8602,7 +8780,7 @@ var resolveProviderClientConfiguration = ({
 
 // src/routes/authorize.ts
 init_constants();
-import { Elysia as Elysia22, t as t19 } from "elysia";
+import { Elysia as Elysia23, t as t19 } from "elysia";
 var parseReferer = (headerReferer) => {
   if (!headerReferer)
     return "/";
@@ -8624,7 +8802,7 @@ var authorize = ({
   onAuthorizeError
 }) => {
   const secure = resolveCookieSecure(cookieSecure);
-  return new Elysia22().get(authorizeRoute, async ({
+  return new Elysia23().get(authorizeRoute, async ({
     status,
     redirect,
     cookie: {
@@ -8757,7 +8935,7 @@ var authorize = ({
 };
 
 // src/routes/callback.ts
-import { Elysia as Elysia23, t as t20 } from "elysia";
+import { Elysia as Elysia24, t as t20 } from "elysia";
 
 // src/errors.ts
 class AuthIdentityConflictError extends Error {
@@ -8780,7 +8958,7 @@ var callback = ({
   onLinkIdentityConflict,
   onLinkConnector,
   onCallbackError
-}) => new Elysia23().use(sessionStore()).get(callbackRoute, async ({
+}) => new Elysia24().use(sessionStore()).get(callbackRoute, async ({
   status,
   redirect,
   store: { session, unregisteredSession },
@@ -8927,13 +9105,13 @@ var callback = ({
 });
 
 // src/routes/profile.ts
-import { Elysia as Elysia24, t as t21 } from "elysia";
+import { Elysia as Elysia25, t as t21 } from "elysia";
 var profile = ({
   clientProviders,
   profileRoute = "/oauth2/profile",
   onProfileSuccess,
   onProfileError
-}) => new Elysia24().use(sessionStore()).get(profileRoute, async ({
+}) => new Elysia25().use(sessionStore()).get(profileRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -8992,7 +9170,7 @@ var profile = ({
 
 // src/routes/refresh.ts
 init_constants();
-import { Elysia as Elysia25, t as t22 } from "elysia";
+import { Elysia as Elysia26, t as t22 } from "elysia";
 var refresh = ({
   authSessionStore,
   clientProviders,
@@ -9000,7 +9178,7 @@ var refresh = ({
   onRefreshSuccess,
   onRefreshError,
   sessionDurationMs = MILLISECONDS_IN_A_DAY
-}) => new Elysia25().use(sessionStore()).post(refreshRoute, async ({
+}) => new Elysia26().use(sessionStore()).post(refreshRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -9077,14 +9255,14 @@ var refresh = ({
 });
 
 // src/routes/revoke.ts
-import { Elysia as Elysia26, t as t23 } from "elysia";
+import { Elysia as Elysia27, t as t23 } from "elysia";
 var revoke = ({
   authSessionStore,
   clientProviders,
   revokeRoute = "/oauth2/revocation",
   onRevocationSuccess,
   onRevocationError
-}) => new Elysia26().use(sessionStore()).post(revokeRoute, async ({
+}) => new Elysia27().use(sessionStore()).post(revokeRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -9157,12 +9335,12 @@ var revoke = ({
 });
 
 // src/routes/sessions.ts
-import { Elysia as Elysia27, t as t24 } from "elysia";
+import { Elysia as Elysia28, t as t24 } from "elysia";
 var sessionRoutes = ({
   authSessionStore,
   getUserId,
   sessionsRoute = "/auth/sessions"
-}) => new Elysia27().use(sessionStore()).get(sessionsRoute, async ({
+}) => new Elysia28().use(sessionStore()).get(sessionsRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -9222,10 +9400,10 @@ var sessionRoutes = ({
 });
 
 // src/routes/stepUp.ts
-import { Elysia as Elysia28, t as t25 } from "elysia";
+import { Elysia as Elysia29, t as t25 } from "elysia";
 var stepUpPlugin = ({
   authSessionStore
-} = {}) => new Elysia28().use(sessionStore()).guard({ cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+} = {}) => new Elysia29().use(sessionStore()).guard({ cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
     authSessionStore,
     session,
@@ -9244,7 +9422,7 @@ var stepUpPlugin = ({
 })).as("global");
 
 // src/routes/signout.ts
-import { Elysia as Elysia29, t as t26 } from "elysia";
+import { Elysia as Elysia30, t as t26 } from "elysia";
 var sessionForSignOut = ({
   authSessionStore,
   currentSession,
@@ -9274,7 +9452,7 @@ var signout = ({
   authSessionStore,
   signoutRoute = "/oauth2/signout",
   onSignOut
-}) => new Elysia29().use(sessionStore()).delete(signoutRoute, async ({
+}) => new Elysia30().use(sessionStore()).delete(signoutRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider }
@@ -9321,12 +9499,12 @@ var signout = ({
 });
 
 // src/routes/userStatus.ts
-import { Elysia as Elysia30, t as t27 } from "elysia";
+import { Elysia as Elysia31, t as t27 } from "elysia";
 var userStatus = ({
   authSessionStore,
   statusRoute = "/oauth2/status",
   onStatus
-}) => new Elysia30().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
+}) => new Elysia31().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
   const { user, impersonator, error } = await getStatusFromSource({
     authSessionStore,
     session,
@@ -9344,7 +9522,7 @@ var userStatus = ({
 }, { cookie: t27.Cookie({ user_session_id: userSessionIdTypebox }) });
 
 // src/scim/routes.ts
-import { Elysia as Elysia31, t as t28 } from "elysia";
+import { Elysia as Elysia32, t as t28 } from "elysia";
 
 // src/scim/serialize.ts
 var USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -9817,7 +9995,7 @@ var scimRoutes = ({
   const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
   const usersEndpoint = `${scimRoute}/Users`;
   const groupsEndpoint = `${scimRoute}/Groups`;
-  return new Elysia31().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
+  return new Elysia32().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -10009,7 +10187,7 @@ var scimRoutes = ({
 
 // src/session/cleanup.ts
 init_constants();
-import { Elysia as Elysia32 } from "elysia";
+import { Elysia as Elysia33 } from "elysia";
 var sessionCleanup = ({
   authSessionStore,
   cleanupIntervalMs = MILLISECONDS_IN_AN_HOUR,
@@ -10017,7 +10195,7 @@ var sessionCleanup = ({
   onSessionCleanup
 }) => {
   let intervalId = null;
-  return new Elysia32({ name: "sessionCleanup" }).use(sessionStore()).onStart(({ store: { session, unregisteredSession } }) => {
+  return new Elysia33({ name: "sessionCleanup" }).use(sessionStore()).onStart(({ store: { session, unregisteredSession } }) => {
     intervalId = setInterval(async () => {
       await performCleanup({
         authSessionStore,
@@ -10245,7 +10423,7 @@ var performCleanup = async ({
 };
 
 // src/sso/discoveryRoute.ts
-import { Elysia as Elysia33, t as t29 } from "elysia";
+import { Elysia as Elysia34, t as t29 } from "elysia";
 var emailDomain = (email) => {
   const atIndex = email.lastIndexOf("@");
   if (atIndex === -1)
@@ -10258,7 +10436,7 @@ var ssoDiscoveryRoute = ({
   ssoRoute = DEFAULT_SSO_ROUTE
 }) => {
   const discoveryRoute = `${ssoRoute}/authorize`;
-  return new Elysia33().get(discoveryRoute, async ({ query: { email }, redirect, status }) => {
+  return new Elysia34().get(discoveryRoute, async ({ query: { email }, redirect, status }) => {
     if (!isNonEmptyString(email)) {
       return status("Bad Request", 'An "email" query parameter is required');
     }
@@ -10280,7 +10458,7 @@ var ssoDiscoveryRoute = ({
 
 // src/sso/oidcRoutes.ts
 init_constants();
-import { Elysia as Elysia34, t as t30 } from "elysia";
+import { Elysia as Elysia35, t as t30 } from "elysia";
 var makeSsoCookieOptions = (secure) => ({
   httpOnly: true,
   maxAge: COOKIE_DURATION,
@@ -10319,7 +10497,7 @@ var oidcSsoRoutes = ({
   const ssoCookieOptions = makeSsoCookieOptions(resolveCookieSecure(cookieSecure));
   const authorizeRoute = `${ssoRoute}/oidc/:organizationId/authorize`;
   const callbackRoute = `${ssoRoute}/oidc/:organizationId/callback`;
-  return new Elysia34().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia35().use(sessionStore()).get(authorizeRoute, async ({
     cookie: {
       sso_nonce,
       sso_organization,
@@ -10445,7 +10623,7 @@ var oidcSsoRoutes = ({
 };
 
 // src/sso/samlRoutes.ts
-import { Elysia as Elysia35, t as t31 } from "elysia";
+import { Elysia as Elysia36, t as t31 } from "elysia";
 var toLocalPath = (value) => {
   if (value === undefined || value.length === 0)
     return "/";
@@ -10495,7 +10673,7 @@ var samlSsoRoutes = ({
     const target = authSessionStore ? compatibilityLayer.session : inMemorySession;
     return target[userSessionId]?.samlLogout;
   };
-  return new Elysia35().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia36().use(sessionStore()).get(authorizeRoute, async ({
     headers,
     params: { organizationId },
     redirect,
@@ -10717,7 +10895,7 @@ var samlSsoRoutes = ({
 
 // src/webauthn/routes.ts
 init_constants();
-import { Elysia as Elysia36, t as t32 } from "elysia";
+import { Elysia as Elysia37, t as t32 } from "elysia";
 
 // src/webauthn/config.ts
 init_constants();
@@ -10759,7 +10937,7 @@ var webauthnRoutes = ({
     secure,
     value: challenge
   });
-  return new Elysia36().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
+  return new Elysia37().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
     cookie: { user_session_id, webauthn_challenge },
     status,
     store: { session }
@@ -24090,7 +24268,7 @@ var createInMemoryCredentialOfferStore = () => {
   };
 };
 // src/oidc/vciRoutes.ts
-import { Elysia as Elysia37, t as t33 } from "elysia";
+import { Elysia as Elysia38, t as t33 } from "elysia";
 var HTTP_OK3 = 200;
 var HTTP_BAD_REQUEST3 = 400;
 var HTTP_UNAUTHORIZED3 = 401;
@@ -24115,7 +24293,7 @@ var vciRoutes = ({
   const credentialRoute = `${vciRoute}/credential`;
   const nonceRoute = `${vciRoute}/nonce`;
   const vciSigningKey = vciConfig.signingKey ?? signingKey;
-  return new Elysia37().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
+  return new Elysia38().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
@@ -24264,7 +24442,7 @@ var verifyStatusListJwt = async ({
   };
 };
 // src/vc/statusListRoutes.ts
-import { Elysia as Elysia38, t as t34 } from "elysia";
+import { Elysia as Elysia39, t as t34 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
@@ -24276,7 +24454,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia38().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia39().get(listRoute, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -24497,7 +24675,7 @@ var createInMemoryPresentationRequestStore = () => {
   };
 };
 // src/vc/vpRoutes.ts
-import { Elysia as Elysia39, t as t35 } from "elysia";
+import { Elysia as Elysia40, t as t35 } from "elysia";
 var HTTP_OK5 = 200;
 var HTTP_BAD_REQUEST4 = 400;
 var HTTP_NOT_FOUND2 = 404;
@@ -24516,7 +24694,7 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia39().post(authorizeRoute, async ({ body }) => {
+  return new Elysia40().post(authorizeRoute, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -24780,6 +24958,220 @@ var createPostgresScimTokenStore = (db) => ({
     });
   }
 });
+// src/agents/oidcAdapter.ts
+var BEARER_PREFIX6 = "Bearer ";
+var MS_PER_SECOND7 = 1000;
+var readAudience = (audience) => {
+  if (typeof audience === "string")
+    return [audience];
+  if (Array.isArray(audience) && audience.every((entry) => typeof entry === "string")) {
+    return audience;
+  }
+  return [];
+};
+var createOidcAgentCredentialVerifier = ({
+  issuer,
+  publicJwk,
+  resource
+}) => {
+  const verifier = async (request) => {
+    const authorization = request.headers.get("authorization");
+    if (authorization === null || !authorization.startsWith(BEARER_PREFIX6)) {
+      return;
+    }
+    const token = authorization.slice(BEARER_PREFIX6.length).trim();
+    if (token.length === 0)
+      return;
+    const verified = await verifyJwt(token, publicJwk);
+    const payload = verified?.payload;
+    if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND7) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
+      return;
+    }
+    return {
+      agentId: payload.client_id,
+      claims: payload,
+      expiresAt: payload.exp * MS_PER_SECOND7,
+      organizationId: typeof payload.organization_id === "string" ? payload.organization_id : undefined,
+      resource,
+      scopes: typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [],
+      userId: typeof payload.sub === "string" ? payload.sub : undefined
+    };
+  };
+  return verifier;
+};
+// src/agents/inMemoryStores.ts
+var cloneRegistration = (value) => ({
+  ...value,
+  allowedScopes: [...value.allowedScopes],
+  metadata: value.metadata === undefined ? undefined : { ...value.metadata }
+});
+var cloneDelegation = (value) => ({
+  ...value,
+  authorizationDetails: value.authorizationDetails?.map((entry) => ({
+    ...entry
+  })),
+  scopes: [...value.scopes]
+});
+var createInMemoryAgentDelegationStore = () => {
+  const delegations = new Map;
+  return {
+    findActiveDelegation: async ({
+      agentId,
+      now = Date.now(),
+      organizationId,
+      userId
+    }) => {
+      const value = [...delegations.values()].find((delegation) => delegation.agentId === agentId && delegation.userId === userId && delegation.organizationId === organizationId && delegation.status === "active" && (delegation.expiresAt === undefined || delegation.expiresAt > now));
+      return value === undefined ? undefined : cloneDelegation(value);
+    },
+    findByDelegationId: async (delegationId) => {
+      const value = delegations.get(delegationId);
+      return value === undefined ? undefined : cloneDelegation(value);
+    },
+    listDelegations: async (agentId) => [...delegations.values()].filter((delegation) => agentId === undefined || delegation.agentId === agentId).sort((left, right) => right.createdAt - left.createdAt).map(cloneDelegation),
+    saveDelegation: async (delegation) => {
+      delegations.set(delegation.delegationId, cloneDelegation(delegation));
+    }
+  };
+};
+var createInMemoryAgentRegistrationStore = () => {
+  const registrations = new Map;
+  return {
+    findByAgentId: async (agentId) => {
+      const value = registrations.get(agentId);
+      return value === undefined ? undefined : cloneRegistration(value);
+    },
+    findByClientId: async (clientId) => {
+      const value = [...registrations.values()].find((registration) => registration.clientId === clientId);
+      return value === undefined ? undefined : cloneRegistration(value);
+    },
+    listRegistrations: async () => [...registrations.values()].sort((left, right) => right.createdAt - left.createdAt).map(cloneRegistration),
+    saveRegistration: async (registration) => {
+      registrations.set(registration.agentId, cloneRegistration(registration));
+    }
+  };
+};
+// src/agents/postgresStores.ts
+var ID_LENGTH7 = 255;
+var NAME_LENGTH = 255;
+var STATUS_LENGTH2 = 16;
+var agentDelegationsTable = pgTable("auth_agent_delegations", {
+  agent_id: varchar("agent_id", { length: ID_LENGTH7 }).notNull(),
+  authorization_details: jsonb("authorization_details").$type(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  delegation_id: varchar("delegation_id", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }),
+  organization_id: varchar("organization_id", { length: ID_LENGTH7 }),
+  scopes: jsonb("scopes").$type().notNull().default([]),
+  status: varchar("status", { length: STATUS_LENGTH2 }).$type().notNull(),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
+  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+});
+var agentRegistrationsTable = pgTable("auth_agent_registrations", {
+  agent_id: varchar("agent_id", { length: ID_LENGTH7 }).primaryKey(),
+  allowed_scopes: jsonb("allowed_scopes").$type().notNull().default([]),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).unique(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  metadata: jsonb("metadata").$type(),
+  name: varchar("name", { length: NAME_LENGTH }).notNull(),
+  status: varchar("status", { length: STATUS_LENGTH2 }).$type().notNull(),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
+});
+var toRegistration = (row) => ({
+  agentId: row.agent_id,
+  allowedScopes: row.allowed_scopes,
+  clientId: row.client_id ?? undefined,
+  createdAt: row.created_at_ms,
+  metadata: row.metadata ?? undefined,
+  name: row.name,
+  status: row.status,
+  updatedAt: row.updated_at_ms
+});
+var toDelegation = (row) => ({
+  agentId: row.agent_id,
+  authorizationDetails: row.authorization_details ?? undefined,
+  createdAt: row.created_at_ms,
+  delegationId: row.delegation_id,
+  expiresAt: row.expires_at_ms ?? undefined,
+  organizationId: row.organization_id ?? undefined,
+  scopes: row.scopes,
+  status: row.status,
+  updatedAt: row.updated_at_ms,
+  userId: row.user_id
+});
+var createNeonAgentDelegationStore = (databaseUrl) => createPostgresAgentDelegationStore(createNeonDatabase(databaseUrl));
+var createNeonAgentRegistrationStore = (databaseUrl) => createPostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));
+var createPostgresAgentDelegationStore = (db) => ({
+  findActiveDelegation: async ({
+    agentId,
+    now = Date.now(),
+    organizationId,
+    userId
+  }) => {
+    const organizationCondition = organizationId === undefined ? isNull(agentDelegationsTable.organization_id) : eq(agentDelegationsTable.organization_id, organizationId);
+    const [row] = await db.select().from(agentDelegationsTable).where(and(eq(agentDelegationsTable.agent_id, agentId), eq(agentDelegationsTable.user_id, userId), organizationCondition, eq(agentDelegationsTable.status, "active"), or(isNull(agentDelegationsTable.expires_at_ms), gt(agentDelegationsTable.expires_at_ms, now)))).orderBy(desc(agentDelegationsTable.updated_at_ms)).limit(1);
+    return row === undefined ? undefined : toDelegation(row);
+  },
+  findByDelegationId: async (delegationId) => {
+    const [row] = await db.select().from(agentDelegationsTable).where(eq(agentDelegationsTable.delegation_id, delegationId)).limit(1);
+    return row === undefined ? undefined : toDelegation(row);
+  },
+  listDelegations: async (agentId) => {
+    const base = db.select().from(agentDelegationsTable);
+    const rows = await (agentId === undefined ? base.orderBy(desc(agentDelegationsTable.created_at_ms)) : base.where(eq(agentDelegationsTable.agent_id, agentId)).orderBy(desc(agentDelegationsTable.created_at_ms)));
+    return rows.map(toDelegation);
+  },
+  saveDelegation: async (delegation) => {
+    const values = {
+      agent_id: delegation.agentId,
+      authorization_details: delegation.authorizationDetails ?? null,
+      created_at_ms: delegation.createdAt,
+      delegation_id: delegation.delegationId,
+      expires_at_ms: delegation.expiresAt ?? null,
+      organization_id: delegation.organizationId ?? null,
+      scopes: delegation.scopes,
+      status: delegation.status,
+      updated_at_ms: delegation.updatedAt,
+      user_id: delegation.userId
+    };
+    await db.insert(agentDelegationsTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: agentDelegationsTable.delegation_id
+    });
+  }
+});
+var createPostgresAgentRegistrationStore = (db) => ({
+  findByAgentId: async (agentId) => {
+    const [row] = await db.select().from(agentRegistrationsTable).where(eq(agentRegistrationsTable.agent_id, agentId)).limit(1);
+    return row === undefined ? undefined : toRegistration(row);
+  },
+  findByClientId: async (clientId) => {
+    const [row] = await db.select().from(agentRegistrationsTable).where(eq(agentRegistrationsTable.client_id, clientId)).limit(1);
+    return row === undefined ? undefined : toRegistration(row);
+  },
+  listRegistrations: async () => {
+    const rows = await db.select().from(agentRegistrationsTable).orderBy(desc(agentRegistrationsTable.created_at_ms));
+    return rows.map(toRegistration);
+  },
+  saveRegistration: async (registration) => {
+    const values = {
+      agent_id: registration.agentId,
+      allowed_scopes: registration.allowedScopes,
+      client_id: registration.clientId ?? null,
+      created_at_ms: registration.createdAt,
+      metadata: registration.metadata ?? null,
+      name: registration.name,
+      status: registration.status,
+      updated_at_ms: registration.updatedAt
+    };
+    await db.insert(agentRegistrationsTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: agentRegistrationsTable.agent_id
+    });
+  }
+});
 // src/apikeys/inMemoryStores.ts
 var createInMemoryAccessTokenStore = () => {
   const tokens = new Map;
@@ -24832,33 +25224,33 @@ var createInMemoryApiKeyStore = () => {
   };
 };
 // src/apikeys/postgresStores.ts
-var ID_LENGTH7 = 255;
+var ID_LENGTH8 = 255;
 var accessTokensTable = pgTable("auth_access_tokens", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  hashed_token: varchar("hashed_token", { length: ID_LENGTH7 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
+  hashed_token: varchar("hashed_token", { length: ID_LENGTH8 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH8 }),
   scopes: text("scopes").array().notNull(),
-  token_id: varchar("token_id", { length: ID_LENGTH7 }).primaryKey()
+  token_id: varchar("token_id", { length: ID_LENGTH8 }).primaryKey()
 });
 var apiClientsTable = pgTable("auth_api_clients", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }).notNull(),
-  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
+  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH8 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH8 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH8 }),
   scopes: text("scopes").array().notNull()
 });
 var apiKeysTable = pgTable("auth_api_keys", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }),
-  hashed_key: varchar("hashed_key", { length: ID_LENGTH7 }).notNull(),
-  key_id: varchar("key_id", { length: ID_LENGTH7 }).primaryKey(),
+  hashed_key: varchar("hashed_key", { length: ID_LENGTH8 }).notNull(),
+  key_id: varchar("key_id", { length: ID_LENGTH8 }).primaryKey(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
-  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
-  prefix: varchar("prefix", { length: ID_LENGTH7 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH8 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH8 }),
+  prefix: varchar("prefix", { length: ID_LENGTH8 }).notNull(),
   scopes: text("scopes").array().notNull()
 });
 var toKey = (row) => ({
@@ -25171,11 +25563,11 @@ var createInMemoryPushedAuthorizationRequestStore = () => {
 // src/oidc/postgresStores.ts
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
-var ID_LENGTH8 = 255;
+var ID_LENGTH9 = 255;
 var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_requests", {
-  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH8 }).primaryKey(),
+  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH9 }).primaryKey(),
   binding_message: text("binding_message"),
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   interval_seconds: bigint("interval_seconds", {
@@ -25184,30 +25576,30 @@ var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_req
   last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
-  user_sub: varchar("user_sub", { length: ID_LENGTH8 })
+  user_sub: varchar("user_sub", { length: ID_LENGTH9 })
 });
 var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   composite_key: varchar("composite_key", {
-    length: ID_LENGTH8
+    length: ID_LENGTH9
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  jti: varchar("jti", { length: ID_LENGTH8 }).notNull()
+  jti: varchar("jti", { length: ID_LENGTH9 }).notNull()
 });
 var oauthClientRegistrationTokensTable = pgTable("auth_oauth_client_registration_tokens", {
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH9 }).primaryKey()
 });
 var oauthClientsTable = pgTable("auth_oauth_clients", {
   backchannel_logout_uri: varchar("backchannel_logout_uri", {
     length: URL_LENGTH
   }),
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).primaryKey(),
-  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH8 }),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).primaryKey(),
+  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH9 }),
   jwks_json: jsonb("jwks_json").$type(),
   jwks_uri: varchar("jwks_uri", { length: URL_LENGTH }),
-  name: varchar("name", { length: ID_LENGTH8 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH9 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
   require_pushed_authorization_requests: boolean("require_pushed_authorization_requests"),
@@ -25215,24 +25607,24 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
-  acr: varchar("acr", { length: ID_LENGTH8 }),
+  acr: varchar("acr", { length: ID_LENGTH9 }),
   claims_json: jsonb("claims_json").$type(),
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
-  code_challenge: varchar("code_challenge", { length: ID_LENGTH8 }).notNull(),
-  code_hash: varchar("code_hash", { length: ID_LENGTH8 }).primaryKey(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
+  code_challenge: varchar("code_challenge", { length: ID_LENGTH9 }).notNull(),
+  code_hash: varchar("code_hash", { length: ID_LENGTH9 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH8 }),
+  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH9 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  nonce: varchar("nonce", { length: ID_LENGTH8 }),
-  redirect_uri: varchar("redirect_uri", { length: ID_LENGTH8 }).notNull(),
+  nonce: varchar("nonce", { length: ID_LENGTH9 }),
+  redirect_uri: varchar("redirect_uri", { length: ID_LENGTH9 }).notNull(),
   scopes: text("scopes").array().notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 });
 var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations", {
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   device_code_hash: varchar("device_code_hash", {
-    length: ID_LENGTH8
+    length: ID_LENGTH9
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   interval_seconds: bigint("interval_seconds", {
@@ -25241,41 +25633,41 @@ var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations",
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
-  user_sub: varchar("user_sub", { length: ID_LENGTH8 })
+  user_sub: varchar("user_sub", { length: ID_LENGTH9 })
 });
 var oauthInitialAccessTokensTable = pgTable("auth_oauth_initial_access_tokens", {
-  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH9 }).primaryKey()
 });
 var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   endpoint_url: varchar("endpoint_url", { length: URL_LENGTH }).notNull(),
-  id: varchar("id", { length: ID_LENGTH8 }).primaryKey(),
+  id: varchar("id", { length: ID_LENGTH9 }).primaryKey(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" }),
   logout_token: text("logout_token").notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 });
 var oauthPushedAuthorizationRequestsTable = pgTable("auth_oauth_pushed_authorization_requests", {
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   params_json: jsonb("params_json").$type().notNull(),
   request_uri_hash: varchar("request_uri_hash", {
-    length: ID_LENGTH8
+    length: ID_LENGTH9
   }).primaryKey()
 });
 var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
-  acr: varchar("acr", { length: ID_LENGTH8 }),
+  acr: varchar("acr", { length: ID_LENGTH9 }),
   claims_json: jsonb("claims_json").$type(),
-  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH8 }),
+  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH9 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   scopes: text("scopes").array().notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey(),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  token_hash: varchar("token_hash", { length: ID_LENGTH9 }).primaryKey(),
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 });
 var toClient2 = (row) => ({
   backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
@@ -25800,29 +26192,29 @@ var createInMemoryLoginHistoryStore = () => {
   };
 };
 // src/adaptive/postgresStores.ts
-var ID_LENGTH9 = 255;
+var ID_LENGTH10 = 255;
 var knownDevicesTable = pgTable("auth_known_devices", {
-  device_id: varchar("device_id", { length: ID_LENGTH9 }).notNull(),
+  device_id: varchar("device_id", { length: ID_LENGTH10 }).notNull(),
   first_seen_at_ms: bigint("first_seen_at_ms", {
     mode: "number"
   }).notNull(),
-  label: varchar("label", { length: ID_LENGTH9 }),
+  label: varchar("label", { length: ID_LENGTH10 }),
   last_seen_at_ms: bigint("last_seen_at_ms", {
     mode: "number"
   }).notNull(),
   trusted: boolean("trusted").notNull().default(false),
-  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH10 }).notNull()
 }, (table) => [primaryKey({ columns: [table.user_id, table.device_id] })]);
 var loginHistoryTable = pgTable("auth_login_history", {
-  attempt_id: varchar("attempt_id", { length: ID_LENGTH9 }).primaryKey(),
-  country: varchar("country", { length: ID_LENGTH9 }),
-  device_id: varchar("device_id", { length: ID_LENGTH9 }).notNull(),
-  ip_address: varchar("ip_address", { length: ID_LENGTH9 }),
+  attempt_id: varchar("attempt_id", { length: ID_LENGTH10 }).primaryKey(),
+  country: varchar("country", { length: ID_LENGTH10 }),
+  device_id: varchar("device_id", { length: ID_LENGTH10 }).notNull(),
+  ip_address: varchar("ip_address", { length: ID_LENGTH10 }),
   latitude: doublePrecision("latitude"),
   longitude: doublePrecision("longitude"),
-  outcome: varchar("outcome", { length: ID_LENGTH9 }).notNull(),
+  outcome: varchar("outcome", { length: ID_LENGTH10 }).notNull(),
   timestamp_ms: bigint("timestamp_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH10 }).notNull()
 });
 var toRiskAction = (value) => {
   if (value === "deny")
@@ -26149,15 +26541,15 @@ var createRedisFgaCache = (redis, {
   }
 });
 // src/fga/postgresStores.ts
-var ID_LENGTH10 = 255;
+var ID_LENGTH11 = 255;
 var warrantsTable = pgTable("auth_fga_warrants", {
-  id: varchar("id", { length: ID_LENGTH10 }).primaryKey(),
-  relation: varchar("relation", { length: ID_LENGTH10 }).notNull(),
-  resource_id: varchar("resource_id", { length: ID_LENGTH10 }).notNull(),
-  resource_type: varchar("resource_type", { length: ID_LENGTH10 }).notNull(),
-  subject_id: varchar("subject_id", { length: ID_LENGTH10 }).notNull(),
-  subject_relation: varchar("subject_relation", { length: ID_LENGTH10 }),
-  subject_type: varchar("subject_type", { length: ID_LENGTH10 }).notNull()
+  id: varchar("id", { length: ID_LENGTH11 }).primaryKey(),
+  relation: varchar("relation", { length: ID_LENGTH11 }).notNull(),
+  resource_id: varchar("resource_id", { length: ID_LENGTH11 }).notNull(),
+  resource_type: varchar("resource_type", { length: ID_LENGTH11 }).notNull(),
+  subject_id: varchar("subject_id", { length: ID_LENGTH11 }).notNull(),
+  subject_relation: varchar("subject_relation", { length: ID_LENGTH11 }),
+  subject_type: varchar("subject_type", { length: ID_LENGTH11 }).notNull()
 });
 var toWarrant = (row) => ({
   relation: row.relation,
@@ -26194,41 +26586,41 @@ var createPostgresWarrantStore = (db) => ({
 });
 
 // src/organizations/postgresOrganizationStore.ts
-var ID_LENGTH11 = 255;
-var NAME_LENGTH = 255;
+var ID_LENGTH12 = 255;
+var NAME_LENGTH2 = 255;
 var STATE_LENGTH = 16;
 var organizationInvitationsTable = pgTable("auth_organization_invitations", {
   accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  email: varchar("email", { length: ID_LENGTH11 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH12 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   invitation_id: varchar("invitation_id", {
-    length: ID_LENGTH11
+    length: ID_LENGTH12
   }).primaryKey(),
-  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH11 }),
+  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH12 }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH11
+    length: ID_LENGTH12
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
-  token_hash: varchar("token_hash", { length: ID_LENGTH11 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).notNull().unique()
 });
 var organizationMembershipsTable = pgTable("auth_organization_memberships", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH11
+    length: ID_LENGTH12
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH11 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH12 }).notNull()
 }, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
 var organizationsTable = pgTable("auth_organizations", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   metadata: jsonb("metadata").$type(),
-  name: varchar("name", { length: NAME_LENGTH }).notNull(),
+  name: varchar("name", { length: NAME_LENGTH2 }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH11
+    length: ID_LENGTH12
   }).primaryKey(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -26350,11 +26742,11 @@ var createPostgresOrganizationStore = (db) => ({
 });
 
 // src/passwordless/postgresPasswordlessTokenStore.ts
-var ID_LENGTH12 = 255;
+var ID_LENGTH13 = 255;
 var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
-  email: varchar("email", { length: ID_LENGTH12 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH13 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).primaryKey()
 });
 var toToken3 = (row) => ({
   email: row.email,
@@ -26381,19 +26773,19 @@ var createPostgresPasswordlessTokenStore = (db) => ({
 });
 
 // src/portal/postgresSetupSessionStore.ts
-var ID_LENGTH13 = 255;
+var ID_LENGTH14 = 255;
 var setupSessionsTable = pgTable("auth_setup_sessions", {
   capabilities: jsonb("capabilities").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  created_by: varchar("created_by", { length: ID_LENGTH13 }),
+  created_by: varchar("created_by", { length: ID_LENGTH14 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH13
+    length: ID_LENGTH14
   }).notNull(),
   setup_session_id: varchar("setup_session_id", {
-    length: ID_LENGTH13
+    length: ID_LENGTH14
   }).primaryKey(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH14 }).notNull().unique()
 });
 var toSession = (row) => ({
   capabilities: row.capabilities,
@@ -26431,12 +26823,12 @@ var createPostgresSetupSessionStore = (db) => ({
 });
 
 // src/roles/postgresRoleStore.ts
-var ID_LENGTH14 = 255;
+var ID_LENGTH15 = 255;
 var SLUG_LENGTH = 128;
 var GLOBAL_SCOPE = "";
 var rolesTable = pgTable("auth_roles", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", { length: ID_LENGTH14 }).notNull().default(GLOBAL_SCOPE),
+  organization_id: varchar("organization_id", { length: ID_LENGTH15 }).notNull().default(GLOBAL_SCOPE),
   permissions: jsonb("permissions").$type().notNull().default([]),
   slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -26477,13 +26869,13 @@ var createPostgresRoleStore = (db) => ({
 });
 
 // src/sso/postgresSamlServiceProviderStore.ts
-var ID_LENGTH15 = 255;
+var ID_LENGTH16 = 255;
 var URL_LENGTH2 = 2048;
 var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
   acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
-  name_id_format: varchar("name_id_format", { length: ID_LENGTH15 }),
+  name_id_format: varchar("name_id_format", { length: ID_LENGTH16 }),
   signing_cert: text("signing_cert"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -26525,15 +26917,15 @@ var createPostgresSamlServiceProviderStore = (db) => ({
 });
 
 // src/sso/postgresSsoConnectionStore.ts
-var ID_LENGTH16 = 255;
+var ID_LENGTH17 = 255;
 var TYPE_LENGTH2 = 16;
 var ssoConnectionsTable = pgTable("auth_sso_connections", {
   config: jsonb("config").$type().notNull(),
-  connection_id: varchar("connection_id", { length: ID_LENGTH16 }).primaryKey(),
+  connection_id: varchar("connection_id", { length: ID_LENGTH17 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   enabled: boolean("enabled").notNull().default(true),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH16
+    length: ID_LENGTH17
   }).notNull(),
   type: varchar("type", { length: TYPE_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -26639,18 +27031,18 @@ var createPostgresSsoConnectionStore = (db) => ({
 });
 
 // src/webauthn/postgresWebAuthnCredentialStore.ts
-var ID_LENGTH17 = 255;
+var ID_LENGTH18 = 255;
 var DEVICE_TYPE_LENGTH = 32;
 var webauthnCredentialsTable = pgTable("auth_webauthn_credentials", {
   backed_up: boolean("backed_up"),
   counter: bigint("counter", { mode: "number" }).notNull().default(0),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  credential_id: varchar("credential_id", { length: ID_LENGTH17 }).primaryKey(),
+  credential_id: varchar("credential_id", { length: ID_LENGTH18 }).primaryKey(),
   device_type: varchar("device_type", { length: DEVICE_TYPE_LENGTH }),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   public_key: text("public_key").notNull(),
   transports: jsonb("transports").$type(),
-  user_id: varchar("user_id", { length: ID_LENGTH17 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH18 }).notNull()
 });
 var toCredential = (row) => ({
   backedUp: row.backed_up ?? undefined,
@@ -26697,14 +27089,14 @@ var createPostgresWebAuthnCredentialStore = (db) => ({
 });
 
 // src/webhooks/postgresStore.ts
-var ID_LENGTH18 = 255;
+var ID_LENGTH19 = 255;
 var URL_LENGTH3 = 2048;
 var DEFAULT_LIST_LIMIT3 = 100;
 var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
-  envelope_id: varchar("envelope_id", { length: ID_LENGTH18 }).primaryKey(),
+  envelope_id: varchar("envelope_id", { length: ID_LENGTH19 }).primaryKey(),
   envelope_json: jsonb("envelope_json").$type().notNull(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" })
@@ -26864,6 +27256,10 @@ var mfaTotpLockoutMigration = {
 };
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
+  agents: initMigration("agents", [
+    agentRegistrationsTable,
+    agentDelegationsTable
+  ]),
   apikeys: initMigration("apikeys", [
     accessTokensTable,
     apiClientsTable,
@@ -26925,7 +27321,7 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia40, t as t36 } from "elysia";
+import { Elysia as Elysia41, t as t36 } from "elysia";
 var HTTP_BAD_REQUEST5 = 400;
 var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_FOUND2 = 302;
@@ -27035,7 +27431,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia40().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+  return new Elysia41().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
     binding: "POST",
     body,
     inMemorySession: store.session,
@@ -27356,6 +27752,7 @@ var auth = async ({
   sso,
   scim,
   apikeys,
+  agentAuth,
   oidc,
   organizations,
   roles,
@@ -27397,6 +27794,59 @@ var auth = async ({
     }
   }) : undefined;
   const lockoutGuard = lockout ? createLockoutGuard(lockout) : undefined;
+  const oidcConfig = oidc ? {
+    ...oidc,
+    onClientRegistered: async (context) => {
+      await oidc.onClientRegistered?.(context);
+      if (agentAuth?.registerDynamicClients !== true)
+        return;
+      const now = Date.now();
+      await agentAuth.registrationStore.saveRegistration({
+        agentId: context.client.clientId,
+        allowedScopes: context.client.scopes.filter((scope) => agentAuth.scopes.includes(scope)),
+        clientId: context.client.clientId,
+        createdAt: now,
+        name: context.client.name,
+        status: "active",
+        updatedAt: now
+      });
+      await auditEmit?.({
+        at: now,
+        metadata: { agentId: context.client.clientId },
+        type: "agent_registered"
+      });
+    },
+    onDeviceAuthorizationApproved: async (context) => {
+      await oidc.onDeviceAuthorizationApproved?.(context);
+      if (agentAuth === undefined)
+        return;
+      const registration = await agentAuth.registrationStore.findByClientId(context.clientId);
+      if (registration === undefined || registration.status !== "active") {
+        return;
+      }
+      const now = Date.now();
+      const existing = await agentAuth.delegationStore.findActiveDelegation({
+        agentId: registration.agentId,
+        now,
+        userId: context.userSub
+      });
+      await agentAuth.delegationStore.saveDelegation({
+        agentId: registration.agentId,
+        createdAt: existing?.createdAt ?? now,
+        delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
+        scopes: context.scopes.filter((scope) => registration.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
+        status: "active",
+        updatedAt: now,
+        userId: context.userSub
+      });
+      await auditEmit?.({
+        at: now,
+        metadata: { agentId: registration.agentId },
+        type: "agent_delegated",
+        userId: context.userSub
+      });
+    }
+  } : undefined;
   const credentialsConfig = credentials ? {
     ...credentials,
     isMfaRequired: credentials.isMfaRequired ?? (mfa ? createMfaGate(mfa) : undefined)
@@ -27406,7 +27856,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  const composedAuth = new Elysia41().use(sessionCleanup({
+  const composedAuth = new Elysia42().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -27454,54 +27904,58 @@ var auth = async ({
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     lockoutGuard
-  }) : new Elysia41).use(auditedMfa ? mfaRoutes({
+  }) : new Elysia42).use(auditedMfa ? mfaRoutes({
     ...auditedMfa,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia41).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia42).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia41).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia41).use(sso ? oidcSsoRoutes({
+  }) : new Elysia42).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia42).use(sso ? oidcSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia41).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia42).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     samlAdapter: sso.samlAdapter
-  }) : new Elysia41).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+  }) : new Elysia42).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
     ssoConnectionStore: sso.ssoConnectionStore,
     ssoRoute: sso.ssoRoute
-  }) : new Elysia41).use(scim ? scimRoutes(scim) : new Elysia41).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia41).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia41).use(organizations ? organizationRoutes({
+  }) : new Elysia42).use(scim ? scimRoutes(scim) : new Elysia42).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia42).use(oidcConfig ? oidcProviderRoutes({
+    ...oidcConfig,
+    authSessionStore
+  }) : new Elysia42).use(organizations ? organizationRoutes({
     ...organizations,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia41).use(roles ? roleRoutes({
+  }) : new Elysia42).use(roles ? roleRoutes({
     ...roles,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia41).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia41).use(webauthn ? webauthnRoutes({
+  }) : new Elysia42).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia42).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia41).use(compliance ? complianceRoutes({
+  }) : new Elysia42).use(compliance ? complianceRoutes({
     ...compliance,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia41).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
+  }) : new Elysia42).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
     ...authorization,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia41).use(htmx ? createAuthHtmxRoutes({
+  }) : new Elysia42).use(htmx ? createAuthHtmxRoutes({
     ...htmx,
     authSessionStore
-  }) : new Elysia41);
-  return composedAuth;
+  }) : new Elysia42);
+  const authWithAgent = composedAuth.use(agentAuthPlugin(agentAuth));
+  return authWithAgent;
 };
 export {
   writeWarrant,
@@ -27590,6 +28044,7 @@ export {
   resolveClientCert,
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
+  resolveAgentPrincipal,
   removeFromSessionRing,
   rehashCredentialPassword,
   registerClient,
@@ -27780,8 +28235,11 @@ export {
   createPostgresAuditSink,
   createPostgresApiKeyStore,
   createPostgresApiClientStore,
+  createPostgresAgentRegistrationStore,
+  createPostgresAgentDelegationStore,
   createPostgresAccessTokenStore,
   createOrganization,
+  createOidcAgentCredentialVerifier,
   createOAuthLinkedProviderCredentialResolver,
   createNeonWebhookDeliveryStore,
   createNeonWebAuthnCredentialStore,
@@ -27819,6 +28277,8 @@ export {
   createNeonAuditSink,
   createNeonApiKeyStore,
   createNeonApiClientStore,
+  createNeonAgentRegistrationStore,
+  createNeonAgentDelegationStore,
   createNeonAccessTokenStore,
   createMfaGate,
   createMembershipPermissionResolver,
@@ -27859,6 +28319,8 @@ export {
   createInMemoryAuditSink,
   createInMemoryApiKeyStore,
   createInMemoryApiClientStore,
+  createInMemoryAgentRegistrationStore,
+  createInMemoryAgentDelegationStore,
   createInMemoryAccessTokenStore,
   createFgaEngine,
   createFederatedTokenStore,
@@ -27897,6 +28359,12 @@ export {
   apiKeysTable,
   apiKeysRoutes,
   apiClientsTable,
+  agentRegistrationsTable,
+  agentProtectedResourceMetadata,
+  agentHasScopes,
+  agentDelegationsTable,
+  agentAuthPlugin,
+  agentAuthChallenge,
   addToSessionRing,
   accessTokensTable,
   acceptInvitation,
@@ -27940,10 +28408,11 @@ export {
   DEFAULT_INVITATION_TTL_MS,
   DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   DEFAULT_BACKUP_CODE_COUNT,
+  DEFAULT_AGENT_RESOURCE_METADATA_ROUTE,
   CLIENT_ASSERTION_TYPE,
   CIBA_GRANT_TYPE,
   AuthIdentityConflictError
 };
 
-//# debugId=3641271C853CFF2564756E2164756E21
+//# debugId=5F5850B4C390793864756E2164756E21
 //# sourceMappingURL=index.js.map