@absolutejs/auth 0.54.5 → 0.54.7

package/dist/migrations/index.d.ts

@@ -1,5 +1,5 @@
 import type { BlockMigrations } from './types';
-export type BlockName = 'adaptive' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'vc' | 'webauthn' | 'webhooks';
+export type BlockName = 'adaptive' | 'agents' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'vc' | 'webauthn' | 'webhooks';
 export declare const blockMigrations: Record<BlockName, BlockMigrations>;
 export { runMigrations } from './runner';
 export type { Migration, BlockMigrations } from './types';

package/dist/oidc/config.d.ts

@@ -1,6 +1,6 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
-import type { OnClientRegistration } from './registration';
+import type { OnClientRegistered, OnClientRegistration } from './registration';
 import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
@@ -73,6 +73,14 @@ export type OidcProviderConfig<UserType> = {
     logoutDeliveryStore?: LogoutDeliveryStore;
     oidcRoute?: RouteString;
     onClientRegistration?: OnClientRegistration;
+    /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
+    onClientRegistered?: OnClientRegistered;
+    /** Fires after the authenticated user approves an RFC 8628 device request. */
+    onDeviceAuthorizationApproved?: (context: {
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => void | Promise<void>;
     pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
     pushedAuthorizationRequestTtlMs?: number;
     refreshTokenStore: OidcRefreshTokenStore;

package/dist/oidc/registration.d.ts

@@ -2,6 +2,7 @@ import type { ClientRegistrationTokenStore, InitialAccessTokenStore, OAuthClient
 export type ClientRegistrationMetadata = {
     backchannel_logout_uri?: string;
     client_name?: string;
+    grant_types?: string[];
     jwks?: JsonWebKey[];
     jwks_uri?: string;
     post_logout_redirect_uris?: string[];
@@ -18,6 +19,10 @@ export type ClientRegistrationDecision = {
 export type OnClientRegistration = (context: {
     metadata: ClientRegistrationMetadata;
 }) => ClientRegistrationDecision | Promise<ClientRegistrationDecision>;
+export type OnClientRegistered = (context: {
+    client: OAuthClient;
+    metadata: ClientRegistrationMetadata;
+}) => void | Promise<void>;
 export type RegisterClientResult = {
     body: {
         error: string;
@@ -73,11 +78,12 @@ export declare const getRegisteredClient: ({ authorization, clientId, clientStor
     };
     readonly status: 200;
 }>;
-export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
+export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, onClientRegistered, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
     clientStore: OAuthClientStore;
     initialAccessTokenStore?: InitialAccessTokenStore;
     metadata: ClientRegistrationMetadata;
     onClientRegistration?: OnClientRegistration;
+    onClientRegistered?: OnClientRegistered;
     presentedInitialAccessToken?: string;
     registrationBaseUrl: string;
     registrationTokenStore: ClientRegistrationTokenStore;
@@ -118,6 +124,7 @@ export declare const updateRegisteredClient: ({ authorization, clientId, clientS
         readonly registration_access_token: string;
         readonly backchannel_logout_uri?: string;
         readonly client_name?: string;
+        readonly grant_types?: string[];
         readonly jwks?: JsonWebKey[];
         readonly jwks_uri?: string;
         readonly post_logout_redirect_uris?: string[];

package/dist/oidc/routes.d.ts

@@ -63,10 +63,10 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
+                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
                 audience?: string | undefined;
-                resource?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
                 auth_req_id?: string | undefined;
@@ -102,12 +102,12 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
+                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
                 nonce?: string | undefined;
                 audience?: string | undefined;
                 claims?: string | undefined;
-                resource?: string | undefined;
                 client_secret?: string | undefined;
                 redirect_uri?: string | undefined;
                 acr_values?: string | undefined;
@@ -333,6 +333,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 scope?: string | undefined;
                 backchannel_logout_uri?: string | undefined;
                 client_name?: string | undefined;
+                grant_types?: string[] | undefined;
                 jwks_uri?: string | undefined;
                 post_logout_redirect_uris?: string[] | undefined;
                 redirect_uris?: string[] | undefined;
@@ -392,6 +393,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                     scope?: string | undefined;
                     backchannel_logout_uri?: string | undefined;
                     client_name?: string | undefined;
+                    grant_types?: string[] | undefined;
                     jwks_uri?: string | undefined;
                     post_logout_redirect_uris?: string[] | undefined;
                     redirect_uris?: string[] | undefined;

package/dist/oidc/types.d.ts

@@ -1,6 +1,9 @@
 export type OAuthClient = {
     backchannelLogoutUri?: string;
     clientId: string;
+    /** Grant types this dynamically registered client declared. Undefined preserves
+     * the historical authorization-code default for statically configured clients. */
+    grantTypes?: string[];
     hashedSecret?: string;
     jwks?: JsonWebKey[];
     jwksUri?: string;

package/dist/types.d.ts

@@ -2,6 +2,7 @@ import { CredentialsFor, CustomProviderCredentials, NonEmptyArray, OAuth2Client,
 import { Cookie, status as statusType, redirect as redirectType } from 'elysia';
 import { ElysiaCustomStatusResponse } from 'elysia/error';
 import type { ApiKeysConfig } from './apikeys/config';
+import type { AgentAuthConfig } from './agents/config';
 import type { AuditConfig } from './audit/config';
 import type { AuthorizationConfig } from './authorization/config';
 import type { ComplianceConfig } from './compliance/config';
@@ -311,6 +312,10 @@ export type AuthConfig<UserType> = {
      *  Pair with the exported `createApiKey` / `resolveApiPrincipal` / `hasScopes`
      *  helpers to issue and guard with static keys. */
     apikeys?: ApiKeysConfig;
+    /** Standards-first delegated agent authorization. Mounts RFC 9728 protected-resource
+     * metadata and contributes `protectAgent`, while protocol adapters normalize verified
+     * credentials into durable agent registrations + user delegations. */
+    agentAuth?: AgentAuthConfig;
     /** OAuth2 / OIDC provider — makes your app an identity provider ("Sign in with
      *  <yourapp>"). Mounts `{oidcRoute}/authorize` + `/token` + `/jwks` and
      *  `/.well-known/openid-configuration`: authorization_code + mandatory PKCE, ES256

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.54.5",
+	"version": "0.54.7",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -17,7 +17,7 @@
 	"license": "BSL-1.1",
 	"author": "Alex Kahn",
 	"scripts": {
-		"build": "rm -rf dist && bun build src/index.ts src/saml.ts src/webauthn.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts src/manifest.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api --external @simplewebauthn/server --external @node-saml/node-saml && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json && chmod +x dist/cli/migrate.js && absolute-manifest emit",
+		"build": "rm -rf dist && bun build src/index.ts src/agents/index.ts src/saml.ts src/webauthn.ts src/htmx/index.ts src/client/index.ts src/client/react.ts src/client/vue.ts src/client/solid.ts src/client/svelte.ts src/plugins/index.ts src/providers/index.ts src/manifest.ts --root src --outdir dist --sourcemap --target=bun --external elysia --external react --external vue --external solid-js --external svelte --external @opentelemetry/api --external @simplewebauthn/server --external @node-saml/node-saml && bun build src/cli/migrate.ts --outdir dist/cli --sourcemap --target=bun --external @neondatabase/serverless --external drizzle-orm && bun build src/fingerprint-client/index.ts --outdir dist/fingerprint-client --sourcemap --target=browser && tsc --emitDeclarationOnly --project tsconfig.json && chmod +x dist/cli/migrate.js && absolute-manifest emit",
 		"config": "absolute config",
 		"test": "bun test",
 		"format": "absolute prettier --write",
@@ -75,7 +75,7 @@
 		"@absolutejs/linked-providers": "0.0.2",
 		"@neondatabase/serverless": "1.0.0",
 		"citra": "0.29.7",
-		"@absolutejs/manifest": "^0.1.0",
+		"@absolutejs/manifest": "^0.2.0",
 		"@sinclair/typebox": "^0.34.0",
 		"drizzle-orm": "1.0.0-rc.3"
 	},
@@ -116,6 +116,11 @@
 			"types": "./dist/client/index.d.ts",
 			"require": "./dist/client/index.js"
 		},
+		"./agents": {
+			"import": "./dist/agents/index.js",
+			"types": "./dist/agents/index.d.ts",
+			"require": "./dist/agents/index.js"
+		},
 		"./htmx": {
 			"import": "./dist/htmx/index.js",
 			"types": "./dist/htmx/index.d.ts",
@@ -180,6 +185,9 @@
 	],
 	"typesVersions": {
 		"*": {
+			"agents": [
+				"dist/agents/index.d.ts"
+			],
 			"saml": [
 				"dist/saml.d.ts"
 			],