@absolutejs/auth 0.54.9 → 0.55.1

package/dist/manifest.json

@@ -3,10 +3,10 @@
 	"identity": {
 		"accent": "#6366f1",
 		"category": "auth",
-		"description": "OAuth/OIDC sign-in for 60+ providers, email/password, magic links, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys — one Elysia plugin backed by your Postgres database.",
+		"description": "OAuth/OIDC sign-in for people and AI agents, including open auth.md registration, scoped delegation, agent account linking, 60+ providers, passkeys, MFA, enterprise SSO/SCIM, organizations, roles, and API keys.",
 		"docsUrl": "https://github.com/absolutejs/auth",
 		"name": "@absolutejs/auth",
-		"tagline": "Let people create accounts and sign in."
+		"tagline": "Let people and agents create accounts and sign in."
 	},
 	"implements": [
 		{

package/dist/oidc/clientAuth.d.ts

@@ -10,6 +10,10 @@ export declare const verifyJwtSignedByClient: ({ jwt, client }: {
     client: OAuthClient;
     jwt: string;
 }) => Promise<{
-    header: any;
-    payload: any;
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
 } | undefined>;

package/dist/oidc/config.d.ts

@@ -4,7 +4,21 @@ import type { OnClientRegistered, OnClientRegistration } from './registration';
 import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
+export type PublicTokenGrantResult = {
+    body: Record<string, unknown>;
+    status: number;
+};
 export type OidcProviderConfig<UserType> = {
+    /** Additional non-conflicting RFC 8414 metadata. Reserved core OAuth keys
+     * cannot be replaced. Used by profiles such as open agent registration. */
+    additionalDiscoveryMetadata?: Record<string, unknown>;
+    /** Public extension grants whose bearer material is carried in their body
+     * (for example an agent claim_token). They run before OAuth client auth. */
+    publicTokenGrantTypes?: string[];
+    handlePublicTokenGrant?: (context: {
+        body: Record<string, string | undefined>;
+        request: Request;
+    }) => Promise<PublicTokenGrantResult | undefined>;
     accessTokenTtlMs?: number | ((context: {
         scopes: string[];
     }) => number);
@@ -158,11 +172,11 @@ export declare const introspectToken: <UserType>({ config, hint, now, token }: {
     active: false;
 } | {
     active: true;
-    client_id: any;
-    exp: any;
-    iat: any;
-    scope: any;
-    sub: any;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
     token_type: "access_token";
 } | {
     active: true;

package/dist/oidc/keys.d.ts

@@ -5,7 +5,7 @@ export type SigningKey = {
 };
 export declare const generateSigningKey: () => Promise<SigningKey>;
 export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
-export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey) => Promise<string>;
+export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
 export declare const toPublicJwk: (key: SigningKey) => {
     alg: string;
     crv: string | undefined;
@@ -16,6 +16,10 @@ export declare const toPublicJwk: (key: SigningKey) => {
     y: string | undefined;
 };
 export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
-    header: any;
-    payload: any;
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
 } | undefined>;

package/dist/oidc/logout.d.ts

@@ -8,8 +8,8 @@ export declare const verifyIdTokenHint: <UserType>({ config, idTokenHint }: {
     config: OidcProviderConfig<UserType>;
     idTokenHint: string;
 }) => Promise<{
-    audClientId: any;
-    sub: any;
+    audClientId: string;
+    sub: string;
 } | undefined>;
 type DeliveryFetch = (url: string, init: {
     body: string;

package/dist/oidc/routes.d.ts

@@ -63,16 +63,18 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
                 audience?: string | undefined;
+                resource?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
                 auth_req_id?: string | undefined;
-                client_secret?: string | undefined;
                 grant_type?: string | undefined;
+                claim_token?: string | undefined;
+                assertion?: string | undefined;
                 code?: string | undefined;
+                client_secret?: string | undefined;
                 redirect_uri?: string | undefined;
                 client_assertion?: string | undefined;
                 client_assertion_type?: string | undefined;
@@ -102,12 +104,12 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                resource?: string | undefined;
                 client_id?: string | undefined;
                 scope?: string | undefined;
                 nonce?: string | undefined;
                 audience?: string | undefined;
                 claims?: string | undefined;
+                resource?: string | undefined;
                 client_secret?: string | undefined;
                 redirect_uri?: string | undefined;
                 acr_values?: string | undefined;
@@ -199,9 +201,9 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             body: {
                 client_id?: string | undefined;
                 scope?: string | undefined;
+                login_hint?: string | undefined;
                 client_secret?: string | undefined;
                 binding_message?: string | undefined;
-                login_hint?: string | undefined;
             };
             params: {};
             query: unknown;
@@ -526,7 +528,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 query: unknown;
                 headers: unknown;
                 response: {
-                    200: Record<string, string | boolean | string[]>;
+                    200: Record<string, unknown>;
                 };
             };
         };
@@ -540,7 +542,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 query: unknown;
                 headers: unknown;
                 response: {
-                    200: Record<string, string | boolean | string[]>;
+                    200: Record<string, unknown>;
                 };
             };
         };

package/dist/routes/protectRoute.d.ts

@@ -16,7 +16,7 @@ export declare const protectRoutePlugin: <UserType>({ authSessionStore }?: {
         unregisteredSession: import("..").UnregisteredSessionRecord;
     };
     derive: {
-        readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<AuthReturn | import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401>>;
     };
     resolve: {};
 }, {
@@ -33,7 +33,7 @@ export declare const protectRoutePlugin: <UserType>({ authSessionStore }?: {
     macroFn: {};
     parser: {};
     response: import("elysia").ExtractErrorFromHandle<{
-        readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401> | AuthReturn | NonNullable<AuthFailReturn>>;
+        readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AuthFailError) => AuthFailReturn) => Promise<AuthReturn | import("elysia").ElysiaCustomStatusResponse<"Bad Request", "Cookies are missing", 400> | NonNullable<AuthFailReturn> | import("elysia").ElysiaCustomStatusResponse<"Unauthorized", "User is not authenticated", 401>>;
     }>;
 }, {}, {
     derive: {};

package/dist/server.d.ts

@@ -0,0 +1,18 @@
+import type { AuthInstance } from './authInstance';
+import type { AuthConfig } from './types';
+/**
+ * Create the complete AbsoluteJS auth application through a declaration-stable
+ * server entry point. Import this subpath in server applications so TypeScript
+ * does not need to load declarations for every optional Auth feature.
+ */
+export declare const auth: <UserType>(config: AuthConfig<UserType>) => Promise<AuthInstance<UserType>>;
+export type { AuthInstance } from './authInstance';
+export type { AuditSink } from './audit/types';
+export { protectRoutePlugin } from './routes/protectRoute';
+export type { AuthSessionStore } from './session/types';
+export { isUserSessionId } from './typeGuards';
+export { userSessionIdTypebox } from './typebox';
+export type { AuthConfig, OAuth2ConfigurationOptions, SessionData, UnregisteredSessionData, UserSessionId } from './types';
+export { instantiateUserSession } from './utils';
+export type { OAuth2TokenResponse, ProviderOption } from 'citra';
+export { extractPropFromIdentity, isValidProviderOption, providers } from 'citra';