@absolutejs/auth 0.54.9 → 0.55.0

package/README.md

@@ -77,11 +77,13 @@ import { createSimpleWebAuthnAdapter } from '@absolutejs/auth/webauthn';
 
 ### Delegated AI agents
 
-The `agentAuth` block provides a standards-first agent identity layer without
-depending on a vendor registration protocol. It publishes RFC 9728 protected
-resource metadata, records agent registrations and user delegations, and adds a
-scoped `protectAgent` guard. Protocol-specific credentials are normalized by a
-verifier adapter:
+The `agentAuth` block provides a standards-first agent identity layer. It
+publishes RFC 9728 metadata, records registrations and user delegations, and
+adds a scoped `protectAgent` guard. It can also serve a generated `/auth.md`
+registration guide and matching structured OAuth metadata. This is native to
+`@absolutejs/auth`; no WorkOS service or separate package is required.
+
+Protocol-specific credentials are normalized by verifier adapters:
 
 ```ts
 import {
@@ -133,6 +135,18 @@ app.get('/documents', ({ protectAgent }) =>
 Postgres and Neon registration/delegation stores are exported alongside the
 in-memory stores. Include the `agents` migration block in production.
 
+For agents that need to create or link an account, configure
+`agentAuth.agentRegistration` with an identity-registration store, access-token
+store, signing key, authenticated-user resolver, and post-claim scopes. Enable
+`service_auth` or anonymous registration explicitly; anonymous registration
+also requires an idempotent callback that revokes every pre-claim token before
+ownership changes. Absolute exposes provider and consumer helpers from
+`@absolutejs/auth/agents`, including ID-JAG issuance and verification, secure
+RFC 9728/RFC 8414 discovery, claim polling, and assertion exchange.
+
+See [the agent-auth interoperability and deployment guide](docs/AGENT-AUTH.md)
+for supported standards, security invariants, and the production checklist.
+
 ### Features
 
 - **Authorization**: Handles the authorization process by generating the authorization URL and redirecting the user to the authentication provider.

package/dist/agents/config.d.ts

@@ -1,14 +1,30 @@
 import type { RouteString } from '../types';
 import type { AgentCredentialVerifier, AgentDelegationStore, AgentRegistrationStore } from './types';
+import type { AgentRegistrationProtocolConfig } from './registration';
 export declare const DEFAULT_AGENT_RESOURCE_METADATA_ROUTE: RouteString;
+export type AgentRegistrationDiscoveryMetadata = {
+    claim_endpoint: string;
+    identity_assertion: {
+        assertion_types_supported: string[];
+    };
+    identity_endpoint: string;
+    identity_types_supported: string[];
+    skill: string;
+};
 export type AgentAuthConfig = {
     /** Permit registered agents to authenticate without a user delegation. Secure
      * default is false; enable for machine-only resources. */
     allowUndelegated?: boolean;
+    /** Open auth.md agent-registration support. Implemented natively by Absolute
+     * Auth and projected through OAuth discovery; no WorkOS service is required. */
+    agentRegistration?: AgentRegistrationProtocolConfig;
     authorizationServer: string;
     delegationStore: AgentDelegationStore;
     logoUri?: string;
     metadataRoute?: RouteString;
+    /** Authorization-server route prefix. Defaults to `/oauth2`; used to derive
+     * the authoritative token endpoint advertised by the generated guide. */
+    oidcRoute?: RouteString;
     registrationStore: AgentRegistrationStore;
     /** Treat clients created through RFC 7591 DCR as agent registrations. Explicitly
      * opt-in because a deployment may also use DCR for ordinary relying parties. */

package/dist/agents/idJag.d.ts

@@ -0,0 +1,49 @@
+import { type SigningKey } from '../oidc/keys';
+import type { VerifiedAgentIdentityAssertion } from './types';
+export type AgentIdentityAssertionJtiStore = {
+    /** Atomically records an issuer+jti pair. Returns false for a replay. */
+    recordIfFresh: (issuer: string, jti: string, expiresAt: number) => Promise<boolean>;
+};
+export declare const createInMemoryAgentIdentityAssertionJtiStore: () => AgentIdentityAssertionJtiStore;
+export type AgentIdentityAssertionUser = {
+    authenticatedAt: number;
+    email?: string;
+    emailVerified?: boolean;
+    methods?: string[];
+    name?: string;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    subject: string;
+};
+/** Native provider-side ID-JAG issuance. The caller owns the user consent UI
+ * and must authorize the requested audience before invoking this helper. */
+export declare const issueAgentIdentityAssertion: ({ agentContextId, agentPlatform, audience, clientId, issuer, now, resource, signingKey, ttlMs, user }: {
+    agentContextId?: string;
+    agentPlatform?: string;
+    audience: string;
+    clientId: string;
+    issuer: string;
+    now?: number;
+    resource?: string;
+    signingKey: SigningKey;
+    ttlMs?: number;
+    user: AgentIdentityAssertionUser;
+}) => Promise<{
+    assertion: string;
+    assertionType: "urn:ietf:params:oauth:token-type:id-jag";
+    expiresAt: number;
+}>;
+/** Builds a fail-closed service-side verifier. Issuer resolution is injected so
+ * the application can use pinned configuration, CIMD, or an egress-guarded
+ * JWKS resolver without this package performing ambient network access. */
+export declare const createAgentIdentityAssertionVerifier: ({ audience, clockSkewMs, jtiStore, maxAssertionLifetimeMs, maxAuthenticationAgeMs, resolveIssuer }: {
+    audience: string;
+    clockSkewMs?: number;
+    jtiStore: AgentIdentityAssertionJtiStore;
+    maxAssertionLifetimeMs?: number;
+    maxAuthenticationAgeMs?: number;
+    resolveIssuer: (issuer: string) => Promise<{
+        allowedClientIds?: string[];
+        publicJwk: JsonWebKey;
+    } | undefined>;
+}) => (assertion: string, now?: number) => Promise<VerifiedAgentIdentityAssertion | undefined>;

package/dist/agents/inMemoryStores.d.ts

@@ -1,3 +1,4 @@
-import type { AgentDelegationStore, AgentRegistrationStore } from './types';
+import type { AgentDelegationStore, AgentIdentityRegistrationStore, AgentRegistrationStore } from './types';
 export declare const createInMemoryAgentDelegationStore: () => AgentDelegationStore;
+export declare const createInMemoryAgentIdentityRegistrationStore: () => AgentIdentityRegistrationStore;
 export declare const createInMemoryAgentRegistrationStore: () => AgentRegistrationStore;

package/dist/agents/index.d.ts

@@ -1,8 +1,11 @@
 export * from './config';
 export * from './types';
+export * from './registration';
+export * from './registrationClient';
+export * from './idJag';
 export * from '../oidc/clientIdMetadata';
 export { createOidcAgentCredentialVerifier } from './oidcAdapter';
 export { agentHasScopes, resolveAgentPrincipal } from './principal';
 export { agentAuthChallenge, agentAuthPlugin } from './routes';
-export { createInMemoryAgentDelegationStore, createInMemoryAgentRegistrationStore } from './inMemoryStores';
-export { agentDelegationsTable, agentRegistrationsTable, createNeonAgentDelegationStore, createNeonAgentRegistrationStore, createPostgresAgentDelegationStore, createPostgresAgentRegistrationStore } from './postgresStores';
+export { createInMemoryAgentDelegationStore, createInMemoryAgentIdentityRegistrationStore, createInMemoryAgentRegistrationStore } from './inMemoryStores';
+export { agentDelegationsTable, agentIdentityRegistrationsTable, agentRegistrationsTable, createNeonAgentDelegationStore, createNeonAgentIdentityRegistrationStore, createNeonAgentRegistrationStore, createPostgresAgentDelegationStore, createPostgresAgentIdentityRegistrationStore, createPostgresAgentRegistrationStore } from './postgresStores';