@absolutejs/agent
The production-grade, provider-neutral agent stack for AbsoluteJS.
This is the cohesive entry point, not another agent runtime. Each engine remains independently installable and replaceable; this package provides one documented golden path, typed subpath exports, production-readiness checks, and an AbsoluteJS manifest that lets coding agents discover the whole stack.
The facade is the single Agency runtime owner. A2A, MCP, Agent Control, Wallet, and other extensions declare Agency as a required peer, externalize it from their builds, and test a conservative compatibility window. The facade installs the matching real Agency dependency, so one application cannot silently create parallel action types or ledgers.
import { assertProductionReady, defineAgentStack } from "@absolutejs/agent";
import { createAgentRuntime } from "@absolutejs/agent/runtime";
import { createAgency } from "@absolutejs/agent/actions";
const stack = defineAgentStack([
{ capability: "durability", instance: runtime, name: "runtime" },
{ capability: "authorization", instance: agency, name: "actions" },
] as const);
await assertProductionReady(stack); // fails until every production concern is wired
Stable subpaths
@absolutejs/agent/auth— native auth.md registration, ID-JAG, scoped delegation@absolutejs/agent/actions— terminal approvals/rejections, leases, receipts, kill switches, handoffs@absolutejs/agent/runtime— durable runs, checkpoints, budgets, effects@absolutejs/agent/sandbox— deny-by-default HTTP, filesystem, and process grants@absolutejs/agent/trust— provenance, taint propagation, safe context and sinks@absolutejs/agent/memory— scoped, authorized, erasable durable memory@absolutejs/agent/inbox— verified webhooks, schedules, retries, dead letters@absolutejs/agent/discovery— signed well-known documents, cards, text, sitemaps, registry@absolutejs/agent/execution— certified tenant adapter installations, transactional outbox, retries, signed provider evidence ingestion, reconciliation, compensation@absolutejs/agent/exchange— experimental, model-blind sensitive-value exchange with explicit one-time or signed standing-mandate approval, single-use leases, authenticated E2EE, replay defense, revocation, and redacted receipts@absolutejs/agent/mcp,/a2a,/arazzo, and/webmcp— open interoperability, workflow, and browser transports@absolutejs/agent/policy— versioned policy and AuthZEN adapters@absolutejs/agent/wallet— reservations, idempotent settlement, spending policy@absolutejs/agent/control— operator inventory, revoke, restore, kill switches@absolutejs/agent/conformance— adversarial protocol and action suites
The package deliberately does not introduce an Absolute-only wire protocol. Applications expose standard MCP, A2A, OAuth, RFC 9728/RFC 8414, auth.md, and AuthZEN surfaces while Absolute supplies provider-neutral implementation seams.
/auth.md is the open auth.md registration profile's conventional discovery
route. Absolute Auth generates it from the application's authoritative OAuth
metadata and implements the flow natively; it is not a WorkOS adapter and does
not require a WorkOS service.
One authenticated delegation
createAuthAgencyDelegationAuthority() bridges the delegation already verified
by Absolute Auth directly into Agency. Put an
authAgencyAuthorizationDetail() in the Auth grant to bind its audience,
canonical actions, effects, resource types, and optional resource IDs. Agency
then re-reads that same grant before an action request, lease, and execution;
there is no second grant ID or shadow state to synchronize.