@absolutejs/auth 0.56.13 → 0.56.15

package/dist/agents/oauthGuide.d.ts

@@ -0,0 +1,18 @@
+import type { RouteString } from '../types';
+export type AgentOAuthGuideResource = {
+    metadataUrl: string;
+    name: string;
+    resource: string;
+    scopes: readonly string[];
+};
+export type AgentOAuthGuideConfig = {
+    authorizationServer: string;
+    resources: readonly AgentOAuthGuideResource[];
+    route?: RouteString;
+    serviceName: string;
+};
+export declare const agentOAuthGuideRoute: (config: AgentOAuthGuideConfig) => `/${string}`;
+export declare const agentOAuthGuideUrl: (config: AgentOAuthGuideConfig) => string;
+/** Generate an agent-readable OAuth companion from exact application-owned
+ * resource metadata. OAuth discovery remains authoritative. */
+export declare const generateAgentOAuthGuide: (config: AgentOAuthGuideConfig) => string;

package/dist/agents/postgresStores.d.ts

@@ -584,6 +584,8 @@ export declare const agentRegistrationsTable: import("drizzle-orm/pg-core").PgTa
 export declare const createNeonAgentDelegationStore: (databaseUrl: string) => AgentDelegationStore;
 export declare const createNeonAgentIdentityRegistrationStore: (databaseUrl: string) => AgentIdentityRegistrationStore;
 export declare const createNeonAgentRegistrationStore: (databaseUrl: string) => AgentRegistrationStore;
+export declare const createDrizzleAgentDelegationStore: <DB extends AnyPgDatabase>(db: DB) => AgentDelegationStore;
+/** @deprecated Use createDrizzleAgentDelegationStore. */
 export declare const createPostgresAgentDelegationStore: <DB extends AnyPgDatabase>(db: DB) => AgentDelegationStore;
 export declare const createPostgresAgentIdentityRegistrationStore: <DB extends AnyPgDatabase>(db: DB) => AgentIdentityRegistrationStore;
 export declare const createPostgresAgentRegistrationStore: <DB extends AnyPgDatabase>(db: DB) => AgentRegistrationStore;

package/dist/agents/routes.d.ts

@@ -28,26 +28,7 @@ export declare const agentAuthPlugin: (config?: AgentAuthConfig) => Elysia<"", {
             message: "Agent is not authenticated" | "Insufficient agent scopes";
         }) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
     }>;
-}, {} | {
-    [x: string]: {
-        get: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                200: {
-                    resource: string;
-                    scopes_supported: string[];
-                    resource_name?: string | undefined;
-                    resource_logo_uri?: string | undefined;
-                    authorization_servers: string[];
-                    bearer_methods_supported: string[];
-                };
-            };
-        };
-    };
-} | ({
+}, {} | ({
     [x: string]: {
         get: {
             body: unknown;
@@ -200,52 +181,6 @@ export declare const agentAuthRoutes: (config?: AgentAuthConfig) => Elysia<"", {
             };
         };
     };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}> | Elysia<"", {
-    decorator: {};
-    store: {};
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        get: {
-            body: unknown;
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                200: {
-                    resource: string;
-                    scopes_supported: string[];
-                    resource_name?: string | undefined;
-                    resource_logo_uri?: string | undefined;
-                    authorization_servers: string[];
-                    bearer_methods_supported: string[];
-                };
-            };
-        };
-    };
 } & {
     [x: string]: {
         get: {

package/dist/cli/migrate.js.map

@@ -11,7 +11,7 @@
     "import { and, desc, eq } from 'drizzle-orm';\nimport {\n\tbigint,\n\tboolean,\n\tdoublePrecision,\n\tpgTable,\n\tprimaryKey,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tKnownDevice,\n\tKnownDeviceStore,\n\tLoginAttempt,\n\tLoginHistoryStore\n} from './types';\n\nconst ID_LENGTH = 255;\n\nexport const knownDevicesTable = pgTable(\n\t'auth_known_devices',\n\t{\n\t\tdevice_id: varchar('device_id', { length: ID_LENGTH }).notNull(),\n\t\tfirst_seen_at_ms: bigint('first_seen_at_ms', {\n\t\t\tmode: 'number'\n\t\t}).notNull(),\n\t\tlabel: varchar('label', { length: ID_LENGTH }),\n\t\tlast_seen_at_ms: bigint('last_seen_at_ms', {\n\t\t\tmode: 'number'\n\t\t}).notNull(),\n\t\ttrusted: boolean('trusted').notNull().default(false),\n\t\tuser_id: varchar('user_id', { length: ID_LENGTH }).notNull()\n\t},\n\t(table) => [primaryKey({ columns: [table.user_id, table.device_id] })]\n);\n\nexport const loginHistoryTable = pgTable('auth_login_history', {\n\tattempt_id: varchar('attempt_id', { length: ID_LENGTH }).primaryKey(),\n\tcountry: varchar('country', { length: ID_LENGTH }),\n\tdevice_id: varchar('device_id', { length: ID_LENGTH }).notNull(),\n\tip_address: varchar('ip_address', { length: ID_LENGTH }),\n\tlatitude: doublePrecision('latitude'),\n\tlongitude: doublePrecision('longitude'),\n\toutcome: varchar('outcome', { length: ID_LENGTH }).notNull(),\n\ttimestamp_ms: bigint('timestamp_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH }).notNull()\n});\n\ntype KnownDeviceRow = typeof knownDevicesTable.$inferSelect;\ntype LoginAttemptRow = typeof loginHistoryTable.$inferSelect;\n\nconst toRiskAction = (value: string) => {\n\tif (value === 'deny') return 'deny';\n\tif (value === 'step_up') return 'step_up';\n\n\treturn 'allow';\n};\n\nconst toDevice = (row: KnownDeviceRow): KnownDevice => ({\n\tdeviceId: row.device_id,\n\tfirstSeenAt: row.first_seen_at_ms,\n\tlabel: row.label ?? undefined,\n\tlastSeenAt: row.last_seen_at_ms,\n\ttrusted: row.trusted,\n\tuserId: row.user_id\n});\n\nconst toDeviceValues = (\n\tdevice: KnownDevice\n): typeof knownDevicesTable.$inferInsert => ({\n\tdevice_id: device.deviceId,\n\tfirst_seen_at_ms: device.firstSeenAt,\n\tlabel: device.label ?? null,\n\tlast_seen_at_ms: device.lastSeenAt,\n\ttrusted: device.trusted,\n\tuser_id: device.userId\n});\n\nconst toAttempt = (row: LoginAttemptRow): LoginAttempt => ({\n\tattemptId: row.attempt_id,\n\tcountry: row.country ?? undefined,\n\tdeviceId: row.device_id,\n\tipAddress: row.ip_address ?? undefined,\n\tlatitude: row.latitude ?? undefined,\n\tlongitude: row.longitude ?? undefined,\n\toutcome: toRiskAction(row.outcome),\n\ttimestamp: row.timestamp_ms,\n\tuserId: row.user_id\n});\n\nconst toAttemptValues = (\n\tattempt: LoginAttempt\n): typeof loginHistoryTable.$inferInsert => ({\n\tattempt_id: attempt.attemptId,\n\tcountry: attempt.country ?? null,\n\tdevice_id: attempt.deviceId,\n\tip_address: attempt.ipAddress ?? null,\n\tlatitude: attempt.latitude ?? null,\n\tlongitude: attempt.longitude ?? null,\n\toutcome: attempt.outcome,\n\ttimestamp_ms: attempt.timestamp,\n\tuser_id: attempt.userId\n});\n\nexport const createNeonKnownDeviceStore = (databaseUrl: string) =>\n\tcreatePostgresKnownDeviceStore(createNeonDatabase(databaseUrl));\nexport const createNeonLoginHistoryStore = (databaseUrl: string) =>\n\tcreatePostgresLoginHistoryStore(createNeonDatabase(databaseUrl));\nexport const createPostgresKnownDeviceStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): KnownDeviceStore => ({\n\tfindDevice: async (userId, deviceId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(knownDevicesTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(knownDevicesTable.user_id, userId),\n\t\t\t\t\teq(knownDevicesTable.device_id, deviceId)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row ? toDevice(row) : undefined;\n\t},\n\tlistDevices: async (userId) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(knownDevicesTable)\n\t\t\t.where(eq(knownDevicesTable.user_id, userId))\n\t\t\t.orderBy(desc(knownDevicesTable.last_seen_at_ms));\n\n\t\treturn rows.map(toDevice);\n\t},\n\tsaveDevice: async (device) => {\n\t\tconst values = toDeviceValues(device);\n\t\tawait db\n\t\t\t.insert(knownDevicesTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: values,\n\t\t\t\ttarget: [knownDevicesTable.user_id, knownDevicesTable.device_id]\n\t\t\t});\n\t}\n});\nexport const createPostgresLoginHistoryStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): LoginHistoryStore => ({\n\tlistRecent: async (userId, limit) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(loginHistoryTable)\n\t\t\t.where(eq(loginHistoryTable.user_id, userId))\n\t\t\t.orderBy(desc(loginHistoryTable.timestamp_ms))\n\t\t\t.limit(limit);\n\n\t\treturn rows.map(toAttempt);\n\t},\n\trecordAttempt: async (attempt) => {\n\t\tawait db.insert(loginHistoryTable).values(toAttemptValues(attempt));\n\t}\n});\n",
     "import { neon } from '@neondatabase/serverless';\nimport { drizzle } from 'drizzle-orm/neon-http';\nimport type { PgAsyncDatabase } from 'drizzle-orm/pg-core';\n\n// Shared scaffolding for the enterprise stores. Every new store ships an\n// in-memory implementation (dev/test) plus a Postgres implementation that accepts\n// a Drizzle `PgDatabase` — so it runs on Neon (neon-http) AND node-postgres without\n// the package bundling a second driver. `createNeonDatabase` is the convenience\n// wrapper consumers reach for when they just want a Neon connection string.\n\n// PgAsyncDatabase (drizzle 1.0; was PgDatabase pre-1.0) is effectively invariant\n// over its type parameters (query-result HKT, relational config), and TS can't\n// reliably re-infer those base params from a concrete driver *subclass*\n// (PostgresJsDatabase, NeonHttpDatabase, …). So the only way to accept any\n// driver with NO caller-side cast is a generic store constructor whose db\n// parameter is bound by `AnyPgDatabase`: `<DB extends AnyPgDatabase>(db: DB)`.\n// The `any`s live ONLY in this bound — `DB` is inferred as the caller's exact\n// database type, so store bodies stay fully typed (this is not `db: any`).\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- constraint bound only; DB infers the caller's exact db type\nexport type AnyPgDatabase = PgAsyncDatabase<any, any>;\n\nexport const createNeonDatabase = (databaseUrl: string) =>\n\tdrizzle({ client: neon(databaseUrl) });\n",
     "import { desc, eq, lt } from 'drizzle-orm';\nimport { bigint, pgTable, text, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tAccessToken,\n\tAccessTokenStore,\n\tApiClient,\n\tApiClientStore,\n\tApiKey,\n\tApiKeyStore\n} from './types';\n\nconst ID_LENGTH = 255;\n\nexport const accessTokensTable = pgTable('auth_access_tokens', {\n\tclient_id: varchar('client_id', { length: ID_LENGTH }).notNull(),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }).notNull(),\n\thashed_token: varchar('hashed_token', { length: ID_LENGTH }).notNull(),\n\towner_id: varchar('owner_id', { length: ID_LENGTH }),\n\tscopes: text('scopes').array().notNull(),\n\ttoken_id: varchar('token_id', { length: ID_LENGTH }).primaryKey()\n});\nexport const apiClientsTable = pgTable('auth_api_clients', {\n\tclient_id: varchar('client_id', { length: ID_LENGTH }).primaryKey(),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\thashed_secret: varchar('hashed_secret', { length: ID_LENGTH }).notNull(),\n\tname: varchar('name', { length: ID_LENGTH }).notNull(),\n\towner_id: varchar('owner_id', { length: ID_LENGTH }),\n\tscopes: text('scopes').array().notNull()\n});\nexport const apiKeysTable = pgTable('auth_api_keys', {\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }),\n\thashed_key: varchar('hashed_key', { length: ID_LENGTH }).notNull(),\n\tkey_id: varchar('key_id', { length: ID_LENGTH }).primaryKey(),\n\tlast_used_at_ms: bigint('last_used_at_ms', { mode: 'number' }),\n\tname: varchar('name', { length: ID_LENGTH }).notNull(),\n\towner_id: varchar('owner_id', { length: ID_LENGTH }),\n\tprefix: varchar('prefix', { length: ID_LENGTH }).notNull(),\n\tscopes: text('scopes').array().notNull()\n});\n\ntype ApiKeyRow = typeof apiKeysTable.$inferSelect;\ntype ApiClientRow = typeof apiClientsTable.$inferSelect;\ntype AccessTokenRow = typeof accessTokensTable.$inferSelect;\n\nconst toKey = (row: ApiKeyRow): ApiKey => ({\n\tcreatedAt: row.created_at_ms,\n\texpiresAt: row.expires_at_ms ?? undefined,\n\thashedKey: row.hashed_key,\n\tkeyId: row.key_id,\n\tlastUsedAt: row.last_used_at_ms ?? undefined,\n\tname: row.name,\n\townerId: row.owner_id ?? undefined,\n\tprefix: row.prefix,\n\tscopes: row.scopes\n});\n\nconst toKeyValues = (key: ApiKey): typeof apiKeysTable.$inferInsert => ({\n\tcreated_at_ms: key.createdAt,\n\texpires_at_ms: key.expiresAt ?? null,\n\thashed_key: key.hashedKey,\n\tkey_id: key.keyId,\n\tlast_used_at_ms: key.lastUsedAt ?? null,\n\tname: key.name,\n\towner_id: key.ownerId ?? null,\n\tprefix: key.prefix,\n\tscopes: key.scopes\n});\n\nconst toClient = (row: ApiClientRow): ApiClient => ({\n\tclientId: row.client_id,\n\tcreatedAt: row.created_at_ms,\n\thashedSecret: row.hashed_secret,\n\tname: row.name,\n\townerId: row.owner_id ?? undefined,\n\tscopes: row.scopes\n});\n\nconst toClientValues = (\n\tclient: ApiClient\n): typeof apiClientsTable.$inferInsert => ({\n\tclient_id: client.clientId,\n\tcreated_at_ms: client.createdAt,\n\thashed_secret: client.hashedSecret,\n\tname: client.name,\n\towner_id: client.ownerId ?? null,\n\tscopes: client.scopes\n});\n\nconst toAccessToken = (row: AccessTokenRow): AccessToken => ({\n\tclientId: row.client_id,\n\tcreatedAt: row.created_at_ms,\n\texpiresAt: row.expires_at_ms,\n\thashedToken: row.hashed_token,\n\townerId: row.owner_id ?? undefined,\n\tscopes: row.scopes,\n\ttokenId: row.token_id\n});\n\nconst toAccessTokenValues = (\n\ttoken: AccessToken\n): typeof accessTokensTable.$inferInsert => ({\n\tclient_id: token.clientId,\n\tcreated_at_ms: token.createdAt,\n\texpires_at_ms: token.expiresAt,\n\thashed_token: token.hashedToken,\n\towner_id: token.ownerId ?? null,\n\tscopes: token.scopes,\n\ttoken_id: token.tokenId\n});\n\nexport const createNeonAccessTokenStore = (databaseUrl: string) =>\n\tcreatePostgresAccessTokenStore(createNeonDatabase(databaseUrl));\nexport const createNeonApiClientStore = (databaseUrl: string) =>\n\tcreatePostgresApiClientStore(createNeonDatabase(databaseUrl));\nexport const createNeonApiKeyStore = (databaseUrl: string) =>\n\tcreatePostgresApiKeyStore(createNeonDatabase(databaseUrl));\nexport const createPostgresAccessTokenStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AccessTokenStore => ({\n\tdeleteExpired: async (now) => {\n\t\tawait db\n\t\t\t.delete(accessTokensTable)\n\t\t\t.where(lt(accessTokensTable.expires_at_ms, now));\n\t},\n\tdeleteToken: async (tokenId) => {\n\t\tawait db\n\t\t\t.delete(accessTokensTable)\n\t\t\t.where(eq(accessTokensTable.token_id, tokenId));\n\t},\n\tfindByHashedToken: async (hashedToken) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(accessTokensTable)\n\t\t\t.where(eq(accessTokensTable.hashed_token, hashedToken))\n\t\t\t.limit(1);\n\n\t\treturn row ? toAccessToken(row) : undefined;\n\t},\n\tsaveToken: async (token) => {\n\t\tconst values = toAccessTokenValues(token);\n\t\tawait db.insert(accessTokensTable).values(values).onConflictDoUpdate({\n\t\t\tset: values,\n\t\t\ttarget: accessTokensTable.token_id\n\t\t});\n\t}\n});\nexport const createPostgresApiClientStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): ApiClientStore => ({\n\tdeleteClient: async (clientId) => {\n\t\tawait db\n\t\t\t.delete(apiClientsTable)\n\t\t\t.where(eq(apiClientsTable.client_id, clientId));\n\t},\n\tfindClient: async (clientId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(apiClientsTable)\n\t\t\t.where(eq(apiClientsTable.client_id, clientId))\n\t\t\t.limit(1);\n\n\t\treturn row ? toClient(row) : undefined;\n\t},\n\tlistClients: async (ownerId) => {\n\t\tconst rows =\n\t\t\townerId === undefined\n\t\t\t\t? await db\n\t\t\t\t\t\t.select()\n\t\t\t\t\t\t.from(apiClientsTable)\n\t\t\t\t\t\t.orderBy(desc(apiClientsTable.created_at_ms))\n\t\t\t\t: await db\n\t\t\t\t\t\t.select()\n\t\t\t\t\t\t.from(apiClientsTable)\n\t\t\t\t\t\t.where(eq(apiClientsTable.owner_id, ownerId))\n\t\t\t\t\t\t.orderBy(desc(apiClientsTable.created_at_ms));\n\n\t\treturn rows.map(toClient);\n\t},\n\tsaveClient: async (client) => {\n\t\tconst values = toClientValues(client);\n\t\tawait db.insert(apiClientsTable).values(values).onConflictDoUpdate({\n\t\t\tset: values,\n\t\t\ttarget: apiClientsTable.client_id\n\t\t});\n\t}\n});\nexport const createPostgresApiKeyStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): ApiKeyStore => ({\n\tdeleteKey: async (keyId) => {\n\t\tawait db.delete(apiKeysTable).where(eq(apiKeysTable.key_id, keyId));\n\t},\n\tfindByHashedKey: async (hashedKey) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(apiKeysTable)\n\t\t\t.where(eq(apiKeysTable.hashed_key, hashedKey))\n\t\t\t.limit(1);\n\n\t\treturn row ? toKey(row) : undefined;\n\t},\n\tlistKeys: async (ownerId) => {\n\t\tconst rows =\n\t\t\townerId === undefined\n\t\t\t\t? await db\n\t\t\t\t\t\t.select()\n\t\t\t\t\t\t.from(apiKeysTable)\n\t\t\t\t\t\t.orderBy(desc(apiKeysTable.created_at_ms))\n\t\t\t\t: await db\n\t\t\t\t\t\t.select()\n\t\t\t\t\t\t.from(apiKeysTable)\n\t\t\t\t\t\t.where(eq(apiKeysTable.owner_id, ownerId))\n\t\t\t\t\t\t.orderBy(desc(apiKeysTable.created_at_ms));\n\n\t\treturn rows.map(toKey);\n\t},\n\tsaveKey: async (key) => {\n\t\tconst values = toKeyValues(key);\n\t\tawait db.insert(apiKeysTable).values(values).onConflictDoUpdate({\n\t\t\tset: values,\n\t\t\ttarget: apiKeysTable.key_id\n\t\t});\n\t},\n\ttouchKey: async (keyId, lastUsedAt) => {\n\t\tawait db\n\t\t\t.update(apiKeysTable)\n\t\t\t.set({ last_used_at_ms: lastUsedAt })\n\t\t\t.where(eq(apiKeysTable.key_id, keyId));\n\t}\n});\n",
-    "import { and, desc, eq, gt, isNull, or } from 'drizzle-orm';\nimport {\n\tbigint,\n\tcustomType,\n\tinteger,\n\tpgTable,\n\tuniqueIndex,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tAgentDelegation,\n\tAgentDelegationStatus,\n\tAgentDelegationStore,\n\tAgentIdentityRegistration,\n\tAgentIdentityRegistrationKind,\n\tAgentIdentityRegistrationStatus,\n\tAgentIdentityRegistrationStore,\n\tAgentRegistration,\n\tAgentRegistrationStatus,\n\tAgentRegistrationStore\n} from './types';\n\nconst ID_LENGTH = 255;\nconst NAME_LENGTH = 255;\nconst STATUS_LENGTH = 16;\n\n// Drizzle 1.0's built-in JSONB codec is not yet serialized by Bun SQL. This\n// package-owned custom type preserves one portable boundary for Bun SQL,\n// postgres.js, and Neon while `$type<T>()` retains each column's exact shape.\nconst portableJsonb = customType<{ data: unknown; driverData: unknown }>({\n\tdataType: () => 'jsonb',\n\tfromDriver: (value) =>\n\t\ttypeof value === 'string' ? JSON.parse(value) : value,\n\ttoDriver: (value) => JSON.stringify(value)\n});\n\nexport const agentDelegationsTable = pgTable('auth_agent_delegations', {\n\tagent_id: varchar('agent_id', { length: ID_LENGTH }).notNull(),\n\tauthorization_details: portableJsonb('authorization_details').$type<\n\t\tRecord<string, unknown>[]\n\t>(),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\tdelegation_id: varchar('delegation_id', {\n\t\tlength: ID_LENGTH\n\t}).primaryKey(),\n\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\tscopes: portableJsonb('scopes').$type<string[]>().notNull().default([]),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.$type<AgentDelegationStatus>()\n\t\t.notNull(),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH }).notNull()\n});\nexport const agentIdentityRegistrationsTable = pgTable(\n\t'auth_agent_identity_registrations',\n\t{\n\t\tagent_id: varchar('agent_id', { length: ID_LENGTH }).notNull().unique(),\n\t\tclaim_attempt:\n\t\t\tportableJsonb('claim_attempt').$type<\n\t\t\t\tAgentIdentityRegistration['claimAttempt']\n\t\t\t>(),\n\t\tclaim_attempt_token_hash: varchar('claim_attempt_token_hash', {\n\t\t\tlength: ID_LENGTH\n\t\t}).unique(),\n\t\tclaim_expires_at_ms: bigint('claim_expires_at_ms', {\n\t\t\tmode: 'number'\n\t\t}).notNull(),\n\t\tclaim_token_hash: varchar('claim_token_hash', {\n\t\t\tlength: ID_LENGTH\n\t\t})\n\t\t\t.notNull()\n\t\t\t.unique(),\n\t\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\t\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }).notNull(),\n\t\tkind: varchar('kind', { length: 32 })\n\t\t\t.$type<AgentIdentityRegistrationKind>()\n\t\t\t.notNull(),\n\t\tlast_polled_at_ms: bigint('last_polled_at_ms', { mode: 'number' }),\n\t\tlogin_hint: varchar('login_hint', { length: ID_LENGTH }),\n\t\tregistration_id: varchar('registration_id', {\n\t\t\tlength: ID_LENGTH\n\t\t}).primaryKey(),\n\t\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t\t.$type<AgentIdentityRegistrationStatus>()\n\t\t\t.notNull(),\n\t\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\t\tupstream_client_id: varchar('upstream_client_id', {\n\t\t\tlength: ID_LENGTH\n\t\t}),\n\t\tupstream_issuer: varchar('upstream_issuer', { length: ID_LENGTH }),\n\t\tupstream_subject: varchar('upstream_subject', { length: ID_LENGTH }),\n\t\tuser_id: varchar('user_id', { length: ID_LENGTH }),\n\t\tversion: integer('version').notNull()\n\t},\n\t(table) => [\n\t\tuniqueIndex('auth_agent_identity_upstream_unique').on(\n\t\t\ttable.upstream_issuer,\n\t\t\ttable.upstream_subject,\n\t\t\ttable.upstream_client_id\n\t\t)\n\t]\n);\nexport const agentRegistrationsTable = pgTable('auth_agent_registrations', {\n\tagent_id: varchar('agent_id', { length: ID_LENGTH }).primaryKey(),\n\tallowed_scopes: portableJsonb('allowed_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tclient_id: varchar('client_id', { length: ID_LENGTH }).unique(),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\tmetadata: portableJsonb('metadata').$type<Record<string, unknown>>(),\n\tname: varchar('name', { length: NAME_LENGTH }).notNull(),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.$type<AgentRegistrationStatus>()\n\t\t.notNull(),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull()\n});\n\ntype RegistrationRow = typeof agentRegistrationsTable.$inferSelect;\ntype RegistrationInsert = typeof agentRegistrationsTable.$inferInsert;\ntype DelegationRow = typeof agentDelegationsTable.$inferSelect;\ntype DelegationInsert = typeof agentDelegationsTable.$inferInsert;\ntype IdentityRegistrationRow =\n\ttypeof agentIdentityRegistrationsTable.$inferSelect;\ntype IdentityRegistrationInsert =\n\ttypeof agentIdentityRegistrationsTable.$inferInsert;\n\nconst toRegistration = (row: RegistrationRow): AgentRegistration => ({\n\tagentId: row.agent_id,\n\tallowedScopes: row.allowed_scopes,\n\tclientId: row.client_id ?? undefined,\n\tcreatedAt: row.created_at_ms,\n\tmetadata: row.metadata ?? undefined,\n\tname: row.name,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at_ms\n});\n\nconst toDelegation = (row: DelegationRow): AgentDelegation => ({\n\tagentId: row.agent_id,\n\tauthorizationDetails: row.authorization_details ?? undefined,\n\tcreatedAt: row.created_at_ms,\n\tdelegationId: row.delegation_id,\n\texpiresAt: row.expires_at_ms ?? undefined,\n\torganizationId: row.organization_id ?? undefined,\n\tscopes: row.scopes,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id\n});\n\nconst toIdentityRegistration = (\n\trow: IdentityRegistrationRow\n): AgentIdentityRegistration => ({\n\tagentId: row.agent_id,\n\tclaimAttempt: row.claim_attempt ?? undefined,\n\tclaimExpiresAt: row.claim_expires_at_ms,\n\tclaimTokenHash: row.claim_token_hash,\n\tcreatedAt: row.created_at_ms,\n\texpiresAt: row.expires_at_ms,\n\tkind: row.kind,\n\tlastPolledAt: row.last_polled_at_ms ?? undefined,\n\tloginHint: row.login_hint ?? undefined,\n\tregistrationId: row.registration_id,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at_ms,\n\tupstream:\n\t\trow.upstream_client_id === null ||\n\t\trow.upstream_issuer === null ||\n\t\trow.upstream_subject === null\n\t\t\t? undefined\n\t\t\t: {\n\t\t\t\t\tclientId: row.upstream_client_id,\n\t\t\t\t\tissuer: row.upstream_issuer,\n\t\t\t\t\tsubject: row.upstream_subject\n\t\t\t\t},\n\tuserId: row.user_id ?? undefined,\n\tversion: row.version\n});\n\nconst identityRegistrationValues = (\n\tregistration: AgentIdentityRegistration\n): IdentityRegistrationInsert => ({\n\tagent_id: registration.agentId,\n\tclaim_attempt: registration.claimAttempt ?? null,\n\tclaim_attempt_token_hash: registration.claimAttempt?.tokenHash ?? null,\n\tclaim_expires_at_ms: registration.claimExpiresAt,\n\tclaim_token_hash: registration.claimTokenHash,\n\tcreated_at_ms: registration.createdAt,\n\texpires_at_ms: registration.expiresAt,\n\tkind: registration.kind,\n\tlast_polled_at_ms: registration.lastPolledAt ?? null,\n\tlogin_hint: registration.loginHint ?? null,\n\tregistration_id: registration.registrationId,\n\tstatus: registration.status,\n\tupdated_at_ms: registration.updatedAt,\n\tupstream_client_id: registration.upstream?.clientId ?? null,\n\tupstream_issuer: registration.upstream?.issuer ?? null,\n\tupstream_subject: registration.upstream?.subject ?? null,\n\tuser_id: registration.userId ?? null,\n\tversion: registration.version\n});\n\nexport const createNeonAgentDelegationStore = (databaseUrl: string) =>\n\tcreatePostgresAgentDelegationStore(createNeonDatabase(databaseUrl));\nexport const createNeonAgentIdentityRegistrationStore = (databaseUrl: string) =>\n\tcreatePostgresAgentIdentityRegistrationStore(\n\t\tcreateNeonDatabase(databaseUrl)\n\t);\nexport const createNeonAgentRegistrationStore = (databaseUrl: string) =>\n\tcreatePostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));\nexport const createPostgresAgentDelegationStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AgentDelegationStore => ({\n\tfindActiveDelegation: async ({\n\t\tagentId,\n\t\tnow = Date.now(),\n\t\torganizationId,\n\t\tuserId\n\t}) => {\n\t\tconst organizationCondition =\n\t\t\torganizationId === undefined\n\t\t\t\t? isNull(agentDelegationsTable.organization_id)\n\t\t\t\t: eq(agentDelegationsTable.organization_id, organizationId);\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentDelegationsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(agentDelegationsTable.agent_id, agentId),\n\t\t\t\t\teq(agentDelegationsTable.user_id, userId),\n\t\t\t\t\torganizationCondition,\n\t\t\t\t\teq(agentDelegationsTable.status, 'active'),\n\t\t\t\t\tor(\n\t\t\t\t\t\tisNull(agentDelegationsTable.expires_at_ms),\n\t\t\t\t\t\tgt(agentDelegationsTable.expires_at_ms, now)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.orderBy(desc(agentDelegationsTable.updated_at_ms))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toDelegation(row);\n\t},\n\tfindByDelegationId: async (delegationId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentDelegationsTable)\n\t\t\t.where(eq(agentDelegationsTable.delegation_id, delegationId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toDelegation(row);\n\t},\n\tlistDelegations: async (agentId) => {\n\t\tconst base = db.select().from(agentDelegationsTable);\n\t\tconst rows = await (agentId === undefined\n\t\t\t? base.orderBy(desc(agentDelegationsTable.created_at_ms))\n\t\t\t: base\n\t\t\t\t\t.where(eq(agentDelegationsTable.agent_id, agentId))\n\t\t\t\t\t.orderBy(desc(agentDelegationsTable.created_at_ms)));\n\n\t\treturn rows.map(toDelegation);\n\t},\n\tsaveDelegation: async (delegation) => {\n\t\tconst values: DelegationInsert = {\n\t\t\tagent_id: delegation.agentId,\n\t\t\tauthorization_details: delegation.authorizationDetails ?? null,\n\t\t\tcreated_at_ms: delegation.createdAt,\n\t\t\tdelegation_id: delegation.delegationId,\n\t\t\texpires_at_ms: delegation.expiresAt ?? null,\n\t\t\torganization_id: delegation.organizationId ?? null,\n\t\t\tscopes: delegation.scopes,\n\t\t\tstatus: delegation.status,\n\t\t\tupdated_at_ms: delegation.updatedAt,\n\t\t\tuser_id: delegation.userId\n\t\t};\n\t\tawait db\n\t\t\t.insert(agentDelegationsTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: values,\n\t\t\t\ttarget: agentDelegationsTable.delegation_id\n\t\t\t});\n\t}\n});\nexport const createPostgresAgentIdentityRegistrationStore = <\n\tDB extends AnyPgDatabase\n>(\n\tdb: DB\n): AgentIdentityRegistrationStore => ({\n\tcreate: async (registration) => {\n\t\tconst rows = await db\n\t\t\t.insert(agentIdentityRegistrationsTable)\n\t\t\t.values(identityRegistrationValues(registration))\n\t\t\t.onConflictDoNothing()\n\t\t\t.returning({ id: agentIdentityRegistrationsTable.registration_id });\n\n\t\treturn rows.length === 1;\n\t},\n\tfindByAgentId: async (agentId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(eq(agentIdentityRegistrationsTable.agent_id, agentId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByAttemptTokenHash: async (attemptTokenHash) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\teq(\n\t\t\t\t\tagentIdentityRegistrationsTable.claim_attempt_token_hash,\n\t\t\t\t\tattemptTokenHash\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByClaimTokenHash: async (claimTokenHash) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\teq(\n\t\t\t\t\tagentIdentityRegistrationsTable.claim_token_hash,\n\t\t\t\t\tclaimTokenHash\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByRegistrationId: async (registrationId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\teq(\n\t\t\t\t\tagentIdentityRegistrationsTable.registration_id,\n\t\t\t\t\tregistrationId\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByUpstreamIdentity: async ({ clientId, issuer, subject }) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(\n\t\t\t\t\t\tagentIdentityRegistrationsTable.upstream_client_id,\n\t\t\t\t\t\tclientId\n\t\t\t\t\t),\n\t\t\t\t\teq(agentIdentityRegistrationsTable.upstream_issuer, issuer),\n\t\t\t\t\teq(\n\t\t\t\t\t\tagentIdentityRegistrationsTable.upstream_subject,\n\t\t\t\t\t\tsubject\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\treplace: async (registration, expectedVersion) => {\n\t\tconst next: AgentIdentityRegistration = {\n\t\t\t...registration,\n\t\t\tversion: expectedVersion + 1\n\t\t};\n\t\tconst values = identityRegistrationValues(next);\n\t\tconst rows = await db\n\t\t\t.update(agentIdentityRegistrationsTable)\n\t\t\t.set(values)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(\n\t\t\t\t\t\tagentIdentityRegistrationsTable.registration_id,\n\t\t\t\t\t\tregistration.registrationId\n\t\t\t\t\t),\n\t\t\t\t\teq(agentIdentityRegistrationsTable.version, expectedVersion)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.returning({ id: agentIdentityRegistrationsTable.registration_id });\n\n\t\treturn rows.length === 1;\n\t}\n});\nexport const createPostgresAgentRegistrationStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AgentRegistrationStore => ({\n\tfindByAgentId: async (agentId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentRegistrationsTable)\n\t\t\t.where(eq(agentRegistrationsTable.agent_id, agentId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toRegistration(row);\n\t},\n\tfindByClientId: async (clientId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentRegistrationsTable)\n\t\t\t.where(eq(agentRegistrationsTable.client_id, clientId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toRegistration(row);\n\t},\n\tlistRegistrations: async () => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(agentRegistrationsTable)\n\t\t\t.orderBy(desc(agentRegistrationsTable.created_at_ms));\n\n\t\treturn rows.map(toRegistration);\n\t},\n\tsaveRegistration: async (registration) => {\n\t\tconst values: RegistrationInsert = {\n\t\t\tagent_id: registration.agentId,\n\t\t\tallowed_scopes: registration.allowedScopes,\n\t\t\tclient_id: registration.clientId ?? null,\n\t\t\tcreated_at_ms: registration.createdAt,\n\t\t\tmetadata: registration.metadata ?? null,\n\t\t\tname: registration.name,\n\t\t\tstatus: registration.status,\n\t\t\tupdated_at_ms: registration.updatedAt\n\t\t};\n\t\tawait db\n\t\t\t.insert(agentRegistrationsTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: values,\n\t\t\t\ttarget: agentRegistrationsTable.agent_id\n\t\t\t});\n\t}\n});\n",
+    "import { and, desc, eq, gt, isNull, or } from 'drizzle-orm';\nimport {\n\tbigint,\n\tcustomType,\n\tinteger,\n\tpgTable,\n\tuniqueIndex,\n\tvarchar\n} from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tAgentDelegation,\n\tAgentDelegationStatus,\n\tAgentDelegationStore,\n\tAgentIdentityRegistration,\n\tAgentIdentityRegistrationKind,\n\tAgentIdentityRegistrationStatus,\n\tAgentIdentityRegistrationStore,\n\tAgentRegistration,\n\tAgentRegistrationStatus,\n\tAgentRegistrationStore\n} from './types';\n\nconst ID_LENGTH = 255;\nconst NAME_LENGTH = 255;\nconst STATUS_LENGTH = 16;\n\n// Drizzle 1.0's built-in JSONB codec is not yet serialized by Bun SQL. This\n// package-owned custom type preserves one portable boundary for Bun SQL,\n// postgres.js, and Neon while `$type<T>()` retains each column's exact shape.\nconst portableJsonb = customType<{ data: unknown; driverData: unknown }>({\n\tdataType: () => 'jsonb',\n\tfromDriver: (value) =>\n\t\ttypeof value === 'string' ? JSON.parse(value) : value,\n\ttoDriver: (value) => JSON.stringify(value)\n});\n\nexport const agentDelegationsTable = pgTable('auth_agent_delegations', {\n\tagent_id: varchar('agent_id', { length: ID_LENGTH }).notNull(),\n\tauthorization_details: portableJsonb('authorization_details').$type<\n\t\tRecord<string, unknown>[]\n\t>(),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\tdelegation_id: varchar('delegation_id', {\n\t\tlength: ID_LENGTH\n\t}).primaryKey(),\n\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\tscopes: portableJsonb('scopes').$type<string[]>().notNull().default([]),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.$type<AgentDelegationStatus>()\n\t\t.notNull(),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH }).notNull()\n});\nexport const agentIdentityRegistrationsTable = pgTable(\n\t'auth_agent_identity_registrations',\n\t{\n\t\tagent_id: varchar('agent_id', { length: ID_LENGTH }).notNull().unique(),\n\t\tclaim_attempt:\n\t\t\tportableJsonb('claim_attempt').$type<\n\t\t\t\tAgentIdentityRegistration['claimAttempt']\n\t\t\t>(),\n\t\tclaim_attempt_token_hash: varchar('claim_attempt_token_hash', {\n\t\t\tlength: ID_LENGTH\n\t\t}).unique(),\n\t\tclaim_expires_at_ms: bigint('claim_expires_at_ms', {\n\t\t\tmode: 'number'\n\t\t}).notNull(),\n\t\tclaim_token_hash: varchar('claim_token_hash', {\n\t\t\tlength: ID_LENGTH\n\t\t})\n\t\t\t.notNull()\n\t\t\t.unique(),\n\t\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\t\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }).notNull(),\n\t\tkind: varchar('kind', { length: 32 })\n\t\t\t.$type<AgentIdentityRegistrationKind>()\n\t\t\t.notNull(),\n\t\tlast_polled_at_ms: bigint('last_polled_at_ms', { mode: 'number' }),\n\t\tlogin_hint: varchar('login_hint', { length: ID_LENGTH }),\n\t\tregistration_id: varchar('registration_id', {\n\t\t\tlength: ID_LENGTH\n\t\t}).primaryKey(),\n\t\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t\t.$type<AgentIdentityRegistrationStatus>()\n\t\t\t.notNull(),\n\t\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\t\tupstream_client_id: varchar('upstream_client_id', {\n\t\t\tlength: ID_LENGTH\n\t\t}),\n\t\tupstream_issuer: varchar('upstream_issuer', { length: ID_LENGTH }),\n\t\tupstream_subject: varchar('upstream_subject', { length: ID_LENGTH }),\n\t\tuser_id: varchar('user_id', { length: ID_LENGTH }),\n\t\tversion: integer('version').notNull()\n\t},\n\t(table) => [\n\t\tuniqueIndex('auth_agent_identity_upstream_unique').on(\n\t\t\ttable.upstream_issuer,\n\t\t\ttable.upstream_subject,\n\t\t\ttable.upstream_client_id\n\t\t)\n\t]\n);\nexport const agentRegistrationsTable = pgTable('auth_agent_registrations', {\n\tagent_id: varchar('agent_id', { length: ID_LENGTH }).primaryKey(),\n\tallowed_scopes: portableJsonb('allowed_scopes')\n\t\t.$type<string[]>()\n\t\t.notNull()\n\t\t.default([]),\n\tclient_id: varchar('client_id', { length: ID_LENGTH }).unique(),\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\tmetadata: portableJsonb('metadata').$type<Record<string, unknown>>(),\n\tname: varchar('name', { length: NAME_LENGTH }).notNull(),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.$type<AgentRegistrationStatus>()\n\t\t.notNull(),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull()\n});\n\ntype RegistrationRow = typeof agentRegistrationsTable.$inferSelect;\ntype RegistrationInsert = typeof agentRegistrationsTable.$inferInsert;\ntype DelegationRow = typeof agentDelegationsTable.$inferSelect;\ntype DelegationInsert = typeof agentDelegationsTable.$inferInsert;\ntype IdentityRegistrationRow =\n\ttypeof agentIdentityRegistrationsTable.$inferSelect;\ntype IdentityRegistrationInsert =\n\ttypeof agentIdentityRegistrationsTable.$inferInsert;\n\nconst toRegistration = (row: RegistrationRow): AgentRegistration => ({\n\tagentId: row.agent_id,\n\tallowedScopes: row.allowed_scopes,\n\tclientId: row.client_id ?? undefined,\n\tcreatedAt: row.created_at_ms,\n\tmetadata: row.metadata ?? undefined,\n\tname: row.name,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at_ms\n});\n\nconst toDelegation = (row: DelegationRow): AgentDelegation => ({\n\tagentId: row.agent_id,\n\tauthorizationDetails: row.authorization_details ?? undefined,\n\tcreatedAt: row.created_at_ms,\n\tdelegationId: row.delegation_id,\n\texpiresAt: row.expires_at_ms ?? undefined,\n\torganizationId: row.organization_id ?? undefined,\n\tscopes: row.scopes,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id\n});\n\nconst toIdentityRegistration = (\n\trow: IdentityRegistrationRow\n): AgentIdentityRegistration => ({\n\tagentId: row.agent_id,\n\tclaimAttempt: row.claim_attempt ?? undefined,\n\tclaimExpiresAt: row.claim_expires_at_ms,\n\tclaimTokenHash: row.claim_token_hash,\n\tcreatedAt: row.created_at_ms,\n\texpiresAt: row.expires_at_ms,\n\tkind: row.kind,\n\tlastPolledAt: row.last_polled_at_ms ?? undefined,\n\tloginHint: row.login_hint ?? undefined,\n\tregistrationId: row.registration_id,\n\tstatus: row.status,\n\tupdatedAt: row.updated_at_ms,\n\tupstream:\n\t\trow.upstream_client_id === null ||\n\t\trow.upstream_issuer === null ||\n\t\trow.upstream_subject === null\n\t\t\t? undefined\n\t\t\t: {\n\t\t\t\t\tclientId: row.upstream_client_id,\n\t\t\t\t\tissuer: row.upstream_issuer,\n\t\t\t\t\tsubject: row.upstream_subject\n\t\t\t\t},\n\tuserId: row.user_id ?? undefined,\n\tversion: row.version\n});\n\nconst identityRegistrationValues = (\n\tregistration: AgentIdentityRegistration\n): IdentityRegistrationInsert => ({\n\tagent_id: registration.agentId,\n\tclaim_attempt: registration.claimAttempt ?? null,\n\tclaim_attempt_token_hash: registration.claimAttempt?.tokenHash ?? null,\n\tclaim_expires_at_ms: registration.claimExpiresAt,\n\tclaim_token_hash: registration.claimTokenHash,\n\tcreated_at_ms: registration.createdAt,\n\texpires_at_ms: registration.expiresAt,\n\tkind: registration.kind,\n\tlast_polled_at_ms: registration.lastPolledAt ?? null,\n\tlogin_hint: registration.loginHint ?? null,\n\tregistration_id: registration.registrationId,\n\tstatus: registration.status,\n\tupdated_at_ms: registration.updatedAt,\n\tupstream_client_id: registration.upstream?.clientId ?? null,\n\tupstream_issuer: registration.upstream?.issuer ?? null,\n\tupstream_subject: registration.upstream?.subject ?? null,\n\tuser_id: registration.userId ?? null,\n\tversion: registration.version\n});\n\nexport const createNeonAgentDelegationStore = (databaseUrl: string) =>\n\tcreateDrizzleAgentDelegationStore(createNeonDatabase(databaseUrl));\nexport const createNeonAgentIdentityRegistrationStore = (databaseUrl: string) =>\n\tcreatePostgresAgentIdentityRegistrationStore(\n\t\tcreateNeonDatabase(databaseUrl)\n\t);\nexport const createNeonAgentRegistrationStore = (databaseUrl: string) =>\n\tcreatePostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));\nexport const createDrizzleAgentDelegationStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AgentDelegationStore => ({\n\tfindActiveDelegation: async ({\n\t\tagentId,\n\t\tnow = Date.now(),\n\t\torganizationId,\n\t\tuserId\n\t}) => {\n\t\tconst organizationCondition =\n\t\t\torganizationId === undefined\n\t\t\t\t? isNull(agentDelegationsTable.organization_id)\n\t\t\t\t: eq(agentDelegationsTable.organization_id, organizationId);\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentDelegationsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(agentDelegationsTable.agent_id, agentId),\n\t\t\t\t\teq(agentDelegationsTable.user_id, userId),\n\t\t\t\t\torganizationCondition,\n\t\t\t\t\teq(agentDelegationsTable.status, 'active'),\n\t\t\t\t\tor(\n\t\t\t\t\t\tisNull(agentDelegationsTable.expires_at_ms),\n\t\t\t\t\t\tgt(agentDelegationsTable.expires_at_ms, now)\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.orderBy(desc(agentDelegationsTable.updated_at_ms))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toDelegation(row);\n\t},\n\tfindByDelegationId: async (delegationId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentDelegationsTable)\n\t\t\t.where(eq(agentDelegationsTable.delegation_id, delegationId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toDelegation(row);\n\t},\n\tlistDelegations: async (agentId) => {\n\t\tconst base = db.select().from(agentDelegationsTable);\n\t\tconst rows = await (agentId === undefined\n\t\t\t? base.orderBy(desc(agentDelegationsTable.created_at_ms))\n\t\t\t: base\n\t\t\t\t\t.where(eq(agentDelegationsTable.agent_id, agentId))\n\t\t\t\t\t.orderBy(desc(agentDelegationsTable.created_at_ms)));\n\n\t\treturn rows.map(toDelegation);\n\t},\n\tsaveDelegation: async (delegation) => {\n\t\tconst values: DelegationInsert = {\n\t\t\tagent_id: delegation.agentId,\n\t\t\tauthorization_details: delegation.authorizationDetails ?? null,\n\t\t\tcreated_at_ms: delegation.createdAt,\n\t\t\tdelegation_id: delegation.delegationId,\n\t\t\texpires_at_ms: delegation.expiresAt ?? null,\n\t\t\torganization_id: delegation.organizationId ?? null,\n\t\t\tscopes: delegation.scopes,\n\t\t\tstatus: delegation.status,\n\t\t\tupdated_at_ms: delegation.updatedAt,\n\t\t\tuser_id: delegation.userId\n\t\t};\n\t\tawait db\n\t\t\t.insert(agentDelegationsTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: values,\n\t\t\t\ttarget: agentDelegationsTable.delegation_id\n\t\t\t});\n\t}\n});\n/** @deprecated Use createDrizzleAgentDelegationStore. */\nexport const createPostgresAgentDelegationStore =\n\tcreateDrizzleAgentDelegationStore;\nexport const createPostgresAgentIdentityRegistrationStore = <\n\tDB extends AnyPgDatabase\n>(\n\tdb: DB\n): AgentIdentityRegistrationStore => ({\n\tcreate: async (registration) => {\n\t\tconst rows = await db\n\t\t\t.insert(agentIdentityRegistrationsTable)\n\t\t\t.values(identityRegistrationValues(registration))\n\t\t\t.onConflictDoNothing()\n\t\t\t.returning({ id: agentIdentityRegistrationsTable.registration_id });\n\n\t\treturn rows.length === 1;\n\t},\n\tfindByAgentId: async (agentId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(eq(agentIdentityRegistrationsTable.agent_id, agentId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByAttemptTokenHash: async (attemptTokenHash) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\teq(\n\t\t\t\t\tagentIdentityRegistrationsTable.claim_attempt_token_hash,\n\t\t\t\t\tattemptTokenHash\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByClaimTokenHash: async (claimTokenHash) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\teq(\n\t\t\t\t\tagentIdentityRegistrationsTable.claim_token_hash,\n\t\t\t\t\tclaimTokenHash\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByRegistrationId: async (registrationId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\teq(\n\t\t\t\t\tagentIdentityRegistrationsTable.registration_id,\n\t\t\t\t\tregistrationId\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\tfindByUpstreamIdentity: async ({ clientId, issuer, subject }) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentIdentityRegistrationsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(\n\t\t\t\t\t\tagentIdentityRegistrationsTable.upstream_client_id,\n\t\t\t\t\t\tclientId\n\t\t\t\t\t),\n\t\t\t\t\teq(agentIdentityRegistrationsTable.upstream_issuer, issuer),\n\t\t\t\t\teq(\n\t\t\t\t\t\tagentIdentityRegistrationsTable.upstream_subject,\n\t\t\t\t\t\tsubject\n\t\t\t\t\t)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toIdentityRegistration(row);\n\t},\n\treplace: async (registration, expectedVersion) => {\n\t\tconst next: AgentIdentityRegistration = {\n\t\t\t...registration,\n\t\t\tversion: expectedVersion + 1\n\t\t};\n\t\tconst values = identityRegistrationValues(next);\n\t\tconst rows = await db\n\t\t\t.update(agentIdentityRegistrationsTable)\n\t\t\t.set(values)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(\n\t\t\t\t\t\tagentIdentityRegistrationsTable.registration_id,\n\t\t\t\t\t\tregistration.registrationId\n\t\t\t\t\t),\n\t\t\t\t\teq(agentIdentityRegistrationsTable.version, expectedVersion)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.returning({ id: agentIdentityRegistrationsTable.registration_id });\n\n\t\treturn rows.length === 1;\n\t}\n});\nexport const createPostgresAgentRegistrationStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AgentRegistrationStore => ({\n\tfindByAgentId: async (agentId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentRegistrationsTable)\n\t\t\t.where(eq(agentRegistrationsTable.agent_id, agentId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toRegistration(row);\n\t},\n\tfindByClientId: async (clientId) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(agentRegistrationsTable)\n\t\t\t.where(eq(agentRegistrationsTable.client_id, clientId))\n\t\t\t.limit(1);\n\n\t\treturn row === undefined ? undefined : toRegistration(row);\n\t},\n\tlistRegistrations: async () => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(agentRegistrationsTable)\n\t\t\t.orderBy(desc(agentRegistrationsTable.created_at_ms));\n\n\t\treturn rows.map(toRegistration);\n\t},\n\tsaveRegistration: async (registration) => {\n\t\tconst values: RegistrationInsert = {\n\t\t\tagent_id: registration.agentId,\n\t\t\tallowed_scopes: registration.allowedScopes,\n\t\t\tclient_id: registration.clientId ?? null,\n\t\t\tcreated_at_ms: registration.createdAt,\n\t\t\tmetadata: registration.metadata ?? null,\n\t\t\tname: registration.name,\n\t\t\tstatus: registration.status,\n\t\t\tupdated_at_ms: registration.updatedAt\n\t\t};\n\t\tawait db\n\t\t\t.insert(agentRegistrationsTable)\n\t\t\t.values(values)\n\t\t\t.onConflictDoUpdate({\n\t\t\t\tset: values,\n\t\t\t\ttarget: agentRegistrationsTable.agent_id\n\t\t\t});\n\t}\n});\n",
     "import { desc, eq, lt } from 'drizzle-orm';\nimport { bigint, jsonb, pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type { AuditEvent, AuditEventType, AuditSink } from './types';\n\nconst ID_LENGTH = 255;\nconst IP_LENGTH = 64;\nconst TYPE_LENGTH = 64;\nconst DEFAULT_AUDIT_LIMIT = 100;\n\nexport const auditEventsTable = pgTable('auth_audit_events', {\n\tat_ms: bigint('at_ms', { mode: 'number' }).notNull(),\n\tid: varchar('id', { length: ID_LENGTH }).primaryKey(),\n\tip: varchar('ip', { length: IP_LENGTH }),\n\tmetadata_json: jsonb('metadata_json').$type<Record<string, unknown>>(),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\ttype: varchar('type', { length: TYPE_LENGTH }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH })\n});\n\ntype AuditRow = typeof auditEventsTable.$inferSelect;\n\nconst toEvent = (row: AuditRow): AuditEvent => ({\n\tat: row.at_ms,\n\tip: row.ip ?? undefined,\n\tmetadata: row.metadata_json ?? undefined,\n\torganizationId: row.organization_id ?? undefined,\n\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- deserialization boundary: `type` was persisted from AuditEventType, so reading it back is sound\n\ttype: row.type as AuditEventType,\n\tuserId: row.user_id ?? undefined\n});\n\nexport const createNeonAuditSink = (databaseUrl: string) =>\n\tcreatePostgresAuditSink(createNeonDatabase(databaseUrl));\nexport const createPostgresAuditSink = <DB extends AnyPgDatabase>(\n\tdb: DB\n): AuditSink => ({\n\tappend: async (event) => {\n\t\tawait db.insert(auditEventsTable).values({\n\t\t\tat_ms: event.at,\n\t\t\tid: crypto.randomUUID(),\n\t\t\tip: event.ip ?? null,\n\t\t\tmetadata_json: event.metadata ?? null,\n\t\t\torganization_id: event.organizationId ?? null,\n\t\t\ttype: event.type,\n\t\t\tuser_id: event.userId ?? null\n\t\t});\n\t},\n\tlist: async (filter) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(auditEventsTable)\n\t\t\t.where(\n\t\t\t\tfilter?.userId\n\t\t\t\t\t? eq(auditEventsTable.user_id, filter.userId)\n\t\t\t\t\t: undefined\n\t\t\t)\n\t\t\t.orderBy(desc(auditEventsTable.at_ms))\n\t\t\t.limit(filter?.limit ?? DEFAULT_AUDIT_LIMIT);\n\n\t\treturn rows.map(toEvent);\n\t},\n\tprune: async (before) => {\n\t\tconst deleted = await db\n\t\t\t.delete(auditEventsTable)\n\t\t\t.where(lt(auditEventsTable.at_ms, before))\n\t\t\t.returning({ id: auditEventsTable.id });\n\n\t\treturn deleted.length;\n\t}\n});\n",
     "import { eq } from 'drizzle-orm';\nimport { bigint, boolean, pgTable, text, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport type {\n\tCredentialRecord,\n\tCredentialStatus,\n\tCredentialStore,\n\tCredentialToken\n} from './types';\n\nconst EMAIL_LENGTH = 320;\nconst ID_LENGTH = 255;\nconst STATUS_LENGTH = 32;\nconst TOKEN_HASH_LENGTH = 255;\n\nexport const credentialsTable = pgTable('auth_credentials', {\n\tcreated_at_ms: bigint('created_at_ms', { mode: 'number' }).notNull(),\n\temail: varchar('email', { length: EMAIL_LENGTH }).primaryKey(),\n\temail_verified: boolean('email_verified').notNull().default(false),\n\torganization_id: varchar('organization_id', { length: ID_LENGTH }),\n\tpassword_hash: text('password_hash').notNull(),\n\tstatus: varchar('status', { length: STATUS_LENGTH })\n\t\t.notNull()\n\t\t.default('active'),\n\tupdated_at_ms: bigint('updated_at_ms', { mode: 'number' }).notNull(),\n\tuser_id: varchar('user_id', { length: ID_LENGTH })\n});\n\nconst createTokenTable = (name: string) =>\n\tpgTable(name, {\n\t\temail: varchar('email', { length: EMAIL_LENGTH }).notNull(),\n\t\texpires_at_ms: bigint('expires_at_ms', { mode: 'number' }).notNull(),\n\t\ttoken_hash: varchar('token_hash', {\n\t\t\tlength: TOKEN_HASH_LENGTH\n\t\t}).primaryKey()\n\t});\n\nexport const credentialResetTokensTable = createTokenTable(\n\t'auth_credential_reset_tokens'\n);\nexport const credentialVerificationTokensTable = createTokenTable(\n\t'auth_credential_verification_tokens'\n);\n\ntype CredentialRow = typeof credentialsTable.$inferSelect;\ntype CredentialInsert = typeof credentialsTable.$inferInsert;\ntype TokenTable = ReturnType<typeof createTokenTable>;\ntype TokenRow = TokenTable['$inferSelect'];\ntype TokenInsert = TokenTable['$inferInsert'];\n\nconst CREDENTIAL_STATUSES: CredentialStatus[] = ['active', 'disabled'];\n\nconst isCredentialStatus = (value: string): value is CredentialStatus =>\n\tCREDENTIAL_STATUSES.some((status) => status === value);\n\nconst toCredentialRecord = (row: CredentialRow): CredentialRecord => ({\n\tcreatedAt: row.created_at_ms,\n\temail: row.email,\n\temailVerified: row.email_verified,\n\torganizationId: row.organization_id ?? undefined,\n\tpasswordHash: row.password_hash,\n\tstatus: isCredentialStatus(row.status) ? row.status : 'active',\n\tupdatedAt: row.updated_at_ms,\n\tuserId: row.user_id ?? undefined\n});\n\nconst toToken = (row: TokenRow): CredentialToken => ({\n\temail: row.email,\n\texpiresAt: row.expires_at_ms,\n\ttokenHash: row.token_hash\n});\n\nconst saveToken = async <DB extends AnyPgDatabase>(\n\tdb: DB,\n\ttable: TokenTable,\n\ttoken: CredentialToken\n) => {\n\tconst values: TokenInsert = {\n\t\temail: token.email.toLowerCase(),\n\t\texpires_at_ms: token.expiresAt,\n\t\ttoken_hash: token.tokenHash\n\t};\n\tawait db\n\t\t.insert(table)\n\t\t.values(values)\n\t\t.onConflictDoUpdate({ set: values, target: table.token_hash });\n};\n\nconst consumeToken = async <DB extends AnyPgDatabase>(\n\tdb: DB,\n\ttable: TokenTable,\n\ttokenHash: string\n) => {\n\tconst [row] = await db\n\t\t.select()\n\t\t.from(table)\n\t\t.where(eq(table.token_hash, tokenHash))\n\t\t.limit(1);\n\tif (!row) return undefined;\n\n\tawait db.delete(table).where(eq(table.token_hash, tokenHash));\n\tif (row.expires_at_ms < Date.now()) return undefined;\n\n\treturn toToken(row);\n};\n\nexport const createNeonCredentialStore = (databaseUrl: string) =>\n\tcreatePostgresCredentialStore(createNeonDatabase(databaseUrl));\nexport const createPostgresCredentialStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): CredentialStore => ({\n\tconsumeResetToken: (tokenHash) =>\n\t\tconsumeToken(db, credentialResetTokensTable, tokenHash),\n\tconsumeVerificationToken: (tokenHash) =>\n\t\tconsumeToken(db, credentialVerificationTokensTable, tokenHash),\n\tgetCredentialByEmail: async (email) => {\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(credentialsTable)\n\t\t\t.where(eq(credentialsTable.email, email.toLowerCase()))\n\t\t\t.limit(1);\n\n\t\treturn row ? toCredentialRecord(row) : undefined;\n\t},\n\tsaveCredential: async (credential) => {\n\t\tconst values: CredentialInsert = {\n\t\t\tcreated_at_ms: credential.createdAt,\n\t\t\temail: credential.email.toLowerCase(),\n\t\t\temail_verified: credential.emailVerified,\n\t\t\torganization_id: credential.organizationId ?? null,\n\t\t\tpassword_hash: credential.passwordHash,\n\t\t\tstatus: credential.status,\n\t\t\tupdated_at_ms: credential.updatedAt,\n\t\t\tuser_id: credential.userId ?? null\n\t\t};\n\t\tawait db.insert(credentialsTable).values(values).onConflictDoUpdate({\n\t\t\tset: values,\n\t\t\ttarget: credentialsTable.email\n\t\t});\n\t},\n\tsaveResetToken: (token) => saveToken(db, credentialResetTokensTable, token),\n\tsaveVerificationToken: (token) =>\n\t\tsaveToken(db, credentialVerificationTokensTable, token),\n\tsetEmailVerified: async (email) => {\n\t\tawait db\n\t\t\t.update(credentialsTable)\n\t\t\t.set({ email_verified: true, updated_at_ms: Date.now() })\n\t\t\t.where(eq(credentialsTable.email, email.toLowerCase()));\n\t}\n});\n",
     "import { and, eq } from 'drizzle-orm';\nimport { pgTable, varchar } from 'drizzle-orm/pg-core';\nimport { type AnyPgDatabase, createNeonDatabase } from '../stores/postgres';\nimport { warrantKey } from './inMemoryStores';\nimport type { Warrant, WarrantStore } from './types';\n\nconst ID_LENGTH = 255;\n\nexport const warrantsTable = pgTable('auth_fga_warrants', {\n\tid: varchar('id', { length: ID_LENGTH }).primaryKey(),\n\trelation: varchar('relation', { length: ID_LENGTH }).notNull(),\n\tresource_id: varchar('resource_id', { length: ID_LENGTH }).notNull(),\n\tresource_type: varchar('resource_type', { length: ID_LENGTH }).notNull(),\n\tsubject_id: varchar('subject_id', { length: ID_LENGTH }).notNull(),\n\tsubject_relation: varchar('subject_relation', { length: ID_LENGTH }),\n\tsubject_type: varchar('subject_type', { length: ID_LENGTH }).notNull()\n});\n\ntype WarrantRow = typeof warrantsTable.$inferSelect;\n\nconst toWarrant = (row: WarrantRow): Warrant => ({\n\trelation: row.relation,\n\tresourceId: row.resource_id,\n\tresourceType: row.resource_type,\n\tsubjectId: row.subject_id,\n\tsubjectRelation: row.subject_relation ?? undefined,\n\tsubjectType: row.subject_type\n});\n\nexport const createNeonWarrantStore = (databaseUrl: string) =>\n\tcreatePostgresWarrantStore(createNeonDatabase(databaseUrl));\nexport const createPostgresWarrantStore = <DB extends AnyPgDatabase>(\n\tdb: DB\n): WarrantStore => ({\n\tdeleteWarrant: async (warrant) => {\n\t\tawait db\n\t\t\t.delete(warrantsTable)\n\t\t\t.where(eq(warrantsTable.id, warrantKey(warrant)));\n\t},\n\tlistForResource: async (resourceType, resourceId, relation) => {\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(warrantsTable)\n\t\t\t.where(\n\t\t\t\tand(\n\t\t\t\t\teq(warrantsTable.resource_type, resourceType),\n\t\t\t\t\teq(warrantsTable.resource_id, resourceId),\n\t\t\t\t\teq(warrantsTable.relation, relation)\n\t\t\t\t)\n\t\t\t);\n\n\t\treturn rows.map(toWarrant);\n\t},\n\tlistResourceIds: async (resourceType) => {\n\t\tconst rows = await db\n\t\t\t.selectDistinct({ resourceId: warrantsTable.resource_id })\n\t\t\t.from(warrantsTable)\n\t\t\t.where(eq(warrantsTable.resource_type, resourceType));\n\n\t\treturn rows.map((row) => row.resourceId);\n\t},\n\tsaveWarrant: async (warrant) => {\n\t\tawait db\n\t\t\t.insert(warrantsTable)\n\t\t\t.values({\n\t\t\t\tid: warrantKey(warrant),\n\t\t\t\trelation: warrant.relation,\n\t\t\t\tresource_id: warrant.resourceId,\n\t\t\t\tresource_type: warrant.resourceType,\n\t\t\t\tsubject_id: warrant.subjectId,\n\t\t\t\tsubject_relation: warrant.subjectRelation ?? null,\n\t\t\t\tsubject_type: warrant.subjectType\n\t\t\t})\n\t\t\t.onConflictDoNothing({ target: warrantsTable.id });\n\t}\n});\n",

package/dist/index.d.ts

@@ -3317,26 +3317,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 };
             };
         };
-    }))) & ({} | {
-        [x: string]: {
-            get: {
-                body: unknown;
-                params: {};
-                query: unknown;
-                headers: unknown;
-                response: {
-                    200: {
-                        resource: string;
-                        scopes_supported: string[];
-                        resource_name?: string | undefined;
-                        resource_logo_uri?: string | undefined;
-                        authorization_servers: string[];
-                        bearer_methods_supported: string[];
-                    };
-                };
-            };
-        };
-    } | ({
+    }))) & ({} | ({
         [x: string]: {
             get: {
                 body: unknown;
@@ -3568,11 +3549,12 @@ export * from './agents/types';
 export * from './agents/registration';
 export * from './agents/registrationClient';
 export * from './agents/idJag';
+export * from './agents/oauthGuide';
 export { agentAuthPlugin, agentAuthChallenge } from './agents/routes';
 export { resolveAgentPrincipal, agentHasScopes } from './agents/principal';
 export { createOidcAgentCredentialVerifier } from './agents/oidcAdapter';
 export { createInMemoryAgentDelegationStore, createInMemoryAgentIdentityRegistrationStore, createInMemoryAgentRegistrationStore } from './agents/inMemoryStores';
-export { agentDelegationsTable, agentIdentityRegistrationsTable, agentRegistrationsTable, createNeonAgentDelegationStore, createNeonAgentIdentityRegistrationStore, createNeonAgentRegistrationStore, createPostgresAgentDelegationStore, createPostgresAgentIdentityRegistrationStore, createPostgresAgentRegistrationStore } from './agents/postgresStores';
+export { agentDelegationsTable, agentIdentityRegistrationsTable, agentRegistrationsTable, createNeonAgentDelegationStore, createNeonAgentIdentityRegistrationStore, createNeonAgentRegistrationStore, createDrizzleAgentDelegationStore, createPostgresAgentDelegationStore, createPostgresAgentIdentityRegistrationStore, createPostgresAgentRegistrationStore } from './agents/postgresStores';
 export { createInMemoryAccessTokenStore, createInMemoryApiClientStore, createInMemoryApiKeyStore } from './apikeys/inMemoryStores';
 export { accessTokensTable, apiClientsTable, apiKeysTable, createNeonAccessTokenStore, createNeonApiClientStore, createNeonApiKeyStore, createPostgresAccessTokenStore, createPostgresApiClientStore, createPostgresApiKeyStore } from './apikeys/postgresStores';
 export * from './oidc/config';

package/dist/index.js

@@ -3206,6 +3206,95 @@ var agentAuthContextPlugin = (config) => new Elysia2({
   }
 })).as("global");
 
+// src/agents/oauthGuide.ts
+var DEFAULT_GUIDE_ROUTE = "/auth.md";
+var secureUrl = (value, label) => {
+  const url = new URL(value);
+  const loopback = url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
+  if (url.protocol !== "https:" && !loopback)
+    throw new Error(`${label} must use HTTPS outside loopback development`);
+  if (url.username || url.password || url.hash)
+    throw new Error(`${label} cannot contain credentials or a fragment`);
+  return url.toString();
+};
+var agentOAuthGuideRoute = (config) => config.route ?? DEFAULT_GUIDE_ROUTE;
+var agentOAuthGuideUrl = (config) => new URL(agentOAuthGuideRoute(config), secureUrl(config.authorizationServer, "OAuth authorization server")).toString();
+var normalizedResources = (config) => {
+  if (config.resources.length === 0)
+    throw new Error("Agent OAuth guide requires at least one resource");
+  const resources = config.resources.map((resource) => ({
+    metadataUrl: secureUrl(resource.metadataUrl, "Protected-resource metadata URL"),
+    name: resource.name.trim(),
+    resource: secureUrl(resource.resource, "OAuth protected resource"),
+    scopes: [
+      ...new Set(resource.scopes.map((scope) => scope.trim()))
+    ].filter(Boolean)
+  }));
+  if (resources.some(({ name, scopes }) => !name || scopes.length === 0))
+    throw new Error("Every agent OAuth guide resource requires a name and at least one scope");
+  if (new Set(resources.map(({ resource }) => resource)).size !== resources.length)
+    throw new Error("Agent OAuth guide resources must be unique");
+  return resources;
+};
+var resourceSections = (resources) => resources.map((resource) => `### ${resource.name}
+
+- Protected resource: \`${resource.resource}\`
+- Metadata: ${resource.metadataUrl}
+- Allowed scopes: ${resource.scopes.map((scope) => `\`${scope}\``).join(", ")}
+`).join(`
+`);
+var generateAgentOAuthGuide = (config) => {
+  if (!config.serviceName.trim())
+    throw new Error("Agent OAuth guide requires a service name");
+  const authorizationServer = secureUrl(config.authorizationServer, "OAuth authorization server");
+  const resources = normalizedResources(config);
+  const authorizationMetadata = new URL("/.well-known/oauth-authorization-server", authorizationServer).toString();
+  return `# OAuth access for ${config.serviceName.trim()}
+
+This guide is the agent-readable companion to the service's standards-based
+OAuth metadata. Discovery metadata is authoritative. Do not infer endpoints,
+scopes, audiences, or capabilities that are not advertised.
+
+## 1. Discover
+
+Fetch the protected-resource metadata for the exact interface you intend to
+use, then fetch the authorization-server metadata at
+${authorizationMetadata}.
+
+${resourceSections(resources)}
+## 2. Register the OAuth client
+
+Use an existing registered client or the advertised \`registration_endpoint\`.
+Request only scopes listed for the selected protected resource. Never register
+redirect URIs, grant types, or authentication methods the metadata rejects.
+
+## 3. Obtain user delegation
+
+For an interactive user, use authorization code with PKCE. For a device or
+headless client, use the device authorization grant only when
+\`device_authorization_endpoint\` is advertised. Send the selected protected
+resource as the OAuth \`resource\` value and show the exact requested scopes to
+the user before consent.
+
+## 4. Call the selected interface
+
+Present the access token in the Authorization header. The token must name the
+selected resource as its audience and contain the required scope. A token for
+one resource or transport is not authority for another.
+
+## Safety
+
+- Never ask a user to send a password, passkey response, MFA code, device code,
+  authorization code, client secret, refresh token, or access token to the
+  agent or place one in model context.
+- Stop on issuer, signature, audience, expiry, delegation, or scope failure.
+- Treat consent denial, revocation, and disabled interfaces as final until the
+  user explicitly starts a new authorization flow.
+- Discovery is not authorization, and this guide grants no capability by
+  itself.
+`;
+};
+
 // src/agents/registration.ts
 init_constants();
 init_crypto();
@@ -3317,7 +3406,7 @@ var AGENT_IDENTITY_ASSERTION_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
 var DEFAULT_IDENTITY_ROUTE = "/agent/identity";
 var DEFAULT_CLAIM_ROUTE = "/agent/identity/claim";
 var DEFAULT_COMPLETE_ROUTE = "/agent/identity/claim/complete";
-var DEFAULT_GUIDE_ROUTE = "/auth.md";
+var DEFAULT_GUIDE_ROUTE2 = "/auth.md";
 var DEFAULT_CLAIM_TTL_MS = 24 * 60 * MILLISECONDS_IN_A_MINUTE;
 var DEFAULT_ATTEMPT_TTL_MS = 10 * MILLISECONDS_IN_A_MINUTE;
 var DEFAULT_ASSERTION_TTL_MS = 60 * MILLISECONDS_IN_A_MINUTE;
@@ -3352,7 +3441,7 @@ var agentRegistrationEndpoints = (config) => {
   return {
     claimEndpoint: new URL(registration.claimRoute ?? DEFAULT_CLAIM_ROUTE, base).toString(),
     completeEndpoint: new URL(registration.completeRoute ?? DEFAULT_COMPLETE_ROUTE, base).toString(),
-    guide: new URL(registration.guideRoute ?? DEFAULT_GUIDE_ROUTE, base).toString(),
+    guide: new URL(registration.guideRoute ?? DEFAULT_GUIDE_ROUTE2, base).toString(),
     identityEndpoint: new URL(registration.identityRoute ?? DEFAULT_IDENTITY_ROUTE, base).toString(),
     tokenEndpoint: new URL(`${oidcRoute}/token`, base).toString()
   };
@@ -3980,7 +4069,18 @@ var agentAuthRoutes = (config) => {
   if (config === undefined)
     return plugin.as("global");
   if (config.agentRegistration === undefined) {
-    return plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config)).as("global");
+    plugin.get(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, () => agentProtectedResourceMetadata(config));
+    const { oauthGuide } = config;
+    if (oauthGuide === undefined)
+      return plugin.as("global");
+    const guide = generateAgentOAuthGuide(oauthGuide);
+    plugin.get(agentOAuthGuideRoute(oauthGuide), () => new Response(guide, {
+      headers: {
+        "cache-control": "public, max-age=300",
+        "content-type": "text/markdown; charset=utf-8"
+      }
+    }));
+    return plugin.as("global");
   }
   const registration = config.agentRegistration;
   const identityRoute = registration.identityRoute ?? "/agent/identity";
@@ -26763,7 +26863,7 @@ var createPostgresScimTokenStore = (db) => ({
 });
 // src/agents/registrationClient.ts
 var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var secureUrl = (value, allowLocalhost) => {
+var secureUrl2 = (value, allowLocalhost) => {
   if (typeof value !== "string")
     return;
   try {
@@ -26853,32 +26953,32 @@ var discoverAgentRegistration = async (resource, options = {}) => {
   const request = options.request ?? fetch;
   const maxBytes = options.maxResponseBytes ?? 256 * 1024;
   const allowLocalhost = options.allowInsecureLocalhost === true;
-  const resourceUrl = secureUrl(resource, allowLocalhost);
+  const resourceUrl = secureUrl2(resource, allowLocalhost);
   if (resourceUrl === undefined)
     throw new Error("Resource URL must use HTTPS");
   const resourceMetadataUrl = new URL("/.well-known/oauth-protected-resource", resourceUrl).toString();
   const prm = await requestJson(request, resourceMetadataUrl, {}, maxBytes);
-  const advertisedResource = secureUrl(prm.body.resource, allowLocalhost);
+  const advertisedResource = secureUrl2(prm.body.resource, allowLocalhost);
   if (advertisedResource === undefined || advertisedResource !== resourceUrl) {
     throw new Error("Protected resource metadata identity mismatch");
   }
-  const authorizationServer = secureUrl(stringArray(prm.body.authorization_servers)[0], allowLocalhost);
+  const authorizationServer = secureUrl2(stringArray(prm.body.authorization_servers)[0], allowLocalhost);
   if (authorizationServer === undefined) {
     throw new Error("No secure authorization server is advertised");
   }
   const asUrl = new URL("/.well-known/oauth-authorization-server", authorizationServer).toString();
   const metadata = await requestJson(request, asUrl, {}, maxBytes);
-  if (secureUrl(metadata.body.issuer, allowLocalhost) !== authorizationServer) {
+  if (secureUrl2(metadata.body.issuer, allowLocalhost) !== authorizationServer) {
     throw new Error("Authorization server issuer mismatch");
   }
-  const tokenEndpoint = secureUrl(metadata.body.token_endpoint, allowLocalhost);
+  const tokenEndpoint = secureUrl2(metadata.body.token_endpoint, allowLocalhost);
   const agentAuth = metadata.body.agent_auth;
   if (tokenEndpoint === undefined || !isObject2(agentAuth)) {
     throw new Error("Authorization server does not advertise agent registration");
   }
-  const identityEndpoint = secureUrl(agentAuth.identity_endpoint, allowLocalhost);
-  const claimEndpoint = secureUrl(agentAuth.claim_endpoint, allowLocalhost);
-  const skill = secureUrl(agentAuth.skill, allowLocalhost);
+  const identityEndpoint = secureUrl2(agentAuth.identity_endpoint, allowLocalhost);
+  const claimEndpoint = secureUrl2(agentAuth.claim_endpoint, allowLocalhost);
+  const skill = secureUrl2(agentAuth.skill, allowLocalhost);
   const assertionMetadata = agentAuth.identity_assertion;
   if (identityEndpoint === undefined || claimEndpoint === undefined || skill === undefined || !isObject2(assertionMetadata)) {
     throw new Error("Agent registration metadata is incomplete");
@@ -27328,10 +27428,10 @@ var identityRegistrationValues = (registration) => ({
   user_id: registration.userId ?? null,
   version: registration.version
 });
-var createNeonAgentDelegationStore = (databaseUrl) => createPostgresAgentDelegationStore(createNeonDatabase(databaseUrl));
+var createNeonAgentDelegationStore = (databaseUrl) => createDrizzleAgentDelegationStore(createNeonDatabase(databaseUrl));
 var createNeonAgentIdentityRegistrationStore = (databaseUrl) => createPostgresAgentIdentityRegistrationStore(createNeonDatabase(databaseUrl));
 var createNeonAgentRegistrationStore = (databaseUrl) => createPostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));
-var createPostgresAgentDelegationStore = (db) => ({
+var createDrizzleAgentDelegationStore = (db) => ({
   findActiveDelegation: async ({
     agentId,
     now = Date.now(),
@@ -27370,6 +27470,7 @@ var createPostgresAgentDelegationStore = (db) => ({
     });
   }
 });
+var createPostgresAgentDelegationStore = createDrizzleAgentDelegationStore;
 var createPostgresAgentIdentityRegistrationStore = (db) => ({
   create: async (registration) => {
     const rows = await db.insert(agentIdentityRegistrationsTable).values(identityRegistrationValues(registration)).onConflictDoNothing().returning({ id: agentIdentityRegistrationsTable.registration_id });
@@ -27638,7 +27739,7 @@ var createPostgresApiKeyStore = (db) => ({
   }
 });
 // src/oidc/clientIdMetadata.ts
-var secureUrl2 = (value) => {
+var secureUrl3 = (value) => {
   try {
     return new URL(value).protocol === "https:";
   } catch {
@@ -27649,7 +27750,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
   const errors = [];
   if (document.client_id !== expectedClientId)
     errors.push("client_id does not match the metadata document URL");
-  if (!secureUrl2(document.client_id))
+  if (!secureUrl3(document.client_id))
     errors.push("client_id must use HTTPS");
   if (!Array.isArray(document.redirect_uris) || document.redirect_uris.length === 0)
     errors.push("redirect_uris is required");
@@ -27669,7 +27770,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
     ["tos_uri", document.tos_uri],
     ["jwks_uri", document.jwks_uri]
   ]) {
-    if (value !== undefined && !secureUrl2(value))
+    if (value !== undefined && !secureUrl3(value))
       errors.push(`${name2} must use HTTPS`);
   }
   return errors;
@@ -27692,7 +27793,7 @@ var createClientIdMetadataResolver = ({
 }) => {
   const cache = new Map;
   return async (clientId) => {
-    if (!secureUrl2(clientId) || !await allow(clientId))
+    if (!secureUrl3(clientId) || !await allow(clientId))
       return;
     const cached = cache.get(clientId);
     if (cached !== undefined && cached.expiresAt > now())
@@ -30371,6 +30472,22 @@ var buildAuthApplications = async (configuration) => {
       tokenTtlMs: registration2.tokenTtlMs
     });
   }
+  if (agentAuth?.oauthGuide !== undefined) {
+    if (oidc === undefined)
+      throw new Error("agentAuth.oauthGuide requires the OIDC provider");
+    if (agentAuth.authorizationServer !== oidc.issuer)
+      throw new Error("agentAuth.authorizationServer must equal oidc.issuer");
+    if (agentAuth.oauthGuide.authorizationServer !== agentAuth.authorizationServer)
+      throw new Error("agentAuth.oauthGuide.authorizationServer must equal agentAuth.authorizationServer");
+    const unknownGuideScopes = agentAuth.oauthGuide.resources.flatMap(({ scopes }) => scopes).filter((scope) => !agentAuth.scopes.includes(scope));
+    if (unknownGuideScopes.length > 0)
+      throw new Error(`Agent OAuth guide uses undeclared scopes: ${[
+        ...new Set(unknownGuideScopes)
+      ].join(", ")}`);
+    if (agentAuth.agentRegistration !== undefined && (agentAuth.agentRegistration.guideRoute ?? "/auth.md") === (agentAuth.oauthGuide.route ?? "/auth.md"))
+      throw new Error("Agent OAuth and registration guides cannot use the same route");
+    generateAgentOAuthGuide(agentAuth.oauthGuide);
+  }
   if (tracing !== undefined)
     await initTracing(tracing);
   const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client, customProviders);
@@ -30392,6 +30509,9 @@ var buildAuthApplications = async (configuration) => {
     ...oidc,
     additionalDiscoveryMetadata: {
       ...oidc.additionalDiscoveryMetadata,
+      ...resolvedAgentAuth?.oauthGuide === undefined ? {} : {
+        service_documentation: agentOAuthGuideUrl(resolvedAgentAuth.oauthGuide)
+      },
       ...resolvedAgentAuth?.agentRegistration === undefined ? {} : {
         agent_auth: agentRegistrationDiscoveryMetadata(resolvedAgentAuth)
       }
@@ -30797,6 +30917,7 @@ export {
   generateEncryptionKey,
   generateBackupCodes,
   generateAgentRegistrationGuide,
+  generateAgentOAuthGuide,
   fromBase64Url2 as fromBase64Url,
   fingerprintDevice,
   fetchUserInfo,
@@ -30978,6 +31099,7 @@ export {
   createInMemoryAccessTokenStore,
   createFgaEngine,
   createFederatedTokenStore,
+  createDrizzleAgentDelegationStore,
   createCustomOAuth2Client,
   createCredentialOffer,
   createClientIdMetadataResolver,
@@ -31026,6 +31148,8 @@ export {
   agentRegistrationEndpoints,
   agentRegistrationDiscoveryMetadata,
   agentProtectedResourceMetadata,
+  agentOAuthGuideUrl,
+  agentOAuthGuideRoute,
   agentIdentityRegistrationsTable,
   agentHasScopes,
   agentDelegationsTable,
@@ -31083,5 +31207,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=EF4CB146B3B9999C64756E2164756E21
+//# debugId=C85526782954EAFA64756E2164756E21
 //# sourceMappingURL=index.js.map