@absolutejs/auth 0.54.9 → 0.55.1

package/dist/index.js

@@ -3112,11 +3112,684 @@ var resolveAgentPrincipal = async (request, config) => {
   };
 };
 
+// src/agents/registration.ts
+init_constants();
+init_crypto();
+
+// src/oidc/keys.ts
+var ENCODER = new TextEncoder;
+var ES256 = { hash: "SHA-256", name: "ECDSA" };
+var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
+var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
+var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+var decodeSegment = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return;
+    }
+    return Object.fromEntries(Object.entries(value));
+  } catch {
+    return;
+  }
+};
+var generateSigningKey = async () => {
+  const pair = await crypto.subtle.generateKey(KEY_PARAMS, true, [
+    "sign",
+    "verify"
+  ]);
+  const privateJwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+  const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
+  return { kid: await jwkThumbprint(publicJwk), privateJwk, publicJwk };
+};
+var jwkThumbprint = async (jwk) => {
+  const canonical = JSON.stringify({
+    crv: jwk.crv,
+    kty: jwk.kty,
+    x: jwk.x,
+    y: jwk.y
+  });
+  return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
+};
+var signJwt = async (payload, signing, typ = "JWT") => {
+  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+  const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
+  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
+  return `${input}.${toBase64Url(signature)}`;
+};
+var toPublicJwk = (key) => ({
+  alg: "ES256",
+  crv: key.publicJwk.crv,
+  kid: key.kid,
+  kty: key.publicJwk.kty,
+  use: "sig",
+  x: key.publicJwk.x,
+  y: key.publicJwk.y
+});
+var verifyJwt = async (token, publicJwk) => {
+  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
+  if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
+    return;
+  }
+  const key = await crypto.subtle.importKey("jwk", publicJwk, KEY_PARAMS, false, ["verify"]);
+  const valid = await crypto.subtle.verify(ES256, key, fromBase64Url(signatureSegment), ENCODER.encode(`${headerSegment}.${payloadSegment}`));
+  if (!valid)
+    return;
+  const header = decodeSegment(headerSegment);
+  const payload = decodeSegment(payloadSegment);
+  if (header === undefined || payload === undefined)
+    return;
+  return {
+    header,
+    payload
+  };
+};
+
+// src/agents/registration.ts
+var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
+var AGENT_IDENTITY_ASSERTION_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var AGENT_IDENTITY_ASSERTION_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
+var DEFAULT_IDENTITY_ROUTE = "/agent/identity";
+var DEFAULT_CLAIM_ROUTE = "/agent/identity/claim";
+var DEFAULT_COMPLETE_ROUTE = "/agent/identity/claim/complete";
+var DEFAULT_GUIDE_ROUTE = "/auth.md";
+var DEFAULT_CLAIM_TTL_MS = 24 * 60 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ATTEMPT_TTL_MS = 10 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ASSERTION_TTL_MS = 60 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_ACCESS_TOKEN_TTL_MS2 = 15 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_MAX_AUTH_AGE_MS = 60 * MILLISECONDS_IN_A_MINUTE;
+var DEFAULT_POLL_INTERVAL_SECONDS = 5;
+var DEFAULT_MAX_CODE_ATTEMPTS = 5;
+var MAX_CONCURRENT_UPDATE_RETRIES = 5;
+var TOKEN_BYTES2 = 32;
+var agentRegistrationDiscoveryMetadata = (config) => {
+  const registration = requiredRegistration(config);
+  const endpoints = agentRegistrationEndpoints(config);
+  const identityTypes = ["identity_assertion"];
+  if (registration.allowAnonymous === true)
+    identityTypes.unshift("anonymous");
+  if (registration.allowServiceAuth === true)
+    identityTypes.push("service_auth");
+  return {
+    claim_endpoint: endpoints.claimEndpoint,
+    identity_assertion: {
+      assertion_types_supported: [AGENT_IDENTITY_ASSERTION_TYPE]
+    },
+    identity_endpoint: endpoints.identityEndpoint,
+    identity_types_supported: identityTypes,
+    skill: endpoints.guide
+  };
+};
+var agentRegistrationEndpoints = (config) => {
+  const registration = requiredRegistration(config);
+  const base = config.authorizationServer;
+  const oidcRoute = config.oidcRoute ?? "/oauth2";
+  return {
+    claimEndpoint: new URL(registration.claimRoute ?? DEFAULT_CLAIM_ROUTE, base).toString(),
+    completeEndpoint: new URL(registration.completeRoute ?? DEFAULT_COMPLETE_ROUTE, base).toString(),
+    guide: new URL(registration.guideRoute ?? DEFAULT_GUIDE_ROUTE, base).toString(),
+    identityEndpoint: new URL(registration.identityRoute ?? DEFAULT_IDENTITY_ROUTE, base).toString(),
+    tokenEndpoint: new URL(`${oidcRoute}/token`, base).toString()
+  };
+};
+var markdownJson = (value) => `\`\`\`json
+${JSON.stringify(value, null, 2)}
+\`\`\``;
+var generateAgentRegistrationGuide = (config) => {
+  const registration = requiredRegistration(config);
+  const endpoints = agentRegistrationEndpoints(config);
+  const metadataUrl = new URL(config.metadataRoute ?? "/.well-known/oauth-protected-resource", config.resource).toString();
+  const methods = [
+    "- `identity_assertion`: present an audience-bound ID-JAG from a trusted provider.",
+    ...registration.allowServiceAuth === true ? [
+      "- `service_auth`: provide a user login hint and complete the service-owned claim ceremony."
+    ] : [],
+    ...registration.allowAnonymous === true ? [
+      "- `anonymous`: receive pre-claim scopes, then optionally let a signed-in user claim the registration."
+    ] : []
+  ].join(`
+`);
+  return `# Agent registration for ${config.resourceName ?? config.resource}
+
+This service supports the open auth.md agent-registration profile. Structured
+OAuth metadata is authoritative; this document is its agent-readable companion.
+
+## 1. Discover
+
+Fetch ${metadataUrl}, follow \`authorization_servers\`, then fetch
+\`/.well-known/oauth-authorization-server\`. Read its \`agent_auth\` object and
+top-level \`token_endpoint\` and \`grant_types_supported\` fields.
+
+## 2. Choose a method
+
+${methods}
+
+Before asserting a user identity, show the service name and requested scopes to
+the user and obtain consent. Never ask the user to send a password or OTP to the
+agent.
+
+## 3. Register
+
+POST one of these bodies to ${endpoints.identityEndpoint}:
+
+${markdownJson({
+    assertion: "<ID-JAG>",
+    assertion_type: AGENT_IDENTITY_ASSERTION_TYPE,
+    type: "identity_assertion"
+  })}
+
+${registration.allowServiceAuth === true ? markdownJson({ login_hint: "user@example.com", type: "service_auth" }) : ""}
+
+${registration.allowAnonymous === true ? markdownJson({ type: "anonymous" }) : ""}
+
+## 4. Claim
+
+Surface \`verification_uri\` and \`user_code\` together. The user opens the
+service-owned page, signs in using the service's normal MFA/SSO policy, and types
+the code there. Poll ${endpoints.tokenEndpoint} using
+\`grant_type=${AGENT_CLAIM_GRANT_TYPE}\` and the one-time \`claim_token\`.
+Treat \`authorization_pending\` as retryable, honor \`interval\`, and restart
+when the server returns \`expired_token\`.
+
+## 5. Exchange and use credentials
+
+Exchange \`identity_assertion\` at ${endpoints.tokenEndpoint} with
+\`grant_type=${AGENT_IDENTITY_ASSERTION_GRANT_TYPE}\`. Present the resulting
+access token as \`Authorization: Bearer <access_token>\`. Credentials are scoped,
+short-lived, revocable, and bound to the registered agent identity.
+
+## Errors and safety
+
+- Stop on \`invalid_issuer\`, \`invalid_signature\`, \`invalid_audience\`, or \`replay_detected\`.
+- Reauthenticate the user on \`login_required\`.
+- Open the service-owned confirmation URL on \`interaction_required\`.
+- Never persist claim tokens after completion and never expose credentials in model context.
+`;
+};
+var requiredRegistration = (config) => {
+  if (config.agentRegistration === undefined) {
+    throw new Error("agentAuth.agentRegistration is not configured");
+  }
+  return config.agentRegistration;
+};
+var randomCode = () => {
+  const bytes = crypto.getRandomValues(new Uint8Array(4));
+  const value = new DataView(bytes.buffer).getUint32(0) % 1e6;
+  return value.toString().padStart(6, "0");
+};
+var makeSecret = (prefix) => `${prefix}_${generateSecureToken(TOKEN_BYTES2)}`;
+var makeAttempt = async ({
+  email,
+  now,
+  registration
+}) => {
+  const attemptToken = makeSecret("cat");
+  const userCode = randomCode();
+  const expiresAt = now + (registration.attemptTtlMs ?? DEFAULT_ATTEMPT_TTL_MS);
+  return {
+    attempt: {
+      attempts: 0,
+      email: email.toLowerCase(),
+      expiresAt,
+      tokenHash: await hashToken(attemptToken),
+      userCodeHash: await hashToken(userCode)
+    },
+    attemptToken,
+    expiresAt,
+    userCode
+  };
+};
+var createFlow = async ({
+  agentId,
+  kind,
+  loginHint,
+  now,
+  registration,
+  status,
+  upstream,
+  userId,
+  withAttempt
+}) => {
+  const claimToken = makeSecret("clm");
+  const registrationId = `air_${crypto.randomUUID()}`;
+  const claimExpiresAt = now + (registration.claimTtlMs ?? DEFAULT_CLAIM_TTL_MS);
+  const attempt = withAttempt === undefined ? undefined : await makeAttempt({ email: withAttempt, now, registration });
+  const flow = {
+    agentId,
+    claimAttempt: attempt?.attempt,
+    claimExpiresAt,
+    claimTokenHash: await hashToken(claimToken),
+    createdAt: now,
+    expiresAt: claimExpiresAt,
+    kind,
+    loginHint,
+    registrationId,
+    status,
+    updatedAt: now,
+    upstream,
+    userId,
+    version: 1
+  };
+  if (!await registration.identityStore.create(flow)) {
+    throw new Error("Agent identity registration id collision");
+  }
+  return { attempt, claimToken, flow };
+};
+var assertionClaims = (config, flow, now) => ({
+  aud: config.authorizationServer,
+  exp: Math.floor((now + (config.agentRegistration?.assertionTtlMs ?? DEFAULT_ASSERTION_TTL_MS)) / MILLISECONDS_IN_A_SECOND),
+  iat: Math.floor(now / MILLISECONDS_IN_A_SECOND),
+  iss: config.authorizationServer,
+  jti: crypto.randomUUID(),
+  registration_version: flow.version,
+  sub: flow.registrationId
+});
+var issueAgentServiceAssertion = async (config, flow, now = Date.now()) => ({
+  assertion: await signJwt(assertionClaims(config, flow, now), requiredRegistration(config).signingKey, "oauth-id-jag+jwt"),
+  expiresAt: now + (requiredRegistration(config).assertionTtlMs ?? DEFAULT_ASSERTION_TTL_MS)
+});
+var activateAgent = async (config, flow, scopes) => {
+  const now = Date.now();
+  await config.registrationStore.saveRegistration({
+    agentId: flow.agentId,
+    allowedScopes: scopes.filter((scope) => config.scopes.includes(scope)),
+    createdAt: now,
+    metadata: {
+      identityRegistrationId: flow.registrationId,
+      registrationKind: flow.kind
+    },
+    name: `Agent registration ${flow.registrationId}`,
+    status: "active",
+    updatedAt: now
+  });
+  if (flow.userId !== undefined) {
+    await config.delegationStore.saveDelegation({
+      agentId: flow.agentId,
+      createdAt: now,
+      delegationId: `agd_${crypto.randomUUID()}`,
+      scopes: scopes.filter((scope) => config.scopes.includes(scope)),
+      status: "active",
+      updatedAt: now,
+      userId: flow.userId
+    });
+  }
+};
+var ceremony = (config, flow, attempt) => ({
+  expires_in: Math.max(0, Math.floor((attempt.expiresAt - Date.now()) / MILLISECONDS_IN_A_SECOND)),
+  interval: requiredRegistration(config).pollIntervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS,
+  user_code: attempt.userCode,
+  verification_uri: `${agentRegistrationEndpoints(config).completeEndpoint}?claim_attempt_token=${encodeURIComponent(attempt.attemptToken)}`
+});
+var startAgentRegistration = async (config, input, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  const agentId = `agent_${crypto.randomUUID()}`;
+  if (input.type === "anonymous") {
+    if (registration.allowAnonymous !== true) {
+      return { error: "anonymous_not_enabled", status: 403 };
+    }
+    if (registration.revokeAccessTokens === undefined) {
+      throw new Error("Anonymous agent registration requires revokeAccessTokens");
+    }
+    const created2 = await createFlow({
+      agentId,
+      kind: "anonymous",
+      now,
+      registration,
+      status: "pending"
+    });
+    await activateAgent(config, created2.flow, registration.preClaimScopes ?? []);
+    const assertion2 = await issueAgentServiceAssertion(config, created2.flow, now);
+    return {
+      assertionExpires: assertion2.expiresAt,
+      claimToken: created2.claimToken,
+      claimTokenExpires: created2.flow.claimExpiresAt,
+      identityAssertion: assertion2.assertion,
+      postClaimScopes: registration.postClaimScopes,
+      preClaimScopes: registration.preClaimScopes ?? [],
+      registrationId: created2.flow.registrationId,
+      registrationType: "anonymous",
+      status: 200
+    };
+  }
+  if (input.type === "service_auth") {
+    if (registration.allowServiceAuth !== true) {
+      return { error: "service_auth_not_enabled", status: 403 };
+    }
+    const email = input.loginHint.trim().toLowerCase();
+    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/u.test(email)) {
+      return { error: "invalid_login_hint", status: 400 };
+    }
+    const created2 = await createFlow({
+      agentId,
+      kind: "service_auth",
+      loginHint: email,
+      now,
+      registration,
+      status: "pending",
+      withAttempt: email
+    });
+    if (created2.attempt === undefined)
+      throw new Error("Claim attempt missing");
+    return {
+      assertionExpires: 0,
+      claim: ceremony(config, created2.flow, created2.attempt),
+      claimToken: created2.claimToken,
+      claimTokenExpires: created2.flow.claimExpiresAt,
+      postClaimScopes: registration.postClaimScopes,
+      registrationId: created2.flow.registrationId,
+      registrationType: "service_auth",
+      status: 200
+    };
+  }
+  if (input.assertionType !== AGENT_IDENTITY_ASSERTION_TYPE || registration.verifyIdentityAssertion === undefined) {
+    return { error: "invalid_request", status: 400 };
+  }
+  const identity = await registration.verifyIdentityAssertion(input.assertion);
+  if (identity === undefined) {
+    return { error: "invalid_identity_assertion", status: 401 };
+  }
+  const authAge = now - identity.authenticatedAt;
+  if (authAge < -MILLISECONDS_IN_A_MINUTE || authAge > (registration.maxAuthenticationAgeMs ?? DEFAULT_MAX_AUTH_AGE_MS)) {
+    return { error: "login_required", status: 401 };
+  }
+  if (identity.emailVerified !== true && identity.phoneNumberVerified !== true) {
+    return { error: "missing_verified_identity", status: 403 };
+  }
+  const existing = await registration.identityStore.findByUpstreamIdentity({
+    clientId: identity.clientId,
+    issuer: identity.issuer,
+    subject: identity.subject
+  });
+  if (existing?.status === "claimed") {
+    const assertion2 = await issueAgentServiceAssertion(config, existing, now);
+    return {
+      assertionExpires: assertion2.expiresAt,
+      identityAssertion: assertion2.assertion,
+      postClaimScopes: registration.postClaimScopes,
+      registrationId: existing.registrationId,
+      registrationType: "identity_assertion",
+      status: 200
+    };
+  }
+  const match = await registration.resolveVerifiedIdentity?.(identity);
+  const verifiedEmail = identity.emailVerified === true ? identity.email : undefined;
+  if (match?.userId === undefined && verifiedEmail === undefined) {
+    return { error: "interaction_required", status: 401 };
+  }
+  const created = await createFlow({
+    agentId,
+    kind: "identity_assertion",
+    now,
+    registration,
+    status: match?.userId === undefined ? "pending" : "claimed",
+    upstream: {
+      clientId: identity.clientId,
+      issuer: identity.issuer,
+      subject: identity.subject
+    },
+    userId: match?.userId,
+    withAttempt: match?.userId === undefined ? verifiedEmail : undefined
+  });
+  if (match?.userId === undefined) {
+    if (created.attempt === undefined)
+      throw new Error("Claim attempt missing");
+    return {
+      assertionExpires: 0,
+      claim: ceremony(config, created.flow, created.attempt),
+      claimToken: created.claimToken,
+      claimTokenExpires: created.flow.claimExpiresAt,
+      postClaimScopes: registration.postClaimScopes,
+      registrationId: created.flow.registrationId,
+      registrationType: "identity_assertion",
+      status: 200
+    };
+  }
+  await activateAgent(config, created.flow, registration.postClaimScopes);
+  const assertion = await issueAgentServiceAssertion(config, created.flow, now);
+  return {
+    assertionExpires: assertion.expiresAt,
+    identityAssertion: assertion.assertion,
+    postClaimScopes: registration.postClaimScopes,
+    registrationId: created.flow.registrationId,
+    registrationType: "identity_assertion",
+    status: 200
+  };
+};
+var beginAgentClaim = async (config, input, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  const email = input.email.trim().toLowerCase();
+  const claimTokenHash = await hashToken(input.claimToken);
+  for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+    const flow = await registration.identityStore.findByClaimTokenHash(claimTokenHash);
+    if (flow === undefined) {
+      return { error: "invalid_claim_token", status: 400 };
+    }
+    if (flow.claimExpiresAt <= now || flow.status === "revoked") {
+      return { error: "claim_expired", status: 400 };
+    }
+    if (flow.loginHint !== undefined && flow.loginHint !== email) {
+      return { error: "invalid_claim_token", status: 400 };
+    }
+    const attempt = await makeAttempt({ email, now, registration });
+    const replacement = {
+      ...flow,
+      claimAttempt: attempt.attempt,
+      loginHint: email,
+      updatedAt: now
+    };
+    if (await registration.identityStore.replace(replacement, flow.version)) {
+      return {
+        claimAttempt: ceremony(config, replacement, attempt),
+        status: 200
+      };
+    }
+  }
+  return { error: "concurrent_update", status: 409 };
+};
+var completeAgentClaim = async (config, input, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  const user = await registration.resolveAuthenticatedUser(input.request);
+  if (user === undefined)
+    return { error: "wrong_user", status: 403 };
+  const attemptTokenHash = await hashToken(input.attemptToken);
+  const userCodeHash = await hashToken(input.userCode);
+  for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+    const flow = await registration.identityStore.findByAttemptTokenHash(attemptTokenHash);
+    const attempt = flow?.claimAttempt;
+    if (flow === undefined || attempt === undefined) {
+      return { error: "invalid_claim_attempt", status: 400 };
+    }
+    if (flow.claimExpiresAt <= now || attempt.expiresAt <= now) {
+      return { error: "claim_expired", status: 400 };
+    }
+    if (user.email?.toLowerCase() !== attempt.email) {
+      return { error: "wrong_user", status: 403 };
+    }
+    const matches = await constantTimeEqual(userCodeHash, attempt.userCodeHash);
+    if (!matches) {
+      const attempts = attempt.attempts + 1;
+      const locked = attempts >= (registration.maxCodeAttempts ?? DEFAULT_MAX_CODE_ATTEMPTS);
+      const replaced = await registration.identityStore.replace({
+        ...flow,
+        claimAttempt: locked ? undefined : { ...attempt, attempts },
+        updatedAt: now
+      }, flow.version);
+      if (replaced) {
+        return {
+          error: "user_code_invalid",
+          status: locked ? 429 : 400
+        };
+      }
+      continue;
+    }
+    if (flow.kind === "anonymous") {
+      await registration.revokeAccessTokens?.(flow.agentId);
+    }
+    const replacement = {
+      ...flow,
+      claimAttempt: undefined,
+      status: "claimed",
+      updatedAt: now,
+      userId: user.userId
+    };
+    if (!await registration.identityStore.replace(replacement, flow.version)) {
+      continue;
+    }
+    const persisted = await registration.identityStore.findByRegistrationId(flow.registrationId);
+    if (persisted === undefined) {
+      throw new Error("Completed agent registration disappeared");
+    }
+    await activateAgent(config, persisted, registration.postClaimScopes);
+    return { status: 204 };
+  }
+  return { error: "concurrent_update", status: 409 };
+};
+var issueAgentAccessToken = async (config, flow, now) => {
+  const registration = requiredRegistration(config);
+  const accessToken = `at_${generateSecureToken(TOKEN_BYTES2)}`;
+  const scopes = (flow.status === "claimed" ? registration.postClaimScopes : registration.preClaimScopes ?? []).filter((scope) => config.scopes.includes(scope));
+  const expiresAt = now + (registration.tokenTtlMs ?? DEFAULT_ACCESS_TOKEN_TTL_MS2);
+  await registration.accessTokenStore.saveToken({
+    clientId: flow.agentId,
+    createdAt: now,
+    expiresAt,
+    hashedToken: await hashToken(accessToken),
+    ownerId: flow.userId,
+    scopes,
+    tokenId: crypto.randomUUID()
+  });
+  return {
+    accessToken,
+    expiresIn: Math.floor((expiresAt - now) / MILLISECONDS_IN_A_SECOND),
+    scopes
+  };
+};
+var createAgentRegistrationCredentialVerifier = (accessTokenStore, identityStore) => async (request) => {
+  const authorization = request.headers.get("authorization");
+  if (authorization?.startsWith("Bearer at_") !== true)
+    return;
+  const token = authorization.slice("Bearer ".length).trim();
+  const record = await accessTokenStore.findByHashedToken(await hashToken(token));
+  if (record === undefined || record.expiresAt <= Date.now())
+    return;
+  if (identityStore !== undefined) {
+    const identity = await identityStore.findByAgentId(record.clientId);
+    if (identity === undefined || identity.status === "revoked") {
+      return;
+    }
+  }
+  return {
+    agentId: record.clientId,
+    expiresAt: record.expiresAt,
+    scopes: record.scopes,
+    userId: record.ownerId
+  };
+};
+var handleAgentTokenGrant = async (config, body, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  if (body.grant_type === AGENT_CLAIM_GRANT_TYPE) {
+    if (body.claim_token === undefined) {
+      return { body: { error: "invalid_request" }, status: 400 };
+    }
+    const claimTokenHash = await hashToken(body.claim_token);
+    let flow2;
+    for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+      flow2 = await registration.identityStore.findByClaimTokenHash(claimTokenHash);
+      if (flow2 === undefined || flow2.claimExpiresAt <= now) {
+        return { body: { error: "expired_token" }, status: 400 };
+      }
+      if (flow2.status === "claimed")
+        break;
+      if (flow2.claimAttempt !== undefined && flow2.claimAttempt.expiresAt <= now) {
+        return { body: { error: "expired_token" }, status: 400 };
+      }
+      const intervalMs = (registration.pollIntervalSeconds ?? DEFAULT_POLL_INTERVAL_SECONDS) * MILLISECONDS_IN_A_SECOND;
+      if (flow2.lastPolledAt !== undefined && now - flow2.lastPolledAt < intervalMs) {
+        return { body: { error: "slow_down" }, status: 400 };
+      }
+      if (await registration.identityStore.replace({ ...flow2, lastPolledAt: now, updatedAt: now }, flow2.version)) {
+        return {
+          body: { error: "authorization_pending" },
+          status: 400
+        };
+      }
+    }
+    if (flow2?.status !== "claimed") {
+      return { body: { error: "temporarily_unavailable" }, status: 400 };
+    }
+    const assertion = await issueAgentServiceAssertion(config, flow2, now);
+    const token2 = await issueAgentAccessToken(config, flow2, now);
+    return {
+      body: {
+        access_token: token2.accessToken,
+        assertion_expires: new Date(assertion.expiresAt).toISOString(),
+        expires_in: token2.expiresIn,
+        identity_assertion: assertion.assertion,
+        scope: token2.scopes.join(" "),
+        token_type: "Bearer"
+      },
+      status: 200
+    };
+  }
+  if (body.grant_type !== AGENT_IDENTITY_ASSERTION_GRANT_TYPE) {
+    return;
+  }
+  if (body.assertion === undefined) {
+    return { body: { error: "invalid_request" }, status: 400 };
+  }
+  const verified = await verifyJwt(body.assertion, registration.signingKey.publicJwk);
+  const payload = verified?.payload;
+  if (verified?.header?.typ !== "oauth-id-jag+jwt" || payload?.iss !== config.authorizationServer || payload.aud !== config.authorizationServer || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= Math.floor(now / MILLISECONDS_IN_A_SECOND)) {
+    return { body: { error: "invalid_grant" }, status: 400 };
+  }
+  const flow = await registration.identityStore.findByRegistrationId(payload.sub);
+  if (flow === undefined || flow.status === "revoked" || payload.registration_version !== flow.version) {
+    return { body: { error: "invalid_grant" }, status: 400 };
+  }
+  const token = await issueAgentAccessToken(config, flow, now);
+  return {
+    body: {
+      access_token: token.accessToken,
+      expires_in: token.expiresIn,
+      scope: token.scopes.join(" "),
+      token_type: "Bearer"
+    },
+    status: 200
+  };
+};
+var revokeAgentIdentityRegistration = async (config, registrationId, now = Date.now()) => {
+  const registration = requiredRegistration(config);
+  for (let retry = 0;retry < MAX_CONCURRENT_UPDATE_RETRIES; retry += 1) {
+    const flow = await registration.identityStore.findByRegistrationId(registrationId);
+    if (flow === undefined)
+      return false;
+    if (flow.status === "revoked")
+      return true;
+    await registration.revokeAccessTokens?.(flow.agentId);
+    if (await registration.identityStore.replace({
+      ...flow,
+      claimAttempt: undefined,
+      status: "revoked",
+      updatedAt: now
+    }, flow.version)) {
+      return true;
+    }
+  }
+  throw new Error("Could not revoke agent identity after concurrent updates");
+};
+
 // src/agents/routes.ts
+var DELETE_CODE_POINT = 127;
+var HTTP_BAD_REQUEST2 = 400;
+var HTTP_FORBIDDEN = 403;
+var HTTP_OK2 = 200;
+var HTTP_UNAUTHORIZED2 = 401;
+var MINIMUM_PRINTABLE_CODE_POINT = 32;
 var quoteHeaderValue = (value) => {
   const printable = [...value].filter((character) => {
     const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint >= 32 && codePoint !== 127;
+    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
   }).join("");
   return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
 };
@@ -3149,39 +3822,170 @@ var failureResponse = (config, failure, requiredScopes) => new Response(JSON.str
       requiredScopes
     })
   },
-  status: failure.code === "Forbidden" ? 403 : 401
+  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
 });
-var agentAuthPlugin = (config) => {
-  const plugin = new Elysia2().derive(({ request }) => ({
-    protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
-      if (config === undefined) {
-        const failure = {
-          code: "Unauthorized",
-          message: "Agent is not authenticated"
-        };
-        return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
-      }
-      const principal = await resolveAgentPrincipal(request, config);
-      if (principal === undefined) {
-        const failure = {
-          code: "Unauthorized",
-          message: "Agent is not authenticated"
-        };
-        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-      }
-      if (!agentHasScopes(principal, requiredScopes)) {
-        const failure = {
-          code: "Forbidden",
-          message: "Insufficient agent scopes"
-        };
-        return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-      }
-      return handleAuth(principal);
+var json = (value, status = HTTP_OK2) => new Response(JSON.stringify(value), {
+  headers: {
+    "cache-control": "no-store",
+    "content-type": "application/json"
+  },
+  status
+});
+var recordBody = (body) => {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(body));
+};
+var registrationResponse = (result) => {
+  const body = {
+    ...result.assertionExpires > 0 ? {
+      assertion_expires: new Date(result.assertionExpires).toISOString()
+    } : {},
+    ...result.claim === undefined ? {} : { claim: result.claim },
+    ...result.claimToken === undefined ? {} : { claim_token: result.claimToken },
+    ...result.claimTokenExpires === undefined ? {} : {
+      claim_token_expires: new Date(result.claimTokenExpires).toISOString()
+    },
+    ...result.identityAssertion === undefined ? {} : { identity_assertion: result.identityAssertion },
+    ...result.preClaimScopes === undefined ? {} : { pre_claim_scopes: result.preClaimScopes },
+    post_claim_scopes: result.postClaimScopes,
+    registration_id: result.registrationId,
+    registration_type: result.registrationType
+  };
+  if (result.registrationType === "identity_assertion" && result.identityAssertion === undefined) {
+    return json({
+      ...body,
+      error: "interaction_required",
+      error_description: "Authenticate at the service and confirm the account link."
+    }, HTTP_UNAUTHORIZED2);
+  }
+  return json(body);
+};
+var parseRegistrationInput = (value) => {
+  if (value.type === "anonymous") {
+    const input2 = { type: "anonymous" };
+    return input2;
+  }
+  if (value.type === "service_auth" && typeof value.login_hint === "string") {
+    const input2 = {
+      loginHint: value.login_hint,
+      type: "service_auth"
+    };
+    return input2;
+  }
+  if (value.type !== "identity_assertion" || value.assertion_type !== AGENT_IDENTITY_ASSERTION_TYPE || typeof value.assertion !== "string") {
+    return;
+  }
+  const input = {
+    assertion: value.assertion,
+    assertionType: AGENT_IDENTITY_ASSERTION_TYPE,
+    type: "identity_assertion"
+  };
+  return input;
+};
+var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
+  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+    if (config === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
     }
-  }));
+    const principal = await resolveAgentPrincipal(request, config);
+    if (principal === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    if (!agentHasScopes(principal, requiredScopes)) {
+      const failure = {
+        code: "Forbidden",
+        message: "Insufficient agent scopes"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    return handleAuth(principal);
+  }
+}));
+var agentAuthPlugin = (config) => {
+  const plugin = agentAuthContextPlugin(config);
   if (config === undefined)
     return plugin.as("global");
-  return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).as("global");
+  if (config.agentRegistration === undefined) {
+    return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).as("global");
+  }
+  const registration = config.agentRegistration;
+  const identityRoute = registration.identityRoute ?? "/agent/identity";
+  const claimRoute = registration.claimRoute ?? "/agent/identity/claim";
+  const completeRoute = registration.completeRoute ?? "/agent/identity/claim/complete";
+  const guideRoute = registration.guideRoute ?? "/auth.md";
+  return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).get(guideRoute, () => new Response(generateAgentRegistrationGuide(config), {
+    headers: {
+      "cache-control": "public, max-age=300",
+      "content-type": "text/markdown; charset=utf-8"
+    }
+  })).get(completeRoute, ({ query }) => {
+    const token = typeof query.claim_attempt_token === "string" ? query.claim_attempt_token : "";
+    if (token.length === 0)
+      return new Response("Invalid claim link", { status: 400 });
+    return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="robots" content="noindex"><title>Confirm agent registration</title></head><body><main><h1>Confirm agent registration</h1><p>Sign in to this service, verify the agent and scopes shown by your agent, then enter the six-digit code.</p><form method="post"><input type="hidden" name="claim_attempt_token" value="${escapeHtml(token)}"><label>Code <input name="user_code" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9]{6}" required></label><button type="submit">Confirm</button></form></main></body></html>`, {
+      headers: {
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'none'; form-action 'self'; style-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+        "content-type": "text/html; charset=utf-8",
+        "x-content-type-options": "nosniff"
+      }
+    });
+  }).post(identityRoute, async ({ body }) => {
+    const value = recordBody(body);
+    if (value === undefined || typeof value.type !== "string") {
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
+    }
+    const input = parseRegistrationInput(value);
+    if (input === undefined)
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
+    const result = await startAgentRegistration(config, input);
+    if ("error" in result) {
+      return json({
+        error: result.error,
+        ...result.message === undefined ? {} : { error_description: result.message }
+      }, result.status);
+    }
+    return registrationResponse(result);
+  }).post(claimRoute, async ({ body }) => {
+    const value = recordBody(body);
+    if (value === undefined || typeof value.claim_token !== "string" || typeof value.email !== "string") {
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
+    }
+    const result = await beginAgentClaim(config, {
+      claimToken: value.claim_token,
+      email: value.email
+    });
+    if ("error" in result)
+      return json({ error: result.error }, result.status);
+    return json({ claim_attempt: result.claimAttempt });
+  }).post(completeRoute, async ({ body, request }) => {
+    let value = recordBody(body);
+    if (value === undefined && typeof body === "string") {
+      value = Object.fromEntries(new URLSearchParams(body));
+    }
+    if (value === undefined || typeof value.claim_attempt_token !== "string" || typeof value.user_code !== "string") {
+      return json({ error: "invalid_request" }, HTTP_BAD_REQUEST2);
+    }
+    const result = await completeAgentClaim(config, {
+      attemptToken: value.claim_attempt_token,
+      request,
+      userCode: value.user_code
+    });
+    if ("error" in result)
+      return json({ error: result.error }, result.status);
+    return new Response(null, { status: 204 });
+  }).as("global");
 };
 
 // src/audit/config.ts
@@ -3484,6 +4288,11 @@ import { Elysia as Elysia5, t as t4 } from "elysia";
 
 // src/utils.ts
 init_constants();
+var MILLISECONDS_IN_A_SECOND2 = 1000;
+var readOptionalString = (value, property) => {
+  const candidate = Reflect.get(value, property);
+  return typeof candidate === "string" ? candidate : undefined;
+};
 var defineAuthConfig = (configuration) => configuration;
 var defineAuthHtmxConfig = (htmxConfig) => htmxConfig;
 var defineAuthSettings = (settings) => settings;
@@ -3579,14 +4388,10 @@ var resolveOAuthAuthorization = async ({
   let userIdentity;
   let accessToken = tokenResponse.access_token;
   let refreshToken = tokenResponse.refresh_token;
-  if (authProvider === "withings" && !accessToken) {
-    const body = Reflect.get(tokenResponse, "body");
-    if (body && typeof body === "object") {
-      const nestedAccessToken = Reflect.get(body, "access_token");
-      if (typeof nestedAccessToken === "string") {
-        accessToken = nestedAccessToken;
-      }
-    }
+  const withingsBody = Reflect.get(tokenResponse, "body");
+  const withingsAccessToken = authProvider === "withings" && withingsBody !== null && typeof withingsBody === "object" ? readOptionalString(withingsBody, "access_token") : undefined;
+  if (!accessToken && withingsAccessToken !== undefined) {
+    accessToken = withingsAccessToken;
   }
   if (typeof accessToken !== "string" || accessToken.length === 0) {
     throw new Error("OAuth authorization response contains no access_token");
@@ -3604,9 +4409,12 @@ var resolveOAuthAuthorization = async ({
       source: "tokenResponse"
     });
   } else if (authProvider === "withings") {
-    userIdentity = { userid: tokenResponse.body.userid };
-    accessToken = tokenResponse.body.access_token;
-    refreshToken = tokenResponse.body.refresh_token;
+    if (withingsBody === null || typeof withingsBody !== "object") {
+      throw new Error("Withings OAuth response contains no body");
+    }
+    userIdentity = { userid: Reflect.get(withingsBody, "userid") };
+    accessToken = readOptionalString(withingsBody, "access_token") ?? accessToken;
+    refreshToken = readOptionalString(withingsBody, "refresh_token") ?? refreshToken;
   } else {
     userIdentity = normalizeProviderIdentity({
       identity: await providerInstance.fetchUserProfile(accessToken),
@@ -3638,7 +4446,7 @@ var resolveOAuthTokenExpiresAt = (tokenResponse, now = Date.now()) => {
   if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
     return;
   }
-  return now + expiresInSeconds * 1000;
+  return now + expiresInSeconds * MILLISECONDS_IN_A_SECOND2;
 };
 var validateSession = ({
   user_session_id,
@@ -4381,7 +5189,7 @@ var protectRoutePlugin = ({
 })).as("global");
 
 // src/htmx/renderers.ts
-var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+var escapeHtml2 = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 var defaultAuthorizationHref = (provider, client) => client ? `/oauth2/${provider}/authorization?client=${client}` : `/oauth2/${provider}/authorization`;
 var resolveAuthHtmxRenderers = (config) => {
   const { connectorTargets, featuredLoginProviders, providerData } = config;
@@ -4394,10 +5202,10 @@ var resolveAuthHtmxRenderers = (config) => {
     return `<div class="grid-2">
     <div class="card"><h2 class="card__title">Canonical account</h2><p class="muted">Absolute Auth keeps one canonical user and links every OAuth identity to it. Conflicting identities raise a merge request.</p></div>
     <div class="card text-left"><h2 class="card__title">Profile fields</h2>
-      <div class="spread"><span class="muted">Subject</span><span>${escapeHtml(user.sub)}</span></div>
-      <div class="spread"><span class="muted">Name</span><span>${escapeHtml(fullName || "\u2014")}</span></div>
-      <div class="spread"><span class="muted">Email</span><span>${escapeHtml(user.email ?? "\u2014")}</span></div>
-      <div class="spread"><span class="muted">Primary identity</span><span>${escapeHtml(user.primary_auth_identity_id ?? "\u2014")}</span></div>
+      <div class="spread"><span class="muted">Subject</span><span>${escapeHtml2(user.sub)}</span></div>
+      <div class="spread"><span class="muted">Name</span><span>${escapeHtml2(fullName || "\u2014")}</span></div>
+      <div class="spread"><span class="muted">Email</span><span>${escapeHtml2(user.email ?? "\u2014")}</span></div>
+      <div class="spread"><span class="muted">Primary identity</span><span>${escapeHtml2(user.primary_auth_identity_id ?? "\u2014")}</span></div>
     </div>
   </div>`;
   };
@@ -4406,18 +5214,18 @@ var resolveAuthHtmxRenderers = (config) => {
       return `<a class="btn btn--primary btn--sm" href="/htmx">Sign in</a>`;
     }
     const label = user.email ?? user.first_name ?? "Account";
-    return `<span class="muted">${escapeHtml(label)}</span><a class="btn btn--ghost btn--sm" href="/htmx/signout">Sign out</a>`;
+    return `<span class="muted">${escapeHtml2(label)}</span><a class="btn btn--ghost btn--sm" href="/htmx/signout">Sign out</a>`;
   };
-  const connectorLinks = () => connectorTargets.map((target) => `<div class="card text-left"><h2 class="card__title row"><img class="entity__logo" alt="" src="${providerLogo(target.provider)}" />${escapeHtml(target.label)}</h2><p class="muted">${escapeHtml(target.description)}</p><a class="btn btn--primary" href="${authorizationHref(target.provider, "connector")}">Link ${escapeHtml(target.label)}</a></div>`).join("");
+  const connectorLinks = () => connectorTargets.map((target) => `<div class="card text-left"><h2 class="card__title row"><img class="entity__logo" alt="" src="${providerLogo(target.provider)}" />${escapeHtml2(target.label)}</h2><p class="muted">${escapeHtml2(target.description)}</p><a class="btn btn--primary" href="${authorizationHref(target.provider, "connector")}">Link ${escapeHtml2(target.label)}</a></div>`).join("");
   const connectors = (payload) => {
-    const scopeList = (scopes) => scopes.map((scope) => `<span class="scope">${escapeHtml(scope)}</span>`).join("");
-    const bindings = payload.bindings.length === 0 ? `<div class="empty-state">No external accounts linked.</div>` : `<div class="entity-list">${payload.bindings.map((binding) => `<div class="entity"><div class="entity__meta"><span class="entity__title">${escapeHtml(binding.label ?? binding.externalAccountId)}<span class="pill">${escapeHtml(binding.connectorProvider)}</span></span><span class="entity__sub">${escapeHtml(binding.externalAccountType)} \xB7 ${escapeHtml(binding.status)}</span><div class="scope-list">${scopeList(binding.availableScopes)}</div></div><div class="entity__actions"><form hx-delete="/htmx/connectors/bindings/${binding.id}" hx-target="#connector-list" hx-swap="innerHTML"><button class="btn btn--danger btn--sm" type="submit">Remove</button></form></div></div>`).join("")}</div>`;
-    const grants = payload.grants.length === 0 ? `<div class="empty-state">No connector grants yet.</div>` : `<div class="entity-list">${payload.grants.map((grant) => `<div class="entity"><div class="entity__meta"><span class="entity__title">${escapeHtml(grant.authProviderKey)}<span class="pill pill--indigo">${escapeHtml(grant.status)}</span></span><span class="entity__sub">Subject ${escapeHtml(grant.providerSubject)}</span><div class="scope-list">${scopeList(grant.grantedScopes)}</div></div><div class="entity__actions"><form hx-delete="/htmx/connectors/grants/${grant.id}" hx-target="#connector-list" hx-swap="innerHTML"><button class="btn btn--danger btn--sm" type="submit">Remove</button></form></div></div>`).join("")}</div>`;
+    const scopeList = (scopes) => scopes.map((scope) => `<span class="scope">${escapeHtml2(scope)}</span>`).join("");
+    const bindings = payload.bindings.length === 0 ? `<div class="empty-state">No external accounts linked.</div>` : `<div class="entity-list">${payload.bindings.map((binding) => `<div class="entity"><div class="entity__meta"><span class="entity__title">${escapeHtml2(binding.label ?? binding.externalAccountId)}<span class="pill">${escapeHtml2(binding.connectorProvider)}</span></span><span class="entity__sub">${escapeHtml2(binding.externalAccountType)} \xB7 ${escapeHtml2(binding.status)}</span><div class="scope-list">${scopeList(binding.availableScopes)}</div></div><div class="entity__actions"><form hx-delete="/htmx/connectors/bindings/${binding.id}" hx-target="#connector-list" hx-swap="innerHTML"><button class="btn btn--danger btn--sm" type="submit">Remove</button></form></div></div>`).join("")}</div>`;
+    const grants = payload.grants.length === 0 ? `<div class="empty-state">No connector grants yet.</div>` : `<div class="entity-list">${payload.grants.map((grant) => `<div class="entity"><div class="entity__meta"><span class="entity__title">${escapeHtml2(grant.authProviderKey)}<span class="pill pill--indigo">${escapeHtml2(grant.status)}</span></span><span class="entity__sub">Subject ${escapeHtml2(grant.providerSubject)}</span><div class="scope-list">${scopeList(grant.grantedScopes)}</div></div><div class="entity__actions"><form hx-delete="/htmx/connectors/grants/${grant.id}" hx-target="#connector-list" hx-swap="innerHTML"><button class="btn btn--danger btn--sm" type="submit">Remove</button></form></div></div>`).join("")}</div>`;
     return `<h3 class="provider-heading">External accounts</h3>${bindings}<h3 class="provider-heading">Grants</h3>${grants}`;
   };
   const identities = (payload, query) => {
     const pending = payload.mergeRequests.filter((req) => req.status === "pending");
-    const mergesHtml = pending.length === 0 ? "" : `<div class="stack"><h3 class="provider-heading">Merge requests</h3><div class="entity-list">${pending.map((req) => `<div class="entity card--danger"><div class="entity__meta"><span class="entity__title">${escapeHtml(providerLabel(req.conflicting_auth_provider))} conflict</span><span class="entity__sub">Subject ${escapeHtml(req.conflicting_provider_subject)}</span></div><div class="entity__actions">
+    const mergesHtml = pending.length === 0 ? "" : `<div class="stack"><h3 class="provider-heading">Merge requests</h3><div class="entity-list">${pending.map((req) => `<div class="entity card--danger"><div class="entity__meta"><span class="entity__title">${escapeHtml2(providerLabel(req.conflicting_auth_provider))} conflict</span><span class="entity__sub">Subject ${escapeHtml2(req.conflicting_provider_subject)}</span></div><div class="entity__actions">
                 <form hx-post="/htmx/merge/${req.id}" hx-target="#identities-list" hx-swap="innerHTML" hx-include="#identity-query"><button class="btn btn--primary btn--sm" type="submit">Merge</button></form>
                 <form hx-delete="/htmx/merge/${req.id}" hx-target="#identities-list" hx-swap="innerHTML" hx-include="#identity-query"><button class="btn btn--ghost btn--sm" type="submit">Dismiss</button></form>
               </div></div>`).join("")}</div></div>`;
@@ -4426,19 +5234,19 @@ var resolveAuthHtmxRenderers = (config) => {
       identities: list.filter((identity) => term === "" || providerLabel(provider).toLowerCase().includes(term) || identity.id.toLowerCase().includes(term) || identity.provider_subject.toLowerCase().includes(term)),
       provider
     })).filter((group) => group.identities.length > 0);
-    const groupsHtml = groups.length === 0 ? `<div class="empty-state">No identities match your search.</div>` : groups.map((group) => `<div class="provider-group"><h3 class="provider-heading">${providerLogo(group.provider) ? `<img class="entity__logo" alt="" src="${providerLogo(group.provider)}" />` : ""}${escapeHtml(providerLabel(group.provider))}</h3><div class="entity-list">${group.identities.map((identity) => `<div class="entity"><div class="entity__main"><div class="entity__meta"><span class="entity__title">${escapeHtml(identity.provider_subject)}${identity.isPrimary ? `<span class="pill pill--primary">Primary</span>` : ""}</span><span class="entity__sub">${escapeHtml(identity.id)}</span></div></div><div class="entity__actions">
+    const groupsHtml = groups.length === 0 ? `<div class="empty-state">No identities match your search.</div>` : groups.map((group) => `<div class="provider-group"><h3 class="provider-heading">${providerLogo(group.provider) ? `<img class="entity__logo" alt="" src="${providerLogo(group.provider)}" />` : ""}${escapeHtml2(providerLabel(group.provider))}</h3><div class="entity-list">${group.identities.map((identity) => `<div class="entity"><div class="entity__main"><div class="entity__meta"><span class="entity__title">${escapeHtml2(identity.provider_subject)}${identity.isPrimary ? `<span class="pill pill--primary">Primary</span>` : ""}</span><span class="entity__sub">${escapeHtml2(identity.id)}</span></div></div><div class="entity__actions">
                       ${identity.isPrimary ? "" : `<form hx-post="/htmx/identities/${identity.id}/primary" hx-target="#identities-list" hx-swap="innerHTML" hx-include="#identity-query"><button class="btn btn--neutral btn--sm" type="submit">Set primary</button></form>`}
                       <form hx-delete="/htmx/identities/${identity.id}" hx-target="#identities-list" hx-swap="innerHTML" hx-include="#identity-query"><button class="btn btn--danger btn--sm" type="submit">Remove</button></form>
                     </div></div>`).join("")}</div></div>`).join("");
     return `${mergesHtml}${groupsHtml}`;
   };
-  const protectedView = (user) => `<section class="auth-section stack"><div><h1 class="page-heading">Protected page</h1><p class="muted">Your authenticated session resolves to this user record.</p></div><pre class="json">${escapeHtml(JSON.stringify(user, null, 2))}</pre></section>`;
+  const protectedView = (user) => `<section class="auth-section stack"><div><h1 class="page-heading">Protected page</h1><p class="muted">Your authenticated session resolves to this user record.</p></div><pre class="json">${escapeHtml2(JSON.stringify(user, null, 2))}</pre></section>`;
   const providerLogin = (verb, includeDropdown) => {
-    const featured = featuredLoginProviders.map((provider) => `<a class="oauth-button" href="${authorizationHref(provider)}"><img class="oauth-button__icon" alt="" src="${providerLogo(provider)}" /><span class="oauth-button__text">${escapeHtml(verb)} ${escapeHtml(providerLabel(provider))}</span></a>`).join("");
+    const featured = featuredLoginProviders.map((provider) => `<a class="oauth-button" href="${authorizationHref(provider)}"><img class="oauth-button__icon" alt="" src="${providerLogo(provider)}" /><span class="oauth-button__text">${escapeHtml2(verb)} ${escapeHtml2(providerLabel(provider))}</span></a>`).join("");
     if (!includeDropdown) {
       return `<div class="oauth-grid">${featured}</div>`;
     }
-    const options = providerOptions.map((provider) => `<option value="${provider}">${escapeHtml(providerLabel(provider))}</option>`).join("");
+    const options = providerOptions.map((provider) => `<option value="${provider}">${escapeHtml2(providerLabel(provider))}</option>`).join("");
     return `<div class="oauth-grid">${featured}
     <div class="separator"><span class="separator__line"></span><span class="separator__text">or any provider</span><span class="separator__line"></span></div>
     <form class="oauth-grid" action="/htmx/login-redirect" method="get">
@@ -4454,7 +5262,7 @@ var resolveAuthHtmxRenderers = (config) => {
     authMenu: overrides.authMenu ?? authMenu,
     connectorLinks: overrides.connectorLinks ?? connectorLinks,
     connectors: overrides.connectors ?? connectors,
-    escapeHtml,
+    escapeHtml: escapeHtml2,
     identities: overrides.identities ?? identities,
     protected: overrides.protected ?? protectedView,
     providerLogin: overrides.providerLogin ?? providerLogin
@@ -5071,75 +5879,17 @@ import { Elysia as Elysia18, t as t14 } from "elysia";
 // src/oidc/config.ts
 init_constants();
 init_crypto();
-
-// src/oidc/keys.ts
-var ENCODER = new TextEncoder;
-var ES256 = { hash: "SHA-256", name: "ECDSA" };
-var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
-var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
-var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
-var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
-var decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-var generateSigningKey = async () => {
-  const pair = await crypto.subtle.generateKey(KEY_PARAMS, true, [
-    "sign",
-    "verify"
-  ]);
-  const privateJwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
-  const publicJwk = await crypto.subtle.exportKey("jwk", pair.publicKey);
-  return { kid: await jwkThumbprint(publicJwk), privateJwk, publicJwk };
-};
-var jwkThumbprint = async (jwk) => {
-  const canonical = JSON.stringify({
-    crv: jwk.crv,
-    kty: jwk.kty,
-    x: jwk.x,
-    y: jwk.y
-  });
-  return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
-};
-var signJwt = async (payload, signing) => {
-  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
-  const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ: "JWT" })}.${encodeSegment(payload)}`;
-  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
-  return `${input}.${toBase64Url(signature)}`;
-};
-var toPublicJwk = (key) => ({
-  alg: "ES256",
-  crv: key.publicJwk.crv,
-  kid: key.kid,
-  kty: key.publicJwk.kty,
-  use: "sig",
-  x: key.publicJwk.x,
-  y: key.publicJwk.y
-});
-var verifyJwt = async (token, publicJwk) => {
-  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
-  if (headerSegment === undefined || payloadSegment === undefined || signatureSegment === undefined) {
-    return;
-  }
-  const key = await crypto.subtle.importKey("jwk", publicJwk, KEY_PARAMS, false, ["verify"]);
-  const valid = await crypto.subtle.verify(ES256, key, fromBase64Url(signatureSegment), ENCODER.encode(`${headerSegment}.${payloadSegment}`));
-  if (!valid)
-    return;
-  return {
-    header: decodeSegment(headerSegment),
-    payload: decodeSegment(payloadSegment)
-  };
-};
-
-// src/oidc/config.ts
 var DEFAULT_OIDC_ROUTE = "/oauth2";
 var MS_PER_SECOND = 1000;
-var TOKEN_BYTES2 = 32;
+var TOKEN_BYTES3 = 32;
 var REFRESH_TTL_DAYS = 30;
-var DEFAULT_ACCESS_TOKEN_TTL_MS2 = MILLISECONDS_IN_AN_HOUR;
+var DEFAULT_ACCESS_TOKEN_TTL_MS3 = MILLISECONDS_IN_AN_HOUR;
 var DEFAULT_ID_TOKEN_TTL_MS = MILLISECONDS_IN_AN_HOUR;
 var DEFAULT_REFRESH_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY * REFRESH_TTL_DAYS;
 var resolveAccessTtl = (ttl, scopes) => {
   if (typeof ttl === "function")
     return ttl({ scopes });
-  return ttl ?? DEFAULT_ACCESS_TOKEN_TTL_MS2;
+  return ttl ?? DEFAULT_ACCESS_TOKEN_TTL_MS3;
 };
 var nowSeconds = (milliseconds) => Math.floor(milliseconds / MS_PER_SECOND);
 var narrowScopes = (available, requested) => requested === undefined || requested.length === 0 ? available : requested.filter((scope) => available.includes(scope));
@@ -5280,7 +6030,7 @@ var issueTokenSet = async ({
     idPayload.nonce = nonce;
   if (acr !== undefined)
     idPayload.acr = acr;
-  const refreshToken = generateSecureToken(TOKEN_BYTES2);
+  const refreshToken = generateSecureToken(TOKEN_BYTES3);
   await config.refreshTokenStore.saveToken({
     acr,
     claims,
@@ -6706,15 +7456,15 @@ var updateRegisteredClient = async ({
 };
 
 // src/oidc/routes.ts
-var HTTP_OK2 = 200;
+var HTTP_OK3 = 200;
 var HTTP_NO_CONTENT = 204;
 var HTTP_FOUND = 302;
-var HTTP_BAD_REQUEST2 = 400;
-var HTTP_UNAUTHORIZED2 = 401;
+var HTTP_BAD_REQUEST3 = 400;
+var HTTP_UNAUTHORIZED3 = 401;
 var HTTP_NOT_IMPLEMENTED = 501;
 var CODE_TTL_MINUTES = 10;
 var CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * CODE_TTL_MINUTES;
-var TOKEN_BYTES3 = 32;
+var TOKEN_BYTES4 = 32;
 var BASIC_PREFIX2 = "Basic ";
 var jsonResponse = (value, status) => new Response(JSON.stringify(value), {
   headers: {
@@ -6724,7 +7474,7 @@ var jsonResponse = (value, status) => new Response(JSON.stringify(value), {
   status
 });
 var oauthError2 = (status, error) => jsonResponse({ error }, status);
-var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK2);
+var tokenResponse = (tokens) => jsonResponse(tokens, HTTP_OK3);
 var canonicalizeRequestUrl = (requestUrl, issuer) => {
   try {
     const url = new URL(requestUrl);
@@ -6746,7 +7496,7 @@ var formPostResponse = (redirectUri, params) => {
       "cache-control": "no-store",
       "content-type": "text/html;charset=UTF-8"
     },
-    status: HTTP_OK2
+    status: HTTP_OK3
   });
 };
 var respondToClient = (redirectUri, responseMode, params) => {
@@ -6797,7 +7547,7 @@ var oidcProviderRoutes = (config) => {
   const userinfoRoute = `${oidcRoute}/userinfo`;
   const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
-  const resolveClient = async (clientId) => await clientStore.findClient(clientId) ?? await config.resolveClientIdMetadata?.(clientId);
+  const resolveClient = async (clientId) => await clientStore.findClient(clientId) ?? config.resolveClientIdMetadata?.(clientId);
   const authenticateClient = async (clientId, clientSecret) => {
     const client = await resolveClient(clientId);
     if (client === undefined)
@@ -6884,7 +7634,7 @@ var oidcProviderRoutes = (config) => {
         "dpop-nonce": fresh,
         "www-authenticate": 'DPoP error="use_dpop_nonce"'
       },
-      status: HTTP_UNAUTHORIZED2
+      status: HTTP_UNAUTHORIZED3
     });
   };
   const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
@@ -6894,11 +7644,11 @@ var oidcProviderRoutes = (config) => {
       redirect_uri: redirectUri
     } = body;
     if (code === undefined || codeVerifier === undefined || redirectUri === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const record = await authorizationCodeStore.consumeCode(await hashToken(code));
     if (record === undefined || record.expiresAt < Date.now() || record.clientId !== client.clientId || record.redirectUri !== redirectUri || !await verifyPkce(codeVerifier, record.codeChallenge)) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_grant");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_grant");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -6906,7 +7656,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
@@ -6923,11 +7673,11 @@ var oidcProviderRoutes = (config) => {
   const grantRefreshToken = async (client, body, dpop, clientCertThumbprint) => {
     const presented = body.refresh_token;
     if (presented === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const record = await refreshTokenStore.consumeToken(await hashToken(presented));
     if (record === undefined || record.expiresAt < Date.now() || record.clientId !== client.clientId) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_grant");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_grant");
     }
     if (record.dpopJkt !== undefined) {
       const proof = await verifyDpopProof({
@@ -6936,7 +7686,7 @@ var oidcProviderRoutes = (config) => {
         proof: dpop
       });
       if (proof === undefined || proof.jkt !== record.dpopJkt) {
-        return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+        return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
       }
     }
     return tokenResponse(await issueTokenSet({
@@ -6952,7 +7702,7 @@ var oidcProviderRoutes = (config) => {
   };
   const grantTokenExchange = async (client, body, dpop) => {
     if (body.subject_token === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -6960,7 +7710,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     const result = await exchangeToken({
       actorClientId: client.clientId,
@@ -6971,21 +7721,21 @@ var oidcProviderRoutes = (config) => {
       subjectToken: body.subject_token
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       access_token: result.accessToken,
       expires_in: result.expiresIn,
       issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
       scope: result.scope,
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   };
   const grantBackchannel = async (client, body, dpop, clientCertThumbprint) => {
     if (config.backchannelAuthStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     if (body.auth_req_id === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -6993,7 +7743,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     const result = await exchangeBackchannelAuth({
       authReqId: body.auth_req_id,
@@ -7003,7 +7753,7 @@ var oidcProviderRoutes = (config) => {
       dpopJkt: dpopResult?.jkt
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       access_token: result.access_token,
       expires_in: result.expires_in,
@@ -7011,14 +7761,14 @@ var oidcProviderRoutes = (config) => {
       refresh_token: result.refresh_token,
       scope: result.scope,
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   };
   const grantDeviceCode = async (client, body, dpop) => {
     if (config.deviceAuthorizationStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     if (body.device_code === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
@@ -7026,7 +7776,7 @@ var oidcProviderRoutes = (config) => {
       proof: dpop
     });
     if (dpop !== undefined && dpopResult === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_dpop_proof");
     }
     const result = await exchangeDeviceCode({
       clientId: client.clientId,
@@ -7035,7 +7785,7 @@ var oidcProviderRoutes = (config) => {
       dpopJkt: dpopResult?.jkt
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       access_token: result.access_token,
       expires_in: result.expires_in,
@@ -7043,7 +7793,7 @@ var oidcProviderRoutes = (config) => {
       refresh_token: result.refresh_token,
       scope: result.scope,
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   };
   const grantTypes = [
     "authorization_code",
@@ -7059,13 +7809,17 @@ var oidcProviderRoutes = (config) => {
   if (config.vciConfig !== undefined) {
     grantTypes.push(PRE_AUTHORIZED_CODE_GRANT);
   }
+  for (const grantType of config.publicTokenGrantTypes ?? []) {
+    if (!grantTypes.includes(grantType))
+      grantTypes.push(grantType);
+  }
   const discovery = {
     authorization_endpoint: `${issuer}${authorizeRoute}`,
     authorization_response_iss_parameter_supported: true,
     backchannel_logout_session_supported: false,
     backchannel_logout_supported: true,
-    code_challenge_methods_supported: ["S256"],
     client_id_metadata_document_supported: config.resolveClientIdMetadata !== undefined,
+    code_challenge_methods_supported: ["S256"],
     dpop_signing_alg_values_supported: ["ES256"],
     end_session_endpoint: `${issuer}${endSessionRoute}`,
     grant_types_supported: grantTypes,
@@ -7113,6 +7867,11 @@ var oidcProviderRoutes = (config) => {
   if (config.acrValuesSupported !== undefined && config.acrValuesSupported.length > 0) {
     discovery.acr_values_supported = config.acrValuesSupported;
   }
+  const reservedDiscoveryKeys = new Set(Object.keys(discovery));
+  for (const [key, value] of Object.entries(config.additionalDiscoveryMetadata ?? {})) {
+    if (!reservedDiscoveryKeys.has(key))
+      discovery[key] = value;
+  }
   const handleEndSession = async ({
     cookie,
     inMemorySession,
@@ -7147,7 +7906,7 @@ var oidcProviderRoutes = (config) => {
       requestedUri: query.post_logout_redirect_uri
     });
     if (redirectUri === undefined) {
-      return jsonResponse({ ok: true }, HTTP_OK2);
+      return jsonResponse({ ok: true }, HTTP_OK3);
     }
     const url = new URL(redirectUri);
     if (query.state !== undefined)
@@ -7168,11 +7927,11 @@ var oidcProviderRoutes = (config) => {
         store: config.pushedAuthorizationRequestStore
       });
       if (pushed === undefined) {
-        return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
+        return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST3);
       }
       effectiveQuery = pushed;
     } else if (query.request_uri !== undefined && query.request_uri.startsWith(REQUEST_URI_PREFIX)) {
-      return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
+      return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST3);
     }
     const initialClientId = effectiveQuery.client_id;
     const initialClient = initialClientId === undefined ? undefined : await resolveClient(initialClientId);
@@ -7183,7 +7942,7 @@ var oidcProviderRoutes = (config) => {
         jwt: effectiveQuery.request
       });
       if (!parsed.ok) {
-        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST2);
+        return jsonResponse({ error: parsed.error }, HTTP_BAD_REQUEST3);
       }
       effectiveQuery = {
         ...parsed.params,
@@ -7203,11 +7962,11 @@ var oidcProviderRoutes = (config) => {
     } = effectiveQuery;
     const client = initialClient;
     if (client === undefined || clientId !== client.clientId || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
-      return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST2);
+      return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST3);
     }
     const responseMode = requestedResponseMode === "form_post" ? "form_post" : "query";
     if (requestedResponseMode !== undefined && requestedResponseMode !== "query" && requestedResponseMode !== "form_post") {
-      return jsonResponse({ error: "unsupported_response_mode" }, HTTP_BAD_REQUEST2);
+      return jsonResponse({ error: "unsupported_response_mode" }, HTTP_BAD_REQUEST3);
     }
     const errorRedirect = (error) => {
       const params2 = {
@@ -7251,7 +8010,7 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED3) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
     if (config.consentUrl !== undefined && await config.needsConsent?.({
@@ -7287,7 +8046,7 @@ var oidcProviderRoutes = (config) => {
     if (requestedAcr !== undefined && (userAcr === undefined || !requestedAcr.includes(userAcr))) {
       return errorRedirect("insufficient_user_authentication");
     }
-    const code = generateSecureToken(TOKEN_BYTES3);
+    const code = generateSecureToken(TOKEN_BYTES4);
     await authorizationCodeStore.saveCode({
       acr: userAcr,
       claims: getClaims?.(userSession.user),
@@ -7334,7 +8093,7 @@ var oidcProviderRoutes = (config) => {
     if (body.grant_type === PRE_AUTHORIZED_CODE_GRANT && config.vciConfig !== undefined) {
       const preAuthorizedCode = body["pre-authorized_code"];
       if (typeof preAuthorizedCode !== "string") {
-        return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+        return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
       }
       const result = await exchangePreAuthorizedCode({
         config: config.vciConfig,
@@ -7343,14 +8102,23 @@ var oidcProviderRoutes = (config) => {
         signingKey: config.vciConfig.signingKey ?? config.signingKey
       });
       if (!result.ok)
-        return oauthError2(HTTP_BAD_REQUEST2, result.error);
+        return oauthError2(HTTP_BAD_REQUEST3, result.error);
       return jsonResponse({
         access_token: result.access_token,
         c_nonce: result.c_nonce,
         c_nonce_expires_in: result.c_nonce_expires_in,
         expires_in: result.expires_in,
         token_type: result.token_type
-      }, HTTP_OK2);
+      }, HTTP_OK3);
+    }
+    if (typeof body.grant_type === "string" && config.publicTokenGrantTypes?.includes(body.grant_type) === true && config.handlePublicTokenGrant !== undefined) {
+      const result = await config.handlePublicTokenGrant({
+        body,
+        request
+      });
+      if (result !== undefined) {
+        return jsonResponse(result.body, result.status);
+      }
     }
     const basic = readBasicAuth2(headers.authorization);
     const auth = await authenticateTokenClient({
@@ -7363,7 +8131,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
@@ -7384,11 +8152,13 @@ var oidcProviderRoutes = (config) => {
     if (body.grant_type === CIBA_GRANT_TYPE) {
       return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
     }
-    return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+    return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
   }, {
     body: t14.Object({
+      assertion: t14.Optional(t14.String()),
       audience: t14.Optional(t14.String()),
       auth_req_id: t14.Optional(t14.String()),
+      claim_token: t14.Optional(t14.String()),
       client_assertion: t14.Optional(t14.String()),
       client_assertion_type: t14.Optional(t14.String()),
       client_id: t14.Optional(t14.String()),
@@ -7420,7 +8190,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
@@ -7431,7 +8201,7 @@ var oidcProviderRoutes = (config) => {
       store: config.pushedAuthorizationRequestStore,
       ttlMs: config.pushedAuthorizationRequestTtlMs
     });
-    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+    return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
   }, {
     body: t14.Object({
       acr_values: t14.Optional(t14.String()),
@@ -7458,11 +8228,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const result = await introspectToken({
       config,
@@ -7470,7 +8240,7 @@ var oidcProviderRoutes = (config) => {
       now: Date.now(),
       token: body.token
     });
-    return jsonResponse(result, HTTP_OK2);
+    return jsonResponse(result, HTTP_OK3);
   }, {
     body: t14.Object({
       client_id: t14.Optional(t14.String()),
@@ -7486,16 +8256,16 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     if (body.token_type_hint !== "access_token") {
       await revokeRefreshToken(config, body.token);
     }
-    return new Response(null, { status: HTTP_OK2 });
+    return new Response(null, { status: HTTP_OK3 });
   }, {
     body: t14.Object({
       client_id: t14.Optional(t14.String()),
@@ -7508,20 +8278,20 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
     if (config.backchannelAuthStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     if (body.login_hint === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const result = await issueBackchannelAuth({
@@ -7533,12 +8303,12 @@ var oidcProviderRoutes = (config) => {
       requestedScopes: requested
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({
       auth_req_id: result.auth_req_id,
       expires_in: result.expires_in,
       interval: result.interval
-    }, HTTP_OK2);
+    }, HTTP_OK3);
   }, {
     body: t14.Object({
       binding_message: t14.Optional(t14.String()),
@@ -7552,17 +8322,17 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const response = await issueDeviceAuthorization({
@@ -7571,7 +8341,7 @@ var oidcProviderRoutes = (config) => {
       now: Date.now(),
       requestedScopes: requested
     });
-    return jsonResponse(response, HTTP_OK2);
+    return jsonResponse(response, HTTP_OK3);
   }, {
     body: t14.Object({
       client_id: t14.Optional(t14.String()),
@@ -7583,7 +8353,7 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(deviceApproveRoute, async ({ body, cookie: { user_session_id }, store }) => {
     if (config.deviceAuthorizationStore === undefined) {
-      return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
+      return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -7591,7 +8361,7 @@ var oidcProviderRoutes = (config) => {
       userSessionId: user_session_id.value
     });
     if (userSession === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "login_required");
+      return oauthError2(HTTP_UNAUTHORIZED3, "login_required");
     }
     const result = body.action === "deny" ? await denyDeviceAuthorization({
       config,
@@ -7602,8 +8372,8 @@ var oidcProviderRoutes = (config) => {
       userSub: getUserId(userSession.user)
     });
     if (!result.ok)
-      return oauthError2(HTTP_BAD_REQUEST2, result.error);
-    return jsonResponse({ ok: true }, HTTP_OK2);
+      return oauthError2(HTTP_BAD_REQUEST3, result.error);
+    return jsonResponse({ ok: true }, HTTP_OK3);
   }, {
     body: t14.Object({
       action: t14.Optional(t14.Union([t14.Literal("approve"), t14.Literal("deny")])),
@@ -7655,7 +8425,7 @@ var oidcProviderRoutes = (config) => {
       registrationBaseUrl,
       registrationTokenStore: config.clientRegistrationTokenStore
     });
-    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+    return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
   }, {
     body: t14.Object({
       backchannel_logout_uri: t14.Optional(t14.String()),
@@ -7742,10 +8512,10 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED2
+        status: HTTP_UNAUTHORIZED3
       });
     }
-    return jsonResponse(result.body, HTTP_OK2);
+    return jsonResponse(result.body, HTTP_OK3);
   }, {
     headers: t14.Object({
       authorization: t14.Optional(t14.String())
@@ -7759,10 +8529,10 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED2
+        status: HTTP_UNAUTHORIZED3
       });
     }
-    return jsonResponse(result.body, HTTP_OK2);
+    return jsonResponse(result.body, HTTP_OK3);
   }, {
     body: t14.Object({
       access_token: t14.Optional(t14.String())
@@ -13742,7 +14512,7 @@ var PgJson = class extends PgColumn {
     return "json";
   }
 };
-function json(name2) {
+function json2(name2) {
   return new PgJsonBuilder(name2 ?? "");
 }
 
@@ -14279,7 +15049,7 @@ function getPgColumnBuilders() {
     inet,
     integer,
     interval,
-    json,
+    json: json2,
     jsonb,
     line,
     macaddr,
@@ -14496,6 +15266,9 @@ var Index = class {
 function index(name2) {
   return new IndexBuilderOn(false, name2);
 }
+function uniqueIndex(name2) {
+  return new IndexBuilderOn(true, name2);
+}
 // node_modules/drizzle-orm/pg-core/checks.js
 var CheckBuilder = class {
   static [entityKind] = "PgCheckBuilder";
@@ -24277,9 +25050,9 @@ var createInMemoryCredentialOfferStore = () => {
 };
 // src/oidc/vciRoutes.ts
 import { Elysia as Elysia38, t as t33 } from "elysia";
-var HTTP_OK3 = 200;
-var HTTP_BAD_REQUEST3 = 400;
-var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_OK4 = 200;
+var HTTP_BAD_REQUEST4 = 400;
+var HTTP_UNAUTHORIZED4 = 401;
 var BEARER_PREFIX5 = "Bearer ";
 var errorBody = (error, status) => new Response(JSON.stringify({ error }), {
   headers: { "content-type": "application/json" },
@@ -24308,7 +25081,7 @@ var vciRoutes = ({
   }))).post(credentialRoute, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
-      return errorBody("invalid_token", HTTP_UNAUTHORIZED3);
+      return errorBody("invalid_token", HTTP_UNAUTHORIZED4);
     }
     const result = await issueCredential({
       config: vciConfig,
@@ -24321,8 +25094,8 @@ var vciRoutes = ({
       signingKey: vciSigningKey
     });
     if (!result.ok)
-      return errorBody(result.error, HTTP_BAD_REQUEST3);
-    return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK3 });
+      return errorBody(result.error, HTTP_BAD_REQUEST4);
+    return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
   }, {
     body: t33.Object({
       format: t33.Optional(t33.Union([t33.Literal("vc+sd-jwt")])),
@@ -24333,7 +25106,7 @@ var vciRoutes = ({
     })
   }).post(nonceRoute, async () => {
     if (vciConfig.credentialNonceStore === undefined) {
-      return errorBody("not_supported", HTTP_BAD_REQUEST3);
+      return errorBody("not_supported", HTTP_BAD_REQUEST4);
     }
     const { generateSecureToken: generateSecureToken2, hashToken: hashToken2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
     const nonceBytes = 16;
@@ -24347,7 +25120,7 @@ var vciRoutes = ({
     return Response.json({
       c_nonce: nonce,
       c_nonce_expires_in: Math.floor(ttlMs / msPerSecond)
-    }, { status: HTTP_OK3 });
+    }, { status: HTTP_OK4 });
   });
 };
 // src/vc/statusList.ts
@@ -24451,7 +25224,7 @@ var verifyStatusListJwt = async ({
 };
 // src/vc/statusListRoutes.ts
 import { Elysia as Elysia39, t as t34 } from "elysia";
-var HTTP_OK4 = 200;
+var HTTP_OK5 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
 var statusListRoutes = ({
@@ -24476,7 +25249,7 @@ var statusListRoutes = ({
     });
     return new Response(jwt, {
       headers: { "content-type": STATUS_LIST_SUB_TYP },
-      status: HTTP_OK4
+      status: HTTP_OK5
     });
   }, { params: t34.Object({ listId: t34.String() }) });
 };
@@ -24684,8 +25457,8 @@ var createInMemoryPresentationRequestStore = () => {
 };
 // src/vc/vpRoutes.ts
 import { Elysia as Elysia40, t as t35 } from "elysia";
-var HTTP_OK5 = 200;
-var HTTP_BAD_REQUEST4 = 400;
+var HTTP_OK6 = 200;
+var HTTP_BAD_REQUEST5 = 400;
 var HTTP_NOT_FOUND2 = 404;
 var errorBody2 = (error, status) => new Response(JSON.stringify({ error }), {
   headers: { "content-type": "application/json" },
@@ -24718,7 +25491,7 @@ var vpRoutes = ({
       nonce: result.nonce,
       request_uri: result.requestUri,
       requestId: result.request.requestId
-    }, { status: HTTP_OK5 });
+    }, { status: HTTP_OK6 });
   }, {
     body: t35.Object({
       client_id: t35.Optional(t35.String()),
@@ -24747,19 +25520,19 @@ var vpRoutes = ({
       headers: {
         "content-type": "application/oauth-authz-req+jwt"
       },
-      status: HTTP_OK5
+      status: HTTP_OK6
     });
   }, { params: t35.Object({ id: t35.String() }) }).post(responseRoute, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
-      return errorBody2("missing_state", HTTP_BAD_REQUEST4);
+      return errorBody2("missing_state", HTTP_BAD_REQUEST5);
     }
     const result = await verifyPresentationResponse({
       config: vpConfig,
       input: { requestId, vpToken: body.vp_token }
     });
     if (!result.ok)
-      return errorBody2(result.error, HTTP_BAD_REQUEST4);
+      return errorBody2(result.error, HTTP_BAD_REQUEST5);
     if (onVerifiedPresentation !== undefined) {
       await onVerifiedPresentation({ verified: result.verified });
     }
@@ -24768,7 +25541,7 @@ var vpRoutes = ({
       holder_jwk: result.verified.holderJwk,
       protected_claims: result.verified.protectedClaims,
       verified: true
-    }, { status: HTTP_OK5 });
+    }, { status: HTTP_OK6 });
   }, {
     body: t35.Object({
       presentation_submission: t35.Optional(t35.Unknown()),
@@ -24966,6 +25739,284 @@ var createPostgresScimTokenStore = (db) => ({
     });
   }
 });
+// src/agents/registrationClient.ts
+var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var secureUrl = (value, allowLocalhost) => {
+  if (typeof value !== "string")
+    return;
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:")
+      return url.toString();
+    if (allowLocalhost && url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1")) {
+      return url.toString();
+    }
+  } catch {
+    return;
+  }
+  return;
+};
+var readBoundedJson = async (response, maxBytes) => {
+  const length = Number(response.headers.get("content-length"));
+  if (Number.isFinite(length) && length > maxBytes) {
+    throw new Error("Agent registration metadata exceeds the response limit");
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > maxBytes) {
+    throw new Error("Agent registration metadata exceeds the response limit");
+  }
+  const parsed = JSON.parse(new TextDecoder().decode(bytes));
+  return parsed;
+};
+var stringArray = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var requestJson = async (request, url, init, maxBytes) => {
+  const response = await request(url, {
+    ...init,
+    headers: {
+      accept: "application/json",
+      ...init.headers
+    },
+    redirect: "error"
+  });
+  const body = await readBoundedJson(response, maxBytes);
+  if (!isObject2(body))
+    throw new Error("Expected a JSON object");
+  return { body, response };
+};
+var createAgentRegistrationClient = (discovery, options = {}) => {
+  const request = options.request ?? fetch;
+  const maxBytes = options.maxResponseBytes ?? 256 * 1024;
+  const post = (url, body, form = false) => requestJson(request, url, {
+    body: form ? new URLSearchParams(Object.fromEntries(Object.entries(body).map(([key, value]) => [
+      key,
+      String(value)
+    ]))) : JSON.stringify(body),
+    headers: {
+      "content-type": form ? "application/x-www-form-urlencoded" : "application/json"
+    },
+    method: "POST"
+  }, maxBytes);
+  return {
+    beginAnonymous: () => post(discovery.agentAuth.identityEndpoint, { type: "anonymous" }),
+    beginServiceAuth: (loginHint) => post(discovery.agentAuth.identityEndpoint, {
+      login_hint: loginHint,
+      type: "service_auth"
+    }),
+    beginVerified: (assertion) => {
+      if (!discovery.agentAuth.identityAssertionTypes.includes(AGENT_IDENTITY_ASSERTION_TYPE)) {
+        throw new Error("Service does not accept ID-JAG assertions");
+      }
+      return post(discovery.agentAuth.identityEndpoint, {
+        assertion,
+        assertion_type: AGENT_IDENTITY_ASSERTION_TYPE,
+        type: "identity_assertion"
+      });
+    },
+    claim: (claimToken, email) => post(discovery.agentAuth.claimEndpoint, {
+      claim_token: claimToken,
+      email
+    }),
+    exchangeAssertion: (assertion) => post(discovery.tokenEndpoint, {
+      assertion,
+      grant_type: AGENT_IDENTITY_ASSERTION_GRANT_TYPE,
+      resource: discovery.resource
+    }, true),
+    pollClaim: (claimToken) => post(discovery.tokenEndpoint, {
+      claim_token: claimToken,
+      grant_type: AGENT_CLAIM_GRANT_TYPE
+    }, true)
+  };
+};
+var discoverAgentRegistration = async (resource, options = {}) => {
+  const request = options.request ?? fetch;
+  const maxBytes = options.maxResponseBytes ?? 256 * 1024;
+  const allowLocalhost = options.allowInsecureLocalhost === true;
+  const resourceUrl = secureUrl(resource, allowLocalhost);
+  if (resourceUrl === undefined)
+    throw new Error("Resource URL must use HTTPS");
+  const resourceMetadataUrl = new URL("/.well-known/oauth-protected-resource", resourceUrl).toString();
+  const prm = await requestJson(request, resourceMetadataUrl, {}, maxBytes);
+  const advertisedResource = secureUrl(prm.body.resource, allowLocalhost);
+  if (advertisedResource === undefined || advertisedResource !== resourceUrl) {
+    throw new Error("Protected resource metadata identity mismatch");
+  }
+  const authorizationServer = secureUrl(stringArray(prm.body.authorization_servers)[0], allowLocalhost);
+  if (authorizationServer === undefined) {
+    throw new Error("No secure authorization server is advertised");
+  }
+  const asUrl = new URL("/.well-known/oauth-authorization-server", authorizationServer).toString();
+  const metadata = await requestJson(request, asUrl, {}, maxBytes);
+  if (secureUrl(metadata.body.issuer, allowLocalhost) !== authorizationServer) {
+    throw new Error("Authorization server issuer mismatch");
+  }
+  const tokenEndpoint = secureUrl(metadata.body.token_endpoint, allowLocalhost);
+  const agentAuth = metadata.body.agent_auth;
+  if (tokenEndpoint === undefined || !isObject2(agentAuth)) {
+    throw new Error("Authorization server does not advertise agent registration");
+  }
+  const identityEndpoint = secureUrl(agentAuth.identity_endpoint, allowLocalhost);
+  const claimEndpoint = secureUrl(agentAuth.claim_endpoint, allowLocalhost);
+  const skill = secureUrl(agentAuth.skill, allowLocalhost);
+  const assertionMetadata = agentAuth.identity_assertion;
+  if (identityEndpoint === undefined || claimEndpoint === undefined || skill === undefined || !isObject2(assertionMetadata)) {
+    throw new Error("Agent registration metadata is incomplete");
+  }
+  return {
+    agentAuth: {
+      claimEndpoint,
+      identityAssertionTypes: stringArray(assertionMetadata.assertion_types_supported),
+      identityEndpoint,
+      identityTypes: stringArray(agentAuth.identity_types_supported),
+      skill
+    },
+    authorizationServer,
+    resource: resourceUrl,
+    resourceMetadataUrl,
+    scopes: stringArray(prm.body.scopes_supported),
+    tokenEndpoint
+  };
+};
+// src/agents/idJag.ts
+init_constants();
+var createInMemoryAgentIdentityAssertionJtiStore = () => {
+  const entries = new Map;
+  return {
+    recordIfFresh: async (issuer, jti, expiresAt) => {
+      const now = Date.now();
+      for (const [key2, expiry] of entries) {
+        if (expiry <= now)
+          entries.delete(key2);
+      }
+      const key = `${issuer}\x00${jti}`;
+      if (entries.has(key))
+        return false;
+      entries.set(key, expiresAt);
+      return true;
+    }
+  };
+};
+var issueAgentIdentityAssertion = async ({
+  agentContextId,
+  agentPlatform,
+  audience,
+  clientId,
+  issuer,
+  now = Date.now(),
+  resource,
+  signingKey,
+  ttlMs = 5 * 60 * MILLISECONDS_IN_A_SECOND,
+  user
+}) => {
+  if (user.emailVerified !== true && user.phoneNumberVerified !== true) {
+    throw new Error("ID-JAG issuance requires a verified email or phone number");
+  }
+  const expiresAt = now + ttlMs;
+  const payload = {
+    aud: audience,
+    auth_time: Math.floor(user.authenticatedAt / MILLISECONDS_IN_A_SECOND),
+    client_id: clientId,
+    exp: Math.floor(expiresAt / MILLISECONDS_IN_A_SECOND),
+    iat: Math.floor(now / MILLISECONDS_IN_A_SECOND),
+    iss: issuer,
+    jti: crypto.randomUUID(),
+    sub: user.subject
+  };
+  if (user.email !== undefined)
+    payload.email = user.email;
+  if (user.emailVerified !== undefined)
+    payload.email_verified = user.emailVerified;
+  if (user.name !== undefined)
+    payload.name = user.name;
+  if (user.phoneNumber !== undefined)
+    payload.phone_number = user.phoneNumber;
+  if (user.phoneNumberVerified !== undefined)
+    payload.phone_number_verified = user.phoneNumberVerified;
+  if (user.methods !== undefined)
+    payload.amr = user.methods;
+  if (resource !== undefined)
+    payload.resource = resource;
+  if (agentPlatform !== undefined)
+    payload.agent_platform = agentPlatform;
+  if (agentContextId !== undefined)
+    payload.agent_context_id = agentContextId;
+  return {
+    assertion: await signJwt(payload, signingKey, "oauth-id-jag+jwt"),
+    assertionType: AGENT_IDENTITY_ASSERTION_TYPE,
+    expiresAt
+  };
+};
+var numberClaim2 = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+var stringClaim2 = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+var createAgentIdentityAssertionVerifier = ({
+  audience,
+  clockSkewMs = MILLISECONDS_IN_A_SECOND * 60,
+  jtiStore,
+  maxAssertionLifetimeMs = MILLISECONDS_IN_A_SECOND * 60 * 60,
+  maxAuthenticationAgeMs = MILLISECONDS_IN_A_SECOND * 60 * 60,
+  resolveIssuer
+}) => async (assertion, now = Date.now()) => {
+  const segments = assertion.split(".");
+  if (segments.length !== 3 || segments[1] === undefined)
+    return;
+  let decoded;
+  try {
+    decoded = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+  } catch {
+    return;
+  }
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+    return;
+  }
+  const unverified = Object.fromEntries(Object.entries(decoded));
+  const issuer = stringClaim2(unverified.iss);
+  if (issuer === undefined)
+    return;
+  const trusted = await resolveIssuer(issuer);
+  if (trusted === undefined)
+    return;
+  const verified = await verifyJwt(assertion, trusted.publicJwk);
+  if (verified?.header?.typ !== "oauth-id-jag+jwt")
+    return;
+  const { payload } = verified;
+  const subject = stringClaim2(payload.sub);
+  const jti = stringClaim2(payload.jti);
+  const clientId = stringClaim2(payload.client_id);
+  const expiresAtSeconds = numberClaim2(payload.exp);
+  const issuedAtSeconds = numberClaim2(payload.iat);
+  const authenticatedAtSeconds = numberClaim2(payload.auth_time);
+  if (payload.iss !== issuer || payload.aud !== audience || subject === undefined || jti === undefined || clientId === undefined || expiresAtSeconds === undefined || issuedAtSeconds === undefined || authenticatedAtSeconds === undefined) {
+    return;
+  }
+  const expiresAt = expiresAtSeconds * MILLISECONDS_IN_A_SECOND;
+  const issuedAt = issuedAtSeconds * MILLISECONDS_IN_A_SECOND;
+  const authenticatedAt = authenticatedAtSeconds * MILLISECONDS_IN_A_SECOND;
+  if (expiresAt <= now - clockSkewMs || issuedAt > now + clockSkewMs || expiresAt <= issuedAt || expiresAt - issuedAt > maxAssertionLifetimeMs + clockSkewMs || authenticatedAt > now + clockSkewMs || authenticatedAt > issuedAt + clockSkewMs || now - authenticatedAt > maxAuthenticationAgeMs + clockSkewMs) {
+    return;
+  }
+  if (trusted.allowedClientIds !== undefined && !trusted.allowedClientIds.includes(clientId)) {
+    return;
+  }
+  const email = stringClaim2(payload.email);
+  const phoneNumber = stringClaim2(payload.phone_number);
+  const emailVerified = payload.email_verified === true;
+  const phoneNumberVerified = payload.phone_number_verified === true;
+  if (!emailVerified && !phoneNumberVerified)
+    return;
+  if (!await jtiStore.recordIfFresh(issuer, jti, expiresAt)) {
+    return;
+  }
+  return {
+    authenticatedAt,
+    clientId,
+    email,
+    emailVerified,
+    issuer,
+    name: stringClaim2(payload.name),
+    phoneNumber,
+    phoneNumberVerified,
+    subject
+  };
+};
 // src/agents/oidcAdapter.ts
 var BEARER_PREFIX6 = "Bearer ";
 var MS_PER_SECOND7 = 1000;
@@ -25027,6 +26078,11 @@ var createOidcAgentCredentialVerifier = ({
   return verifier;
 };
 // src/agents/inMemoryStores.ts
+var cloneIdentityRegistration = (value) => ({
+  ...value,
+  claimAttempt: value.claimAttempt === undefined ? undefined : { ...value.claimAttempt },
+  upstream: value.upstream === undefined ? undefined : { ...value.upstream }
+});
 var cloneRegistration = (value) => ({
   ...value,
   allowedScopes: [...value.allowedScopes],
@@ -25061,6 +26117,48 @@ var createInMemoryAgentDelegationStore = () => {
     }
   };
 };
+var createInMemoryAgentIdentityRegistrationStore = () => {
+  const registrations = new Map;
+  return {
+    create: async (registration) => {
+      const conflicts = [...registrations.values()].some((existing) => existing.registrationId === registration.registrationId || existing.agentId === registration.agentId || existing.claimTokenHash === registration.claimTokenHash || existing.claimAttempt !== undefined && existing.claimAttempt.tokenHash === registration.claimAttempt?.tokenHash || existing.upstream !== undefined && registration.upstream !== undefined && existing.upstream.clientId === registration.upstream.clientId && existing.upstream.issuer === registration.upstream.issuer && existing.upstream.subject === registration.upstream.subject);
+      if (conflicts)
+        return false;
+      registrations.set(registration.registrationId, cloneIdentityRegistration(registration));
+      return true;
+    },
+    findByAgentId: async (agentId) => {
+      const value = [...registrations.values()].find((registration) => registration.agentId === agentId);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByAttemptTokenHash: async (attemptTokenHash) => {
+      const value = [...registrations.values()].find((registration) => registration.claimAttempt?.tokenHash === attemptTokenHash);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByClaimTokenHash: async (claimTokenHash) => {
+      const value = [...registrations.values()].find((registration) => registration.claimTokenHash === claimTokenHash);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByRegistrationId: async (registrationId) => {
+      const value = registrations.get(registrationId);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    findByUpstreamIdentity: async ({ clientId, issuer, subject }) => {
+      const value = [...registrations.values()].find((registration) => registration.upstream?.clientId === clientId && registration.upstream?.issuer === issuer && registration.upstream.subject === subject);
+      return value === undefined ? undefined : cloneIdentityRegistration(value);
+    },
+    replace: async (registration, expectedVersion) => {
+      const current = registrations.get(registration.registrationId);
+      if (current?.version !== expectedVersion)
+        return false;
+      registrations.set(registration.registrationId, cloneIdentityRegistration({
+        ...registration,
+        version: expectedVersion + 1
+      }));
+      return true;
+    }
+  };
+};
 var createInMemoryAgentRegistrationStore = () => {
   const registrations = new Map;
   return {
@@ -25096,6 +26194,38 @@ var agentDelegationsTable = pgTable("auth_agent_delegations", {
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
 });
+var agentIdentityRegistrationsTable = pgTable("auth_agent_identity_registrations", {
+  agent_id: varchar("agent_id", { length: ID_LENGTH7 }).notNull().unique(),
+  claim_attempt: jsonb("claim_attempt").$type(),
+  claim_attempt_token_hash: varchar("claim_attempt_token_hash", {
+    length: ID_LENGTH7
+  }).unique(),
+  claim_expires_at_ms: bigint("claim_expires_at_ms", {
+    mode: "number"
+  }).notNull(),
+  claim_token_hash: varchar("claim_token_hash", {
+    length: ID_LENGTH7
+  }).notNull().unique(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  kind: varchar("kind", { length: 32 }).$type().notNull(),
+  last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
+  login_hint: varchar("login_hint", { length: ID_LENGTH7 }),
+  registration_id: varchar("registration_id", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  status: varchar("status", { length: STATUS_LENGTH2 }).$type().notNull(),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
+  upstream_client_id: varchar("upstream_client_id", {
+    length: ID_LENGTH7
+  }),
+  upstream_issuer: varchar("upstream_issuer", { length: ID_LENGTH7 }),
+  upstream_subject: varchar("upstream_subject", { length: ID_LENGTH7 }),
+  user_id: varchar("user_id", { length: ID_LENGTH7 }),
+  version: integer("version").notNull()
+}, (table) => [
+  uniqueIndex("auth_agent_identity_upstream_unique").on(table.upstream_issuer, table.upstream_subject, table.upstream_client_id)
+]);
 var agentRegistrationsTable = pgTable("auth_agent_registrations", {
   agent_id: varchar("agent_id", { length: ID_LENGTH7 }).primaryKey(),
   allowed_scopes: jsonb("allowed_scopes").$type().notNull().default([]),
@@ -25128,7 +26258,49 @@ var toDelegation = (row) => ({
   updatedAt: row.updated_at_ms,
   userId: row.user_id
 });
+var toIdentityRegistration = (row) => ({
+  agentId: row.agent_id,
+  claimAttempt: row.claim_attempt ?? undefined,
+  claimExpiresAt: row.claim_expires_at_ms,
+  claimTokenHash: row.claim_token_hash,
+  createdAt: row.created_at_ms,
+  expiresAt: row.expires_at_ms,
+  kind: row.kind,
+  lastPolledAt: row.last_polled_at_ms ?? undefined,
+  loginHint: row.login_hint ?? undefined,
+  registrationId: row.registration_id,
+  status: row.status,
+  updatedAt: row.updated_at_ms,
+  upstream: row.upstream_client_id === null || row.upstream_issuer === null || row.upstream_subject === null ? undefined : {
+    clientId: row.upstream_client_id,
+    issuer: row.upstream_issuer,
+    subject: row.upstream_subject
+  },
+  userId: row.user_id ?? undefined,
+  version: row.version
+});
+var identityRegistrationValues = (registration) => ({
+  agent_id: registration.agentId,
+  claim_attempt: registration.claimAttempt ?? null,
+  claim_attempt_token_hash: registration.claimAttempt?.tokenHash ?? null,
+  claim_expires_at_ms: registration.claimExpiresAt,
+  claim_token_hash: registration.claimTokenHash,
+  created_at_ms: registration.createdAt,
+  expires_at_ms: registration.expiresAt,
+  kind: registration.kind,
+  last_polled_at_ms: registration.lastPolledAt ?? null,
+  login_hint: registration.loginHint ?? null,
+  registration_id: registration.registrationId,
+  status: registration.status,
+  updated_at_ms: registration.updatedAt,
+  upstream_client_id: registration.upstream?.clientId ?? null,
+  upstream_issuer: registration.upstream?.issuer ?? null,
+  upstream_subject: registration.upstream?.subject ?? null,
+  user_id: registration.userId ?? null,
+  version: registration.version
+});
 var createNeonAgentDelegationStore = (databaseUrl) => createPostgresAgentDelegationStore(createNeonDatabase(databaseUrl));
+var createNeonAgentIdentityRegistrationStore = (databaseUrl) => createPostgresAgentIdentityRegistrationStore(createNeonDatabase(databaseUrl));
 var createNeonAgentRegistrationStore = (databaseUrl) => createPostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));
 var createPostgresAgentDelegationStore = (db) => ({
   findActiveDelegation: async ({
@@ -25169,6 +26341,41 @@ var createPostgresAgentDelegationStore = (db) => ({
     });
   }
 });
+var createPostgresAgentIdentityRegistrationStore = (db) => ({
+  create: async (registration) => {
+    const rows = await db.insert(agentIdentityRegistrationsTable).values(identityRegistrationValues(registration)).onConflictDoNothing().returning({ id: agentIdentityRegistrationsTable.registration_id });
+    return rows.length === 1;
+  },
+  findByAgentId: async (agentId) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.agent_id, agentId)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByAttemptTokenHash: async (attemptTokenHash) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.claim_attempt_token_hash, attemptTokenHash)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByClaimTokenHash: async (claimTokenHash) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.claim_token_hash, claimTokenHash)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByRegistrationId: async (registrationId) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.registration_id, registrationId)).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  findByUpstreamIdentity: async ({ clientId, issuer, subject }) => {
+    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(and(eq(agentIdentityRegistrationsTable.upstream_client_id, clientId), eq(agentIdentityRegistrationsTable.upstream_issuer, issuer), eq(agentIdentityRegistrationsTable.upstream_subject, subject))).limit(1);
+    return row === undefined ? undefined : toIdentityRegistration(row);
+  },
+  replace: async (registration, expectedVersion) => {
+    const next = {
+      ...registration,
+      version: expectedVersion + 1
+    };
+    const values = identityRegistrationValues(next);
+    const rows = await db.update(agentIdentityRegistrationsTable).set(values).where(and(eq(agentIdentityRegistrationsTable.registration_id, registration.registrationId), eq(agentIdentityRegistrationsTable.version, expectedVersion))).returning({ id: agentIdentityRegistrationsTable.registration_id });
+    return rows.length === 1;
+  }
+});
 var createPostgresAgentRegistrationStore = (db) => ({
   findByAgentId: async (agentId) => {
     const [row] = await db.select().from(agentRegistrationsTable).where(eq(agentRegistrationsTable.agent_id, agentId)).limit(1);
@@ -25402,7 +26609,7 @@ var createPostgresApiKeyStore = (db) => ({
   }
 });
 // src/oidc/clientIdMetadata.ts
-var secureUrl = (value) => {
+var secureUrl2 = (value) => {
   try {
     return new URL(value).protocol === "https:";
   } catch {
@@ -25413,7 +26620,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
   const errors = [];
   if (document.client_id !== expectedClientId)
     errors.push("client_id does not match the metadata document URL");
-  if (!secureUrl(document.client_id))
+  if (!secureUrl2(document.client_id))
     errors.push("client_id must use HTTPS");
   if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
     errors.push("redirect_uris is required");
@@ -25433,7 +26640,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
     ["tos_uri", document.tos_uri],
     ["jwks_uri", document.jwks_uri]
   ]) {
-    if (value !== undefined && !secureUrl(value))
+    if (value !== undefined && !secureUrl2(value))
       errors.push(`${name2} must use HTTPS`);
   }
   return errors;
@@ -25456,7 +26663,7 @@ var createClientIdMetadataResolver = ({
 }) => {
   const cache = new Map;
   return async (clientId) => {
-    if (!secureUrl(clientId) || !await allow(clientId))
+    if (!secureUrl2(clientId) || !await allow(clientId))
       return;
     const cached = cache.get(clientId);
     if (cached !== undefined && cached.expiresAt > now())
@@ -27368,10 +28575,20 @@ var mfaTotpLockoutMigration = {
 };
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
-  agents: initMigration("agents", [
-    agentRegistrationsTable,
-    agentDelegationsTable
-  ]),
+  agents: {
+    block: "agents",
+    migrations: [
+      ...initMigration("agents", [
+        agentRegistrationsTable,
+        agentDelegationsTable,
+        agentIdentityRegistrationsTable
+      ]).migrations,
+      {
+        id: "0002_identity_registration",
+        sql: tablesToInitSql([agentIdentityRegistrationsTable])
+      }
+    ]
+  },
   apikeys: initMigration("apikeys", [
     accessTokensTable,
     apiClientsTable,
@@ -27434,17 +28651,17 @@ var blockMigrations = {
 };
 // src/sso/samlIdpRoutes.ts
 import { Elysia as Elysia41, t as t36 } from "elysia";
-var HTTP_BAD_REQUEST5 = 400;
-var HTTP_UNAUTHORIZED4 = 401;
+var HTTP_BAD_REQUEST6 = 400;
+var HTTP_UNAUTHORIZED5 = 401;
 var HTTP_FOUND2 = 302;
-var HTTP_OK6 = 200;
+var HTTP_OK7 = 200;
 var xmlResponse = (body) => new Response(body, {
   headers: { "content-type": "application/samlmetadata+xml" },
-  status: HTTP_OK6
+  status: HTTP_OK7
 });
 var htmlResponse = (body) => new Response(body, {
   headers: { "content-type": "text/html; charset=utf-8" },
-  status: HTTP_OK6
+  status: HTTP_OK7
 });
 var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
 var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
@@ -27496,7 +28713,7 @@ var samlIdpRoutes = ({
     userSessionIdValue
   }) => {
     if (body.SAMLRequest === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "missing_saml_request");
+      return errorJson(HTTP_BAD_REQUEST6, "missing_saml_request");
     }
     let firstPass;
     try {
@@ -27505,11 +28722,11 @@ var samlIdpRoutes = ({
         samlRequest: body.SAMLRequest
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST6, "invalid_authn_request");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST6, "unknown_service_provider");
     }
     let parsed;
     try {
@@ -27522,7 +28739,7 @@ var samlIdpRoutes = ({
         signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST6, "invalid_authn_request");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -27531,7 +28748,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined || parsed.forceAuthn === true) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED4, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED5, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -27580,11 +28797,11 @@ var samlIdpRoutes = ({
     store
   }) => {
     if (serviceProviderEntityId === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "missing_sp");
+      return errorJson(HTTP_BAD_REQUEST6, "missing_sp");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST6, "unknown_service_provider");
     }
     const userSession = authSessionStore === undefined ? await loadSessionFromSource({
       session: store.session,
@@ -27596,7 +28813,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED4, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED5, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -27893,6 +29110,38 @@ var auth = async ({
   onRevocationError,
   onSessionCleanup
 }) => {
+  if (agentAuth?.agentRegistration !== undefined) {
+    if (oidc === undefined) {
+      throw new Error("agentAuth.agentRegistration requires the OIDC provider");
+    }
+    if (agentAuth.authorizationServer !== oidc.issuer) {
+      throw new Error("agentAuth.authorizationServer must equal oidc.issuer");
+    }
+    const registration2 = agentAuth.agentRegistration;
+    const unknownScopes = [
+      ...registration2.preClaimScopes ?? [],
+      ...registration2.postClaimScopes
+    ].filter((scope) => !agentAuth.scopes.includes(scope));
+    if (unknownScopes.length > 0) {
+      throw new Error(`Agent registration uses undeclared scopes: ${[...new Set(unknownScopes)].join(", ")}`);
+    }
+    if (registration2.allowAnonymous === true && registration2.revokeAccessTokens === undefined) {
+      throw new Error("Anonymous agent registration requires revokeAccessTokens");
+    }
+    for (const [name2, value] of Object.entries({
+      assertionTtlMs: registration2.assertionTtlMs,
+      attemptTtlMs: registration2.attemptTtlMs,
+      claimTtlMs: registration2.claimTtlMs,
+      maxAuthenticationAgeMs: registration2.maxAuthenticationAgeMs,
+      maxCodeAttempts: registration2.maxCodeAttempts,
+      pollIntervalSeconds: registration2.pollIntervalSeconds,
+      tokenTtlMs: registration2.tokenTtlMs
+    })) {
+      if (value !== undefined && (!Number.isFinite(value) || value <= 0)) {
+        throw new Error(`agentAuth.agentRegistration.${name2} must be positive`);
+      }
+    }
+  }
   if (tracing !== undefined)
     await initTracing(tracing);
   const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client, customProviders);
@@ -27906,8 +29155,34 @@ var auth = async ({
     }
   }) : undefined;
   const lockoutGuard = lockout ? createLockoutGuard(lockout) : undefined;
+  const resolvedAgentAuth = agentAuth === undefined ? undefined : {
+    ...agentAuth,
+    oidcRoute: agentAuth.oidcRoute ?? oidc?.oidcRoute
+  };
   const oidcConfig = oidc ? {
     ...oidc,
+    additionalDiscoveryMetadata: {
+      ...oidc.additionalDiscoveryMetadata,
+      ...resolvedAgentAuth?.agentRegistration === undefined ? {} : {
+        agent_auth: agentRegistrationDiscoveryMetadata(resolvedAgentAuth)
+      }
+    },
+    publicTokenGrantTypes: [
+      ...oidc.publicTokenGrantTypes ?? [],
+      ...resolvedAgentAuth?.agentRegistration === undefined ? [] : [
+        AGENT_CLAIM_GRANT_TYPE,
+        AGENT_IDENTITY_ASSERTION_GRANT_TYPE
+      ]
+    ],
+    handlePublicTokenGrant: async (context) => {
+      const consumerResult = await oidc.handlePublicTokenGrant?.(context);
+      if (consumerResult !== undefined)
+        return consumerResult;
+      if (resolvedAgentAuth?.agentRegistration === undefined) {
+        return;
+      }
+      return handleAgentTokenGrant(resolvedAgentAuth, context.body);
+    },
     onClientRegistered: async (context) => {
       await oidc.onClientRegistered?.(context);
       if (agentAuth?.registerDynamicClients !== true)
@@ -27932,28 +29207,28 @@ var auth = async ({
       await oidc.onDeviceAuthorizationApproved?.(context);
       if (agentAuth === undefined)
         return;
-      const registration = await agentAuth.registrationStore.findByClientId(context.clientId);
-      if (registration === undefined || registration.status !== "active") {
+      const registration2 = await agentAuth.registrationStore.findByClientId(context.clientId);
+      if (registration2 === undefined || registration2.status !== "active") {
         return;
       }
       const now = Date.now();
       const existing = await agentAuth.delegationStore.findActiveDelegation({
-        agentId: registration.agentId,
+        agentId: registration2.agentId,
         now,
         userId: context.userSub
       });
       await agentAuth.delegationStore.saveDelegation({
-        agentId: registration.agentId,
+        agentId: registration2.agentId,
         createdAt: existing?.createdAt ?? now,
         delegationId: existing?.delegationId ?? `agd_${crypto.randomUUID()}`,
-        scopes: context.scopes.filter((scope) => registration.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
+        scopes: context.scopes.filter((scope) => registration2.allowedScopes.includes(scope) && agentAuth.scopes.includes(scope)),
         status: "active",
         updatedAt: now,
         userId: context.userSub
       });
       await auditEmit?.({
         at: now,
-        metadata: { agentId: registration.agentId },
+        metadata: { agentId: registration2.agentId },
         type: "agent_delegated",
         userId: context.userSub
       });
@@ -28066,7 +29341,7 @@ var auth = async ({
     ...htmx,
     authSessionStore
   }) : new Elysia42);
-  const authWithAgent = composedAuth.use(agentAuthPlugin(agentAuth));
+  const authWithAgent = composedAuth.use(agentAuthPlugin(resolvedAgentAuth));
   return authWithAgent;
 };
 export {
@@ -28118,6 +29393,7 @@ export {
   stepUpPlugin,
   statusListRoutes,
   startImpersonation,
+  startAgentRegistration,
   ssoDiscoveryRoute,
   ssoConnectionsTable,
   signWebhook,
@@ -28144,6 +29420,7 @@ export {
   roleRoutes,
   revokeUserSessions,
   revokeRefreshToken,
+  revokeAgentIdentityRegistration,
   revocableProviderOptions,
   resolveSetupSession,
   resolveScimOrganization,
@@ -28223,6 +29500,8 @@ export {
   issueDeviceAuthorization,
   issueCredential,
   issueBackchannelAuth,
+  issueAgentServiceAssertion,
+  issueAgentIdentityAssertion,
   isValidUser,
   isValidProviderOption,
   isUserSessionId,
@@ -28251,6 +29530,7 @@ export {
   hashAuditEvent,
   hasScopes,
   hasOrganizationScope,
+  handleAgentTokenGrant,
   getUserSessionId,
   getStatus,
   getRegisteredClient,
@@ -28262,6 +29542,7 @@ export {
   generateSecureToken,
   generateEncryptionKey,
   generateBackupCodes,
+  generateAgentRegistrationGuide,
   fromBase64Url2 as fromBase64Url,
   fingerprintDevice,
   fetchUserInfo,
@@ -28279,6 +29560,7 @@ export {
   endImpersonation,
   encryptTotpSecret,
   encryptSecret,
+  discoverAgentRegistration,
   diffScimGroupMembers,
   denyDeviceAuthorization,
   denyBackchannelAuth,
@@ -28349,6 +29631,7 @@ export {
   createPostgresApiKeyStore,
   createPostgresApiClientStore,
   createPostgresAgentRegistrationStore,
+  createPostgresAgentIdentityRegistrationStore,
   createPostgresAgentDelegationStore,
   createPostgresAccessTokenStore,
   createOrganization,
@@ -28391,6 +29674,7 @@ export {
   createNeonApiKeyStore,
   createNeonApiClientStore,
   createNeonAgentRegistrationStore,
+  createNeonAgentIdentityRegistrationStore,
   createNeonAgentDelegationStore,
   createNeonAccessTokenStore,
   createMfaGate,
@@ -28433,6 +29717,8 @@ export {
   createInMemoryApiKeyStore,
   createInMemoryApiClientStore,
   createInMemoryAgentRegistrationStore,
+  createInMemoryAgentIdentityRegistrationStore,
+  createInMemoryAgentIdentityAssertionJtiStore,
   createInMemoryAgentDelegationStore,
   createInMemoryAccessTokenStore,
   createFgaEngine,
@@ -28446,6 +29732,9 @@ export {
   createApiKey,
   createApiClient,
   createAnonymousSession,
+  createAgentRegistrationCredentialVerifier,
+  createAgentRegistrationClient,
+  createAgentIdentityAssertionVerifier,
   createActionPipeline,
   createAbuseGuard,
   consumePushedRequest,
@@ -28453,6 +29742,7 @@ export {
   constantTimeEqual,
   computeCertThumbprint,
   complianceRoutes,
+  completeAgentClaim,
   clientIdMetadataToOAuthClient,
   check2 as check,
   buildStatusClaim,
@@ -28460,6 +29750,7 @@ export {
   buildHolderKeyBindingJwt,
   buildClientProviders,
   blockMigrations,
+  beginAgentClaim,
   base32Encode,
   base32Decode,
   authProviderOption,
@@ -28475,7 +29766,10 @@ export {
   apiKeysRoutes,
   apiClientsTable,
   agentRegistrationsTable,
+  agentRegistrationEndpoints,
+  agentRegistrationDiscoveryMetadata,
   agentProtectedResourceMetadata,
+  agentIdentityRegistrationsTable,
   agentHasScopes,
   agentDelegationsTable,
   agentAuthPlugin,
@@ -28526,8 +29820,11 @@ export {
   DEFAULT_AGENT_RESOURCE_METADATA_ROUTE,
   CLIENT_ASSERTION_TYPE,
   CIBA_GRANT_TYPE,
-  AuthIdentityConflictError
+  AuthIdentityConflictError,
+  AGENT_IDENTITY_ASSERTION_TYPE,
+  AGENT_IDENTITY_ASSERTION_GRANT_TYPE,
+  AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=D8A79A996B677FF164756E2164756E21
+//# debugId=A2D2B9523667A9C564756E2164756E21
 //# sourceMappingURL=index.js.map