@absolutejs/auth 0.54.9 → 0.55.1

package/dist/agents/index.js

@@ -55,6 +55,132 @@ var init_constants = __esm(() => {
   COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
 });
 
+// src/crypto.ts
+var exports_crypto = {};
+__export(exports_crypto, {
+  verifyTotp: () => verifyTotp,
+  verifyPassword: () => verifyPassword,
+  hashToken: () => hashToken,
+  hashPassword: () => hashPassword,
+  generateTotpSecret: () => generateTotpSecret,
+  generateTotp: () => generateTotp,
+  generateSecureToken: () => generateSecureToken,
+  generateEncryptionKey: () => generateEncryptionKey,
+  encryptSecret: () => encryptSecret,
+  decryptSecret: () => decryptSecret,
+  createTotpKeyUri: () => createTotpKeyUri,
+  constantTimeEqual: () => constantTimeEqual,
+  base32Encode: () => base32Encode,
+  base32Decode: () => base32Decode
+});
+var DEFAULT_TOKEN_BYTES = 32, AES_KEY_BYTES = 32, AES_IV_BYTES = 12, HOTP_COUNTER_BYTES = 8, TOTP_SECRET_BYTES = 20, TOTP_DIGITS = 6, TOTP_PERIOD_SECONDS = 30, DEFAULT_TOTP_WINDOW = 1, DECIMAL_RADIX = 10, LAST_NIBBLE_MASK = 15, SIGN_BIT_MASK = 2147483647, BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", BASE32_GROUP_BITS = 5, BASE32_MASK = 31, BYTE_BITS = 8, textEncoder, textDecoder, base64UrlEncode = (bytes) => Buffer.from(bytes).toString("base64url"), base64UrlDecode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64url")), sha256 = async (input) => {
+  const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(input));
+  return new Uint8Array(digest);
+}, hmacSha1 = async (key, message) => {
+  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, message);
+  return new Uint8Array(signature);
+}, counterToBytes = (counter) => {
+  const bytes = new Uint8Array(HOTP_COUNTER_BYTES);
+  new DataView(bytes.buffer).setBigUint64(0, BigInt(counter), false);
+  return bytes;
+}, generateHotp = async (secret, counter, digits = TOTP_DIGITS) => {
+  const hmac = await hmacSha1(secret, counterToBytes(counter));
+  const view = new DataView(hmac.buffer, hmac.byteOffset, hmac.byteLength);
+  const offset = view.getUint8(hmac.byteLength - 1) & LAST_NIBBLE_MASK;
+  const truncated = view.getUint32(offset, false) & SIGN_BIT_MASK;
+  const otp = truncated % DECIMAL_RADIX ** digits;
+  return otp.toString().padStart(digits, "0");
+}, importAesKey = (keyMaterial) => crypto.subtle.importKey("raw", base64UrlDecode(keyMaterial), { name: "AES-GCM" }, false, ["decrypt", "encrypt"]), base32Decode = (encoded) => {
+  const normalized = encoded.toUpperCase().replace(/[^A-Z2-7]/gu, "");
+  const bits = [...normalized].map((char) => BASE32_ALPHABET.indexOf(char).toString(2).padStart(BASE32_GROUP_BITS, "0")).join("");
+  const byteChunks = bits.match(/.{8}/gu) ?? [];
+  return new Uint8Array(byteChunks.map((chunk) => parseInt(chunk, 2)));
+}, base32Encode = (bytes) => {
+  const bits = Array.from(bytes, (byte) => byte.toString(2).padStart(BYTE_BITS, "0")).join("");
+  const groups = bits.match(/.{1,5}/gu) ?? [];
+  return groups.map((group) => BASE32_ALPHABET[parseInt(group.padEnd(BASE32_GROUP_BITS, "0"), 2) & BASE32_MASK] ?? "").join("");
+}, constantTimeEqual = async (left, right) => {
+  const [leftDigest, rightDigest] = await Promise.all([
+    sha256(left),
+    sha256(right)
+  ]);
+  const leftView = new DataView(leftDigest.buffer, leftDigest.byteOffset, leftDigest.byteLength);
+  const rightView = new DataView(rightDigest.buffer, rightDigest.byteOffset, rightDigest.byteLength);
+  let mismatch = 0;
+  for (let index = 0;index < leftDigest.byteLength; index += 1) {
+    mismatch |= leftView.getUint8(index) ^ rightView.getUint8(index);
+  }
+  return mismatch === 0;
+}, createTotpKeyUri = ({
+  accountName,
+  digits = TOTP_DIGITS,
+  issuer,
+  period = TOTP_PERIOD_SECONDS,
+  secret
+}) => {
+  const params = new URLSearchParams({
+    algorithm: "SHA1",
+    digits: `${digits}`,
+    issuer,
+    period: `${period}`,
+    secret
+  });
+  const label = encodeURIComponent(`${issuer}:${accountName}`);
+  return `otpauth://totp/${label}?${params.toString()}`;
+}, decryptSecret = async (ciphertext, keyMaterial) => {
+  const key = await importAesKey(keyMaterial);
+  const combined = base64UrlDecode(ciphertext);
+  const nonce = combined.subarray(0, AES_IV_BYTES);
+  const data = combined.subarray(AES_IV_BYTES);
+  const plaintext = await crypto.subtle.decrypt({ iv: nonce, name: "AES-GCM" }, key, data);
+  return textDecoder.decode(plaintext);
+}, encryptSecret = async (plaintext, keyMaterial) => {
+  const key = await importAesKey(keyMaterial);
+  const nonce = new Uint8Array(AES_IV_BYTES);
+  crypto.getRandomValues(nonce);
+  const ciphertext = await crypto.subtle.encrypt({ iv: nonce, name: "AES-GCM" }, key, textEncoder.encode(plaintext));
+  const combined = new Uint8Array(nonce.byteLength + ciphertext.byteLength);
+  combined.set(nonce, 0);
+  combined.set(new Uint8Array(ciphertext), nonce.byteLength);
+  return base64UrlEncode(combined);
+}, generateEncryptionKey = () => generateSecureToken(AES_KEY_BYTES), generateSecureToken = (byteLength = DEFAULT_TOKEN_BYTES) => {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}, generateTotp = async ({
+  digits = TOTP_DIGITS,
+  now = Date.now(),
+  period = TOTP_PERIOD_SECONDS,
+  secret
+}) => {
+  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
+  return generateHotp(base32Decode(secret), counter, digits);
+}, generateTotpSecret = (byteLength = TOTP_SECRET_BYTES) => {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base32Encode(bytes);
+}, hashPassword = (password) => Bun.password.hash(password, { algorithm: "argon2id" }), hashToken = async (token) => base64UrlEncode(await sha256(token)), verifyPassword = (password, hash) => Bun.password.verify(password, hash), verifyTotp = async ({
+  digits = TOTP_DIGITS,
+  now = Date.now(),
+  period = TOTP_PERIOD_SECONDS,
+  secret,
+  token,
+  window = DEFAULT_TOTP_WINDOW
+}) => {
+  const secretBytes = base32Decode(secret);
+  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
+  const drifts = Array.from({ length: window * 2 + 1 }, (_, offset) => counter - window + offset);
+  const candidates = await Promise.all(drifts.map((value) => generateHotp(secretBytes, value, digits)));
+  const matches = await Promise.all(candidates.map((candidate) => constantTimeEqual(candidate, token)));
+  return matches.includes(true);
+};
+var init_crypto = __esm(() => {
+  init_constants();
+  textEncoder = new TextEncoder;
+  textDecoder = new TextDecoder;
+});
+
 // src/agents/config.ts
 var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
 var agentProtectedResourceMetadata = (config) => ({
@@ -65,8 +191,952 @@ var agentProtectedResourceMetadata = (config) => ({
   resource: config.resource,
   scopes_supported: config.scopes
 });
+// src/agents/registration.ts
+init_constants();
+init_crypto();
+
+// src/oidc/keys.ts
+var ENCODER = new TextEncoder;
+var ES256 = { hash: "SHA-256", name: "ECDSA" };
+var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
+var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
+var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+var decodeSegment = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return;
+    }
+    return Object.fromEntries(Object.entries(value));
+  } catch {
+    return;
+  }
+};
+var generateSigningKey = async () => {
+  const pair = await crypto.subtle.generateKey(KEY_PARAMS, true, [
+    "sign",
+    "verify"
+  ]);
+  const privateJwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+  const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
+  return { kid: await jwkThumbprint(publicJwk), privateJwk, publicJwk };
+};
+var jwkThumbprint = async (jwk) => {
+  const canonical = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x,
+    y: jwk.y
+  });
+  return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
+};
+var signJwt = async (payload, signing, typ = "JWT") => {
+  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+  const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
+  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
+  return `${input}.${toBase64Url(signature)}`;
+};
+var toPublicJwk = (key) => ({
+  alg: "ES256",
+  crv: key.publicJwk.crv,
+  kid: key.kid,
+  kty: key.publicJwk.kty,
+  use: "sig",
+  x: key.publicJwk.x,
+  y: key.publicJwk.y
+});
+var verifyJwt = async (token, publicJwk) => {
+  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
+  if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
+    return;
+  }
+  const key = await crypto.subtle.importKey("jwk", publicJwk, KEY_PARAMS, false, ["verify"]);
+  const valid = await crypto.subtle.verify(ES256, key, fromBase64Url(signatureSegment), ENCODER.encode(`${headerSegment}.${payloadSegment}`));
+  if (!valid)
+    return;
+  const header = decodeSegment(headerSegment);
+  const payload = decodeSegment(payloadSegment);
+  if (header === undefined || payload === undefined)
+    return;
+  return {
+    header,
+    payload
+  };
+};
+
+// src/agents/registration.ts
+var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
+var AGENT_IDENTITY_ASSERTION_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var AGENT_IDENTITY_ASSERTION_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
+var DEFAULT_IDENTITY_ROUTE = "/agent/identity";
+var DEFAULT_CLAIM_ROUTE = "/agent/identity/claim";
+var DEFAULT_COMPLETE_ROUTE = "/agent/identity/claim/complete";
+var DEFAULT_GUIDE_ROUTE = "/auth.md";
+var DEFAULT_CLAIM_TTL_MS = 24 * 60 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ATTEMPT_TTL_MS = 10 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ASSERTION_TTL_MS = 60 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ACCESS_TOKEN_TTL_MS = 15 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_MAX_AUTH_AGE_MS = 60 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_POLL_INTERVAL_SECONDS = 5;
+var DEFAULT_MAX_CODE_ATTEMPTS = 5;
+var MAX_CONCURRENT_UPDATE_RETRIES = 5;
+var TOKEN_BYTES = 32;
+var agentRegistrationDiscoveryMetadata = (config) => {
+  const registration = requiredRegistration(config);
+  const endpoints = agentRegistrationEndpoints(config);
+  const identityTypes = ["identity_assertion"];
+  if (registration.allowAnonymous === true)
+    identityTypes.unshift("anonymous");
+  if (registration.allowServiceAuth === true)
+    identityTypes.push("service_auth");
+  return {
+    claim_endpoint: endpoints.claimEndpoint,
+    identity_assertion: {
+      assertion_types_supported: [AGENT_IDENTITY_ASSERTION_TYPE]
+    },
+    identity_endpoint: endpoints.identityEndpoint,
+    identity_types_supported: identityTypes,
+    skill: endpoints.guide
+  };
+};
+var agentRegistrationEndpoints = (config) => {
+  const registration = requiredRegistration(config);
+  const base = config.authorizationServer;
+  const oidcRoute = config.oidcRoute ?? "/oauth2";
+  return {
+    claimEndpoint: new URL(registration.claimRoute ?? DEFAULT_CLAIM_ROUTE, base).toString(),
+    completeEndpoint: new URL(registration.completeRoute ?? DEFAULT_COMPLETE_ROUTE, base).toString(),
+    guide: new URL(registration.guideRoute ?? DEFAULT_GUIDE_ROUTE, base).toString(),
+    identityEndpoint: new URL(registration.identityRoute ?? DEFAULT_IDENTITY_ROUTE, base).toString(),
+    tokenEndpoint: new URL(`${oidcRoute}/token`, base).toString()
+  };
+};
+var markdownJson = (value) => `\`\`\`json
+${JSON.stringify(value, null, 2)}
+\`\`\``;
+var generateAgentRegistrationGuide = (config) => {
+  const registration = requiredRegistration(config);
+  const endpoints = agentRegistrationEndpoints(config);
+  const metadataUrl = new URL(config.metadataRoute ?? "/.well-known/oauth-protected-resource", config.resource).toString();
+  const methods = [
+    "- `identity_assertion`: present an audience-bound ID-JAG from a trusted provider.",
+    ...registration.allowServiceAuth === true ? [
+      "- `service_auth`: provide a user login hint and complete the service-owned claim ceremony."
+    ] : [],
+    ...registration.allowAnonymous === true ? [
+      "- `anonymous`: receive pre-claim scopes, then optionally let a signed-in user claim the registration."
+    ] : []
+  ].join(`
+`);
+  return `# Agent registration for ${config.resourceName ?? config.resource}
+
+This service supports the open auth.md agent-registration profile. Structured
+OAuth metadata is authoritative; this document is its agent-readable companion.
+
+## 1. Discover
+
+Fetch ${metadataUrl}, follow \`authorization_servers\`, then fetch
+\`/.well-known/oauth-authorization-server\`. Read its \`agent_auth\` object and
+top-level \`token_endpoint\` and \`grant_types_supported\` fields.
+
+## 2. Choose a method
+
+${methods}
+
+Before asserting a user identity, show the service name and requested scopes to
+the user and obtain consent. Never ask the user to send a password or OTP to the
+agent.
+
+## 3. Register
+
+POST one of these bodies to ${endpoints.identityEndpoint}:
+
+${markdownJson({
+    assertion: "<ID-JAG>",
+    assertion_type: AGENT_IDENTITY_ASSERTION_TYPE,
+    type: "identity_assertion"
+  })}
+
+${registration.allowServiceAuth === true ? markdownJson({ login_hint: "user@example.com", type: "service_auth" }) : ""}
+
+${registration.allowAnonymous === true ? markdownJson({ type: "anonymous" }) : ""}
+
+## 4. Claim
+
+Surface \`verification_uri\` and \`user_code\` together. The user opens the
+service-owned page, signs in using the service's normal MFA/SSO policy, and types
+the code there. Poll ${endpoints.tokenEndpoint} using
+\`grant_type=${AGENT_CLAIM_GRANT_TYPE}\` and the one-time \`claim_token\`.
+Treat \`authorization_pending\` as retryable, honor \`interval\`, and restart
+when the server returns \`expired_token\`.
+
+## 5. Exchange and use credentials
+
+Exchange \`identity_assertion\` at ${endpoints.tokenEndpoint} with
+\`grant_type=${AGENT_IDENTITY_ASSERTION_GRANT_TYPE}\`. Present the resulting
+access token as \`Authorization: Bearer <access_token>\`. Credentials are scoped,
+short-lived, revocable, and bound to the registered agent identity.
+
+## Errors and safety
+
+- Stop on \`invalid_issuer\`, \`invalid_signature\`, \`invalid_audience\`, or \`replay_detected\`.
+- Reauthenticate the user on \`login_required\`.
+- Open the service-owned confirmation URL on \`interaction_required\`.
+- Never persist claim tokens after completion and never expose credentials in model context.
+`;
+};
+var requiredRegistration = (config) => {
+  if (config.agentRegistration === undefined) {
+    throw new Error("agentAuth.agentRegistration is not configured");
+  }
+  return config.agentRegistration;
+};
+var randomCode = () => {
+  const bytes = crypto.getRandomValues(new Uint8Array(4));
+  const value = new DataView(bytes.buffer).getUint32(0) % 1e6;
+  return value.toString().padStart(6, "0");
+};
+var makeSecret = (prefix) => `${prefix}_${generateSecureToken(TOKEN_BYTES)}`;
+var makeAttempt = async ({
+  email,
+  now,
+  registration
+}) => {
+  const attemptToken = makeSecret("cat");
+  const userCode = randomCode();
+  const expiresAt = now + (registration.attemptTtlMs ?? DEFAULT_ATTEMPT_TTL_MS);
+  return {
+    attempt: {
+      attempts: 0,
+      email: email.toLowerCase(),
+      expiresAt,
+      tokenHash: await hashToken(attemptToken),
+      userCodeHash: await hashToken(userCode)
+    },
+    attemptToken,
+    expiresAt,
+    userCode
+  };
+};
+var createFlow = async ({
+  agentId,
+  kind,
+  loginHint,
+  now,
+  registration,
+  status,
+  upstream,
+  userId,
+  withAttempt
+}) => {
+  const claimToken = makeSecret("clm");
+  const registrationId = `air_${crypto.randomUUID()}`;
+  const claimExpiresAt = now + (registration.claimTtlMs ?? DEFAULT_CLAIM_TTL_MS);
+  const attempt = withAttempt === undefined ? undefined : await makeAttempt({ email: withAttempt, now, registration });
+  const flow = {
+    agentId,
+    claimAttempt: attempt?.attempt,
+    claimExpiresAt,
+    claimTokenHash: await hashToken(claimToken),
+    createdAt: now,
+    expiresAt: claimExpiresAt,
+    kind,
+    loginHint,
+    registrationId,
+    status,
+    updatedAt: now,
+    upstream,
+    userId,
+    version: 1
+  };
+  if (!await registration.identityStore.create(flow)) {
+    throw new Error("Agent identity registration id collision");
+  }
+  return { attempt, claimToken, flow };
+};
+var assertionClaims = (config, flow, now) => ({
+  aud: config.authorizationServer,
+  exp: Math.floor((now + (config.agentRegistration?.assertionTtlMs ?? DEFAULT_ASSERTION_TTL_MS)) / MILLISECONDS_IN_A_SECOND),
+  iat: Math.floor(now / MILLISECONDS_IN_A_SECOND),
+  iss: config.authorizationServer,
+  jti: crypto.randomUUID(),
+  registration_version: flow.version,
+  sub: flow.registrationId
+});
+var issueAgentServiceAssertion = async (config, flow, now = Date.now()) => ({
+  assertion: await signJwt(assertionClaims(config, flow, now), requiredRegistration(config).signingKey, "oauth-id-jag+jwt"),
+  expiresAt: now + (requiredRegistration(config).assertionTtlMs ?? DEFAULT_ASSERTION_TTL_MS)
+});
+var activateAgent = async (config, flow, scopes) => {
+  const now = Date.now();
+  await config.registrationStore.saveRegistration({
+    agentId: flow.agentId,
+    allowedScopes: scopes.filter((scope) => config.scopes.includes(scope)),
+    createdAt: now,
+    metadata: {
+      identityRegistrationId: flow.registrationId,
+      registrationKind: flow.kind
+    },
+    name: `Agent registration ${flow.registrationId}`,
+    status: "active",
+    updatedAt: now
+  });
+  if (flow.userId !== undefined) {
+    await config.delegationStore.saveDelegation({
+      agentId: flow.agentId,
+      createdAt: now,
+      delegationId: `agd_${crypto.randomUUID()}`,
+      scopes: scopes.filter((scope) => config.scopes.includes(scope)),
+      status: "active",
+      updatedAt: now,
+      userId: flow.userId
+    });
+  }
+};
+var ceremony = (config, flow, attempt) => ({
+  expires_in: Math.max(0, Math.floor((attempt.expiresAt - Date.now()) / MILLISECONDS_IN_A_SECOND)),
+  interval: requiredRegistration(config).pollIntervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS,
+  user_code: attempt.userCode,
+  verification_uri: `${agentRegistrationEndpoints(config).completeEndpoint}?claim_attempt_token=${encodeURIComponent(attempt.attemptToken)}`
+});
+var startAgentRegistration = async (config, input, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  const agentId = `agent_${crypto.randomUUID()}`;
+  if (input.type === "anonymous") {
+    if (registration.allowAnonymous !== true) {
+      return { error: "anonymous_not_enabled", status: 403 };
+    }
+    if (registration.revokeAccessTokens === undefined) {
+      throw new Error("Anonymous agent registration requires revokeAccessTokens");
+    }
+    const created2 = await createFlow({
+      agentId,
+      kind: "anonymous",
+      now,
+      registration,
+      status: "pending"
+    });
+    await activateAgent(config, created2.flow, registration.preClaimScopes ?? []);
+    const assertion2 = await issueAgentServiceAssertion(config, created2.flow, now);
+    return {
+      assertionExpires: assertion2.expiresAt,
+      claimToken: created2.claimToken,
+      claimTokenExpires: created2.flow.claimExpiresAt,
+      identityAssertion: assertion2.assertion,
+      postClaimScopes: registration.postClaimScopes,
+      preClaimScopes: registration.preClaimScopes ?? [],
+      registrationId: created2.flow.registrationId,
+      registrationType: "anonymous",
+      status: 200
+    };
+  }
+  if (input.type === "service_auth") {
+    if (registration.allowServiceAuth !== true) {
+      return { error: "service_auth_not_enabled", status: 403 };
+    }
+    const email = input.loginHint.trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/u.test(email)) {
+      return { error: "invalid_login_hint", status: 400 };
+    }
+    const created2 = await createFlow({
+      agentId,
+      kind: "service_auth",
+      loginHint: email,
+      now,
+      registration,
+      status: "pending",
+      withAttempt: email
+    });
+    if (created2.attempt === undefined)
+      throw new Error("Claim attempt missing");
+    return {
+      assertionExpires: 0,
+      claim: ceremony(config, created2.flow, created2.attempt),
+      claimToken: created2.claimToken,
+      claimTokenExpires: created2.flow.claimExpiresAt,
+      postClaimScopes: registration.postClaimScopes,
+      registrationId: created2.flow.registrationId,
+      registrationType: "service_auth",
+      status: 200
+    };
+  }
+  if (input.assertionType !== AGENT_IDENTITY_ASSERTION_TYPE || registration.verifyIdentityAssertion === undefined) {
+    return { error: "invalid_request", status: 400 };
+  }
+  const identity = await registration.verifyIdentityAssertion(input.assertion);
+  if (identity === undefined) {
+    return { error: "invalid_identity_assertion", status: 401 };
+  }
+  const authAge = now - identity.authenticatedAt;
+  if (authAge < -MILLISECONDS_IN_A_MINUTE || authAge > (registration.maxAuthenticationAgeMs ?? DEFAULT_MAX_AUTH_AGE_MS)) {
+    return { error: "login_required", status: 401 };
+  }
+  if (identity.emailVerified !== true && identity.phoneNumberVerified !== true) {
+    return { error: "missing_verified_identity", status: 403 };
+  }
+  const existing = await registration.identityStore.findByUpstreamIdentity({
+    clientId: identity.clientId,
+    issuer: identity.issuer,
+    subject: identity.subject
+  });
+  if (existing?.status === "claimed") {
+    const assertion2 = await issueAgentServiceAssertion(config, existing, now);
+    return {
+      assertionExpires: assertion2.expiresAt,
+      identityAssertion: assertion2.assertion,
+      postClaimScopes: registration.postClaimScopes,
+      registrationId: existing.registrationId,
+      registrationType: "identity_assertion",
+      status: 200
+    };
+  }
+  const match = await registration.resolveVerifiedIdentity?.(identity);
+  const verifiedEmail = identity.emailVerified === true ? identity.email : undefined;
+  if (match?.userId === undefined && verifiedEmail === undefined) {
+    return { error: "interaction_required", status: 401 };
+  }
+  const created = await createFlow({
+    agentId,
+    kind: "identity_assertion",
+    now,
+    registration,
+    status: match?.userId === undefined ? "pending" : "claimed",
+    upstream: {
+      clientId: identity.clientId,
+      issuer: identity.issuer,
+      subject: identity.subject
+    },
+    userId: match?.userId,
+    withAttempt: match?.userId === undefined ? verifiedEmail : undefined
+  });
+  if (match?.userId === undefined) {
+    if (created.attempt === undefined)
+      throw new Error("Claim attempt missing");
+    return {
+      assertionExpires: 0,
+      claim: ceremony(config, created.flow, created.attempt),
+      claimToken: created.claimToken,
+      claimTokenExpires: created.flow.claimExpiresAt,
+      postClaimScopes: registration.postClaimScopes,
+      registrationId: created.flow.registrationId,
+      registrationType: "identity_assertion",
+      status: 200
+    };
+  }
+  await activateAgent(config, created.flow, registration.postClaimScopes);
+  const assertion = await issueAgentServiceAssertion(config, created.flow, now);
+  return {
+    assertionExpires: assertion.expiresAt,
+    identityAssertion: assertion.assertion,
+    postClaimScopes: registration.postClaimScopes,
+    registrationId: created.flow.registrationId,
+    registrationType: "identity_assertion",
+    status: 200
+  };
+};
+var beginAgentClaim = async (config, input, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  const email = input.email.trim().toLowerCase();
+  const claimTokenHash = await hashToken(input.claimToken);
+  for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+    const flow = await registration.identityStore.findByClaimTokenHash(claimTokenHash);
+    if (flow === undefined) {
+      return { error: "invalid_claim_token", status: 400 };
+    }
+    if (flow.claimExpiresAt <= now || flow.status === "revoked") {
+      return { error: "claim_expired", status: 400 };
+    }
+    if (flow.loginHint !== undefined && flow.loginHint !== email) {
+      return { error: "invalid_claim_token", status: 400 };
+    }
+    const attempt = await makeAttempt({ email, now, registration });
+    const replacement = {
+      ...flow,
+      claimAttempt: attempt.attempt,
+      loginHint: email,
+      updatedAt: now
+    };
+    if (await registration.identityStore.replace(replacement, flow.version)) {
+      return {
+        claimAttempt: ceremony(config, replacement, attempt),
+        status: 200
+      };
+    }
+  }
+  return { error: "concurrent_update", status: 409 };
+};
+var completeAgentClaim = async (config, input, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  const user = await registration.resolveAuthenticatedUser(input.request);
+  if (user === undefined)
+    return { error: "wrong_user", status: 403 };
+  const attemptTokenHash = await hashToken(input.attemptToken);
+  const userCodeHash = await hashToken(input.userCode);
+  for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+    const flow = await registration.identityStore.findByAttemptTokenHash(attemptTokenHash);
+    const attempt = flow?.claimAttempt;
+    if (flow === undefined || attempt === undefined) {
+      return { error: "invalid_claim_attempt", status: 400 };
+    }
+    if (flow.claimExpiresAt <= now || attempt.expiresAt <= now) {
+      return { error: "claim_expired", status: 400 };
+    }
+    if (user.email?.toLowerCase() !== attempt.email) {
+      return { error: "wrong_user", status: 403 };
+    }
+    const matches = await constantTimeEqual(userCodeHash, attempt.userCodeHash);
+    if (!matches) {
+      const attempts = attempt.attempts + 1;
+      const locked = attempts >= (registration.maxCodeAttempts ?? DEFAULT_MAX_CODE_ATTEMPTS);
+      const replaced = await registration.identityStore.replace({
+        ...flow,
+        claimAttempt: locked ? undefined : { ...attempt, attempts },
+        updatedAt: now
+      }, flow.version);
+      if (replaced) {
+        return {
+          error: "user_code_invalid",
+          status: locked ? 429 : 400
+        };
+      }
+      continue;
+    }
+    if (flow.kind === "anonymous") {
+      await registration.revokeAccessTokens?.(flow.agentId);
+    }
+    const replacement = {
+      ...flow,
+      claimAttempt: undefined,
+      status: "claimed",
+      updatedAt: now,
+      userId: user.userId
+    };
+    if (!await registration.identityStore.replace(replacement, flow.version)) {
+      continue;
+    }
+    const persisted = await registration.identityStore.findByRegistrationId(flow.registrationId);
+    if (persisted === undefined) {
+      throw new Error("Completed agent registration disappeared");
+    }
+    await activateAgent(config, persisted, registration.postClaimScopes);
+    return { status: 204 };
+  }
+  return { error: "concurrent_update", status: 409 };
+};
+var issueAgentAccessToken = async (config, flow, now) => {
+  const registration = requiredRegistration(config);
+  const accessToken = `at_${generateSecureToken(TOKEN_BYTES)}`;
+  const scopes = (flow.status === "claimed" ? registration.postClaimScopes : registration.preClaimScopes ?? []).filter((scope) => config.scopes.includes(scope));
+  const expiresAt = now + (registration.tokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS);
+  await registration.accessTokenStore.saveToken({
+    clientId: flow.agentId,
+    createdAt: now,
+    expiresAt,
+    hashedToken: await hashToken(accessToken),
+    ownerId: flow.userId,
+    scopes,
+    tokenId: crypto.randomUUID()
+  });
+  return {
+    accessToken,
+    expiresIn: Math.floor((expiresAt - now) / MILLISECONDS_IN_A_SECOND),
+    scopes
+  };
+};
+var createAgentRegistrationCredentialVerifier = (accessTokenStore, identityStore) => async (request) => {
+  const authorization = request.headers.get("authorization");
+  if (authorization?.startsWith("Bearer at_") !== true)
+    return;
+  const token = authorization.slice("Bearer ".length).trim();
+  const record = await accessTokenStore.findByHashedToken(await hashToken(token));
+  if (record === undefined || record.expiresAt <= Date.now())
+    return;
+  if (identityStore !== undefined) {
+    const identity = await identityStore.findByAgentId(record.clientId);
+    if (identity === undefined || identity.status === "revoked") {
+      return;
+    }
+  }
+  return {
+    agentId: record.clientId,
+    expiresAt: record.expiresAt,
+    scopes: record.scopes,
+    userId: record.ownerId
+  };
+};
+var handleAgentTokenGrant = async (config, body, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  if (body.grant_type === AGENT_CLAIM_GRANT_TYPE) {
+    if (body.claim_token === undefined) {
+      return { body: { error: "invalid_request" }, status: 400 };
+    }
+    const claimTokenHash = await hashToken(body.claim_token);
+    let flow2;
+    for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+      flow2 = await registration.identityStore.findByClaimTokenHash(claimTokenHash);
+      if (flow2 === undefined || flow2.claimExpiresAt <= now) {
+        return { body: { error: "expired_token" }, status: 400 };
+      }
+      if (flow2.status === "claimed")
+        break;
+      if (flow2.claimAttempt !== undefined && flow2.claimAttempt.expiresAt <= now) {
+        return { body: { error: "expired_token" }, status: 400 };
+      }
+      const intervalMs = (registration.pollIntervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS) * MILLISECONDS_IN_A_SECOND;
+      if (flow2.lastPolledAt !== undefined && now - flow2.lastPolledAt < intervalMs) {
+        return { body: { error: "slow_down" }, status: 400 };
+      }
+      if (await registration.identityStore.replace({ ...flow2, lastPolledAt: now, updatedAt: now }, flow2.version)) {
+        return {
+          body: { error: "authorization_pending" },
+          status: 400
+        };
+      }
+    }
+    if (flow2?.status !== "claimed") {
+      return { body: { error: "temporarily_unavailable" }, status: 400 };
+    }
+    const assertion = await issueAgentServiceAssertion(config, flow2, now);
+    const token2 = await issueAgentAccessToken(config, flow2, now);
+    return {
+      body: {
+        access_token: token2.accessToken,
+        assertion_expires: new Date(assertion.expiresAt).toISOString(),
+        expires_in: token2.expiresIn,
+        identity_assertion: assertion.assertion,
+        scope: token2.scopes.join(" "),
+        token_type: "Bearer"
+      },
+      status: 200
+    };
+  }
+  if (body.grant_type !== AGENT_IDENTITY_ASSERTION_GRANT_TYPE) {
+    return;
+  }
+  if (body.assertion === undefined) {
+    return { body: { error: "invalid_request" }, status: 400 };
+  }
+  const verified = await verifyJwt(body.assertion, registration.signingKey.publicJwk);
+  const payload = verified?.payload;
+  if (verified?.header?.typ !== "oauth-id-jag+jwt" || payload?.iss !== config.authorizationServer || payload.aud !== config.authorizationServer || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= Math.floor(now / MILLISECONDS_IN_A_SECOND)) {
+    return { body: { error: "invalid_grant" }, status: 400 };
+  }
+  const flow = await registration.identityStore.findByRegistrationId(payload.sub);
+  if (flow === undefined || flow.status === "revoked" || payload.registration_version !== flow.version) {
+    return { body: { error: "invalid_grant" }, status: 400 };
+  }
+  const token = await issueAgentAccessToken(config, flow, now);
+  return {
+    body: {
+      access_token: token.accessToken,
+      expires_in: token.expiresIn,
+      scope: token.scopes.join(" "),
+      token_type: "Bearer"
+    },
+    status: 200
+  };
+};
+var revokeAgentIdentityRegistration = async (config, registrationId, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+    const flow = await registration.identityStore.findByRegistrationId(registrationId);
+    if (flow === undefined)
+      return false;
+    if (flow.status === "revoked")
+      return true;
+    await registration.revokeAccessTokens?.(flow.agentId);
+    if (await registration.identityStore.replace({
+      ...flow,
+      claimAttempt: undefined,
+      status: "revoked",
+      updatedAt: now
+    }, flow.version)) {
+      return true;
+    }
+  }
+  throw new Error("Could not revoke agent identity after concurrent updates");
+};
+// src/agents/registrationClient.ts
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var secureUrl = (value, allowLocalhost) => {
+  if (typeof value !== "string")
+    return;
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:")
+      return url.toString();
+    if (allowLocalhost && url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1")) {
+      return url.toString();
+    }
+  } catch {
+    return;
+  }
+  return;
+};
+var readBoundedJson = async (response, maxBytes) => {
+  const length = Number(response.headers.get("content-length"));
+  if (Number.isFinite(length) && length > maxBytes) {
+    throw new Error("Agent registration metadata exceeds the response limit");
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > maxBytes) {
+    throw new Error("Agent registration metadata exceeds the response limit");
+  }
+  const parsed = JSON.parse(new TextDecoder().decode(bytes));
+  return parsed;
+};
+var stringArray = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var requestJson = async (request, url, init, maxBytes) => {
+  const response = await request(url, {
+    ...init,
+    headers: {
+      accept: "application/json",
+      ...init.headers
+    },
+    redirect: "error"
+  });
+  const body = await readBoundedJson(response, maxBytes);
+  if (!isObject(body))
+    throw new Error("Expected a JSON object");
+  return { body, response };
+};
+var createAgentRegistrationClient = (discovery, options = {}) => {
+  const request = options.request ?? fetch;
+  const maxBytes = options.maxResponseBytes ?? 256 * 1024;
+  const post = (url, body, form = false) => requestJson(request, url, {
+    body: form ? new URLSearchParams(Object.fromEntries(Object.entries(body).map(([key, value]) => [
+      key,
+      String(value)
+    ]))) : JSON.stringify(body),
+    headers: {
+      "content-type": form ? "application/x-www-form-urlencoded" : "application/json"
+    },
+    method: "POST"
+  }, maxBytes);
+  return {
+    beginAnonymous: () => post(discovery.agentAuth.identityEndpoint, { type: "anonymous" }),
+    beginServiceAuth: (loginHint) => post(discovery.agentAuth.identityEndpoint, {
+      login_hint: loginHint,
+      type: "service_auth"
+    }),
+    beginVerified: (assertion) => {
+      if (!discovery.agentAuth.identityAssertionTypes.includes(AGENT_IDENTITY_ASSERTION_TYPE)) {
+        throw new Error("Service does not accept ID-JAG assertions");
+      }
+      return post(discovery.agentAuth.identityEndpoint, {
+        assertion,
+        assertion_type: AGENT_IDENTITY_ASSERTION_TYPE,
+        type: "identity_assertion"
+      });
+    },
+    claim: (claimToken, email) => post(discovery.agentAuth.claimEndpoint, {
+      claim_token: claimToken,
+      email
+    }),
+    exchangeAssertion: (assertion) => post(discovery.tokenEndpoint, {
+      assertion,
+      grant_type: AGENT_IDENTITY_ASSERTION_GRANT_TYPE,
+      resource: discovery.resource
+    }, true),
+    pollClaim: (claimToken) => post(discovery.tokenEndpoint, {
+      claim_token: claimToken,
+      grant_type: AGENT_CLAIM_GRANT_TYPE
+    }, true)
+  };
+};
+var discoverAgentRegistration = async (resource, options = {}) => {
+  const request = options.request ?? fetch;
+  const maxBytes = options.maxResponseBytes ?? 256 * 1024;
+  const allowLocalhost = options.allowInsecureLocalhost === true;
+  const resourceUrl = secureUrl(resource, allowLocalhost);
+  if (resourceUrl === undefined)
+    throw new Error("Resource URL must use HTTPS");
+  const resourceMetadataUrl = new URL("/.well-known/oauth-protected-resource", resourceUrl).toString();
+  const prm = await requestJson(request, resourceMetadataUrl, {}, maxBytes);
+  const advertisedResource = secureUrl(prm.body.resource, allowLocalhost);
+  if (advertisedResource === undefined || advertisedResource !== resourceUrl) {
+    throw new Error("Protected resource metadata identity mismatch");
+  }
+  const authorizationServer = secureUrl(stringArray(prm.body.authorization_servers)[0], allowLocalhost);
+  if (authorizationServer === undefined) {
+    throw new Error("No secure authorization server is advertised");
+  }
+  const asUrl = new URL("/.well-known/oauth-authorization-server", authorizationServer).toString();
+  const metadata = await requestJson(request, asUrl, {}, maxBytes);
+  if (secureUrl(metadata.body.issuer, allowLocalhost) !== authorizationServer) {
+    throw new Error("Authorization server issuer mismatch");
+  }
+  const tokenEndpoint = secureUrl(metadata.body.token_endpoint, allowLocalhost);
+  const agentAuth = metadata.body.agent_auth;
+  if (tokenEndpoint === undefined || !isObject(agentAuth)) {
+    throw new Error("Authorization server does not advertise agent registration");
+  }
+  const identityEndpoint = secureUrl(agentAuth.identity_endpoint, allowLocalhost);
+  const claimEndpoint = secureUrl(agentAuth.claim_endpoint, allowLocalhost);
+  const skill = secureUrl(agentAuth.skill, allowLocalhost);
+  const assertionMetadata = agentAuth.identity_assertion;
+  if (identityEndpoint === undefined || claimEndpoint === undefined || skill === undefined || !isObject(assertionMetadata)) {
+    throw new Error("Agent registration metadata is incomplete");
+  }
+  return {
+    agentAuth: {
+      claimEndpoint,
+      identityAssertionTypes: stringArray(assertionMetadata.assertion_types_supported),
+      identityEndpoint,
+      identityTypes: stringArray(agentAuth.identity_types_supported),
+      skill
+    },
+    authorizationServer,
+    resource: resourceUrl,
+    resourceMetadataUrl,
+    scopes: stringArray(prm.body.scopes_supported),
+    tokenEndpoint
+  };
+};
+// src/agents/idJag.ts
+init_constants();
+var createInMemoryAgentIdentityAssertionJtiStore = () => {
+  const entries = new Map;
+  return {
+    recordIfFresh: async (issuer, jti, expiresAt) => {
+      const now = Date.now();
+      for (const [key2, expiry] of entries) {
+        if (expiry <= now)
+          entries.delete(key2);
+      }
+      const key = `${issuer}\x00${jti}`;
+      if (entries.has(key))
+        return false;
+      entries.set(key, expiresAt);
+      return true;
+    }
+  };
+};
+var issueAgentIdentityAssertion = async ({
+  agentContextId,
+  agentPlatform,
+  audience,
+  clientId,
+  issuer,
+  now = Date.now(),
+  resource,
+  signingKey,
+  ttlMs = 5 * 60 * MILLISECONDS_IN_A_SECOND,
+  user
+}) => {
+  if (user.emailVerified !== true && user.phoneNumberVerified !== true) {
+    throw new Error("ID-JAG issuance requires a verified email or phone number");
+  }
+  const expiresAt = now + ttlMs;
+  const payload = {
+    aud: audience,
+    auth_time: Math.floor(user.authenticatedAt / MILLISECONDS_IN_A_SECOND),
+    client_id: clientId,
+    exp: Math.floor(expiresAt / MILLISECONDS_IN_A_SECOND),
+    iat: Math.floor(now / MILLISECONDS_IN_A_SECOND),
+    iss: issuer,
+    jti: crypto.randomUUID(),
+    sub: user.subject
+  };
+  if (user.email !== undefined)
+    payload.email = user.email;
+  if (user.emailVerified !== undefined)
+    payload.email_verified = user.emailVerified;
+  if (user.name !== undefined)
+    payload.name = user.name;
+  if (user.phoneNumber !== undefined)
+    payload.phone_number = user.phoneNumber;
+  if (user.phoneNumberVerified !== undefined)
+    payload.phone_number_verified = user.phoneNumberVerified;
+  if (user.methods !== undefined)
+    payload.amr = user.methods;
+  if (resource !== undefined)
+    payload.resource = resource;
+  if (agentPlatform !== undefined)
+    payload.agent_platform = agentPlatform;
+  if (agentContextId !== undefined)
+    payload.agent_context_id = agentContextId;
+  return {
+    assertion: await signJwt(payload, signingKey, "oauth-id-jag+jwt"),
+    assertionType: AGENT_IDENTITY_ASSERTION_TYPE,
+    expiresAt
+  };
+};
+var numberClaim = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+var stringClaim = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+var createAgentIdentityAssertionVerifier = ({
+  audience,
+  clockSkewMs = MILLISECONDS_IN_A_SECOND * 60,
+  jtiStore,
+  maxAssertionLifetimeMs = MILLISECONDS_IN_A_SECOND * 60 * 60,
+  maxAuthenticationAgeMs = MILLISECONDS_IN_A_SECOND * 60 * 60,
+  resolveIssuer
+}) => async (assertion, now = Date.now()) => {
+  const segments = assertion.split(".");
+  if (segments.length !== 3 || segments[1] === undefined)
+    return;
+  let decoded;
+  try {
+    decoded = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+  } catch {
+    return;
+  }
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+    return;
+  }
+  const unverified = Object.fromEntries(Object.entries(decoded));
+  const issuer = stringClaim(unverified.iss);
+  if (issuer === undefined)
+    return;
+  const trusted = await resolveIssuer(issuer);
+  if (trusted === undefined)
+    return;
+  const verified = await verifyJwt(assertion, trusted.publicJwk);
+  if (verified?.header?.typ !== "oauth-id-jag+jwt")
+    return;
+  const { payload } = verified;
+  const subject = stringClaim(payload.sub);
+  const jti = stringClaim(payload.jti);
+  const clientId = stringClaim(payload.client_id);
+  const expiresAtSeconds = numberClaim(payload.exp);
+  const issuedAtSeconds = numberClaim(payload.iat);
+  const authenticatedAtSeconds = numberClaim(payload.auth_time);
+  if (payload.iss !== issuer || payload.aud !== audience || subject === undefined || jti === undefined || clientId === undefined || expiresAtSeconds === undefined || issuedAtSeconds === undefined || authenticatedAtSeconds === undefined) {
+    return;
+  }
+  const expiresAt = expiresAtSeconds * MILLISECONDS_IN_A_SECOND;
+  const issuedAt = issuedAtSeconds * MILLISECONDS_IN_A_SECOND;
+  const authenticatedAt = authenticatedAtSeconds * MILLISECONDS_IN_A_SECOND;
+  if (expiresAt <= now - clockSkewMs || issuedAt > now + clockSkewMs || expiresAt <= issuedAt || expiresAt - issuedAt > maxAssertionLifetimeMs + clockSkewMs || authenticatedAt > now + clockSkewMs || authenticatedAt > issuedAt + clockSkewMs || now - authenticatedAt > maxAuthenticationAgeMs + clockSkewMs) {
+    return;
+  }
+  if (trusted.allowedClientIds !== undefined && !trusted.allowedClientIds.includes(clientId)) {
+    return;
+  }
+  const email = stringClaim(payload.email);
+  const phoneNumber = stringClaim(payload.phone_number);
+  const emailVerified = payload.email_verified === true;
+  const phoneNumberVerified = payload.phone_number_verified === true;
+  if (!emailVerified && !phoneNumberVerified)
+    return;
+  if (!await jtiStore.recordIfFresh(issuer, jti, expiresAt)) {
+    return;
+  }
+  return {
+    authenticatedAt,
+    clientId,
+    email,
+    emailVerified,
+    issuer,
+    name: stringClaim(payload.name),
+    phoneNumber,
+    phoneNumberVerified,
+    subject
+  };
+};
 // src/oidc/clientIdMetadata.ts
-var secureUrl = (value) => {
+var secureUrl2 = (value) => {
   try {
     return new URL(value).protocol === "https:";
   } catch {
@@ -77,7 +1147,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
   const errors = [];
   if (document.client_id !== expectedClientId)
     errors.push("client_id does not match the metadata document URL");
-  if (!secureUrl(document.client_id))
+  if (!secureUrl2(document.client_id))
     errors.push("client_id must use HTTPS");
   if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
     errors.push("redirect_uris is required");
@@ -97,7 +1167,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
     ["tos_uri", document.tos_uri],
     ["jwks_uri", document.jwks_uri]
   ]) {
-    if (value !== undefined && !secureUrl(value))
+    if (value !== undefined && !secureUrl2(value))
       errors.push(`${name} must use HTTPS`);
   }
   return errors;
@@ -120,7 +1190,7 @@ var createClientIdMetadataResolver = ({
 }) => {
   const cache = new Map;
   return async (clientId) => {
-    if (!secureUrl(clientId) || !await allow(clientId))
+    if (!secureUrl2(clientId) || !await allow(clientId))
       return;
     const cached = cache.get(clientId);
     if (cached !== undefined && cached.expiresAt > now())
@@ -150,62 +1220,6 @@ var createClientIdMetadataResolver = ({
     return client;
   };
 };
-// src/oidc/keys.ts
-var ENCODER = new TextEncoder;
-var ES256 = { hash: "SHA-256", name: "ECDSA" };
-var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
-var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
-var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
-var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
-var decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-var generateSigningKey = async () => {
-  const pair = await crypto.subtle.generateKey(KEY_PARAMS, true, [
-    "sign",
-    "verify"
-  ]);
-  const privateJwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
-  const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
-  return { kid: await jwkThumbprint(publicJwk), privateJwk, publicJwk };
-};
-var jwkThumbprint = async (jwk) => {
-  const canonical = JSON.stringify({
-    crv: jwk.crv,
-    kty: jwk.kty,
-    x: jwk.x,
-    y: jwk.y
-  });
-  return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
-};
-var signJwt = async (payload, signing) => {
-  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
-  const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ: "JWT" })}.${encodeSegment(payload)}`;
-  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
-  return `${input}.${toBase64Url(signature)}`;
-};
-var toPublicJwk = (key) => ({
-  alg: "ES256",
-  crv: key.publicJwk.crv,
-  kid: key.kid,
-  kty: key.publicJwk.kty,
-  use: "sig",
-  x: key.publicJwk.x,
-  y: key.publicJwk.y
-});
-var verifyJwt = async (token, publicJwk) => {
-  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
-  if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
-    return;
-  }
-  const key = await crypto.subtle.importKey("jwk", publicJwk, KEY_PARAMS, false, ["verify"]);
-  const valid = await crypto.subtle.verify(ES256, key, fromBase64Url(signatureSegment), ENCODER.encode(`${headerSegment}.${payloadSegment}`));
-  if (!valid)
-    return;
-  return {
-    header: decodeSegment(headerSegment),
-    payload: decodeSegment(payloadSegment)
-  };
-};
-
 // src/oidc/dpop.ts
 init_constants();
 var DEFAULT_MAX_AGE_MS = 60000;
@@ -411,10 +1425,16 @@ var resolveAgentPrincipal = async (request, config) => {
 };
 // src/agents/routes.ts
 import { Elysia } from "elysia";
+var DELETE_CODE_POINT = 127;
+var HTTP_BAD_REQUEST = 400;
+var HTTP_FORBIDDEN = 403;
+var HTTP_OK = 200;
+var HTTP_UNAUTHORIZED = 401;
+var MINIMUM_PRINTABLE_CODE_POINT = 32;
 var quoteHeaderValue = (value) => {
   const printable = [...value].filter((character) => {
     const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint >= 32 && codePoint !== 127;
+    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
   }).join("");
   return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
 };
@@ -447,41 +1467,177 @@ var failureResponse = (config, failure, requiredScopes) => new Response(JSON.str
       requiredScopes
     })
   },
-  status: failure.code === "Forbidden" ? 403 : 401
+  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED
 });
-var agentAuthPlugin = (config) => {
-  const plugin = new Elysia().derive(({ request }) => ({
-    protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
-      if (config === undefined) {
-        const failure = {
-          code: "Unauthorized",
-          message: "Agent is not authenticated"
-        };
-        return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
-      }
-      const principal = await resolveAgentPrincipal(request, config);
-      if (principal === undefined) {
-        const failure = {
-          code: "Unauthorized",
-          message: "Agent is not authenticated"
-        };
-        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-      }
-      if (!agentHasScopes(principal, requiredScopes)) {
-        const failure = {
-          code: "Forbidden",
-          message: "Insufficient agent scopes"
-        };
-        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-      }
-      return handleAuth(principal);
+var json = (value, status = HTTP_OK) => new Response(JSON.stringify(value), {
+  headers: {
+    "cache-control": "no-store",
+    "content-type": "application/json"
+  },
+  status
+});
+var recordBody = (body) => {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(body));
+};
+var registrationResponse = (result) => {
+  const body = {
+    ...result.assertionExpires > 0 ? {
+      assertion_expires: new Date(result.assertionExpires).toISOString()
+    } : {},
+    ...result.claim === undefined ? {} : { claim: result.claim },
+    ...result.claimToken === undefined ? {} : { claim_token: result.claimToken },
+    ...result.claimTokenExpires === undefined ? {} : {
+      claim_token_expires: new Date(result.claimTokenExpires).toISOString()
+    },
+    ...result.identityAssertion === undefined ? {} : { identity_assertion: result.identityAssertion },
+    ...result.preClaimScopes === undefined ? {} : { pre_claim_scopes: result.preClaimScopes },
+    post_claim_scopes: result.postClaimScopes,
+    registration_id: result.registrationId,
+    registration_type: result.registrationType
+  };
+  if (result.registrationType === "identity_assertion" && result.identityAssertion === undefined) {
+    return json({
+      ...body,
+      error: "interaction_required",
+      error_description: "Authenticate at the service and confirm the account link."
+    }, HTTP_UNAUTHORIZED);
+  }
+  return json(body);
+};
+var parseRegistrationInput = (value) => {
+  if (value.type === "anonymous") {
+    const input2 = { type: "anonymous" };
+    return input2;
+  }
+  if (value.type === "service_auth" && typeof value.login_hint === "string") {
+    const input2 = {
+      loginHint: value.login_hint,
+      type: "service_auth"
+    };
+    return input2;
+  }
+  if (value.type !== "identity_assertion" || value.assertion_type !== AGENT_IDENTITY_ASSERTION_TYPE || typeof value.assertion !== "string") {
+    return;
+  }
+  const input = {
+    assertion: value.assertion,
+    assertionType: AGENT_IDENTITY_ASSERTION_TYPE,
+    type: "identity_assertion"
+  };
+  return input;
+};
+var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+var agentAuthContextPlugin = (config) => new Elysia().derive(({ request }) => ({
+  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+    if (config === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
     }
-  }));
+    const principal = await resolveAgentPrincipal(request, config);
+    if (principal === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    if (!agentHasScopes(principal, requiredScopes)) {
+      const failure = {
+        code: "Forbidden",
+        message: "Insufficient agent scopes"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    return handleAuth(principal);
+  }
+}));
+var agentAuthPlugin = (config) => {
+  const plugin = agentAuthContextPlugin(config);
   if (config === undefined)
     return plugin.as("global");
-  return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).as("global");
+  if (config.agentRegistration === undefined) {
+    return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).as("global");
+  }
+  const registration = config.agentRegistration;
+  const identityRoute = registration.identityRoute ?? "/agent/identity";
+  const claimRoute = registration.claimRoute ?? "/agent/identity/claim";
+  const completeRoute = registration.completeRoute ?? "/agent/identity/claim/complete";
+  const guideRoute = registration.guideRoute ?? "/auth.md";
+  return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).get(guideRoute, () => new Response(generateAgentRegistrationGuide(config), {
+    headers: {
+      "cache-control": "public, max-age=300",
+      "content-type": "text/markdown; charset=utf-8"
+    }
+  })).get(completeRoute, ({ query }) => {
+    const token = typeof query.claim_attempt_token === "string" ? query.claim_attempt_token : "";
+    if (token.length === 0)
+      return new Response("Invalid claim link", { status: 400 });
+    return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="robots" content="noindex"><title>Confirm agent registration</title></head><body><main><h1>Confirm agent registration</h1><p>Sign in to this service, verify the agent and scopes shown by your agent, then enter the six-digit code.</p><form method="post"><input type="hidden" name="claim_attempt_token" value="${escapeHtml(token)}"><label>Code <input name="user_code" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9]{6}" required></label><button type="submit">Confirm</button></form></main></body></html>`, {
+      headers: {
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'none'; form-action 'self'; style-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+        "content-type": "text/html; charset=utf-8",
+        "x-content-type-options": "nosniff"
+      }
+    });
+  }).post(identityRoute, async ({ body }) => {
+    const value = recordBody(body);
+    if (value === undefined || typeof value.type !== "string") {
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST);
+    }
+    const input = parseRegistrationInput(value);
+    if (input === undefined)
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST);
+    const result = await startAgentRegistration(config, input);
+    if ("error" in result) {
+      return json({
+        error: result.error,
+        ...result.message === undefined ? {} : { error_description: result.message }
+      }, result.status);
+    }
+    return registrationResponse(result);
+  }).post(claimRoute, async ({ body }) => {
+    const value = recordBody(body);
+    if (value === undefined || typeof value.claim_token !== "string" || typeof value.email !== "string") {
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST);
+    }
+    const result = await beginAgentClaim(config, {
+      claimToken: value.claim_token,
+      email: value.email
+    });
+    if ("error" in result)
+      return json({ error: result.error }, result.status);
+    return json({ claim_attempt: result.claimAttempt });
+  }).post(completeRoute, async ({ body, request }) => {
+    let value = recordBody(body);
+    if (value === undefined && typeof body === "string") {
+      value = Object.fromEntries(new URLSearchParams(body));
+    }
+    if (value === undefined || typeof value.claim_attempt_token !== "string" || typeof value.user_code !== "string") {
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST);
+    }
+    const result = await completeAgentClaim(config, {
+      attemptToken: value.claim_attempt_token,
+      request,
+      userCode: value.user_code
+    });
+    if ("error" in result)
+      return json({ error: result.error }, result.status);
+    return new Response(null, { status: 204 });
+  }).as("global");
 };
 // src/agents/inMemoryStores.ts
+var cloneIdentityRegistration = (value) => ({
+  ...value,
+  claimAttempt: value.claimAttempt === undefined ? undefined : { ...value.claimAttempt },
+  upstream: value.upstream === undefined ? undefined : { ...value.upstream }
+});
 var cloneRegistration = (value) => ({
   ...value,
   allowedScopes: [...value.allowedScopes],
@@ -516,6 +1672,48 @@ var createInMemoryAgentDelegationStore = () => {
     }
   };
 };
+var createInMemoryAgentIdentityRegistrationStore = () => {
+  const registrations = new Map;
+  return {
+    create: async (registration) => {
+      const conflicts = [...registrations.values()].some((existing) => existing.registrationId === registration.registrationId || existing.agentId === registration.agentId || existing.claimTokenHash === registration.claimTokenHash || existing.claimAttempt !== undefined && existing.claimAttempt.tokenHash === registration.claimAttempt?.tokenHash || existing.upstream !== undefined && registration.upstream !== undefined && existing.upstream.clientId === registration.upstream.clientId && existing.upstream.issuer === registration.upstream.issuer && existing.upstream.subject === registration.upstream.subject);
+      if (conflicts)
+        return false;
+      registrations.set(registration.registrationId, cloneIdentityRegistration(registration));
+      return true;
+    },
+    findByAgentId: async (agentId) => {
+      const value = [...registrations.values()].find((registration) => registration.agentId === agentId);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByAttemptTokenHash: async (attemptTokenHash) => {
+      const value = [...registrations.values()].find((registration) => registration.claimAttempt?.tokenHash === attemptTokenHash);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByClaimTokenHash: async (claimTokenHash) => {
+      const value = [...registrations.values()].find((registration) => registration.claimTokenHash === claimTokenHash);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByRegistrationId: async (registrationId) => {
+      const value = registrations.get(registrationId);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByUpstreamIdentity: async ({ clientId, issuer, subject }) => {
+      const value = [...registrations.values()].find((registration) => registration.upstream?.clientId === clientId && registration.upstream?.issuer === issuer && registration.upstream.subject === subject);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    replace: async (registration, expectedVersion) => {
+      const current = registrations.get(registration.registrationId);
+      if (current?.version !== expectedVersion)
+        return false;
+      registrations.set(registration.registrationId, cloneIdentityRegistration({
+        ...registration,
+        version: expectedVersion + 1
+      }));
+      return true;
+    }
+  };
+};
 var createInMemoryAgentRegistrationStore = () => {
   const registrations = new Map;
   return {
@@ -1824,7 +3022,7 @@ function getColumnNameAndConfig2(a, b) {
     config: typeof a === "object" ? a : b
   };
 }
-var textDecoder2 = typeof TextDecoder === "undefined" ? null : new TextDecoder;
+var textDecoder3 = typeof TextDecoder === "undefined" ? null : new TextDecoder;
 function assertUnreachable2(_x) {
   throw new Error("Didn't expect to get here");
 }
@@ -2875,7 +4073,7 @@ var PgJson = class extends PgColumn {
     return "json";
   }
 };
-function json(name2) {
+function json2(name2) {
   return new PgJsonBuilder(name2 ?? "");
 }
 
@@ -3412,7 +4610,7 @@ function getPgColumnBuilders() {
     inet,
     integer,
     interval,
-    json,
+    json: json2,
     jsonb,
     line,
     macaddr,
@@ -3629,6 +4827,9 @@ var Index = class {
 function index(name2) {
   return new IndexBuilderOn(false, name2);
 }
+function uniqueIndex(name2) {
+  return new IndexBuilderOn(true, name2);
+}
 // node_modules/drizzle-orm/pg-core/checks.js
 var CheckBuilder = class {
   static [entityKind] = "PgCheckBuilder";
@@ -11377,6 +12578,38 @@ var agentDelegationsTable = pgTable("auth_agent_delegations", {
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar("user_id", { length: ID_LENGTH }).notNull()
 });
+var agentIdentityRegistrationsTable = pgTable("auth_agent_identity_registrations", {
+  agent_id: varchar("agent_id", { length: ID_LENGTH }).notNull().unique(),
+  claim_attempt: jsonb("claim_attempt").$type(),
+  claim_attempt_token_hash: varchar("claim_attempt_token_hash", {
+    length: ID_LENGTH
+  }).unique(),
+  claim_expires_at_ms: bigint("claim_expires_at_ms", {
+    mode: "number"
+  }).notNull(),
+  claim_token_hash: varchar("claim_token_hash", {
+    length: ID_LENGTH
+  }).notNull().unique(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  kind: varchar("kind", { length: 32 }).$type().notNull(),
+  last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
+  login_hint: varchar("login_hint", { length: ID_LENGTH }),
+  registration_id: varchar("registration_id", {
+    length: ID_LENGTH
+  }).primaryKey(),
+  status: varchar("status", { length: STATUS_LENGTH }).$type().notNull(),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
+  upstream_client_id: varchar("upstream_client_id", {
+    length: ID_LENGTH
+  }),
+  upstream_issuer: varchar("upstream_issuer", { length: ID_LENGTH }),
+  upstream_subject: varchar("upstream_subject", { length: ID_LENGTH }),
+  user_id: varchar("user_id", { length: ID_LENGTH }),
+  version: integer("version").notNull()
+}, (table) => [
+  uniqueIndex("auth_agent_identity_upstream_unique").on(table.upstream_issuer, table.upstream_subject, table.upstream_client_id)
+]);
 var agentRegistrationsTable = pgTable("auth_agent_registrations", {
   agent_id: varchar("agent_id", { length: ID_LENGTH }).primaryKey(),
   allowed_scopes: jsonb("allowed_scopes").$type().notNull().default([]),
@@ -11409,7 +12642,49 @@ var toDelegation = (row) => ({
   updatedAt: row.updated_at_ms,
   userId: row.user_id
 });
+var toIdentityRegistration = (row) => ({
+  agentId: row.agent_id,
+  claimAttempt: row.claim_attempt ?? undefined,
+  claimExpiresAt: row.claim_expires_at_ms,
+  claimTokenHash: row.claim_token_hash,
+  createdAt: row.created_at_ms,
+  expiresAt: row.expires_at_ms,
+  kind: row.kind,
+  lastPolledAt: row.last_polled_at_ms ?? undefined,
+  loginHint: row.login_hint ?? undefined,
+  registrationId: row.registration_id,
+  status: row.status,
+  updatedAt: row.updated_at_ms,
+  upstream: row.upstream_client_id === null || row.upstream_issuer === null || row.upstream_subject === null ? undefined : {
+    clientId: row.upstream_client_id,
+    issuer: row.upstream_issuer,
+    subject: row.upstream_subject
+  },
+  userId: row.user_id ?? undefined,
+  version: row.version
+});
+var identityRegistrationValues = (registration) => ({
+  agent_id: registration.agentId,
+  claim_attempt: registration.claimAttempt ?? null,
+  claim_attempt_token_hash: registration.claimAttempt?.tokenHash ?? null,
+  claim_expires_at_ms: registration.claimExpiresAt,
+  claim_token_hash: registration.claimTokenHash,
+  created_at_ms: registration.createdAt,
+  expires_at_ms: registration.expiresAt,
+  kind: registration.kind,
+  last_polled_at_ms: registration.lastPolledAt ?? null,
+  login_hint: registration.loginHint ?? null,
+  registration_id: registration.registrationId,
+  status: registration.status,
+  updated_at_ms: registration.updatedAt,
+  upstream_client_id: registration.upstream?.clientId ?? null,
+  upstream_issuer: registration.upstream?.issuer ?? null,
+  upstream_subject: registration.upstream?.subject ?? null,
+  user_id: registration.userId ?? null,
+  version: registration.version
+});
 var createNeonAgentDelegationStore = (databaseUrl) => createPostgresAgentDelegationStore(createNeonDatabase(databaseUrl));
+var createNeonAgentIdentityRegistrationStore = (databaseUrl) => createPostgresAgentIdentityRegistrationStore(createNeonDatabase(databaseUrl));
 var createNeonAgentRegistrationStore = (databaseUrl) => createPostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));
 var createPostgresAgentDelegationStore = (db) => ({
   findActiveDelegation: async ({
@@ -11450,6 +12725,41 @@ var createPostgresAgentDelegationStore = (db) => ({
     });
   }
 });
+var createPostgresAgentIdentityRegistrationStore = (db) => ({
+  create: async (registration) => {
+    const rows = await db.insert(agentIdentityRegistrationsTable).values(identityRegistrationValues(registration)).onConflictDoNothing().returning({ id: agentIdentityRegistrationsTable.registration_id });
+    return rows.length === 1;
+  },
+  findByAgentId: async (agentId) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.agent_id, agentId)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByAttemptTokenHash: async (attemptTokenHash) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.claim_attempt_token_hash, attemptTokenHash)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByClaimTokenHash: async (claimTokenHash) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.claim_token_hash, claimTokenHash)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByRegistrationId: async (registrationId) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.registration_id, registrationId)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByUpstreamIdentity: async ({ clientId, issuer, subject }) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(and(eq(agentIdentityRegistrationsTable.upstream_client_id, clientId), eq(agentIdentityRegistrationsTable.upstream_issuer, issuer), eq(agentIdentityRegistrationsTable.upstream_subject, subject))).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  replace: async (registration, expectedVersion) => {
+    const next = {
+      ...registration,
+      version: expectedVersion + 1
+    };
+    const values = identityRegistrationValues(next);
+    const rows = await db.update(agentIdentityRegistrationsTable).set(values).where(and(eq(agentIdentityRegistrationsTable.registration_id, registration.registrationId), eq(agentIdentityRegistrationsTable.version, expectedVersion))).returning({ id: agentIdentityRegistrationsTable.registration_id });
+    return rows.length === 1;
+  }
+});
 var createPostgresAgentRegistrationStore = (db) => ({
   findByAgentId: async (agentId) => {
     const [row] = await db.select().from(agentRegistrationsTable).where(eq(agentRegistrationsTable.agent_id, agentId)).limit(1);
@@ -11482,24 +12792,46 @@ var createPostgresAgentRegistrationStore = (db) => ({
 });
 export {
   validateClientIdMetadataDocument,
+  startAgentRegistration,
+  revokeAgentIdentityRegistration,
   resolveAgentPrincipal,
+  issueAgentServiceAssertion,
+  issueAgentIdentityAssertion,
+  handleAgentTokenGrant,
+  generateAgentRegistrationGuide,
+  discoverAgentRegistration,
   createPostgresAgentRegistrationStore,
+  createPostgresAgentIdentityRegistrationStore,
   createPostgresAgentDelegationStore,
   createOidcAgentCredentialVerifier,
   createNeonAgentRegistrationStore,
+  createNeonAgentIdentityRegistrationStore,
   createNeonAgentDelegationStore,
   createInMemoryAgentRegistrationStore,
+  createInMemoryAgentIdentityRegistrationStore,
+  createInMemoryAgentIdentityAssertionJtiStore,
   createInMemoryAgentDelegationStore,
   createClientIdMetadataResolver,
+  createAgentRegistrationCredentialVerifier,
+  createAgentRegistrationClient,
+  createAgentIdentityAssertionVerifier,
+  completeAgentClaim,
   clientIdMetadataToOAuthClient,
+  beginAgentClaim,
   agentRegistrationsTable,
+  agentRegistrationEndpoints,
+  agentRegistrationDiscoveryMetadata,
   agentProtectedResourceMetadata,
+  agentIdentityRegistrationsTable,
   agentHasScopes,
   agentDelegationsTable,
   agentAuthPlugin,
   agentAuthChallenge,
-  DEFAULT_AGENT_RESOURCE_METADATA_ROUTE
+  DEFAULT_AGENT_RESOURCE_METADATA_ROUTE,
+  AGENT_IDENTITY_ASSERTION_TYPE,
+  AGENT_IDENTITY_ASSERTION_GRANT_TYPE,
+  AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=BF8C5C40CCB4AFB564756E2164756E21
+//# debugId=05CB90C7C290284064756E2164756E21
 //# sourceMappingURL=index.js.map