{"_rev":"5-8f87358997e6b83f991e95b0e38eb0c4","time":{"created":"2026-07-06T15:47:51.507Z","modified":"2026-07-06T15:47:52.029Z","0.1.1":"2026-07-06T02:03:19.263Z","0.1.0":"2026-07-06T02:11:53.375Z","0.1.2":"2026-07-06T15:47:51.783Z"},"_id":"@agent-grant-protocol/connect","name":"@agent-grant-protocol/connect","dist-tags":{"latest":"0.1.2"},"versions":{"0.1.2":{"name":"@agent-grant-protocol/connect","version":"0.1.2","description":"Vendor-side signup/login kit for the AGP Connect v0.2-draft profile.","main":"src/connect.mjs","type":"module","exports":{".":"./src/connect.mjs"},"engines":{"node":">=18"},"scripts":{"test":"node --test test/*.test.mjs && node ../../examples/connect-demo/run-demo.mjs","prepublishOnly":"npm test"},"publishConfig":{"access":"public"},"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/agent-grant-protocol/agp.git","directory":"packages/connect"},"homepage":"https://github.com/agent-grant-protocol/agp/tree/main/packages/connect#readme","bugs":{"url":"https://github.com/agent-grant-protocol/agp/issues"},"dependencies":{"@agent-grant-protocol/verifier":"^0.1.2"},"gitHead":"dd732c26ee9c65b65c94736dd4ad2c9e0fc0e456","_id":"@agent-grant-protocol/connect@0.1.2","_nodeVersion":"24.15.0","_npmVersion":"11.12.1","dist":{"integrity":"sha512-pxosNNVuNRGkT4Nf2Rrckh+8ODuAo9Gl8B6y+JwWVuzn+N1FX9O/qx500OHjf14gdZBPA+ssh21h+IoUViCeMQ==","shasum":"077a09143a8b3501648d653ce6dd8462ae11eccb","tarball":"https://registry.npmjs.org/@agent-grant-protocol/connect/-/connect-0.1.2.tgz","fileCount":4,"unpackedSize":20426,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIDXIzRhgGUHugXwkrSoA38XNoSvgry0kCiFN/CmQyfmKAiEAh9/nvFIXxOZUUwjhwqtJraG6d2ZkttQfRxrws0am8zc="}]},"_npmUser":{"name":"inasens","email":"ops@rawket.io"},"directories":{},"maintainers":[{"name":"inasens","email":"ops@rawket.io"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/connect_0.1.2_1783352871670_0.636947229677362"},"_hasShrinkwrap":false}},"maintainers":[{"name":"inasens","email":"ops@rawket.io"}],"description":"Vendor-side signup/login kit for the AGP Connect v0.2-draft profile.","homepage":"https://github.com/agent-grant-protocol/agp/tree/main/packages/connect#readme","repository":{"type":"git","url":"git+https://github.com/agent-grant-protocol/agp.git","directory":"packages/connect"},"bugs":{"url":"https://github.com/agent-grant-protocol/agp/issues"},"license":"Apache-2.0","readme":"# AGP Connect\n\nSignup and login for AI agents, built on AGP v0.1 grants.\n\nInstead of registering with an email and password (or borrowing its owner's credentials), an agent presents a grant signed from its owner's device. The account belongs to the human root, identified by a `did:key`. The agent is just whoever currently holds valid authority. Logging in means presenting a fresh grant, so there is nothing to phish and no session that outlives the authority behind it.\n\nWhen the owner revokes the grant in their app, the agent is locked out at the vendor's next status check, usually within a minute. The vendor doesn't deprovision anything. If the owner freezes their root key, every account relationship it ever created stops working, at every vendor, at the same time.\n\n## Try it\n\nFrom the repo root:\n\n```bash\nnpm install && node examples/connect-demo/run-demo.mjs\n```\n\nThe demo walks through signup, login, revocation (next login fails with `REVOKED`), a stolen grant presented without the agent's key (`BAD_PROOF`), and a root freeze (`FROZEN`).\n\n## Integration\n\nThe handlers are framework-agnostic: they take the two AGP headers and return `{ status, body }`. Wiring them into Express looks like this:\n\n```js\nimport { createConnect, memoryStores } from '@agent-grant-protocol/connect';\n\nconst connect = createConnect({\n  origin: 'https://your-service.com',\n  stores: memoryStores(), // in-memory reference; swap in your DB with the same shape\n  // You need statusOf in practice. The verifier has no built-in fetcher, and\n  // account actions are do-scoped, so without it every signup and login fails\n  // closed with STATUS_UNAVAILABLE (spec §7.3 step 9).\n  statusOf: async (jti) => {\n    const res = await fetch(`https://g.aye.app/s/${jti}`);\n    return res.ok ? (await res.json()).status : null;\n  },\n});\n\napp.post('/agp/signup', async (req, res) => {\n  const r = await connect.handleSignup({\n    grantJwt: req.get('AGP-Grant'), proofJws: req.get('AGP-Proof'),\n  });\n  res.status(r.status).json(r.body);\n});\n// /agp/login works the same way; connect.authenticate(token) guards your API routes.\n```\n\n## Why a vendor would want this\n\nYou learn who authorized the agent: the grant chains cryptographically to a key held in a person's device. Grants are locked to your origin, so a grant issued for your service is useless anywhere else. Deprovisioning costs you nothing, since revocation and freeze arrive through a status check you're already making. And spam gets more expensive for the attacker: one root means one device-held identity, so you can rate-limit per root instead of per email address.\n\n## Spec\n\nThis package implements [the Connect profile draft](https://github.com/agent-grant-protocol/agp/blob/main/spec/profiles/connect-v0.2-draft.md), a profile layered on frozen AGP v0.1. It adds two extension actions, `x.agp.account.create` and `x.agp.account.access`, requires audience-locking, and caps session lifetime at the grant's remaining lifetime. The wire format and verification algorithm are unchanged; each endpoint makes one `verifyAgentGrant` call via `@agent-grant-protocol/verifier`.\n\nOne positioning note we hold ourselves to: Connect is for services that want to accept agent traffic on their own terms. It is not a way for agents to get around signup controls a vendor hasn't opted into.\n","readmeFilename":"README.md"}