@absolutejs/auth 0.75.2 → 0.75.3

package/README.md

@@ -300,8 +300,9 @@ const authPlugin = await auth({
 
 With `registerDynamicClients` enabled, an RFC 7591 client becomes an agent
 registration. Approval through the existing RFC 8628 device flow creates the
-user-to-agent delegation. The agent can then use RFC 8693 token exchange to get
-a narrowed, audience-bound access token for the protected API.
+user-to-agent delegation. Send the RFC 8707 `resource` value with device
+authorization to bind the resulting token directly to the protected API, or
+use RFC 8693 token exchange when narrowing an existing user token.
 
 When `requireDpop` is enabled, the adapter accepts only an RFC 9449-bound
 access token using the `DPoP` authorization scheme, verifies its per-request
@@ -313,6 +314,24 @@ claims containing query or fragment components fail closed. Resource servers
 that require RFC 9449 nonces can use the nonce helpers exported by
 `@absolutejs/auth/oidc` to issue a separate resource nonce challenge.
 
+Client applications can use `createDpopClient` from `@absolutejs/auth/client`.
+It creates a non-exportable P-256 private key, signs a fresh proof for every
+request, adds `ath` and the case-sensitive `DPoP` authorization scheme when an
+access token is supplied, and retries one authorization- or resource-server
+nonce challenge. Give the two servers distinct `nonceScope` values when they
+share an origin. Redirects remain manual so credentials and proofs are never
+forwarded to an unverified location.
+
+```ts
+import { createDpopClient } from '@absolutejs/auth/client';
+
+const dpop = await createDpopClient();
+const response = await dpop.fetch(resourceUrl, {
+	dpop: { accessToken, nonceScope: protectedResource },
+	method: 'POST'
+});
+```
+
 ```ts
 app.get('/documents', ({ protectAgent }) =>
 	protectAgent(['documents:read'], (agent) => ({

package/dist/cli/migrate.js

@@ -2827,6 +2827,7 @@ var oauthCodesTable = pgTable10("auth_oauth_codes", {
   user_id: varchar10("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var oauthDeviceAuthorizationsTable = pgTable10("auth_oauth_device_authorizations", {
+  audience: varchar10("audience", { length: 2048 }),
   client_id: varchar10("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint8("created_at_ms", { mode: "number" }).notNull(),
   device_code_hash: varchar10("device_code_hash", {
@@ -3341,6 +3342,10 @@ var oidcSocketTicketsMigration = {
   id: "0004_socket_tickets",
   sql: tablesToInitSql([oauthSocketTicketsTable])
 };
+var oidcDeviceAudienceMigration = {
+  id: "0005_device_resource_audience",
+  sql: 'ALTER TABLE "auth_oauth_device_authorizations" ADD COLUMN IF NOT EXISTS "audience" varchar(2048);'
+};
 var sessionOAuthSubjectMigration = {
   id: "0002_oauth_subject",
   sql: [
@@ -3416,7 +3421,8 @@ var blockMigrations = {
       ]).migrations,
       oidcResourceAudienceMigration,
       oidcRefreshTokenFamiliesMigration,
-      oidcSocketTicketsMigration
+      oidcSocketTicketsMigration,
+      oidcDeviceAudienceMigration
     ]
   },
   organizations: initMigration("organizations", [
@@ -3635,5 +3641,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=3B381D4CCB9C631A64756E2164756E21
+//# debugId=A94ED948A86827BA64756E2164756E21
 //# sourceMappingURL=migrate.js.map