@afauthhq/server

​

Entry points

• defineService(opts) — opinionated convenience factory. Returns a Server with attestation: "required" defaults (unclaimed_mode: "attested_only" in the discovery doc + bundled trustAttestor()). With this default, an un-attested signup is rejected with 401 attestation_required; an agent reaches it by linking to a human and minting a per-service JWT via TrustClient (or afauth trust link
  • afauth signup). Use this for new integrations; opt out with attestation: "off" (paid/read-only) or "optional" (migration path). Synthesizes the discovery doc from baseUrl + serviceDid and accepts a discovery override for partial customization. A human’s agents are grouped onto one account by their (iss, sub_h) (§10.4.4: one account, many devices) — automatic for any AccountStore, no option needed.
• new Server({...}) — the lower-level constructor. Pass an explicit DiscoveryDocument, attestor, nonce store, etc. Use when you need MultiAttestor, a custom HmacAttestor, or full discovery control.
• Verifier — standalone §5.5/§5.6 request verifier. Use directly at an edge proxy or sidecar that fronts a service backend.
• server.verifyAttested(req) + attestedSession — the §10.7 attested-session gate. Configure attestedSession: { store, mode } (with an attestor) and call verifyAttested on your own authenticated endpoints: it verifies the signature, refreshes the session when the agent re-presents an attestation, and challenges with 401 attestation_required when the freshness window lapses. Stores: MemoryAttestedFreshnessStore here, KvAttestedFreshnessStore in @afauthhq/worker. See Keep attested access live.
• Multi-agent accounts (§10.4.4) — an Account is keyed on an opaque account_id and holds one or more agent credentials (agents[]). At signup, an agent presenting a verified (iss, sub_h) that a human already has attaches to that account (AccountStore.signupAgent → attached: true) — one account, many devices. Agents with no sub_h (attestation off/optional, runtime-only) get singleton accounts. Key rotation keeps account_id stable; resolve an account from a request via accounts.getByAgentDid(did).