@slashfi/agents-sdk 0.11.2 → 0.13.0

package/dist/key-manager.js

@@ -0,0 +1,156 @@
+/**
+ * JWKS Key Manager
+ *
+ * Manages ES256 signing keys with automatic rotation and revocation.
+ * Store-agnostic — provide a KeyStore implementation for your DB.
+ *
+ * Features:
+ * - Automatic key rotation on a configurable schedule
+ * - Key lifecycle: active → deprecated → revoked → cleaned up
+ * - Multi-instance safe: checks DB before rotating (another instance may have already rotated)
+ * - Periodic background checks (configurable interval)
+ * - Exposes JWKS for /.well-known/jwks.json
+ * - Signs JWTs with the active key
+ */
+import { generateKeyPair, exportJWK, importJWK, SignJWT, } from "jose";
+// ── Constants ──
+const FIVE_MINUTES = 5 * 60 * 1000;
+const ONE_HOUR = 60 * 60 * 1000;
+const TWO_HOURS = 2 * ONE_HOUR;
+const ALG = "ES256";
+// ── Key generation ──
+function generateKid() {
+    return `key-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+async function generateNewKey(keyLifetimeMs) {
+    const { privateKey, publicKey } = await generateKeyPair(ALG, { extractable: true });
+    const kid = generateKid();
+    const publicJwk = await exportJWK(publicKey);
+    publicJwk.kid = kid;
+    publicJwk.alg = ALG;
+    publicJwk.use = "sig";
+    const privateJwk = await exportJWK(privateKey);
+    privateJwk.kid = kid;
+    privateJwk.alg = ALG;
+    return {
+        kid,
+        alg: ALG,
+        status: "active",
+        publicJwk,
+        privateJwk,
+        createdAt: new Date(),
+        expiresAt: new Date(Date.now() + keyLifetimeMs),
+    };
+}
+async function toCachedKey(stored) {
+    const privateKey = await importJWK(stored.privateJwk, ALG);
+    return { ...stored, privateKey };
+}
+// ── Key Manager ──
+export async function createKeyManager(opts) {
+    const { store, issuer, checkIntervalMs = FIVE_MINUTES, rotationThresholdMs = ONE_HOUR, keyLifetimeMs = TWO_HOURS, tokenTtlSeconds = 300, enableRotation = true, } = opts;
+    let keys = [];
+    /** Generate a new key, deprecate old ones, cleanup expired, refresh cache — all in one transaction */
+    async function rotate() {
+        await store.transaction(async () => {
+            const newKey = await generateNewKey(keyLifetimeMs);
+            await store.deprecateAllActive();
+            await store.insertKey(newKey);
+            await store.cleanupExpired();
+            const updated = await store.loadKeys();
+            keys = await Promise.all(updated.map(toCachedKey));
+        });
+    }
+    /** Check if rotation is needed and rotate if so — all within a single transaction */
+    async function checkAndRotate() {
+        // Quick check against cache — no DB/store hit if key is fresh
+        const cached = keys.find((k) => k.status === "active");
+        if (cached) {
+            const age = Date.now() - cached.createdAt.getTime();
+            if (age < rotationThresholdMs)
+                return;
+        }
+        // Cache says stale (or empty) — take a lock via transaction to check + rotate atomically
+        await store.transaction(async () => {
+            const stored = await store.loadKeys();
+            const active = stored.find((k) => k.status === "active");
+            if (active) {
+                const age = Date.now() - active.createdAt.getTime();
+                if (age < rotationThresholdMs) {
+                    // Another instance already rotated — just update our cache
+                    keys = await Promise.all(stored.map(toCachedKey));
+                    return;
+                }
+            }
+            // Still stale (or no active key) — rotate within this tx
+            const newKey = await generateNewKey(keyLifetimeMs);
+            await store.deprecateAllActive();
+            await store.insertKey(newKey);
+            await store.cleanupExpired();
+            // Refresh cache inside the tx for a consistent read
+            const updated = await store.loadKeys();
+            keys = await Promise.all(updated.map(toCachedKey));
+        });
+    }
+    // Initial load + ensure we have at least one key
+    // Initial load from store
+    const stored = await store.loadKeys();
+    keys = await Promise.all(stored.map(toCachedKey));
+    if (!keys.some((k) => k.status === "active")) {
+        if (enableRotation) {
+            await rotate();
+        }
+        else {
+            // Read-only mode: generate a key in memory only (no store writes)
+            // This ensures signJwt works even without rotation enabled
+            const newKey = await generateNewKey(keyLifetimeMs);
+            keys.push(await toCachedKey(newKey));
+        }
+    }
+    else if (enableRotation) {
+        await checkAndRotate();
+    }
+    // Periodic background check (only if rotation enabled)
+    const interval = enableRotation
+        ? setInterval(async () => {
+            try {
+                await checkAndRotate();
+            }
+            catch (err) {
+                console.error("[key-manager] Check/rotation failed:", err);
+            }
+        }, checkIntervalMs)
+        : null;
+    function getActiveKey() {
+        const active = keys.find((k) => k.status === "active");
+        if (!active)
+            throw new Error("[key-manager] No active signing key");
+        return active;
+    }
+    return {
+        getJwks() {
+            return {
+                keys: keys
+                    .filter((k) => k.status !== "revoked")
+                    .map((k) => k.publicJwk),
+            };
+        },
+        async signJwt(claims) {
+            const key = getActiveKey();
+            return new SignJWT({ ...claims })
+                .setProtectedHeader({ alg: ALG, kid: key.kid })
+                .setIssuer(issuer)
+                .setIssuedAt()
+                .setExpirationTime(`${tokenTtlSeconds}s`)
+                .sign(key.privateKey);
+        },
+        async rotate() {
+            await rotate();
+        },
+        stop() {
+            if (interval)
+                clearInterval(interval);
+        },
+    };
+}
+//# sourceMappingURL=key-manager.js.map

package/dist/key-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../src/key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,eAAe,EACf,SAAS,EACT,SAAS,EACT,OAAO,GAER,MAAM,MAAM,CAAC;AAsEd,kBAAkB;AAElB,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC;AAC/B,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB,uBAAuB;AAEvB,SAAS,WAAW;IAClB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,aAAqB;IACjD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAE1B,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC;IACpB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC;IACpB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;IAEtB,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;IACrB,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;IAErB,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG;QACR,MAAM,EAAE,QAAQ;QAChB,SAAS;QACT,UAAU;QACV,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAiB;IAC1C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAc,CAAC;IACxE,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED,oBAAoB;AAEpB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAuB;IAC5D,MAAM,EACJ,KAAK,EACL,MAAM,EACN,eAAe,GAAG,YAAY,EAC9B,mBAAmB,GAAG,QAAQ,EAC9B,aAAa,GAAG,SAAS,EACzB,eAAe,GAAG,GAAG,EACrB,cAAc,GAAG,IAAI,GACtB,GAAG,IAAI,CAAC;IAET,IAAI,IAAI,GAAgB,EAAE,CAAC;IAE3B,sGAAsG;IACtG,KAAK,UAAU,MAAM;QACnB,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,KAAK,UAAU,cAAc;QAC3B,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,mBAAmB;gBAAE,OAAO;QACxC,CAAC;QAED,yFAAyF;QACzF,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;YAEzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACpD,IAAI,GAAG,GAAG,mBAAmB,EAAE,CAAC;oBAC9B,2DAA2D;oBAC3D,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,yDAAyD;YACzD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;YAE7B,oDAAoD;YACpD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,0BAA0B;IAC1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,2DAA2D;YAC3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;IAED,uDAAuD;IACvD,MAAM,QAAQ,GAAG,cAAc;QAC7B,CAAC,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,cAAc,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,EAAE,eAAe,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC;IAET,SAAS,YAAY;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,OAAO;YACL,OAAO;gBACL,IAAI,EAAE,IAAI;qBACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;qBACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;aAC3B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAA+B;YAC3C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,MAAM,EAAS,CAAC;iBACrC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;iBAC9C,SAAS,CAAC,MAAM,CAAC;iBACjB,WAAW,EAAE;iBACb,iBAAiB,CAAC,GAAG,eAAe,GAAG,CAAC;iBACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAED,IAAI;YACF,IAAI,QAAQ;gBAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server.d.ts

@@ -36,6 +36,34 @@ export interface TrustedIssuer {
     /** Scopes granted to tokens from this issuer */
     scopes: string[];
 }
+/** OAuth identity provider for /oauth/authorize + /oauth/callback flows */
+export interface OAuthIdentityProvider {
+    /**
+     * Handle /oauth/authorize — redirect the user to an external IdP.
+     * Return a Response (typically a 302 redirect).
+     */
+    authorize(req: Request, params: {
+        /** The verified JWT from the foreign registry */
+        token: string;
+        /** Claims from the verified JWT */
+        claims: Record<string, unknown>;
+        /** Where to redirect after completion */
+        redirectUri: string;
+        /** Base URL of this server */
+        baseUrl: string;
+        /** OAuth scope (e.g. "setup" for tenant creation flow) */
+        scope?: string;
+    }): Promise<Response>;
+    /**
+     * Handle /oauth/callback — process the IdP response.
+     * Should link the foreign identity to a local user and redirect back.
+     * Return a Response (typically a 302 redirect to redirectUri).
+     */
+    callback(req: Request, params: {
+        /** Base URL of this server */
+        baseUrl: string;
+    }): Promise<Response>;
+}
 export interface AgentServerOptions {
     /** Port to listen on (default: 3000) */
     port?: number;
@@ -55,8 +83,14 @@ export interface AgentServerOptions {
     trustedIssuers?: (TrustedIssuer | string)[];
     /** Pre-generated signing key (if not provided, one is generated on start) */
     signingKey?: SigningKey;
+    /** OAuth identity provider for cross-registry user linking */
+    oauthIdentityProvider?: OAuthIdentityProvider;
+    /** Key store for managed key rotation (if provided, uses createKeyManager instead of simple key gen) */
+    keyStore?: import("./key-manager.js").KeyStore;
 }
 export interface AgentServer {
+    /** Initialize signing keys without starting HTTP server */
+    initKeys(): Promise<void>;
     /** Start the server */
     start(): Promise<void>;
     /** Stop the server */
@@ -67,6 +101,10 @@ export interface AgentServer {
     url: string | null;
     /** The agent registry this server uses */
     registry: AgentRegistry;
+    /** Sign a JWT with the server's signing key (for outbound calls) */
+    signJwt(claims: Record<string, unknown>): Promise<string>;
+    /** Dynamically add a trusted JWT issuer at runtime */
+    addTrustedIssuer(issuerUrl: string, scopes?: string[]): void;
 }
 export interface AuthConfig {
     store?: AuthStore;
@@ -74,6 +112,7 @@ export interface AuthConfig {
     tokenTtl?: number;
 }
 export interface ResolvedAuth {
+    issuer?: string;
     callerId: string;
     callerType: "agent" | "user" | "system";
     scopes: string[];

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,KAAK,WAAW,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,YAAY,CAAC;AAMhF,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iDAAiD;IACjD,cAAc,CAAC,EAAE,CAAC,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,sBAAsB;IACtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,yEAAyE;IACzE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,EAAE,aAAa,CAAC;CACzB;AAwBD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAqED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAgB9D;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,UAAU,EACtB,WAAW,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;CAAE,GAC7E,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA8G9B;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,YAAY,GAAG,IAAI,GACxB,OAAO,CAQT;AA4DD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CA8Zb"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,KAAK,WAAW,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,YAAY,CAAC;AAMhF,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAID,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;QAC9B,iDAAiD;QACjD,KAAK,EAAE,MAAM,CAAC;QACd,mCAAmC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,yCAAyC;QACzC,WAAW,EAAE,MAAM,CAAC;QACpB,8BAA8B;QAC9B,OAAO,EAAE,MAAM,CAAC;QAChB,0DAA0D;QAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEtB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;QAC7B,8BAA8B;QAC9B,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACvB;AACD,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iDAAiD;IACjD,cAAc,CAAC,EAAE,CAAC,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,OAAO,kBAAkB,EAAE,QAAQ,CAAC;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,uBAAuB;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,sBAAsB;IACtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,yEAAyE;IACzE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,sDAAsD;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,EAAE,aAAa,CAAC;IACxB,oEAAoE;IACpE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,sDAAsD;IACtD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC9D;AAwBD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAqED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAgB9D;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,UAAU,EACtB,WAAW,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;CAAE,GAC7E,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA8G9B;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,YAAY,GAAG,IAAI,GACxB,OAAO,CAQT;AA4DD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,kBAAuB,GAC/B,WAAW,CAsoBb"}

package/dist/server.js

@@ -26,7 +26,7 @@
  */
 import { processSecretParams, } from "./agent-definitions/secrets.js";
 import { verifyJwt } from "./jwt.js";
-import { generateSigningKey, importSigningKey, exportSigningKey, buildJwks, verifyJwtLocal, verifyJwtFromIssuer } from "./jwt.js";
+import { generateSigningKey, importSigningKey, exportSigningKey, buildJwks, verifyJwtLocal, verifyJwtFromIssuer, signJwtES256 } from "./jwt.js";
 // ============================================
 // HTTP Helpers
 // ============================================
@@ -257,7 +257,7 @@ function getToolDefinitions() {
 // Create Server
 // ============================================
 export function createAgentServer(registry, options = {}) {
-    const { port = 3000, hostname = "localhost", basePath = "", cors = true, serverName = "agents-sdk", serverVersion = "1.0.0", secretStore, } = options;
+    const { port = 3000, hostname = "localhost", basePath = "", cors = true, serverName = "agents-sdk", serverVersion = "1.0.0", secretStore, oauthIdentityProvider, } = options;
     // Signing keys for JWKS-based auth
     const serverSigningKeys = [];
     // Normalize trustedIssuers to TrustedIssuer objects
@@ -311,6 +311,8 @@ export function createAgentServer(registry, options = {}) {
                         req.metadata = {};
                     req.metadata.scopes = auth.scopes;
                     req.metadata.isRoot = auth.isRoot;
+                    if (auth.issuer)
+                        req.metadata.issuer = auth.issuer;
                 }
                 if (auth?.isRoot) {
                     req.callerType = "system";
@@ -362,62 +364,160 @@ export function createAgentServer(registry, options = {}) {
     // ──────────────────────────────────────────
     // OAuth2 token handler
     // ──────────────────────────────────────────
+    // Resolve public-facing base URL, respecting reverse proxy headers
+    const resolveBaseUrl = (r) => {
+        const fwdProto = r.headers.get("x-forwarded-proto");
+        const fwdHost = r.headers.get("x-forwarded-host");
+        if (fwdProto && fwdHost)
+            return `${fwdProto}://${fwdHost}`;
+        return new URL(r.url).origin;
+    };
     async function handleOAuthToken(req) {
         if (!authConfig) {
             return jsonResponse({ error: "auth_not_configured" }, 404);
         }
         const contentType = req.headers.get("Content-Type") ?? "";
-        let grantType;
-        let clientId;
-        let clientSecret;
+        let params;
         if (contentType.includes("application/x-www-form-urlencoded")) {
             const body = await req.text();
-            const params = new URLSearchParams(body);
-            grantType = params.get("grant_type") ?? "";
-            clientId = params.get("client_id") ?? "";
-            clientSecret = params.get("client_secret") ?? "";
+            const urlParams = new URLSearchParams(body);
+            params = Object.fromEntries(urlParams.entries());
         }
         else {
-            const body = (await req.json());
-            grantType = body.grant_type ?? "";
-            clientId = body.client_id ?? "";
-            clientSecret = body.client_secret ?? "";
-        }
-        if (grantType !== "client_credentials") {
-            return jsonResponse({
-                error: "unsupported_grant_type",
-                error_description: "Only client_credentials is supported",
-            }, 400);
-        }
-        if (!clientId || !clientSecret) {
-            return jsonResponse({
-                error: "invalid_request",
-                error_description: "Missing client_id or client_secret",
-            }, 400);
+            params = (await req.json());
         }
-        try {
-            const result = await registry.call({
-                action: "execute_tool",
-                path: "@auth",
-                tool: "token",
-                params: { clientId, clientSecret },
-                callerType: "system",
-            });
-            const tokenResult = result?.result;
-            if (!tokenResult?.accessToken) {
-                return jsonResponse({ error: "invalid_client", error_description: "Authentication failed" }, 401);
+        const grantType = params.grant_type ?? "";
+        // ── jwt_exchange grant: verify foreign JWT, resolve local identity ──
+        if (grantType === "jwt_exchange") {
+            const assertion = params.assertion ?? "";
+            if (!assertion) {
+                return jsonResponse({ error: "invalid_request", error_description: "Missing assertion parameter" }, 400);
+            }
+            try {
+                const result = await registry.call({
+                    action: "execute_tool",
+                    path: "@auth",
+                    tool: "exchange_token",
+                    params: { token: assertion },
+                    callerType: "system",
+                });
+                const exchangeResult = result?.result;
+                // If the tool call failed, forward the error
+                if (result?.success === false) {
+                    return jsonResponse({ error: "server_error", error_description: result?.error ?? "Exchange tool failed", raw: JSON.stringify(result)?.slice(0, 300) }, 500);
+                }
+                // ── Reverse registration: if caller is an agent-registry, auto-store connection ──
+                try {
+                    const assertionParts = assertion.split(".");
+                    if (assertionParts.length === 3) {
+                        const assertionPayload = JSON.parse(atob(assertionParts[1].replace(/-/g, "+").replace(/_/g, "/")));
+                        if (assertionPayload.type === "agent-registry" && assertionPayload.iss && false /* disabled: causes infinite loop */) {
+                            // Find or create @remote-registry agent and store the reverse connection
+                            const rrAgent = registry.get("@remote-registry") ?? registry.get("/agents/@remote-registry");
+                            if (rrAgent) {
+                                const setupTool = rrAgent.tools?.find((t) => t.name === "setup_integration");
+                                if (setupTool?.execute) {
+                                    try {
+                                        await setupTool.execute({ url: assertionPayload.iss, name: assertionPayload.name ?? "remote-registry" }, { callerId: "system", callerType: "system", tenantId: "default", agentPath: "@remote-registry" });
+                                        console.error(`[jwt_exchange] Reverse connection stored for ${assertionPayload.iss}`);
+                                    }
+                                    catch (setupErr) {
+                                        console.error(`[jwt_exchange] Reverse registration setup failed:`, setupErr);
+                                    }
+                                }
+                                else {
+                                    console.error("[jwt_exchange] @remote-registry has no setup_integration tool — reverse registration skipped");
+                                }
+                            }
+                            else {
+                                console.error("[jwt_exchange] @remote-registry agent not found — reverse registration skipped");
+                            }
+                        }
+                    }
+                }
+                catch (reverseErr) {
+                    console.error("[jwt_exchange] Reverse registration check failed:", reverseErr);
+                }
+                if (!exchangeResult) {
+                    return jsonResponse({ error: "server_error", error_description: `Exchange returned null: ${JSON.stringify(result)?.slice(0, 300)}` }, 500);
+                }
+                // User not linked yet — needs OAuth identity linking
+                if (exchangeResult.needsAuth) {
+                    const baseUrl = resolveBaseUrl(req);
+                    const authorizeUrl = new URL(`${baseUrl}${basePath}/oauth/authorize`);
+                    authorizeUrl.searchParams.set("token", assertion);
+                    if (params.redirect_uri) {
+                        authorizeUrl.searchParams.set("redirect_uri", params.redirect_uri);
+                    }
+                    if (params.scope) {
+                        authorizeUrl.searchParams.set("scope", params.scope);
+                    }
+                    return jsonResponse({
+                        error: "identity_required",
+                        error_description: "User identity not linked. Redirect to authorize_url to complete linking.",
+                        authorize_url: authorizeUrl.toString(),
+                        tenant_id: exchangeResult.tenantId,
+                    }, 403);
+                }
+                // User found — sign a local access token
+                if (exchangeResult.userId && serverSigningKeys.length > 0) {
+                    const sigKey = serverSigningKeys[0];
+                    const token = await signJwtES256({
+                        sub: exchangeResult.userId,
+                        name: exchangeResult.userId,
+                        scopes: ["*"],
+                        tenantId: exchangeResult.tenantId,
+                    }, sigKey.privateKey, sigKey.kid, resolveBaseUrl(req), `${authConfig.tokenTtl ?? 3600}s`);
+                    return jsonResponse({
+                        access_token: token,
+                        token_type: "Bearer",
+                        expires_in: authConfig.tokenTtl ?? 3600,
+                        user_id: exchangeResult.userId,
+                        tenant_id: exchangeResult.tenantId,
+                    });
+                }
+                return jsonResponse(exchangeResult);
+            }
+            catch (err) {
+                console.error("[oauth] JWT exchange error:", err);
+                return jsonResponse({ error: "server_error", error_description: `JWT exchange failed: ${err instanceof Error ? err.message : String(err)}` }, 500);
             }
-            return jsonResponse({
-                access_token: tokenResult.accessToken,
-                token_type: "Bearer",
-                expires_in: tokenResult.expiresIn ?? authConfig.tokenTtl,
-                refresh_token: tokenResult.refreshToken,
-            });
         }
-        catch (err) {
-            console.error("[oauth] Token error:", err);
-            return jsonResponse({ error: "server_error", error_description: "Token exchange failed" }, 500);
+        // ── client_credentials grant ──
+        if (grantType === "client_credentials") {
+            const clientId = params.client_id ?? "";
+            const clientSecret = params.client_secret ?? "";
+            if (!clientId || !clientSecret) {
+                return jsonResponse({ error: "invalid_request", error_description: "Missing client_id or client_secret" }, 400);
+            }
+            try {
+                const result = await registry.call({
+                    action: "execute_tool",
+                    path: "@auth",
+                    tool: "token",
+                    params: { clientId, clientSecret },
+                    callerType: "system",
+                });
+                const tokenResult = result?.result;
+                if (!tokenResult?.accessToken) {
+                    return jsonResponse({ error: "invalid_client", error_description: "Authentication failed" }, 401);
+                }
+                return jsonResponse({
+                    access_token: tokenResult.accessToken,
+                    token_type: "Bearer",
+                    expires_in: tokenResult.expiresIn ?? authConfig.tokenTtl,
+                    refresh_token: tokenResult.refreshToken,
+                });
+            }
+            catch (err) {
+                console.error("[oauth] Token error:", err);
+                return jsonResponse({ error: "server_error", error_description: "Token exchange failed" }, 500);
+            }
         }
+        return jsonResponse({
+            error: "unsupported_grant_type",
+            error_description: "Supported grant types: client_credentials, jwt_exchange",
+        }, 400);
     }
     // ──────────────────────────────────────────
     // Main fetch handler
@@ -458,11 +558,68 @@ export function createAgentServer(registry, options = {}) {
                 const result = await handleJsonRpc(body, effectiveAuth);
                 return cors ? addCors(jsonResponse(result)) : jsonResponse(result);
             }
-            // ── POST /oauth/token → OAuth2 client_credentials ──
+            // ── POST /oauth/token → OAuth2 token exchange ──
             if (path === "/oauth/token" && req.method === "POST") {
                 const res = await handleOAuthToken(req);
                 return cors ? addCors(res) : res;
             }
+            // ── GET /oauth/authorize → Identity linking redirect (browser flow) ──
+            if (path === "/oauth/authorize" && req.method === "GET") {
+                if (!oauthIdentityProvider) {
+                    const res = jsonResponse({ error: "not_configured", error_description: "No OAuth identity provider configured" }, 404);
+                    return cors ? addCors(res) : res;
+                }
+                const url = new URL(req.url);
+                const token = url.searchParams.get("token") ?? "";
+                const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+                if (!token) {
+                    const res = jsonResponse({ error: "invalid_request", error_description: "Missing token parameter" }, 400);
+                    return cors ? addCors(res) : res;
+                }
+                // Verify the JWT against trusted issuers (from store, falling back to config)
+                let claims = null;
+                const storeIssuers = authConfig?.store?.listTrustedIssuers
+                    ? await authConfig.store.listTrustedIssuers()
+                    : [];
+                const configIssuerUrls = configTrustedIssuers.map(i => typeof i === "string" ? i : i.issuer);
+                const allIssuerUrls = [...new Set([...storeIssuers, ...configIssuerUrls])];
+                for (const issuerUrl of allIssuerUrls) {
+                    try {
+                        const result = await verifyJwtFromIssuer(token, issuerUrl);
+                        if (result) {
+                            claims = result;
+                            break;
+                        }
+                    }
+                    catch { /* try next issuer */ }
+                }
+                if (!claims) {
+                    const res = jsonResponse({ error: "invalid_token", error_description: "JWT verification failed against all trusted issuers" }, 401);
+                    return cors ? addCors(res) : res;
+                }
+                const baseUrl = resolveBaseUrl(req);
+                const scope = url.searchParams.get("scope") ?? undefined;
+                const res = await oauthIdentityProvider.authorize(req, {
+                    token,
+                    claims,
+                    redirectUri,
+                    baseUrl: baseUrl + basePath,
+                    scope,
+                });
+                return cors ? addCors(res) : res;
+            }
+            // ── GET /oauth/callback → Identity linking callback ──
+            if (path === "/oauth/callback" && req.method === "GET") {
+                if (!oauthIdentityProvider) {
+                    const res = jsonResponse({ error: "not_configured", error_description: "No OAuth identity provider configured" }, 404);
+                    return cors ? addCors(res) : res;
+                }
+                const baseUrl = resolveBaseUrl(req);
+                const res = await oauthIdentityProvider.callback(req, {
+                    baseUrl: baseUrl + basePath,
+                });
+                return cors ? addCors(res) : res;
+            }
             // ── GET /health → Health check ──
             if (path === "/health" && req.method === "GET") {
                 const res = jsonResponse({ status: "ok", agents: registry.listPaths() });
@@ -478,14 +635,15 @@ export function createAgentServer(registry, options = {}) {
             }
             // ── GET /.well-known/configuration → Server discovery ──
             if (path === "/.well-known/configuration" && req.method === "GET") {
-                const baseUrl = new URL(req.url).origin;
+                const baseUrl = resolveBaseUrl(req);
                 const res = jsonResponse({
                     issuer: baseUrl,
                     jwks_uri: `${baseUrl}/.well-known/jwks.json`,
                     token_endpoint: `${baseUrl}/oauth/token`,
                     agents_endpoint: `${baseUrl}/list`,
                     call_endpoint: baseUrl,
-                    supported_grant_types: ["client_credentials"],
+                    supported_grant_types: ["client_credentials", "jwt_exchange"],
+                    authorization_endpoint: `${baseUrl}/oauth/authorize`,
                     agents: registry.listPaths(),
                 });
                 return cors ? addCors(res) : res;
@@ -548,12 +706,12 @@ export function createAgentServer(registry, options = {}) {
     return {
         url: null,
         registry,
-        async start() {
-            // Load or generate signing key for JWKS
-            if (options.signingKey) {
+        async initKeys() {
+            // Load or generate signing keys (without starting Bun.serve)
+            if (options.signingKey && serverSigningKeys.length === 0) {
                 serverSigningKeys.push(options.signingKey);
             }
-            else if (authConfig?.store?.getSigningKeys) {
+            else if (authConfig?.store?.getSigningKeys && serverSigningKeys.length === 0) {
                 const stored = await authConfig.store.getSigningKeys() ?? [];
                 for (const exported of stored) {
                     serverSigningKeys.push(await importSigningKey(exported));
@@ -566,6 +724,9 @@ export function createAgentServer(registry, options = {}) {
                     await authConfig.store.storeSigningKey(await exportSigningKey(key));
                 }
             }
+        },
+        async start() {
+            await this.initKeys();
             serverInstance = Bun.serve({
                 port,
                 hostname,
@@ -582,6 +743,21 @@ export function createAgentServer(registry, options = {}) {
             }
         },
         fetch,
+        async signJwt(claims) {
+            if (serverSigningKeys.length === 0) {
+                throw new Error('No signing keys available. Call start() or initKeys() first.');
+            }
+            const key = serverSigningKeys[0];
+            return signJwtES256({ sub: 'system', name: 'atlas-os', scopes: ['*'], ...claims }, key.privateKey, key.kid, options.serverName ?? 'agents-sdk', '1h');
+        },
+        addTrustedIssuer(issuerUrl, scopes) {
+            // Avoid duplicates
+            const existing = configTrustedIssuers.find(i => i.issuer === issuerUrl);
+            if (!existing) {
+                configTrustedIssuers.push({ issuer: issuerUrl, scopes: scopes ?? ['*'] });
+                console.error(`[agent-server] Added trusted issuer: ${issuerUrl}`);
+            }
+        },
     };
 }
 //# sourceMappingURL=server.js.map