{"_id":"@alien-id/sso-agent-id","_rev":"13-12c7754f7a0f011877ec960e18a958b0","name":"@alien-id/sso-agent-id","dist-tags":{"alpha":"2.0.0-alpha.4","beta":"2.1.2-beta.0","latest":"2.1.2"},"versions":{"1.0.0":{"name":"@alien-id/sso-agent-id","version":"1.0.0","_id":"@alien-id/sso-agent-id@1.0.0","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"089f80f146408c14141dddcd1e4cab31484eb90b","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-1.0.0.tgz","fileCount":9,"integrity":"sha512-C2ezx22QYYExOIZ0i0sqnc/wQMISfQYqkMDOkTzHyKsIXcbV/7mJzc2x97KxcvgOjMy0sbORbttX9q18WetcTQ==","signatures":[{"sig":"MEUCIQDIrGYPhYpj9HYtPorVmoGUb7hPY8BOjsghHr30DeFevAIgBbrKp+3kbjPCO65ANf5gQPeocjIAj1rNDtz6HIEyN8A=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":69036},"main":"./dist/index.cjs","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"gitHead":"2ce15290f06834d33afa55ddac599f1dd4cf0e57","scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"dushebaa","email":"dushebaa75@gmail.com"},"repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.6.1","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.10.0","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_1.0.0_1775659371617_0.5593562374591337","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"@alien-id/sso-agent-id","version":"1.0.1","_id":"@alien-id/sso-agent-id@1.0.1","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"f3f2f1aecc1b6d83b848ecff96d9d5509769e547","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-1.0.1.tgz","fileCount":9,"integrity":"sha512-zV+4c8XCU0KxzkS2aqvaC+/DXbfi/IZbVpLMuW+iLsS4WKm9inL7z/vJz9hn5d8Gp7g+jxs9u3hWkYXQKT3YTQ==","signatures":[{"sig":"MEQCIFPdwKOcTXH1fT8v9JVx63BP73OufNLvUBY84nywjL4WAiBCNRmqiI6UPrE5AMJgt9AkskWgoyGjPsrQ6Oc554p/ZQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@1.0.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":69049},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-1.0.1.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-1.0.1.tgz","_integrity":"sha512-zV+4c8XCU0KxzkS2aqvaC+/DXbfi/IZbVpLMuW+iLsS4WKm9inL7z/vJz9hn5d8Gp7g+jxs9u3hWkYXQKT3YTQ==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_1.0.1_1775677086760_0.8277214931672348","host":"s3://npm-registry-packages-npm-production"}},"1.0.2":{"name":"@alien-id/sso-agent-id","version":"1.0.2","_id":"@alien-id/sso-agent-id@1.0.2","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"dd56b55a2a1547836cc4e984e324f980126f5164","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-1.0.2.tgz","fileCount":9,"integrity":"sha512-+oXA//YOXkaq9CXlX6ZAec0JHG7FxvDUdWCauyYaTBhfPcJDqL5ssMLakrqu+W/40EgB6PUiEatJD5H5+P1KoQ==","signatures":[{"sig":"MEUCIGZ0Fy6KtI0+m1dpeqQsNpGTch/kDPnTPRB5tsUg2hhGAiEA+Rezr8tnZVpA+r9Yq724plE5Ai9UBKxfEx4bAy0RqSg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@1.0.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":69155},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-1.0.2.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-1.0.2.tgz","_integrity":"sha512-+oXA//YOXkaq9CXlX6ZAec0JHG7FxvDUdWCauyYaTBhfPcJDqL5ssMLakrqu+W/40EgB6PUiEatJD5H5+P1KoQ==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_1.0.2_1775677936682_0.3331035734767904","host":"s3://npm-registry-packages-npm-production"}},"2.0.0-alpha.1":{"name":"@alien-id/sso-agent-id","version":"2.0.0-alpha.1","_id":"@alien-id/sso-agent-id@2.0.0-alpha.1","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"002ed56401eb6a797157978dbbf49df4f8a27705","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.0.0-alpha.1.tgz","fileCount":9,"integrity":"sha512-kECDjlC6RigR/fbFt7TqKftEPNpeRKuJoi5zEB0AxF18WelCyuUu/HU/1mmJah+jb0mcIoGyMrtX1CtEC2E2ww==","signatures":[{"sig":"MEUCIArRmKq1sHwQaWaf48p4trM81Z+8dJDv9GGsiq9kWxJFAiEA0LubSRR19kXYXP785i9SZKcrzp0HQuJC37a/Z8EEam8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.0.0-alpha.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":65307},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-2.0.0-alpha.1.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-2.0.0-alpha.1.tgz","_integrity":"sha512-kECDjlC6RigR/fbFt7TqKftEPNpeRKuJoi5zEB0AxF18WelCyuUu/HU/1mmJah+jb0mcIoGyMrtX1CtEC2E2ww==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.0.0-alpha.1_1778528750041_0.06857103850861823","host":"s3://npm-registry-packages-npm-production"}},"2.0.0-alpha.2":{"name":"@alien-id/sso-agent-id","version":"2.0.0-alpha.2","_id":"@alien-id/sso-agent-id@2.0.0-alpha.2","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"bf039ba937dc3f3b3a9dbdd0f71fdbd40c92becb","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.0.0-alpha.2.tgz","fileCount":9,"integrity":"sha512-awdzF/RUKVpxsAiAjlp54UHVJH912FzLLZLWwVMfAYhcW99d9J1iRAfUJx29TvZ8t/nM7jPgFYUbBQMlsvY50A==","signatures":[{"sig":"MEQCIEMhQP5kLtYsxd/vBdr3AYKxrDcrIxkUhqzDLPDNeWm4AiAXdhXyTbuB156nLrCNYIoUH8/XDmJodBjxoZiPMcPQQw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.0.0-alpha.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":65307},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-2.0.0-alpha.2.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-2.0.0-alpha.2.tgz","_integrity":"sha512-awdzF/RUKVpxsAiAjlp54UHVJH912FzLLZLWwVMfAYhcW99d9J1iRAfUJx29TvZ8t/nM7jPgFYUbBQMlsvY50A==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.0.0-alpha.2_1778529427963_0.1602542442478112","host":"s3://npm-registry-packages-npm-production"}},"2.0.0-alpha.3":{"name":"@alien-id/sso-agent-id","version":"2.0.0-alpha.3","_id":"@alien-id/sso-agent-id@2.0.0-alpha.3","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"56d262de5e9cc071effd63a960c30489680e1351","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.0.0-alpha.3.tgz","fileCount":9,"integrity":"sha512-n6+ATWPkrDHm94kaSoiuF621rqXDLgpNqZd1yv1CItwvYxJWUaVvJbLPVhlE+365/Ind9815bS68Gh/iotQg1Q==","signatures":[{"sig":"MEQCIA4YpwCQqE+e7sxJzVhbppNkZNAvaFyFoi32y2cwCkyUAiAqw5H36p6nkz3mPzH2SFE6p25e8orffQYjwzSVaWSJBQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.0.0-alpha.3","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":65307},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-2.0.0-alpha.3.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-2.0.0-alpha.3.tgz","_integrity":"sha512-n6+ATWPkrDHm94kaSoiuF621rqXDLgpNqZd1yv1CItwvYxJWUaVvJbLPVhlE+365/Ind9815bS68Gh/iotQg1Q==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.0.0-alpha.3_1778531837969_0.5033624252685225","host":"s3://npm-registry-packages-npm-production"}},"2.0.0-alpha.4":{"name":"@alien-id/sso-agent-id","version":"2.0.0-alpha.4","_id":"@alien-id/sso-agent-id@2.0.0-alpha.4","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"426779c595781b33490a340541a77a45e89a3221","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.0.0-alpha.4.tgz","fileCount":9,"integrity":"sha512-bl3vD+0xmPrlybceF3LYv3Bex7p41324NDGi8587KCFhreblgV7da60x2ko65H0UruiJiY2zzp6YEkzSIBsS6Q==","signatures":[{"sig":"MEYCIQDvm1c5HN6V5K8VFIjgKHzpdGtTuDtmQaEZnAyOBNuGegIhAONn7O7ZkDeu5UnUCiLT1clhkdnVEzcqIgZl3js8P+V7","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.0.0-alpha.4","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":65307},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-2.0.0-alpha.4.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-2.0.0-alpha.4.tgz","_integrity":"sha512-bl3vD+0xmPrlybceF3LYv3Bex7p41324NDGi8587KCFhreblgV7da60x2ko65H0UruiJiY2zzp6YEkzSIBsS6Q==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.0.0-alpha.4_1778534373395_0.8845710031310154","host":"s3://npm-registry-packages-npm-production"}},"2.0.0":{"name":"@alien-id/sso-agent-id","version":"2.0.0","_id":"@alien-id/sso-agent-id@2.0.0","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"1fc7b7bf46a1e3aee4e606620c351f5f77ba8898","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.0.0.tgz","fileCount":9,"integrity":"sha512-h9PULeIC6jriC/aN1m2nOxad8CcmNnBZ9ss/FTNPpu3d5aNWsxkFWURl/gzyM+q1adbu66ElgahnhfgG7TtFYQ==","signatures":[{"sig":"MEYCIQDyyJTYrqr/Pu1m46mlqjX6vwi1tb/zuBVZOCy+goNTXAIhAIo8e85V4bV1gxsUxEtmsDhVB1dnQVIksdbI69ZnucDo","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.0.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":65300},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-2.0.0.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-2.0.0.tgz","_integrity":"sha512-h9PULeIC6jriC/aN1m2nOxad8CcmNnBZ9ss/FTNPpu3d5aNWsxkFWURl/gzyM+q1adbu66ElgahnhfgG7TtFYQ==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.0.0_1778580342330_0.8838781103905107","host":"s3://npm-registry-packages-npm-production"}},"2.1.0":{"name":"@alien-id/sso-agent-id","version":"2.1.0","_id":"@alien-id/sso-agent-id@2.1.0","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"5c2b82f86cfae146eeef6626402e7742b8c6d9f3","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.1.0.tgz","fileCount":9,"integrity":"sha512-eRMjgbzlIKq5IXoulv100+Uiq/TzUcbrjrjnmW1/h1TXPWfa5iYU3Ys1oKTVLfyamglEDFsn+hK7tf+5Kvc3QQ==","signatures":[{"sig":"MEUCIQC3ajuTmFVcpgzW0Zr1+HaHwgozyXcYHuVe5V7EiJMqZgIgUPSANujVdhAvj/wPS4vSqRpxV2MTEn7LuOOosFGR0Vo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":68355},"main":"./dist/index.cjs","_from":"file:alien-id-sso-agent-id-2.1.0.tgz","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:ff412f37-99b5-45fc-922c-3550210e16af"}},"_resolved":"/home/runner/work/sso-sdk-js/sso-sdk-js/packages/agent-id/alien-id-sso-agent-id-2.1.0.tgz","_integrity":"sha512-eRMjgbzlIKq5IXoulv100+Uiq/TzUcbrjrjnmW1/h1TXPWfa5iYU3Ys1oKTVLfyamglEDFsn+hK7tf+5Kvc3QQ==","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.11.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.14.1","_hasShrinkwrap":false,"devDependencies":{"jest":"^30.1.2","tsdown":"^0.18.1","ts-jest":"^29.4.1","@types/jest":"^30.0.0","@types/node":"^24.3.0"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.1.0_1778592753730_0.35972323647945226","host":"s3://npm-registry-packages-npm-production"}},"2.1.1":{"name":"@alien-id/sso-agent-id","version":"2.1.1","_id":"@alien-id/sso-agent-id@2.1.1","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"6237b57fba50c408044fd74489a397bee141b5de","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.1.1.tgz","fileCount":9,"integrity":"sha512-SZrOMqFUU/SXR0T57/gst9R19/A15onPElVmkWZYJEfrujkVT3QhUux90sH566IwRg3T0X0ZPkj0L8qqqqzdkg==","signatures":[{"sig":"MEUCIQCll86B20LDc9nMhWmfa3cPNvvSIa4vsOlBN+QqDYAVuwIgRdSn63x5WJ5TLuFMJIwM2W6AxSyP2ks5GVID81/xirA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.1.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":68495},"main":"./dist/index.cjs","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"gitHead":"8e41d27517de43d6989630fef019b31f6da71761","scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:c0405fc9-3d8d-418b-8f36-32fbe3afd035"}},"repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.13.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.16.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"jest":"30.4.2","tsdown":"0.18.4","ts-jest":"29.4.11","@types/jest":"30.0.0","@types/node":"24.12.4"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.1.1_1780312614170_0.22893673532774228","host":"s3://npm-registry-packages-npm-production"}},"2.1.2-beta.0":{"name":"@alien-id/sso-agent-id","version":"2.1.2-beta.0","_id":"@alien-id/sso-agent-id@2.1.2-beta.0","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"f45d6fd1d94811e150353269d4ce88c414e2977d","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.1.2-beta.0.tgz","fileCount":9,"integrity":"sha512-ers4w4rgmivzHRS6KCUNuHw8id5rDOYRGsIwiDQU59vleR5RSqvdkzXw172AOhrW+OH2jEHiPXoZY0RoNCkL9w==","signatures":[{"sig":"MEYCIQC96CYy5xbSzqrnAjmyp3P4BBgJrjhiCaHTOOAmfz31ogIhANG2ADU+4n3C7Kl/t9Dksvn5gqtLrER/TI1zHKjHvHc1","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.1.2-beta.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":68723},"main":"./dist/index.cjs","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"gitHead":"d8469c000bc14f909ec09b25708e310e1b181f62","scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:c0405fc9-3d8d-418b-8f36-32fbe3afd035"}},"repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.13.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.16.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org","provenance":true},"_hasShrinkwrap":false,"readmeFilename":"README.md","devDependencies":{"jest":"30.4.2","tsdown":"0.22.3","ts-jest":"29.4.11","@types/jest":"30.0.0","@types/node":"24.13.2"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.1.2-beta.0_1782376045022_0.6883125717969074","host":"s3://npm-registry-packages-npm-production"}},"2.1.2":{"name":"@alien-id/sso-agent-id","version":"2.1.2","_id":"@alien-id/sso-agent-id@2.1.2","maintainers":[{"name":"truehazker-eti","email":"egor@eti.co"},{"name":"sampekmoy","email":"sampekmoy@gmail.com"},{"name":"alexanikin","email":"a@eti.co"},{"name":"dushebaa","email":"dushebaa75@gmail.com"}],"homepage":"https://github.com/alien-id/sso-sdk-js#readme","bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"dist":{"shasum":"d73417d5eede813b7b1c3e7ae6dfb0612ed93885","tarball":"https://registry.npmjs.org/@alien-id/sso-agent-id/-/sso-agent-id-2.1.2.tgz","fileCount":9,"integrity":"sha512-uZ6LgPFrBg9ZKMFQyI6sXAr4sDeX3lNFwiUoBCR1YIzneQWS4DL0otaZeSaqA27J7f5ThLGoeyroNbcZPnA7fg==","signatures":[{"sig":"MEYCIQDdN6gXc4QYeFNw9FNR2tVbQWLOULYgvVvsVjUgaY9aawIhANYm68Po51hr0SDjmhaGmStwsTFfGsALWS7nrt0Vt2Ct","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@alien-id%2fsso-agent-id@2.1.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":68716},"main":"./dist/index.cjs","types":"./dist/index.d.mts","module":"./dist/index.mjs","engines":{"node":">=18"},"exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"gitHead":"70af3d163e9bb8a9724a80c0c3c708729be2b0e4","scripts":{"dev":"tsdown --watch","test":"jest","build":"tsdown","release":"npm publish --access public","test:watch":"jest --watch"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:c0405fc9-3d8d-418b-8f36-32fbe3afd035"}},"repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"_npmVersion":"11.13.0","description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","directories":{},"_nodeVersion":"24.16.0","publishConfig":{"access":"public","registry":"https://registry.npmjs.org","provenance":true},"_hasShrinkwrap":false,"devDependencies":{"jest":"30.4.2","tsdown":"0.22.3","ts-jest":"29.4.11","@types/jest":"30.0.0","@types/node":"24.13.2"},"_npmOperationalInternal":{"tmp":"tmp/sso-agent-id_2.1.2_1782388149190_0.4232598977269104","host":"s3://npm-registry-packages-npm-production"}}},"time":{"created":"2026-04-08T14:42:51.537Z","modified":"2026-06-30T11:16:29.831Z","1.0.0":"2026-04-08T14:42:51.782Z","1.0.1":"2026-04-08T19:38:06.887Z","1.0.2":"2026-04-08T19:52:16.839Z","2.0.0-alpha.1":"2026-05-11T19:45:50.208Z","2.0.0-alpha.2":"2026-05-11T19:57:08.104Z","2.0.0-alpha.3":"2026-05-11T20:37:18.108Z","2.0.0-alpha.4":"2026-05-11T21:19:33.559Z","2.0.0":"2026-05-12T10:05:42.470Z","2.1.0":"2026-05-12T13:32:33.908Z","2.1.1":"2026-06-01T11:16:54.340Z","2.1.2-beta.0":"2026-06-25T08:27:25.187Z","2.1.2":"2026-06-25T11:49:09.346Z"},"bugs":{"url":"https://github.com/alien-id/sso-sdk-js/issues"},"homepage":"https://github.com/alien-id/sso-sdk-js#readme","repository":{"url":"git+https://github.com/alien-id/sso-sdk-js.git","type":"git"},"description":"Verify Alien Agent ID tokens — Ed25519 token verification for Node.js services","maintainers":[{"email":"egor@eti.co","name":"truehazker-eti"},{"email":"sampekmoy@gmail.com","name":"sampekmoy"},{"email":"a@eti.co","name":"alexanikin"}],"readme":"# @alien-id/sso-agent-id\n\n> Verify inbound RFC 9449 (OAuth 2.0 DPoP) requests from Alien-bound agents in\n> any Node.js service. Zero runtime dependencies.\n\nThe Alien agent sends two HTTP headers to your service:\n\n```\nAuthorization: DPoP <access_token>      ← Alien at+jwt, signed by SSO\nDPoP:          <proof JWT>              ← EdDSA, signed by the agent's own key\n```\n\nThis library walks the [RFC 9449 §4.3](https://www.rfc-editor.org/rfc/rfc9449#section-4.3)\nverification checklist, the [RFC 7800 §3.1](https://www.rfc-editor.org/rfc/rfc7800#section-3.1)\n/ [RFC 9449 §6.1](https://www.rfc-editor.org/rfc/rfc9449#section-6.1) `cnf.jkt`\nproof-of-possession binding, and the [RFC 9068 §4](https://www.rfc-editor.org/rfc/rfc9068#section-4)\naccess-token claim checks. On success, you can trust the `sub` (the human\nowner) and `jkt` (the agent's DPoP key thumbprint) — both transitively signed\nby the SSO and the agent respectively.\n\n## Install\n\n```bash\nnpm install @alien-id/sso-agent-id\n```\n\nRequires Node.js 18+ (uses built-in `crypto`, `URL`).\n\n## Quick start\n\n```typescript\nimport { fetchAlienJWKS, verifyDPoPRequest } from '@alien-id/sso-agent-id';\n\n// Fetch the SSO's JWKS once at startup. Cache it; refresh every few hours.\nconst jwks = await fetchAlienJWKS();\n\n// In your request handler:\nconst result = verifyDPoPRequest(req, { jwks });\n\nif (!result.ok) {\n  return res.status(401)\n    .set('WWW-Authenticate', `DPoP error=\"${result.code}\"`)\n    .json({ error: result.error });\n}\n\n// result.sub  — human owner's AlienID address (signed by SSO)\n// result.jkt  — agent's Ed25519 key thumbprint (RFC 7638)\n// result.accessTokenClaims, result.proofClaims — raw decoded JWT payloads\n```\n\nThat's the full integration for a service that wants to accept any agent on\nthe Alien network. `expectedIssuer` defaults to `https://sso.alien-api.com`\nand `expectedAudience` defaults to that same value — see\n[Federated audience](#federated-audience) for the rationale and when to\noverride.\n\nThe verifier needs the *full* request: method, URL, and headers. It uses these\nto compare the proof's `htm` and `htu` claims against the actual request\n(RFC 9449 §4.3 step 8–9).\n\n## Federated audience\n\nThe Alien SSO mints every access token with `aud = [client_id, issuer]`. By\ndefault the verifier checks that `aud` contains `expectedIssuer` — i.e. the\ntoken was minted by the Alien SSO at all. This is the \"federated audience\"\npattern: every Alien-aware service treats the SSO issuer URL as its own\naudience identifier, so one agent identity works against the whole network\nwith no per-service configuration.\n\nThe default is also defense-in-depth on top of the existing `typ == at+jwt`\ncheck: an `id+jwt` from the same SSO has `aud = client_id` only (no issuer),\nso even if the `typ` check were ever weakened the federated-audience default\nwould reject it.\n\nOverride `expectedAudience` only when you specifically want to *narrow*\nacceptance:\n\n```typescript\n// Scope to agents bound to your own OAuth client only:\nverifyDPoPRequest(req, { jwks, expectedAudience: 'YOUR_CLIENT_ID' });\n\n// Scope to an RFC 8707 resource indicator (when SSO/agent support lands):\nverifyDPoPRequest(req, { jwks, expectedAudience: 'https://your.service/api' });\n\n// Skip the audience check entirely (test fixtures only):\nverifyDPoPRequest(req, { jwks, expectedAudience: false });\n```\n\nSee [`docs/RS-INTEGRATION.md`](./docs/RS-INTEGRATION.md) for the full\nresource-server integration checklist.\n\n## API\n\n### `verifyDPoPRequest(req, opts)`\n\n| Parameter | Type | Description |\n| --- | --- | --- |\n| `req.method` | `string` | HTTP method, e.g. `\"GET\"`. Must match the proof's `htm` (case-sensitive). |\n| `req.url` | `string` | Full request URL including scheme/host/path. Compared to the proof's `htu` after both sides strip query and fragment. |\n| `req.headers` | `Record<string, string \\| string[] \\| undefined>` | Must include exactly one `authorization: DPoP <at>` and exactly one `dpop: <proof>`. |\n| `opts.jwks` | `JWKS` | Pre-fetched JWKS from the SSO (see `fetchAlienJWKS`). |\n| `opts.expectedIssuer` | `string` | Defaults to `https://sso.alien-api.com`. Override for staging/self-hosted SSO. |\n| `opts.expectedAudience` | `string \\| false` | Defaults to `expectedIssuer` (federated audience). Pass a string to scope to a specific OAuth client_id or RFC 8707 resource. Pass `false` to skip (test fixtures only). |\n| `opts.proofMaxAgeSec` | `number` | DPoP proof freshness window, in seconds. Default `30`. |\n| `opts.clockSkewSec` | `number` | Clock skew applied to access-token `exp`, in seconds. Default `30`. |\n| `opts.jtiStore` | `DPoPJtiStore` | Replay-protection store for the proof's `jti` claim. Default: in-memory `Map`. Inject a shared store (e.g. Redis-backed) for multi-instance deployments. |\n\n**Returns `VerifyDPoPSuccess`:**\n\n```typescript\n{\n  ok: true,\n  sub: string,                          // owner sub (from at+jwt)\n  jkt: string,                          // RFC 7638 thumbprint of the agent's DPoP key\n  accessTokenClaims: Record<string, unknown>,\n  proofClaims: Record<string, unknown>,\n}\n```\n\n**Returns `VerifyDPoPFailure`:**\n\n```typescript\n{\n  ok: false,\n  code: string,    // machine-readable, e.g. \"jkt_mismatch\"\n  error: string,   // human-readable\n}\n```\n\n### `fetchAlienJWKS(ssoBaseUrl?)`\n\nFetch the JWKS from the Alien SSO server. Callers should cache the result.\n\n| Parameter | Type | Description |\n| --- | --- | --- |\n| `ssoBaseUrl` | `string` | Default: `https://sso.alien-api.com`. |\n\nReturns `Promise<JWKS>`.\n\n### `DPoPJtiStore`\n\nPluggable interface for proof-replay protection (RFC 9449 §11.1):\n\n```typescript\ninterface DPoPJtiStore {\n  has(jti: string): boolean;\n  add(jti: string, iat: number): void;\n}\n```\n\nThe default in-memory store is single-process and capped at 10,000 entries.\nFor multi-instance deployments, back it with Redis/Memcached so a captured\nproof can't be replayed against a different worker.\n\n## Framework examples\n\n### Express\n\n```typescript\nimport express from 'express';\nimport { fetchAlienJWKS, verifyDPoPRequest } from '@alien-id/sso-agent-id';\n\nconst app = express();\nconst jwks = await fetchAlienJWKS();\n\nfunction requireAgent(req, res, next) {\n  // Express's req.url is the path; reconstruct the absolute URL the agent saw.\n  const fullUrl = `${req.protocol}://${req.get('host')}${req.originalUrl}`;\n  const result = verifyDPoPRequest(\n    { method: req.method, url: fullUrl, headers: req.headers },\n    { jwks },\n  );\n  if (!result.ok) {\n    res.set('WWW-Authenticate', `DPoP error=\"${result.code}\"`);\n    return res.status(401).json({ error: result.error });\n  }\n  req.agent = { sub: result.sub, jkt: result.jkt };\n  next();\n}\n\napp.get('/api/data', requireAgent, (req, res) => {\n  res.json({ data: 'secret', owner: req.agent.sub });\n});\n```\n\nIf you sit behind a reverse proxy (ALB, Cloudflare, nginx), trust\n`X-Forwarded-Proto` and `X-Forwarded-Host` to reconstruct the URL the agent\nactually addressed — otherwise `htu` comparison will fail.\n\n### Fastify\n\n```typescript\nimport Fastify from 'fastify';\nimport { fetchAlienJWKS, verifyDPoPRequest } from '@alien-id/sso-agent-id';\n\nconst app = Fastify();\nconst jwks = await fetchAlienJWKS();\n\napp.addHook('preHandler', async (request, reply) => {\n  const fullUrl = `${request.protocol}://${request.hostname}${request.url}`;\n  const result = verifyDPoPRequest(\n    { method: request.method, url: fullUrl, headers: request.headers },\n    { jwks },\n  );\n  if (!result.ok) {\n    reply.header('WWW-Authenticate', `DPoP error=\"${result.code}\"`);\n    return reply.code(401).send({ error: result.error });\n  }\n  request.agent = { sub: result.sub, jkt: result.jkt };\n});\n```\n\n### Next.js (App Router)\n\n```typescript\nimport { NextRequest, NextResponse } from 'next/server';\nimport { fetchAlienJWKS, verifyDPoPRequest } from '@alien-id/sso-agent-id';\n\nconst jwks = await fetchAlienJWKS();\n\nexport async function GET(req: NextRequest) {\n  // NextRequest's headers are a Headers instance — flatten for the verifier.\n  const headers: Record<string, string | undefined> = {};\n  req.headers.forEach((v, k) => { headers[k] = v; });\n\n  const result = verifyDPoPRequest(\n    { method: req.method, url: req.url, headers },\n    { jwks },\n  );\n  if (!result.ok) {\n    return NextResponse.json({ error: result.error }, {\n      status: 401,\n      headers: { 'WWW-Authenticate': `DPoP error=\"${result.code}\"` },\n    });\n  }\n  return NextResponse.json({ owner: result.sub, agent_jkt: result.jkt });\n}\n```\n\n## Access control patterns\n\n### Any owner-bound agent\n\n```typescript\nif (!result.ok) return res.status(401).json({ error: result.error });\n// result.sub is guaranteed by the SSO's signature.\n```\n\n### Allow-list by agent key\n\n```typescript\nconst ALLOWED_JKTS = new Set(['wEf6o2ux8sBAUG4oQYhP284gfpZwUJMTxXDPH5XxthY', ...]);\nif (!ALLOWED_JKTS.has(result.jkt)) {\n  return res.status(403).json({ error: 'Agent not authorized' });\n}\n```\n\n### Allow-list by owner\n\n```typescript\nconst ALLOWED_OWNERS = new Set(['00000003...', '00000003...']);\nif (!ALLOWED_OWNERS.has(result.sub)) {\n  return res.status(403).json({ error: 'Owner not authorized' });\n}\n```\n\n## How it works\n\n```mermaid\nsequenceDiagram\n  participant Agent\n  participant Service\n  participant SSO as Alien SSO\n\n  Note over Agent,SSO: 1) Agent obtains an at+jwt access token (DPoP-bound to its key)\n  Agent->>SSO: /oauth/token (with DPoP)\n  SSO-->>Agent: access_token{cnf.jkt = thumbprint(agent.jwk)}\n\n  Note over Agent,Service: 2) Agent calls your service with a per-request proof\n  Agent->>Service: Authorization: DPoP <at> + DPoP: <proof JWT>\n  Service->>Service: verify proof sig, htm, htu, iat, jti, ath\n  Service->>SSO: (cached) JWKS\n  Service->>Service: verify AT sig, iss, aud, exp, sub\n  Service->>Service: cnf.jkt == thumbprint(proof.jwk)\n  Service-->>Agent: 200 OK\n```\n\nEvery fact the service trusts is signed either by the SSO (over standard\nRFC 9068 access-token claims) or by the agent (over the per-request RFC 9449\nDPoP proof). There is no parallel envelope: no `ownerBinding`, no\n`idTokenHash`, no agent-issued attestation of `sub`. The cnf-binding ties the\nSSO-attested owner to the per-request proof-of-possession.\n\n## Error codes\n\n`result.code` values map to RFC 9449 / RFC 9068 / RFC 6750 categories. Stable\nacross releases; new values may be added.\n\n| Code | RFC | Meaning |\n| --- | --- | --- |\n| `missing_authorization` | RFC 9449 §4.3 step 1 | Missing or duplicate `Authorization` header |\n| `invalid_scheme` | RFC 9449 §7.1 | Not `Authorization: DPoP <token>` |\n| `missing_dpop` | RFC 9449 §4.3 step 1 | Missing or duplicate `DPoP` header |\n| `malformed_proof` | §4.3 step 2 | DPoP value is not a well-formed JWS |\n| `bad_proof_typ` | §4.3 step 4 | `typ` ≠ `dpop+jwt` |\n| `bad_proof_alg` | §4.3 step 5 | `alg` ≠ `EdDSA` (Alien agent keys are Ed25519) |\n| `missing_proof_jwk` / `bad_proof_jwk` | §4.3 step 6 | Header `jwk` missing or not OKP/Ed25519 |\n| `private_in_proof_jwk` | §4.3 step 6 | Proof leaks the private `d` member |\n| `bad_proof_signature` | §4.3 step 7 | Signature does not verify with the embedded `jwk` |\n| `bad_proof_htm` | §4.3 step 8 | `htm` ≠ request method |\n| `bad_proof_htu` | §4.3 step 9 | `htu` ≠ request URL (query/fragment stripped) |\n| `bad_proof_iat` / `stale_proof` / `future_proof` | §4.3 step 11 | Proof `iat` is malformed or outside the freshness window |\n| `missing_proof_jti` / `replayed_proof_jti` | §4.3 step 12 + §11.1 | Proof lacks `jti` or it's been seen before |\n| `bad_proof_ath` | §4.3 step 10 | `ath` ≠ SHA-256(access_token) |\n| `malformed_access_token` | RFC 9068 §4 | Access-token is not a well-formed JWS |\n| `bad_access_token_typ` | RFC 9068 §4 | Access-token `typ` ≠ `at+jwt` |\n| `bad_access_token_alg` | RFC 9068 §4 | Access-token `alg` ≠ `RS256` |\n| `unknown_access_token_kid` | RFC 7515 | Access-token's `kid` not in the JWKS |\n| `bad_access_token_signature` / `access_token_sig_error` | RFC 7515 | Access-token signature fails verification |\n| `bad_access_token_iss` | RFC 7519 §4.1.1 | `iss` ≠ `expectedIssuer` |\n| `bad_access_token_aud` | RFC 7519 §4.1.3 | `aud` does not include `expectedAudience` (defaults to `expectedIssuer`) |\n| `expired_access_token` | RFC 7519 §4.1.4 | Access-token `exp` is in the past |\n| `missing_access_token_sub` | RFC 7519 §4.1.2 | Access-token has no `sub` claim |\n| `missing_cnf_jkt` | RFC 7800 §3.1 | Access-token has no `cnf.jkt` (not DPoP-bound) |\n| `jkt_mismatch` | RFC 9449 §6.1 | `cnf.jkt` ≠ thumbprint of the proof's `jwk` |\n\n## Caveats\n\n- **Pre-fetched JWKS.** `fetchAlienJWKS()` does not cache. Call it at startup,\n  hold the result, refresh every few hours. The SSO rotates signing keys\n  infrequently.\n- **Reverse proxies.** If your service runs behind a load balancer or CDN,\n  reconstruct the URL the agent actually addressed (using\n  `X-Forwarded-Proto` / `X-Forwarded-Host`) — otherwise the `htu` comparison\n  will reject every request.\n- **jti replay store.** The default in-memory store is single-process. Inject\n  a shared `jtiStore` for multi-instance deployments so a captured proof can't\n  be replayed against a different worker.\n- **Clock sync.** The 30-second default freshness window assumes loosely\n  synchronized clocks. Tighten via `proofMaxAgeSec` / `clockSkewSec` if you\n  have stricter NTP, widen if you have flakier clocks.\n\n## Additional resources\n\n- [Alien Agent ID docs](https://docs.alien.org/agent-id-guide/introduction)\n- [RFC 9449 — OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://www.rfc-editor.org/rfc/rfc9449)\n- [RFC 9068 — JWT Profile for OAuth 2.0 Access Tokens](https://www.rfc-editor.org/rfc/rfc9068)\n- [RFC 7800 — Proof-of-Possession Key Semantics for JWTs](https://www.rfc-editor.org/rfc/rfc7800)\n","readmeFilename":"README.md"}