OIDC and provisioning bridges
Use the public 0.2.0 OIDC provider; use versioned provisioning contracts separately.
@openagentid/oidc@0.2.0 is the current public agent OIDC provider/federation package. It serves discovery, public JWKS, authorization code with S256 PKCE, signed ID tokens and UserInfo to registered relying parties. Follow the complete OIDC guide for protected keys, durable adapter storage, real identity verification, consent and current grant rechecks.
Owned identities can federate a matching human assertion from the explicitly configured LifeID issuer/audience. Self-rooted identities require provider opt-in and independent authoritative current self-root approval, without a fabricated human. Neither login mode grants inference/billing/tool permissions automatically.
Legacy exchange and SCIM
OidcBridge JWT/ACT exchange helpers remain available with real authorized identity derivation and broker mint callbacks. Their signatures are part of the published OIDC reference; no unsigned token or random fallback is a production identity flow.
@openagentid/scim@0.1.1 is public on npm. It declares an SDK ^0.1.0 peer, which excludes SDK 0.7.2; it is compatibility material rather than a supported current-starter integration. Its published declarations describe provisioning/deprovisioning contracts. A configured deployment must establish real key custody, owner policy and revocation; an in-memory provisioning record is not an enrolled cryptographic identity. Installing this package does not provision a hosted SCIM provider.
Pin the actual component and external-provider configuration, validate inbound assertions before mapping claims, and preserve selected tenant/owner bindings. Exercise deprovisioning, duplicate external IDs, owner changes, revoked access and key rotation on the integration you deploy. Production boundaries and published package reference.