@absolutejs/auth 0.54.8 → 0.55.0

package/dist/manifest.json

@@ -3,10 +3,10 @@
 	"identity": {
 		"accent": "#6366f1",
 		"category": "auth",
-		"description": "OAuth/OIDC sign-in for 60+ providers, email/password, magic links, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys — one Elysia plugin backed by your Postgres database.",
+		"description": "OAuth/OIDC sign-in for people and AI agents, including open auth.md registration, scoped delegation, agent account linking, 60+ providers, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys.",
 		"docsUrl": "https://github.com/absolutejs/auth",
 		"name": "@absolutejs/auth",
-		"tagline": "Let people create accounts and sign in."
+		"tagline": "Let people and agents create accounts and sign in."
 	},
 	"implements": [
 		{

package/dist/mfa/routes.d.ts

@@ -138,10 +138,10 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             response: {
                 400: "Phone must be in E.164 format";
                 401: "Authentication required";
-                501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
                 };
+                501: "SMS MFA is not configured";
                 422: {
                     type: "validation";
                     on: string;
@@ -169,6 +169,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                 200: {
                     readonly status: "enrolled";
                 };
+                429: "Too many attempts";
                 422: {
                     type: "validation";
                     on: string;
@@ -178,7 +179,6 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
             };
         };
     };

package/dist/mfa/sms.d.ts

@@ -40,10 +40,10 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             response: {
                 400: "Phone must be in E.164 format";
                 401: "Authentication required";
-                501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
                 };
+                501: "SMS MFA is not configured";
                 422: {
                     type: "validation";
                     on: string;
@@ -71,6 +71,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                 200: {
                     readonly status: "enrolled";
                 };
+                429: "Too many attempts";
                 422: {
                     type: "validation";
                     on: string;
@@ -80,7 +81,6 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
             };
         };
     };

package/dist/oidc/clientAuth.d.ts

@@ -10,6 +10,10 @@ export declare const verifyJwtSignedByClient: ({ jwt, client }: {
     client: OAuthClient;
     jwt: string;
 }) => Promise<{
-    header: any;
-    payload: any;
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
 } | undefined>;

package/dist/oidc/config.d.ts

@@ -4,7 +4,21 @@ import type { OnClientRegistered, OnClientRegistration } from './registration';
 import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
+export type PublicTokenGrantResult = {
+    body: Record<string, unknown>;
+    status: number;
+};
 export type OidcProviderConfig<UserType> = {
+    /** Additional non-conflicting RFC 8414 metadata. Reserved core OAuth keys
+     * cannot be replaced. Used by profiles such as open agent registration. */
+    additionalDiscoveryMetadata?: Record<string, unknown>;
+    /** Public extension grants whose bearer material is carried in their body
+     * (for example an agent claim_token). They run before OAuth client auth. */
+    publicTokenGrantTypes?: string[];
+    handlePublicTokenGrant?: (context: {
+        body: Record<string, string | undefined>;
+        request: Request;
+    }) => Promise<PublicTokenGrantResult | undefined>;
     accessTokenTtlMs?: number | ((context: {
         scopes: string[];
     }) => number);
@@ -158,11 +172,11 @@ export declare const introspectToken: <UserType>({ config, hint, now, token }: {
     active: false;
 } | {
     active: true;
-    client_id: any;
-    exp: any;
-    iat: any;
-    scope: any;
-    sub: any;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
     token_type: "access_token";
 } | {
     active: true;

package/dist/oidc/keys.d.ts

@@ -5,7 +5,7 @@ export type SigningKey = {
 };
 export declare const generateSigningKey: () => Promise<SigningKey>;
 export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
-export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey) => Promise<string>;
+export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
 export declare const toPublicJwk: (key: SigningKey) => {
     alg: string;
     crv: string | undefined;
@@ -16,6 +16,10 @@ export declare const toPublicJwk: (key: SigningKey) => {
     y: string | undefined;
 };
 export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
-    header: any;
-    payload: any;
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
 } | undefined>;

package/dist/oidc/logout.d.ts

@@ -8,8 +8,8 @@ export declare const verifyIdTokenHint: <UserType>({ config, idTokenHint }: {
     config: OidcProviderConfig<UserType>;
     idTokenHint: string;
 }) => Promise<{
-    audClientId: any;
-    sub: any;
+    audClientId: string;
+    sub: string;
 } | undefined>;
 type DeliveryFetch = (url: string, init: {
     body: string;

package/dist/oidc/routes.d.ts

@@ -27,8 +27,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             body: unknown;
             params: {};
             query: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
+                client_id?: string | undefined;
                 nonce?: string | undefined;
                 claims?: string | undefined;
                 request?: string | undefined;
@@ -63,15 +63,17 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
+                grant_type?: string | undefined;
+                claim_token?: string | undefined;
+                scope?: string | undefined;
+                assertion?: string | undefined;
                 resource?: string | undefined;
                 client_id?: string | undefined;
-                scope?: string | undefined;
                 audience?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
                 auth_req_id?: string | undefined;
                 client_secret?: string | undefined;
-                grant_type?: string | undefined;
                 code?: string | undefined;
                 redirect_uri?: string | undefined;
                 client_assertion?: string | undefined;
@@ -102,9 +104,9 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
+                scope?: string | undefined;
                 resource?: string | undefined;
                 client_id?: string | undefined;
-                scope?: string | undefined;
                 nonce?: string | undefined;
                 audience?: string | undefined;
                 claims?: string | undefined;
@@ -197,11 +199,11 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
+                client_id?: string | undefined;
                 client_secret?: string | undefined;
-                binding_message?: string | undefined;
                 login_hint?: string | undefined;
+                binding_message?: string | undefined;
             };
             params: {};
             query: unknown;
@@ -226,8 +228,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
+                client_id?: string | undefined;
                 client_secret?: string | undefined;
             };
             params: {};
@@ -329,8 +331,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                jwks?: any;
                 scope?: string | undefined;
+                jwks?: any;
                 backchannel_logout_uri?: string | undefined;
                 client_name?: string | undefined;
                 grant_types?: string[] | undefined;
@@ -389,8 +391,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
         ":clientId": {
             put: {
                 body: {
-                    jwks?: any;
                     scope?: string | undefined;
+                    jwks?: any;
                     backchannel_logout_uri?: string | undefined;
                     client_name?: string | undefined;
                     grant_types?: string[] | undefined;
@@ -526,7 +528,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 query: unknown;
                 headers: unknown;
                 response: {
-                    200: Record<string, string | boolean | string[]>;
+                    200: Record<string, unknown>;
                 };
             };
         };
@@ -540,7 +542,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 query: unknown;
                 headers: unknown;
                 response: {
-                    200: Record<string, string | boolean | string[]>;
+                    200: Record<string, unknown>;
                 };
             };
         };

package/dist/organizations/routes.d.ts

@@ -162,10 +162,10 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                         response: {
                             401: "Authentication required";
                             403: "Cannot manage members";
-                            404: "Invitation not found";
                             200: {
                                 readonly revoked: string;
                             };
+                            404: "Invitation not found";
                             422: {
                                 type: "validation";
                                 on: string;

package/dist/portal/routes.d.ts

@@ -66,11 +66,11 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
                     response: {
                         401: "Invalid or expired setup link";
                         403: "This setup link cannot configure SAML";
-                        501: "SSO is not configured";
                         200: {
                             readonly configured: true;
                             readonly type: "saml";
                         };
+                        501: "SSO is not configured";
                         422: {
                             type: "validation";
                             on: string;
@@ -103,11 +103,11 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
                     response: {
                         401: "Invalid or expired setup link";
                         403: "This setup link cannot configure OIDC";
-                        501: "SSO is not configured";
                         200: {
                             readonly configured: true;
                             readonly type: "oidc";
                         };
+                        501: "SSO is not configured";
                         422: {
                             type: "validation";
                             on: string;
@@ -134,12 +134,12 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
                     response: {
                         401: "Invalid or expired setup link";
                         403: "This setup link cannot configure SCIM";
-                        501: "SCIM is not configured";
                         200: {
                             readonly baseUrl: `${string}/${string}`;
                             readonly token: string;
                             readonly tokenId: string;
                         };
+                        501: "SCIM is not configured";
                     };
                 };
             };

package/dist/roles/routes.d.ts

@@ -66,10 +66,10 @@ export declare const roleRoutes: <UserType>({ authSessionStore, canManageRoles,
                         response: {
                             401: "Authentication required";
                             403: "Cannot manage roles";
-                            404: "Membership not found";
                             200: {
                                 readonly roles: string[];
                             };
+                            404: "Membership not found";
                             422: {
                                 type: "validation";
                                 on: string;

package/dist/routes/refresh.d.ts

@@ -37,8 +37,8 @@ export declare const refresh: <UserType>({ authSessionStore, clientProviders, re
             response: {
                 400: "Cookies are missing" | "Invalid provider" | "No refresh token found";
                 401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found" | "No auth provider found" | "No user session found";
-                501: "Provider is not refreshable";
                 200: Response;
+                501: "Provider is not refreshable";
                 422: {
                     type: "validation";
                     on: string;

package/dist/routes/revoke.d.ts

@@ -36,8 +36,8 @@ export declare const revoke: <UserType>({ authSessionStore, clientProviders, rev
             response: {
                 400: "Cookies are missing" | "Invalid provider" | "Session has no access token to revoke";
                 401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found" | "No auth provider found" | "No user session found";
-                501: "Provider does not support revocation";
                 200: Response;
+                501: "Provider does not support revocation";
                 422: {
                     type: "validation";
                     on: string;

package/dist/routes/sessions.d.ts

@@ -34,10 +34,10 @@ export declare const sessionRoutes: <UserType>({ authSessionStore, getUserId, se
             headers: unknown;
             response: {
                 401: "Authentication required";
-                501: "Session management requires an authSessionStore";
                 200: {
                     readonly sessions: SessionSummary[];
                 };
+                501: "Session management requires an authSessionStore";
                 422: {
                     type: "validation";
                     on: string;
@@ -63,11 +63,11 @@ export declare const sessionRoutes: <UserType>({ authSessionStore, getUserId, se
                 response: {
                     400: "Invalid session id";
                     401: "Authentication required";
-                    501: "Session management requires an authSessionStore";
-                    404: "Session not found";
                     200: {
                         readonly revoked: `${string}-${string}-${string}-${string}-${string}`;
                     };
+                    501: "Session management requires an authSessionStore";
+                    404: "Session not found";
                     422: {
                         type: "validation";
                         on: string;

package/dist/sso/discoveryRoute.d.ts

@@ -33,8 +33,8 @@ export declare const ssoDiscoveryRoute: ({ getOrganizationByEmailDomain, ssoConn
             headers: unknown;
             response: {
                 400: "An \"email\" query parameter is required" | "A valid email address is required";
-                404: "No SSO organization is configured for this email domain" | "No SSO connection is configured for this organization";
                 200: Response;
+                404: "No SSO organization is configured for this email domain" | "No SSO connection is configured for this organization";
                 422: {
                     type: "validation";
                     on: string;

package/dist/sso/oidcRoutes.d.ts

@@ -33,8 +33,8 @@ export declare const oidcSsoRoutes: <UserType>({ authSessionStore, cookieSecure,
             query: unknown;
             headers: unknown;
             response: {
-                404: "No OIDC connection is configured for this organization";
                 200: Response;
+                404: "No OIDC connection is configured for this organization";
                 422: {
                     type: "validation";
                     on: string;
@@ -61,8 +61,8 @@ export declare const oidcSsoRoutes: <UserType>({ authSessionStore, cookieSecure,
             headers: unknown;
             response: {
                 400: "SSO session cookies are missing" | "Invalid SSO callback request" | "SSO organization mismatch" | "OIDC token response is missing an id_token";
-                404: "No OIDC connection is configured for this organization";
                 200: Response;
+                404: "No OIDC connection is configured for this organization";
                 422: {
                     type: "validation";
                     on: string;

package/dist/sso/samlRoutes.d.ts

@@ -35,8 +35,8 @@ export declare const samlSsoRoutes: <UserType>({ authSessionStore, cookieSecure,
             query: unknown;
             headers: unknown;
             response: {
-                404: "No SAML connection is configured for this organization";
                 200: Response;
+                404: "No SAML connection is configured for this organization";
                 422: {
                     type: "validation";
                     on: string;
@@ -62,8 +62,8 @@ export declare const samlSsoRoutes: <UserType>({ authSessionStore, cookieSecure,
             query: unknown;
             headers: unknown;
             response: {
-                404: "No SAML connection is configured for this organization";
                 200: Response;
+                404: "No SAML connection is configured for this organization";
                 422: {
                     type: "validation";
                     on: string;
@@ -87,8 +87,8 @@ export declare const samlSsoRoutes: <UserType>({ authSessionStore, cookieSecure,
             query: unknown;
             headers: unknown;
             response: {
-                404: "No SAML connection is configured for this organization";
                 200: Response;
+                404: "No SAML connection is configured for this organization";
                 422: {
                     type: "validation";
                     on: string;
@@ -141,9 +141,9 @@ export declare const samlSsoRoutes: <UserType>({ authSessionStore, cookieSecure,
             headers: unknown;
             response: {
                 400: "Missing SAMLRequest or SAMLResponse" | "Invalid SAML LogoutRequest";
+                200: Response;
                 501: "SAML Single Logout is not configured";
                 404: "No SAML connection is configured for this organization";
-                200: Response;
                 422: {
                     type: "validation";
                     on: string;

package/docs/AGENT-AUTH.md

@@ -0,0 +1,54 @@
+# Agent authentication and registration
+
+Absolute Auth implements agent registration inside `@absolutejs/auth`. There is
+no separate `auth-md` package and no WorkOS service dependency. `/auth.md` is a
+wire-compatible, generated companion document; OAuth metadata remains the
+authoritative machine-readable contract.
+
+## Interoperability contract
+
+The implementation composes existing standards wherever they already define the
+behavior:
+
+- RFC 9728 protected-resource discovery
+- RFC 8414 authorization-server discovery
+- RFC 7523 JWT bearer grants
+- RFC 8628-style user-code polling semantics
+- RFC 9396-compatible authorization details in agent delegations
+- the auth.md v0.6 registration projection and ID-JAG assertion type
+
+The auth.md claim grant currently has a WorkOS-namespaced URN because that is the
+identifier in the open v0.6 wire profile. It is isolated behind
+`AGENT_CLAIM_GRANT_TYPE`; it does not indicate a WorkOS backend dependency. A
+future neutral identifier can be accepted alongside it without changing the
+internal store, verifier, or client contracts.
+
+Protocol inputs are normalized into provider-neutral Absolute types. Identity
+verification, user resolution, stores, key management, and token revocation are
+injected interfaces. Provider adapters can therefore be added without changing
+routes or application authorization logic.
+
+## Security invariants
+
+- The service owns the account-linking page. Agents never receive passwords,
+  MFA codes, or service session cookies.
+- ID-JAG assertions are signature-, issuer-, audience-, client-, freshness-,
+  verification-, and replay-checked before identity resolution.
+- A durable identity key includes issuer, subject, and client id. Different
+  agents acting for the same user cannot collapse into one registration.
+- Claim and attempt tokens are stored only as hashes. User codes have bounded
+  attempts, short expirations, constant-time comparison, and atomic updates.
+- Polling is rate-enforced and returns `slow_down` when the advertised interval
+  is ignored.
+- Access tokens are opaque, scoped, short-lived, and looked up in a revocable
+  store. Anonymous pre-claim credentials must be revoked before ownership is
+  committed.
+- Structured discovery never advertises an optional capability, such as
+  security-event delivery, unless the deployment actually implements it.
+
+## Deployment checklist
+
+Use the Postgres identity-registration store in production, run the `agents`
+migrations, keep signing keys in managed key storage, make anonymous-token
+revocation idempotent, pin trusted assertion issuers and client ids, and apply
+normal edge rate limits to identity, claim, completion, and token routes.