@absolutejs/auth 0.56.4 → 0.56.5

package/dist/abuse/captcha.d.ts

@@ -0,0 +1,11 @@
+import type { AbuseContext } from './config';
+export declare const verifyHcaptcha: ({ secret }: {
+    secret: string;
+}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;
+export declare const verifyRecaptcha: ({ minScore, secret }: {
+    minScore?: number;
+    secret: string;
+}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;
+export declare const verifyTurnstile: ({ secret }: {
+    secret: string;
+}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;

package/dist/abuse/config.d.ts

@@ -0,0 +1,29 @@
+export type AbuseAction = 'allow' | 'challenge' | 'deny';
+export type AbuseSignal = 'blocked_ip' | 'bot' | 'captcha_failed' | 'not_allowlisted';
+export type BotClass = 'agent' | 'bot' | 'crawler' | 'human';
+export type AbuseContext = {
+    captchaToken?: string;
+    ip?: string;
+    userAgent?: string;
+};
+export type AbuseReason = {
+    action: AbuseAction;
+    signal: AbuseSignal;
+};
+export type AbuseAssessment = {
+    action: AbuseAction;
+    reasons: AbuseReason[];
+};
+export type AbuseConfig = {
+    botAction?: AbuseAction;
+    captchaAction?: AbuseAction;
+    classifyBot?: (context: AbuseContext) => BotClass | Promise<BotClass>;
+    ipAllow?: string[];
+    ipDeny?: string[];
+    verifyCaptcha?: (token: string | undefined, context: AbuseContext) => boolean | Promise<boolean>;
+};
+export declare const assessAbuse: (config: AbuseConfig, context: AbuseContext) => Promise<AbuseAssessment>;
+export declare const createAbuseGuard: (config: AbuseConfig) => {
+    assess: (context: AbuseContext) => Promise<AbuseAssessment>;
+};
+export declare const defaultBotClassifier: (context: AbuseContext) => "bot" | "crawler" | "human";

package/dist/actions.d.ts

@@ -0,0 +1,27 @@
+export type AuthEventName = 'postLogin' | 'postLogout' | 'postMfa' | 'postOauthCallback' | 'postRegister' | 'preLogin' | 'preRegister';
+export type AuthActionContext<UserType> = {
+    email?: string;
+    event: AuthEventName;
+    ip?: string;
+    metadata?: Record<string, unknown>;
+    user?: UserType;
+    userAgent?: string;
+};
+export type AuthActionResult = {
+    kind: 'deny';
+    reason: string;
+} | {
+    kind: 'pass';
+} | {
+    kind: 'redirect';
+    url: string;
+};
+export type AuthAction<UserType> = {
+    event: AuthEventName | AuthEventName[];
+    handler: (context: AuthActionContext<UserType>) => AuthActionResult | Promise<AuthActionResult>;
+    name: string;
+};
+export type AuthPipeline<UserType> = {
+    run: (event: AuthEventName, context: Omit<AuthActionContext<UserType>, 'event'>) => Promise<AuthActionResult>;
+};
+export declare const createActionPipeline: <UserType>(actions: AuthAction<UserType>[]) => AuthPipeline<UserType>;

package/dist/adaptive/config.d.ts

@@ -0,0 +1,34 @@
+import type { KnownDeviceStore, LoginHistoryStore, RiskAction, RiskAssessment, RiskContext, RiskSignal, RiskThresholds, RiskWeights, WeightedRiskAssessment } from './types';
+export type AdaptiveConfig = {
+    historyLimit?: number;
+    knownDeviceStore: KnownDeviceStore;
+    loginHistoryStore: LoginHistoryStore;
+    maxTravelKmh?: number;
+    offHours?: {
+        end: number;
+        start: number;
+    };
+    rules?: Partial<Record<RiskSignal, RiskAction>>;
+    velocityMaxAttempts?: number;
+    velocityWindowMs?: number;
+};
+export declare const assessRisk: (config: AdaptiveConfig, context: RiskContext) => Promise<RiskAssessment>;
+export declare const createRiskEngine: (config: AdaptiveConfig) => {
+    assessRisk: (context: RiskContext) => Promise<RiskAssessment>;
+    recordAttempt: (context: RiskContext & {
+        outcome: RiskAction;
+    }) => Promise<void>;
+    scoreRisk: (context: RiskContext, options?: {
+        thresholds?: RiskThresholds;
+        weights?: RiskWeights;
+    }) => Promise<WeightedRiskAssessment>;
+    trustDevice: (userId: string, deviceId: string, label?: string) => Promise<void>;
+};
+export declare const recordLoginAttempt: (config: AdaptiveConfig, context: RiskContext & {
+    outcome: RiskAction;
+}) => Promise<void>;
+export declare const scoreRisk: (config: AdaptiveConfig & {
+    thresholds?: RiskThresholds;
+    weights?: RiskWeights;
+}, context: RiskContext) => Promise<WeightedRiskAssessment>;
+export declare const trustDevice: (config: AdaptiveConfig, userId: string, deviceId: string, label?: string) => Promise<void>;

package/dist/adaptive/fingerprint.d.ts

@@ -0,0 +1,2 @@
+export type DeviceSignals = Record<string, unknown>;
+export declare const fingerprintDevice: (signals: DeviceSignals) => Promise<string>;

package/dist/adaptive/inMemoryStores.d.ts

@@ -0,0 +1,3 @@
+import type { KnownDeviceStore, LoginHistoryStore } from './types';
+export declare const createInMemoryKnownDeviceStore: () => KnownDeviceStore;
+export declare const createInMemoryLoginHistoryStore: () => LoginHistoryStore;

package/dist/adaptive/postgresStores.d.ts

@@ -0,0 +1,245 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { KnownDeviceStore, LoginHistoryStore } from './types';
+export declare const knownDevicesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_known_devices";
+    schema: undefined;
+    columns: {
+        device_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        first_seen_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        label: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        last_seen_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        trusted: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_known_devices";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const loginHistoryTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_login_history";
+    schema: undefined;
+    columns: {
+        attempt_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        country: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        device_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        ip_address: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        latitude: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgDoublePrecisionBuilder, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "number double";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        longitude: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgDoublePrecisionBuilder, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "number double";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        outcome: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        timestamp_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_login_history";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonKnownDeviceStore: (databaseUrl: string) => KnownDeviceStore;
+export declare const createNeonLoginHistoryStore: (databaseUrl: string) => LoginHistoryStore;
+export declare const createPostgresKnownDeviceStore: <DB extends AnyPgDatabase>(db: DB) => KnownDeviceStore;
+export declare const createPostgresLoginHistoryStore: <DB extends AnyPgDatabase>(db: DB) => LoginHistoryStore;

package/dist/adaptive/types.d.ts

@@ -0,0 +1,62 @@
+export type RiskAction = 'allow' | 'deny' | 'step_up';
+export type RiskSignal = 'impossible_travel' | 'new_country' | 'new_device' | 'off_hours' | 'proxy' | 'velocity';
+export type GeoPoint = {
+    country?: string;
+    latitude?: number;
+    longitude?: number;
+};
+export type RiskContext = {
+    deviceId: string;
+    geo?: GeoPoint;
+    ipAddress?: string;
+    isProxy?: boolean;
+    localHour?: number;
+    now?: number;
+    userId: string;
+};
+export type RiskReason = {
+    action: RiskAction;
+    signal: RiskSignal;
+};
+export type RiskAssessment = {
+    action: RiskAction;
+    reasons: RiskReason[];
+};
+export type RiskWeights = Partial<Record<RiskSignal, number>>;
+export type RiskThresholds = {
+    deny: number;
+    stepUp: number;
+};
+export type WeightedRiskAssessment = {
+    action: RiskAction;
+    reasons: RiskReason[];
+    score: number;
+};
+export type KnownDevice = {
+    deviceId: string;
+    firstSeenAt: number;
+    label?: string;
+    lastSeenAt: number;
+    trusted: boolean;
+    userId: string;
+};
+export type KnownDeviceStore = {
+    findDevice: (userId: string, deviceId: string) => Promise<KnownDevice | undefined>;
+    listDevices: (userId: string) => Promise<KnownDevice[]>;
+    saveDevice: (device: KnownDevice) => Promise<void>;
+};
+export type LoginAttempt = {
+    attemptId: string;
+    country?: string;
+    deviceId: string;
+    ipAddress?: string;
+    latitude?: number;
+    longitude?: number;
+    outcome: RiskAction;
+    timestamp: number;
+    userId: string;
+};
+export type LoginHistoryStore = {
+    listRecent: (userId: string, limit: number) => Promise<LoginAttempt[]>;
+    recordAttempt: (attempt: LoginAttempt) => Promise<void>;
+};

package/dist/agents/config.d.ts

@@ -0,0 +1,44 @@
+import type { RouteString } from '../types';
+import type { AgentCredentialVerifier, AgentDelegationStore, AgentRegistrationStore } from './types';
+import type { AgentRegistrationProtocolConfig } from './registration';
+export declare const DEFAULT_AGENT_RESOURCE_METADATA_ROUTE: RouteString;
+export type AgentRegistrationDiscoveryMetadata = {
+    claim_endpoint: string;
+    identity_assertion: {
+        assertion_types_supported: string[];
+    };
+    identity_endpoint: string;
+    identity_types_supported: string[];
+    skill: string;
+};
+export type AgentAuthConfig = {
+    /** Permit registered agents to authenticate without a user delegation. Secure
+     * default is false; enable for machine-only resources. */
+    allowUndelegated?: boolean;
+    /** Open auth.md agent-registration support. Implemented natively by Absolute
+     * Auth and projected through OAuth discovery; no WorkOS service is required. */
+    agentRegistration?: AgentRegistrationProtocolConfig;
+    authorizationServer: string;
+    delegationStore: AgentDelegationStore;
+    logoUri?: string;
+    metadataRoute?: RouteString;
+    /** Authorization-server route prefix. Defaults to `/oauth2`; used to derive
+     * the authoritative token endpoint advertised by the generated guide. */
+    oidcRoute?: RouteString;
+    registrationStore: AgentRegistrationStore;
+    /** Treat clients created through RFC 7591 DCR as agent registrations. Explicitly
+     * opt-in because a deployment may also use DCR for ordinary relying parties. */
+    registerDynamicClients?: boolean;
+    resource: string;
+    resourceName?: string;
+    scopes: string[];
+    verifyCredential: AgentCredentialVerifier;
+};
+export declare const agentProtectedResourceMetadata: (config: Pick<AgentAuthConfig, "authorizationServer" | "logoUri" | "resource" | "resourceName" | "scopes">) => {
+    resource: string;
+    scopes_supported: string[];
+    resource_name?: string | undefined;
+    resource_logo_uri?: string | undefined;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+};

package/dist/agents/context.d.ts

@@ -0,0 +1,46 @@
+import { Elysia } from 'elysia';
+import { type AgentAuthConfig } from './config';
+import type { AgentPrincipal } from './types';
+type AgentAuthFailure = {
+    code: 'Forbidden' | 'Unauthorized';
+    message: 'Agent is not authenticated' | 'Insufficient agent scopes';
+};
+export declare const agentAuthChallenge: ({ config, error, requiredScopes }: {
+    config: AgentAuthConfig;
+    error?: "invalid_token" | "insufficient_scope";
+    requiredScopes?: string[];
+}) => string;
+export declare const agentResourceMetadataUrl: (config: AgentAuthConfig) => string;
+export declare const agentAuthContextPlugin: (config?: AgentAuthConfig) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {
+        readonly protectAgent: <AuthReturn, AuthFailReturn>(requiredScopes: string[], handleAuth: (principal: AgentPrincipal) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AgentAuthFailure) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
+    };
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: import("elysia").ExtractErrorFromHandle<{
+        readonly protectAgent: <AuthReturn, AuthFailReturn>(requiredScopes: string[], handleAuth: (principal: AgentPrincipal) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: (error: AgentAuthFailure) => AuthFailReturn | Promise<AuthFailReturn>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn>>>;
+    }>;
+}, {}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;
+export {};

package/dist/agents/idJag.d.ts

@@ -0,0 +1,49 @@
+import { type SigningKey } from '../oidc/keys';
+import type { VerifiedAgentIdentityAssertion } from './types';
+export type AgentIdentityAssertionJtiStore = {
+    /** Atomically records an issuer+jti pair. Returns false for a replay. */
+    recordIfFresh: (issuer: string, jti: string, expiresAt: number) => Promise<boolean>;
+};
+export declare const createInMemoryAgentIdentityAssertionJtiStore: () => AgentIdentityAssertionJtiStore;
+export type AgentIdentityAssertionUser = {
+    authenticatedAt: number;
+    email?: string;
+    emailVerified?: boolean;
+    methods?: string[];
+    name?: string;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    subject: string;
+};
+/** Native provider-side ID-JAG issuance. The caller owns the user consent UI
+ * and must authorize the requested audience before invoking this helper. */
+export declare const issueAgentIdentityAssertion: ({ agentContextId, agentPlatform, audience, clientId, issuer, now, resource, signingKey, ttlMs, user }: {
+    agentContextId?: string;
+    agentPlatform?: string;
+    audience: string;
+    clientId: string;
+    issuer: string;
+    now?: number;
+    resource?: string;
+    signingKey: SigningKey;
+    ttlMs?: number;
+    user: AgentIdentityAssertionUser;
+}) => Promise<{
+    assertion: string;
+    assertionType: "urn:ietf:params:oauth:token-type:id-jag";
+    expiresAt: number;
+}>;
+/** Builds a fail-closed service-side verifier. Issuer resolution is injected so
+ * the application can use pinned configuration, CIMD, or an egress-guarded
+ * JWKS resolver without this package performing ambient network access. */
+export declare const createAgentIdentityAssertionVerifier: ({ audience, clockSkewMs, jtiStore, maxAssertionLifetimeMs, maxAuthenticationAgeMs, resolveIssuer }: {
+    audience: string;
+    clockSkewMs?: number;
+    jtiStore: AgentIdentityAssertionJtiStore;
+    maxAssertionLifetimeMs?: number;
+    maxAuthenticationAgeMs?: number;
+    resolveIssuer: (issuer: string) => Promise<{
+        allowedClientIds?: string[];
+        publicJwk: JsonWebKey;
+    } | undefined>;
+}) => (assertion: string, now?: number) => Promise<VerifiedAgentIdentityAssertion | undefined>;

package/dist/agents/inMemoryStores.d.ts

@@ -0,0 +1,4 @@
+import type { AgentDelegationStore, AgentIdentityRegistrationStore, AgentRegistrationStore } from './types';
+export declare const createInMemoryAgentDelegationStore: () => AgentDelegationStore;
+export declare const createInMemoryAgentIdentityRegistrationStore: () => AgentIdentityRegistrationStore;
+export declare const createInMemoryAgentRegistrationStore: () => AgentRegistrationStore;

package/dist/agents/oidcAdapter.d.ts

@@ -0,0 +1,12 @@
+import type { AgentCredentialVerifier } from './types';
+/** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
+ * signature, issuer, audience, expiry, and extracts the OAuth client as the
+ * agent identity while retaining `sub` as the authorizing user. */
+export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, requireDpop, resource }: {
+    issuer: string;
+    isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
+    maxDpopAgeMs?: number;
+    publicJwk: JsonWebKey;
+    requireDpop?: boolean;
+    resource: string;
+}) => AgentCredentialVerifier;