Skip to content

v1.0.0

Choose a tag to compare

View all tags
@rohanharikr rohanharikr released this 26 May 13:01
· 49 commits to main since this release
v1.0.0
c6fe394

First major release. The @aauth/bootstrap and @aauth/fetch CLIs are reworked into a stable, agent-first surface, alongside breaking library changes in @aauth/local-keys and @aauth/mcp-agent. Closes #1.

Breaking changes

CLI surface (bootstrap + fetch)

  • Renamed: --access-token → --opaque-token; env AAUTH_ACCESS_TOKEN → AAUTH_OPAQUE_TOKEN; JSON field access_token → opaque_token (per spec's "opaque" terminology, distinct from OAuth's access_token).
  • --with-token / authorize output shape flattened: response is now the resource body directly (was { status, body }). signingKey is emitted only when an auth_token is present — two-party --opaque-token reuse binds per-request to the agent identity and needs no signing key.
  • --authorize flag → authorize subcommand.
  • --agent-url → --agent-provider (consistent across both CLIs).
  • Dropped --log / --jsonl — use -v instead.
  • Positional <url> → <resource> (cosmetic).
  • help [command] subcommand added (alongside --help).
  • Spec-aligned JSON snake_case for protocol fields: auth_token, expires_in, login_hint, domain_hint. Our own artifacts stay camelCase: signingKey, signatureKey, agentProvider.
  • Two-party AAuth-Access fix to spec: opaque token sent under the AAuth scheme (was Bearer) with authorization in the signature's covered components — bound to the signature, not a bearer.
  • Single fetch skill (no name argument); bootstrap dropped the protocol skill — the spec URL is appended to every skill output instead.

Libraries

  • @aauth/local-keys: removed PersonServerMetadata type and AgentConfig.personServerMetadata field. Added new metadata-cache module: readCachedMetadata, writeCachedMetadata, evictCachedMetadata, parseMaxAge, PS_METADATA_FILE.
  • @aauth/mcp-agent createAAuthFetch: renamed options accessToken → opaqueToken, onAccessToken → onOpaqueToken. Added onAuthToken callback. Two-party AAuth-Access send path fixed (scheme + signature binding).

New features

  • PS metadata caching at ~/.aauth/cache/<host>/aauth-person.json, with ~/.aauth/cache/index.json holding expires_at per entry. TTL from server's Cache-Control: max-age, else a ~1-day default. Refetched on expiry; self-heal: a stale cached endpoint (404/410 or connection failure) evicts the entry and refetches once (bounded, no loop).
  • --with-token returns the response + reusable credential in one call — skip a separate authorize round-trip.
  • --opaque-token / AAUTH_OPAQUE_TOKEN for two-party reuse.
  • --no-browser prints the approval URL with a scannable QR.
  • -v verbose output shows the real on-the-wire RFC 9421 signed headers at each protocol step.

Notes on the lockstep version bump

The four unchanged packages — @aauth/hardware-keys, @aauth/mcp-server, @aauth/mcp-stdio, @aauth/mcp-openclaw — also publish at 1.0.0 due to the project's lockstep versioning policy (enforced by the release workflow). No API changes in those.

Assets 2
Loading