@absolutejs/auth 0.29.0-beta.4 → 0.29.0

package/dist/index.js

@@ -4230,6 +4230,7 @@ var exchangeToken = async ({
   };
 };
 var issueTokenSet = async ({
+  acr,
   claims,
   clientId,
   config,
@@ -4250,7 +4251,7 @@ var issueTokenSet = async ({
   const accessPayload = buildAccessClaims({
     clientId,
     dpopJkt,
-    extraClaims: accessExtra,
+    extraClaims: { ...accessExtra, ...acr === undefined ? {} : { acr } },
     issuer: config.issuer,
     now,
     scopes,
@@ -4267,8 +4268,11 @@ var issueTokenSet = async ({
   };
   if (nonce !== undefined)
     idPayload.nonce = nonce;
+  if (acr !== undefined)
+    idPayload.acr = acr;
   const refreshToken = generateSecureToken(TOKEN_BYTES2);
   await config.refreshTokenStore.saveToken({
+    acr,
     claims,
     clientId,
     createdAt: now,
@@ -4554,6 +4558,45 @@ var verifyClientAssertion = async ({
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
+var NONCE_WINDOW_SECONDS = 120;
+var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
+var NONCE_PREVIOUS_WINDOWS_ACCEPTED = 1;
+var hmacSha2562 = async (secret, message) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Buffer.from(new Uint8Array(signature)).toString("base64url");
+};
+var extractDpopNonceClaim = (proof) => {
+  const [, payloadSegment] = proof.split(".");
+  if (payloadSegment === undefined)
+    return;
+  try {
+    const payload = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null)
+      return;
+    const value = payload.nonce;
+    return typeof value === "string" ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var mintDpopNonce = async ({
+  now = Date.now(),
+  secret
+}) => {
+  const window = Math.floor(now / NONCE_WINDOW_MS);
+  return hmacSha2562(secret, String(window));
+};
+var verifyDpopNonce = async ({
+  now = Date.now(),
+  nonce,
+  secret
+}) => {
+  const currentWindow = Math.floor(now / NONCE_WINDOW_MS);
+  const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha2562(secret, String(currentWindow - offset))));
+  return candidates.some((expected) => expected === nonce);
+};
 var decodeHeader = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
 var normalizeHtu = (value) => {
   try {
@@ -4727,6 +4770,70 @@ var fanOutBackchannelLogout = async ({
   return reachable.map(({ client }) => client.clientId);
 };
 
+// src/oidc/par.ts
+var REQUEST_URI_BYTES = 32;
+var DEFAULT_PAR_TTL_SECONDS = 90;
+var DEFAULT_PAR_TTL_MS = DEFAULT_PAR_TTL_SECONDS * MILLISECONDS_IN_A_SECOND;
+var REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+var buildRequestUri = (token) => `${REQUEST_URI_PREFIX}${token}`;
+var extractToken = (requestUri) => {
+  if (!requestUri.startsWith(REQUEST_URI_PREFIX))
+    return;
+  return requestUri.slice(REQUEST_URI_PREFIX.length);
+};
+var consumePushedRequest = async ({
+  clientId,
+  requestUri,
+  store
+}) => {
+  const token = extractToken(requestUri);
+  if (token === undefined)
+    return;
+  const record = await store.consumeRequest(await hashToken(requestUri));
+  if (record === undefined)
+    return;
+  if (record.clientId !== clientId)
+    return;
+  return record.params;
+};
+var pushAuthorizationRequest = async ({
+  client,
+  now = Date.now(),
+  params,
+  store,
+  ttlMs = DEFAULT_PAR_TTL_MS
+}) => {
+  if (typeof params.redirect_uri !== "string" || !client.redirectUris.includes(params.redirect_uri)) {
+    return {
+      body: { error: "invalid_redirect_uri" },
+      ok: false,
+      status: 400
+    };
+  }
+  if (typeof params.client_id === "string" && params.client_id !== client.clientId) {
+    return { body: { error: "invalid_request" }, ok: false, status: 400 };
+  }
+  const token = generateSecureToken(REQUEST_URI_BYTES);
+  const requestUri = buildRequestUri(token);
+  const expiresAt = now + ttlMs;
+  const stored = { ...params };
+  stored.client_id = client.clientId;
+  await store.saveRequest({
+    clientId: client.clientId,
+    createdAt: now,
+    expiresAt,
+    params: stored,
+    requestUriHash: await hashToken(requestUri)
+  });
+  return {
+    body: {
+      expires_in: Math.floor(ttlMs / MILLISECONDS_IN_A_SECOND),
+      request_uri: requestUri
+    },
+    ok: true
+  };
+};
+
 // src/oidc/registration.ts
 var REG_TOKEN_BYTES = 32;
 var CLIENT_ID_BYTES = 16;
@@ -4988,6 +5095,7 @@ var oidcProviderRoutes = (config) => {
   const deviceAuthorizationRoute = `${oidcRoute}/device_authorization`;
   const deviceApproveRoute = `${oidcRoute}/device/decision`;
   const endSessionRoute = `${oidcRoute}/end_session`;
+  const parRoute = `${oidcRoute}/par`;
   const registrationRoute = `${oidcRoute}/register`;
   const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
@@ -5024,6 +5132,29 @@ var oidcProviderRoutes = (config) => {
       return;
     return authenticateClient(clientId, clientSecret);
   };
+  const dpopNonceChallenge = async (proof) => {
+    if (proof === undefined || config.dpopNonce === undefined) {
+      return;
+    }
+    const presented = extractDpopNonceClaim(proof);
+    if (presented !== undefined && await verifyDpopNonce({
+      nonce: presented,
+      secret: config.dpopNonce.secret
+    })) {
+      return;
+    }
+    const fresh = await mintDpopNonce({
+      secret: config.dpopNonce.secret
+    });
+    return new Response(JSON.stringify({ error: "use_dpop_nonce" }), {
+      headers: {
+        "content-type": "application/json",
+        "dpop-nonce": fresh,
+        "www-authenticate": 'DPoP error="use_dpop_nonce"'
+      },
+      status: HTTP_UNAUTHORIZED2
+    });
+  };
   const grantAuthorizationCode = async (client, body, dpop) => {
     const {
       code,
@@ -5046,6 +5177,7 @@ var oidcProviderRoutes = (config) => {
       return oauthError2(HTTP_BAD_REQUEST2, "invalid_dpop_proof");
     }
     return tokenResponse(await issueTokenSet({
+      acr: record.acr,
       claims: record.claims,
       clientId: client.clientId,
       config,
@@ -5075,6 +5207,7 @@ var oidcProviderRoutes = (config) => {
       }
     }
     return tokenResponse(await issueTokenSet({
+      acr: record.acr,
       claims: record.claims,
       clientId: client.clientId,
       config,
@@ -5183,6 +5316,13 @@ var oidcProviderRoutes = (config) => {
   if (config.clientRegistrationTokenStore !== undefined) {
     discovery.registration_endpoint = registrationBaseUrl;
   }
+  if (config.pushedAuthorizationRequestStore !== undefined) {
+    discovery.pushed_authorization_request_endpoint = `${issuer}${parRoute}`;
+    discovery.require_pushed_authorization_requests_supported = true;
+  }
+  if (config.acrValuesSupported !== undefined && config.acrValuesSupported.length > 0) {
+    discovery.acr_values_supported = config.acrValuesSupported;
+  }
   const handleEndSession = async ({
     cookie,
     inMemorySession,
@@ -5225,6 +5365,20 @@ var oidcProviderRoutes = (config) => {
     return redirectTo(url.toString());
   };
   return new Elysia15().use(sessionStore()).get(authorizeRoute, async ({ cookie: { user_session_id }, query, request, store }) => {
+    let effectiveQuery = query;
+    if (query.request_uri !== undefined && config.pushedAuthorizationRequestStore !== undefined && query.client_id !== undefined) {
+      const pushed = await consumePushedRequest({
+        clientId: query.client_id,
+        requestUri: query.request_uri,
+        store: config.pushedAuthorizationRequestStore
+      });
+      if (pushed === undefined) {
+        return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
+      }
+      effectiveQuery = pushed;
+    } else if (query.request_uri !== undefined && query.request_uri.startsWith(REQUEST_URI_PREFIX)) {
+      return jsonResponse({ error: "invalid_request_uri" }, HTTP_BAD_REQUEST2);
+    }
     const {
       client_id: clientId,
       code_challenge: codeChallenge,
@@ -5234,7 +5388,7 @@ var oidcProviderRoutes = (config) => {
       response_type: responseType,
       scope,
       state
-    } = query;
+    } = effectiveQuery;
     const client = clientId === undefined ? undefined : await clientStore.findClient(clientId);
     if (client === undefined || redirectUri === undefined || !client.redirectUris.includes(redirectUri)) {
       return jsonResponse({ error: "invalid_client" }, HTTP_BAD_REQUEST2);
@@ -5245,6 +5399,9 @@ var oidcProviderRoutes = (config) => {
         params2.set("state", state);
       return redirectTo(`${redirectUri}?${params2.toString()}`);
     };
+    if (client.requirePushedAuthorizationRequests === true && query.request_uri === undefined) {
+      return errorRedirect("invalid_request");
+    }
     if (responseType !== "code") {
       return errorRedirect("unsupported_response_type");
     }
@@ -5270,8 +5427,17 @@ var oidcProviderRoutes = (config) => {
     });
     if (granted === undefined)
       return errorRedirect("access_denied");
+    const userAcr = config.getAcr?.({
+      scopes: granted,
+      user: userSession.user
+    });
+    const requestedAcr = effectiveQuery.acr_values === undefined || effectiveQuery.acr_values.length === 0 ? undefined : effectiveQuery.acr_values.split(" ").filter((entry) => entry.length > 0);
+    if (requestedAcr !== undefined && (userAcr === undefined || !requestedAcr.includes(userAcr))) {
+      return errorRedirect("insufficient_user_authentication");
+    }
     const code = generateSecureToken(TOKEN_BYTES3);
     await authorizationCodeStore.saveCode({
+      acr: userAcr,
       claims: getClaims?.(userSession.user),
       clientId: client.clientId,
       codeChallenge,
@@ -5292,11 +5458,14 @@ var oidcProviderRoutes = (config) => {
       user_session_id: t12.Optional(userSessionIdTypebox)
     }),
     query: t12.Object({
+      acr_values: t12.Optional(t12.String()),
+      claims: t12.Optional(t12.String()),
       client_id: t12.Optional(t12.String()),
       code_challenge: t12.Optional(t12.String()),
       code_challenge_method: t12.Optional(t12.String()),
       nonce: t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
+      request_uri: t12.Optional(t12.String()),
       response_type: t12.Optional(t12.String()),
       scope: t12.Optional(t12.String()),
       state: t12.Optional(t12.String())
@@ -5314,6 +5483,9 @@ var oidcProviderRoutes = (config) => {
     if (client === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const nonceChallenge = await dpopNonceChallenge(headers.dpop);
+    if (nonceChallenge !== undefined)
+      return nonceChallenge;
     if (body.grant_type === "authorization_code") {
       return grantAuthorizationCode(client, body, headers.dpop);
     }
@@ -5345,6 +5517,52 @@ var oidcProviderRoutes = (config) => {
       subject_token: t12.Optional(t12.String()),
       subject_token_type: t12.Optional(t12.String())
     })
+  }).post(parRoute, async ({ body, headers }) => {
+    if (config.pushedAuthorizationRequestStore === undefined) {
+      return oauthError2(HTTP_NOT_IMPLEMENTED, "unsupported_response_type");
+    }
+    const basic = readBasicAuth2(headers.authorization);
+    const client = await authenticateTokenClient({
+      basicClientId: basic.clientId,
+      basicClientSecret: basic.clientSecret,
+      bodyClientAssertion: body.client_assertion,
+      bodyClientAssertionType: body.client_assertion_type,
+      bodyClientId: body.client_id,
+      bodyClientSecret: body.client_secret
+    });
+    if (client === undefined) {
+      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
+    }
+    const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
+    const params = Object.fromEntries(Object.entries(body).filter((entry) => typeof entry[1] === "string" && !isAuthField(entry[0])));
+    const result = await pushAuthorizationRequest({
+      client,
+      params,
+      store: config.pushedAuthorizationRequestStore,
+      ttlMs: config.pushedAuthorizationRequestTtlMs
+    });
+    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+  }, {
+    body: t12.Object({
+      acr_values: t12.Optional(t12.String()),
+      audience: t12.Optional(t12.String()),
+      claims: t12.Optional(t12.String()),
+      client_assertion: t12.Optional(t12.String()),
+      client_assertion_type: t12.Optional(t12.String()),
+      client_id: t12.Optional(t12.String()),
+      client_secret: t12.Optional(t12.String()),
+      code_challenge: t12.Optional(t12.String()),
+      code_challenge_method: t12.Optional(t12.String()),
+      nonce: t12.Optional(t12.String()),
+      redirect_uri: t12.Optional(t12.String()),
+      resource: t12.Optional(t12.String()),
+      response_type: t12.Optional(t12.String()),
+      scope: t12.Optional(t12.String()),
+      state: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
   }).post(introspectRoute, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
@@ -20756,6 +20974,25 @@ var createInMemoryClientAssertionJtiStore = () => {
     }
   };
 };
+var createInMemoryClientRegistrationTokenStore = () => {
+  const byHash = new Map;
+  return {
+    deleteByClientId: async (clientId) => {
+      for (const [hash, token] of byHash) {
+        if (token.clientId === clientId)
+          byHash.delete(hash);
+      }
+    },
+    findByTokenHash: async (tokenHash) => byHash.get(tokenHash),
+    saveToken: async (token) => {
+      for (const [hash, existing] of byHash) {
+        if (existing.clientId === token.clientId)
+          byHash.delete(hash);
+      }
+      byHash.set(token.tokenHash, { ...token });
+    }
+  };
+};
 var createInMemoryDeviceAuthorizationStore = () => {
   const byDeviceCode = new Map;
   return {
@@ -20783,6 +21020,17 @@ var createInMemoryDeviceAuthorizationStore = () => {
     }
   };
 };
+var createInMemoryInitialAccessTokenStore = (initialHashes = []) => {
+  const remaining = new Set(initialHashes);
+  return {
+    consumeToken: async (tokenHash) => {
+      if (!remaining.has(tokenHash))
+        return false;
+      remaining.delete(tokenHash);
+      return true;
+    }
+  };
+};
 var createInMemoryLogoutDeliveryStore = () => {
   const failures = new Map;
   return {
@@ -20795,36 +21043,6 @@ var createInMemoryLogoutDeliveryStore = () => {
     }
   };
 };
-var createInMemoryClientRegistrationTokenStore = () => {
-  const byHash = new Map;
-  return {
-    deleteByClientId: async (clientId) => {
-      for (const [hash, token] of byHash) {
-        if (token.clientId === clientId)
-          byHash.delete(hash);
-      }
-    },
-    findByTokenHash: async (tokenHash) => byHash.get(tokenHash),
-    saveToken: async (token) => {
-      for (const [hash, existing] of byHash) {
-        if (existing.clientId === token.clientId)
-          byHash.delete(hash);
-      }
-      byHash.set(token.tokenHash, { ...token });
-    }
-  };
-};
-var createInMemoryInitialAccessTokenStore = (initialHashes = []) => {
-  const remaining = new Set(initialHashes);
-  return {
-    consumeToken: async (tokenHash) => {
-      if (!remaining.has(tokenHash))
-        return false;
-      remaining.delete(tokenHash);
-      return true;
-    }
-  };
-};
 var createInMemoryOAuthClientStore = (clients) => {
   const registry = new Map(clients.map((client) => [client.clientId, client]));
   return {
@@ -20865,6 +21083,23 @@ var createInMemoryOidcRefreshTokenStore = () => {
     }
   };
 };
+var createInMemoryPushedAuthorizationRequestStore = () => {
+  const requests = new Map;
+  return {
+    consumeRequest: async (requestUriHash) => {
+      const record = requests.get(requestUriHash);
+      if (record === undefined)
+        return;
+      requests.delete(requestUriHash);
+      if (record.expiresAt < Date.now())
+        return;
+      return record;
+    },
+    saveRequest: async (request) => {
+      requests.set(request.requestUriHash, { ...request });
+    }
+  };
+};
 // src/oidc/postgresStores.ts
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
@@ -20896,6 +21131,7 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
+  acr: varchar("acr", { length: ID_LENGTH7 }),
   claims_json: jsonb("claims_json").$type(),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
   code_challenge: varchar("code_challenge", { length: ID_LENGTH7 }).notNull(),
@@ -20935,7 +21171,17 @@ var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
   logout_token: text("logout_token").notNull(),
   user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
 });
+var oauthPushedAuthorizationRequestsTable = pgTable("auth_oauth_pushed_authorization_requests", {
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  params_json: jsonb("params_json").$type().notNull(),
+  request_uri_hash: varchar("request_uri_hash", {
+    length: ID_LENGTH7
+  }).primaryKey()
+});
 var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
+  acr: varchar("acr", { length: ID_LENGTH7 }),
   claims_json: jsonb("claims_json").$type(),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
@@ -20968,6 +21214,7 @@ var toLogoutDelivery = (row) => ({
   userId: row.user_id
 });
 var toCode = (row) => ({
+  acr: row.acr ?? undefined,
   claims: row.claims_json ?? undefined,
   clientId: row.client_id,
   codeChallenge: row.code_challenge,
@@ -20981,6 +21228,7 @@ var toCode = (row) => ({
   userId: row.user_id
 });
 var toCodeValues = (code) => ({
+  acr: code.acr ?? null,
   claims_json: code.claims ?? null,
   client_id: code.clientId,
   code_challenge: code.codeChallenge,
@@ -21005,6 +21253,7 @@ var toDeviceAuth = (row) => ({
   userSub: row.user_sub ?? undefined
 });
 var toRefresh = (row) => ({
+  acr: row.acr ?? undefined,
   claims: row.claims_json ?? undefined,
   clientId: row.client_id,
   createdAt: row.created_at_ms,
@@ -21015,6 +21264,7 @@ var toRefresh = (row) => ({
   userId: row.user_id
 });
 var toRefreshValues = (token) => ({
+  acr: token.acr ?? null,
   claims_json: token.claims ?? null,
   client_id: token.clientId,
   created_at_ms: token.createdAt,
@@ -21032,6 +21282,7 @@ var createNeonInitialAccessTokenStore = (databaseUrl) => createPostgresInitialAc
 var createNeonLogoutDeliveryStore = (databaseUrl) => createPostgresLogoutDeliveryStore(createNeonDatabase(databaseUrl));
 var createNeonOAuthClientStore = (databaseUrl) => createPostgresOAuthClientStore(createNeonDatabase(databaseUrl));
 var createNeonOidcRefreshTokenStore = (databaseUrl) => createPostgresOidcRefreshTokenStore(createNeonDatabase(databaseUrl));
+var createNeonPushedAuthorizationRequestStore = (databaseUrl) => createPostgresPushedAuthorizationRequestStore(createNeonDatabase(databaseUrl));
 var createPostgresAuthorizationCodeStore = (db) => ({
   consumeCode: async (codeHash) => {
     const [row] = await db.delete(oauthCodesTable).where(eq(oauthCodesTable.code_hash, codeHash)).returning();
@@ -21185,6 +21436,33 @@ var createPostgresOidcRefreshTokenStore = (db) => ({
     await db.insert(oauthRefreshTokensTable).values(toRefreshValues(token));
   }
 });
+var createPostgresPushedAuthorizationRequestStore = (db) => ({
+  consumeRequest: async (requestUriHash) => {
+    const [row] = await db.delete(oauthPushedAuthorizationRequestsTable).where(eq(oauthPushedAuthorizationRequestsTable.request_uri_hash, requestUriHash)).returning();
+    if (!row)
+      return;
+    await db.delete(oauthPushedAuthorizationRequestsTable).where(lt(oauthPushedAuthorizationRequestsTable.expires_at_ms, Date.now()));
+    if (row.expires_at_ms < Date.now())
+      return;
+    const request = {
+      clientId: row.client_id,
+      createdAt: row.created_at_ms,
+      expiresAt: row.expires_at_ms,
+      params: row.params_json,
+      requestUriHash: row.request_uri_hash
+    };
+    return request;
+  },
+  saveRequest: async (request) => {
+    await db.insert(oauthPushedAuthorizationRequestsTable).values({
+      client_id: request.clientId,
+      created_at_ms: request.createdAt,
+      expires_at_ms: request.expiresAt,
+      params_json: request.params,
+      request_uri_hash: request.requestUriHash
+    });
+  }
+});
 // src/adaptive/config.ts
 var DEFAULT_HISTORY_LIMIT = 50;
 var DEFAULT_MAX_TRAVEL_KMH = 900;
@@ -22608,6 +22886,7 @@ export {
   verifyIdTokenHint,
   verifyHcaptcha,
   verifyDpopProof,
+  verifyDpopNonce,
   verifyClientAssertion,
   verifyAuditChain,
   verifyApiKey,
@@ -22658,6 +22937,7 @@ export {
   refreshableProviderOptions,
   recordLoginAttempt,
   readSessionRing,
+  pushAuthorizationRequest,
   providers,
   providerOptions,
   protectRoutePlugin,
@@ -22675,6 +22955,7 @@ export {
   oidcProviderRoutes,
   oidcProviderOptions,
   oauthRefreshTokensTable,
+  oauthPushedAuthorizationRequestsTable,
   oauthLogoutDeliveriesTable,
   oauthInitialAccessTokensTable,
   oauthDeviceAuthorizationsTable,
@@ -22683,6 +22964,7 @@ export {
   oauthClientRegistrationTokensTable,
   oauthClientAssertionJtisTable,
   mintLogoutToken,
+  mintDpopNonce,
   mfaTotpRoutes,
   mfaRoutes,
   mfaEnrollmentsTable,
@@ -22734,6 +23016,7 @@ export {
   fingerprintDevice,
   fanOutBackchannelLogout,
   extractPropFromIdentity,
+  extractDpopNonceClaim,
   exportAuditCsv,
   exchangeToken,
   exchangeDeviceCode,
@@ -22780,6 +23063,7 @@ export {
   createPostgresSetupSessionStore,
   createPostgresScimTokenStore,
   createPostgresRoleStore,
+  createPostgresPushedAuthorizationRequestStore,
   createPostgresPasswordlessTokenStore,
   createPostgresOrganizationStore,
   createPostgresOidcRefreshTokenStore,
@@ -22809,6 +23093,7 @@ export {
   createNeonSetupSessionStore,
   createNeonScimTokenStore,
   createNeonRoleStore,
+  createNeonPushedAuthorizationRequestStore,
   createNeonPasswordlessTokenStore,
   createNeonOrganizationStore,
   createNeonOidcRefreshTokenStore,
@@ -22844,6 +23129,7 @@ export {
   createInMemorySetupSessionStore,
   createInMemoryScimTokenStore,
   createInMemoryRoleStore,
+  createInMemoryPushedAuthorizationRequestStore,
   createInMemoryPasswordlessTokenStore,
   createInMemoryOrganizationStore,
   createInMemoryOidcRefreshTokenStore,
@@ -22875,6 +23161,7 @@ export {
   createAnonymousSession,
   createActionPipeline,
   createAbuseGuard,
+  consumePushedRequest,
   consumeBackupCode,
   constantTimeEqual,
   complianceRoutes,
@@ -22897,6 +23184,7 @@ export {
   accessTokensTable,
   acceptInvitation,
   WEBAUTHN_CHALLENGE_COOKIE,
+  REQUEST_URI_PREFIX,
   DEFAULT_WEBHOOK_TIMEOUT_MS,
   DEFAULT_WEBHOOK_RETRY,
   DEFAULT_WEBAUTHN_SESSION_TTL_MS,
@@ -22913,6 +23201,7 @@ export {
   DEFAULT_PORTAL_ROUTE,
   DEFAULT_PASSWORDLESS_SESSION_TTL_MS,
   DEFAULT_PASSWORDLESS_ROUTE,
+  DEFAULT_PAR_TTL_MS,
   DEFAULT_OWNER_ROLES,
   DEFAULT_OTP_TTL_MS,
   DEFAULT_OTP_LENGTH,
@@ -22928,5 +23217,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=670CF7C3F8CEA35064756E2164756E21
+//# debugId=7EEC3FFFBF5D362764756E2164756E21
 //# sourceMappingURL=index.js.map