@absolutejs/auth 0.75.1 → 0.75.3

package/README.md

@@ -300,8 +300,9 @@ const authPlugin = await auth({
 
 With `registerDynamicClients` enabled, an RFC 7591 client becomes an agent
 registration. Approval through the existing RFC 8628 device flow creates the
-user-to-agent delegation. The agent can then use RFC 8693 token exchange to get
-a narrowed, audience-bound access token for the protected API.
+user-to-agent delegation. Send the RFC 8707 `resource` value with device
+authorization to bind the resulting token directly to the protected API, or
+use RFC 8693 token exchange when narrowing an existing user token.
 
 When `requireDpop` is enabled, the adapter accepts only an RFC 9449-bound
 access token using the `DPoP` authorization scheme, verifies its per-request
@@ -313,6 +314,24 @@ claims containing query or fragment components fail closed. Resource servers
 that require RFC 9449 nonces can use the nonce helpers exported by
 `@absolutejs/auth/oidc` to issue a separate resource nonce challenge.
 
+Client applications can use `createDpopClient` from `@absolutejs/auth/client`.
+It creates a non-exportable P-256 private key, signs a fresh proof for every
+request, adds `ath` and the case-sensitive `DPoP` authorization scheme when an
+access token is supplied, and retries one authorization- or resource-server
+nonce challenge. Give the two servers distinct `nonceScope` values when they
+share an origin. Redirects remain manual so credentials and proofs are never
+forwarded to an unverified location.
+
+```ts
+import { createDpopClient } from '@absolutejs/auth/client';
+
+const dpop = await createDpopClient();
+const response = await dpop.fetch(resourceUrl, {
+	dpop: { accessToken, nonceScope: protectedResource },
+	method: 'POST'
+});
+```
+
 ```ts
 app.get('/documents', ({ protectAgent }) =>
 	protectAgent(['documents:read'], (agent) => ({

package/dist/agents/config.d.ts

@@ -25,6 +25,9 @@ export type AgentAuthConfig = {
     oauthGuide?: AgentOAuthGuideConfig;
     authorizationServer: string;
     delegationStore: AgentDelegationStore;
+    /** Advertise RFC 9728 `dpop_bound_access_tokens_required`. Keep this aligned
+     * with a credential verifier configured with `requireDpop: true`. */
+    dpopBoundAccessTokensRequired?: boolean;
     logoUri?: string;
     metadataRoute?: RouteString;
     /** Authorization-server route prefix. Defaults to `/oauth2`; used to derive
@@ -39,11 +42,12 @@ export type AgentAuthConfig = {
     scopes: string[];
     verifyCredential: AgentCredentialVerifier;
 };
-export declare const agentProtectedResourceMetadata: (config: Pick<AgentAuthConfig, "authorizationServer" | "logoUri" | "resource" | "resourceName" | "scopes">) => {
+export declare const agentProtectedResourceMetadata: (config: Pick<AgentAuthConfig, "authorizationServer" | "dpopBoundAccessTokensRequired" | "logoUri" | "resource" | "resourceName" | "scopes">) => {
     resource: string;
     scopes_supported: string[];
     resource_name?: string | undefined;
     resource_logo_uri?: string | undefined;
+    dpop_bound_access_tokens_required?: boolean | undefined;
     authorization_servers: string[];
     bearer_methods_supported: string[];
 };

package/dist/agents/index.js

@@ -186,6 +186,7 @@ var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resour
 var agentProtectedResourceMetadata = (config) => ({
   authorization_servers: [config.authorizationServer],
   bearer_methods_supported: ["header"],
+  ...config.dpopBoundAccessTokensRequired === true ? { dpop_bound_access_tokens_required: true } : {},
   ...config.logoUri === undefined ? {} : { resource_logo_uri: config.logoUri },
   ...config.resourceName === undefined ? {} : { resource_name: config.resourceName },
   resource: config.resource,
@@ -13798,5 +13799,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=801AFAC38E904B9A64756E2164756E21
+//# debugId=16DE04B83F43B7D264756E2164756E21
 //# sourceMappingURL=index.js.map