@absolutejs/auth 0.37.0 → 0.40.0-beta.0

package/dist/index.js

@@ -16,6 +16,141 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// src/constants.ts
+var SECONDS_IN_A_MINUTE = 60, MILLISECONDS_IN_A_SECOND = 1000, MILLISECONDS_IN_A_MINUTE, MINUTES_IN_AN_HOUR = 60, HOURS_IN_A_DAY = 24, MILLISECONDS_IN_A_DAY, MILLISECONDS_IN_AN_HOUR, COOKIE_MINUTES = 30, COOKIE_DURATION, DEFAULT_MAX_SESSIONS = 1e4;
+var init_constants = __esm(() => {
+  MILLISECONDS_IN_A_MINUTE = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE;
+  MILLISECONDS_IN_A_DAY = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR * HOURS_IN_A_DAY;
+  MILLISECONDS_IN_AN_HOUR = MILLISECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR;
+  COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
+});
+
+// src/crypto.ts
+var exports_crypto = {};
+__export(exports_crypto, {
+  verifyTotp: () => verifyTotp,
+  verifyPassword: () => verifyPassword,
+  hashToken: () => hashToken,
+  hashPassword: () => hashPassword,
+  generateTotpSecret: () => generateTotpSecret,
+  generateTotp: () => generateTotp,
+  generateSecureToken: () => generateSecureToken,
+  generateEncryptionKey: () => generateEncryptionKey,
+  encryptSecret: () => encryptSecret,
+  decryptSecret: () => decryptSecret,
+  createTotpKeyUri: () => createTotpKeyUri,
+  constantTimeEqual: () => constantTimeEqual,
+  base32Encode: () => base32Encode,
+  base32Decode: () => base32Decode
+});
+var DEFAULT_TOKEN_BYTES = 32, AES_KEY_BYTES = 32, AES_IV_BYTES = 12, HOTP_COUNTER_BYTES = 8, TOTP_SECRET_BYTES = 20, TOTP_DIGITS = 6, TOTP_PERIOD_SECONDS = 30, DEFAULT_TOTP_WINDOW = 1, DECIMAL_RADIX = 10, LAST_NIBBLE_MASK = 15, SIGN_BIT_MASK = 2147483647, BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", BASE32_GROUP_BITS = 5, BASE32_MASK = 31, BYTE_BITS = 8, textEncoder, textDecoder, base64UrlEncode = (bytes) => Buffer.from(bytes).toString("base64url"), base64UrlDecode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64url")), sha256 = async (input) => {
+  const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(input));
+  return new Uint8Array(digest);
+}, hmacSha1 = async (key, message) => {
+  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, message);
+  return new Uint8Array(signature);
+}, counterToBytes = (counter) => {
+  const bytes = new Uint8Array(HOTP_COUNTER_BYTES);
+  new DataView(bytes.buffer).setBigUint64(0, BigInt(counter), false);
+  return bytes;
+}, generateHotp = async (secret, counter, digits = TOTP_DIGITS) => {
+  const hmac = await hmacSha1(secret, counterToBytes(counter));
+  const view = new DataView(hmac.buffer, hmac.byteOffset, hmac.byteLength);
+  const offset = view.getUint8(hmac.byteLength - 1) & LAST_NIBBLE_MASK;
+  const truncated = view.getUint32(offset, false) & SIGN_BIT_MASK;
+  const otp = truncated % DECIMAL_RADIX ** digits;
+  return otp.toString().padStart(digits, "0");
+}, importAesKey = (keyMaterial) => crypto.subtle.importKey("raw", base64UrlDecode(keyMaterial), { name: "AES-GCM" }, false, ["decrypt", "encrypt"]), base32Decode = (encoded) => {
+  const normalized = encoded.toUpperCase().replace(/[^A-Z2-7]/gu, "");
+  const bits = [...normalized].map((char) => BASE32_ALPHABET.indexOf(char).toString(2).padStart(BASE32_GROUP_BITS, "0")).join("");
+  const byteChunks = bits.match(/.{8}/gu) ?? [];
+  return new Uint8Array(byteChunks.map((chunk) => parseInt(chunk, 2)));
+}, base32Encode = (bytes) => {
+  const bits = Array.from(bytes, (byte) => byte.toString(2).padStart(BYTE_BITS, "0")).join("");
+  const groups = bits.match(/.{1,5}/gu) ?? [];
+  return groups.map((group) => BASE32_ALPHABET[parseInt(group.padEnd(BASE32_GROUP_BITS, "0"), 2) & BASE32_MASK] ?? "").join("");
+}, constantTimeEqual = async (left, right) => {
+  const [leftDigest, rightDigest] = await Promise.all([
+    sha256(left),
+    sha256(right)
+  ]);
+  const leftView = new DataView(leftDigest.buffer, leftDigest.byteOffset, leftDigest.byteLength);
+  const rightView = new DataView(rightDigest.buffer, rightDigest.byteOffset, rightDigest.byteLength);
+  let mismatch = 0;
+  for (let index = 0;index < leftDigest.byteLength; index += 1) {
+    mismatch |= leftView.getUint8(index) ^ rightView.getUint8(index);
+  }
+  return mismatch === 0;
+}, createTotpKeyUri = ({
+  accountName,
+  digits = TOTP_DIGITS,
+  issuer,
+  period = TOTP_PERIOD_SECONDS,
+  secret
+}) => {
+  const params = new URLSearchParams({
+    algorithm: "SHA1",
+    digits: `${digits}`,
+    issuer,
+    period: `${period}`,
+    secret
+  });
+  const label = encodeURIComponent(`${issuer}:${accountName}`);
+  return `otpauth://totp/${label}?${params.toString()}`;
+}, decryptSecret = async (ciphertext, keyMaterial) => {
+  const key = await importAesKey(keyMaterial);
+  const combined = base64UrlDecode(ciphertext);
+  const nonce = combined.subarray(0, AES_IV_BYTES);
+  const data = combined.subarray(AES_IV_BYTES);
+  const plaintext = await crypto.subtle.decrypt({ iv: nonce, name: "AES-GCM" }, key, data);
+  return textDecoder.decode(plaintext);
+}, encryptSecret = async (plaintext, keyMaterial) => {
+  const key = await importAesKey(keyMaterial);
+  const nonce = new Uint8Array(AES_IV_BYTES);
+  crypto.getRandomValues(nonce);
+  const ciphertext = await crypto.subtle.encrypt({ iv: nonce, name: "AES-GCM" }, key, textEncoder.encode(plaintext));
+  const combined = new Uint8Array(nonce.byteLength + ciphertext.byteLength);
+  combined.set(nonce, 0);
+  combined.set(new Uint8Array(ciphertext), nonce.byteLength);
+  return base64UrlEncode(combined);
+}, generateEncryptionKey = () => generateSecureToken(AES_KEY_BYTES), generateSecureToken = (byteLength = DEFAULT_TOKEN_BYTES) => {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}, generateTotp = async ({
+  digits = TOTP_DIGITS,
+  now = Date.now(),
+  period = TOTP_PERIOD_SECONDS,
+  secret
+}) => {
+  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
+  return generateHotp(base32Decode(secret), counter, digits);
+}, generateTotpSecret = (byteLength = TOTP_SECRET_BYTES) => {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return base32Encode(bytes);
+}, hashPassword = (password) => Bun.password.hash(password, { algorithm: "argon2id" }), hashToken = async (token) => base64UrlEncode(await sha256(token)), verifyPassword = (password, hash) => Bun.password.verify(password, hash), verifyTotp = async ({
+  digits = TOTP_DIGITS,
+  now = Date.now(),
+  period = TOTP_PERIOD_SECONDS,
+  secret,
+  token,
+  window = DEFAULT_TOTP_WINDOW
+}) => {
+  const secretBytes = base32Decode(secret);
+  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
+  const drifts = Array.from({ length: window * 2 + 1 }, (_, offset) => counter - window + offset);
+  const candidates = await Promise.all(drifts.map((value) => generateHotp(secretBytes, value, digits)));
+  const matches = await Promise.all(candidates.map((candidate) => constantTimeEqual(candidate, token)));
+  return matches.includes(true);
+};
+var init_crypto = __esm(() => {
+  init_constants();
+  textEncoder = new TextEncoder;
+  textDecoder = new TextDecoder;
+});
+
 // node_modules/citra/dist/index.js
 var BASE64_BLOCK_SIZE = 4;
 var NUM_GENERATOR_BYTES = 32;
@@ -2537,165 +2672,14 @@ var createOAuth2Client = async (providerName, config) => {
 };
 
 // src/index.ts
-import { Elysia as Elysia36 } from "elysia";
+import { Elysia as Elysia37 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
 
-// src/constants.ts
-var SECONDS_IN_A_MINUTE = 60;
-var MILLISECONDS_IN_A_SECOND = 1000;
-var MILLISECONDS_IN_A_MINUTE = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE;
-var MINUTES_IN_AN_HOUR = 60;
-var HOURS_IN_A_DAY = 24;
-var MILLISECONDS_IN_A_DAY = MILLISECONDS_IN_A_SECOND * SECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR * HOURS_IN_A_DAY;
-var MILLISECONDS_IN_AN_HOUR = MILLISECONDS_IN_A_MINUTE * MINUTES_IN_AN_HOUR;
-var COOKIE_MINUTES = 30;
-var COOKIE_DURATION = SECONDS_IN_A_MINUTE * COOKIE_MINUTES;
-var DEFAULT_MAX_SESSIONS = 1e4;
-
-// src/crypto.ts
-var DEFAULT_TOKEN_BYTES = 32;
-var AES_KEY_BYTES = 32;
-var AES_IV_BYTES = 12;
-var HOTP_COUNTER_BYTES = 8;
-var TOTP_SECRET_BYTES = 20;
-var TOTP_DIGITS = 6;
-var TOTP_PERIOD_SECONDS = 30;
-var DEFAULT_TOTP_WINDOW = 1;
-var DECIMAL_RADIX = 10;
-var LAST_NIBBLE_MASK = 15;
-var SIGN_BIT_MASK = 2147483647;
-var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-var BASE32_GROUP_BITS = 5;
-var BASE32_MASK = 31;
-var BYTE_BITS = 8;
-var textEncoder = new TextEncoder;
-var textDecoder = new TextDecoder;
-var base64UrlEncode = (bytes) => Buffer.from(bytes).toString("base64url");
-var base64UrlDecode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64url"));
-var sha256 = async (input) => {
-  const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(input));
-  return new Uint8Array(digest);
-};
-var hmacSha1 = async (key, message) => {
-  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, message);
-  return new Uint8Array(signature);
-};
-var counterToBytes = (counter) => {
-  const bytes = new Uint8Array(HOTP_COUNTER_BYTES);
-  new DataView(bytes.buffer).setBigUint64(0, BigInt(counter), false);
-  return bytes;
-};
-var generateHotp = async (secret, counter, digits = TOTP_DIGITS) => {
-  const hmac = await hmacSha1(secret, counterToBytes(counter));
-  const view = new DataView(hmac.buffer, hmac.byteOffset, hmac.byteLength);
-  const offset = view.getUint8(hmac.byteLength - 1) & LAST_NIBBLE_MASK;
-  const truncated = view.getUint32(offset, false) & SIGN_BIT_MASK;
-  const otp = truncated % DECIMAL_RADIX ** digits;
-  return otp.toString().padStart(digits, "0");
-};
-var importAesKey = (keyMaterial) => crypto.subtle.importKey("raw", base64UrlDecode(keyMaterial), { name: "AES-GCM" }, false, ["decrypt", "encrypt"]);
-var base32Decode = (encoded) => {
-  const normalized = encoded.toUpperCase().replace(/[^A-Z2-7]/gu, "");
-  const bits = [...normalized].map((char) => BASE32_ALPHABET.indexOf(char).toString(2).padStart(BASE32_GROUP_BITS, "0")).join("");
-  const byteChunks = bits.match(/.{8}/gu) ?? [];
-  return new Uint8Array(byteChunks.map((chunk) => parseInt(chunk, 2)));
-};
-var base32Encode = (bytes) => {
-  const bits = Array.from(bytes, (byte) => byte.toString(2).padStart(BYTE_BITS, "0")).join("");
-  const groups = bits.match(/.{1,5}/gu) ?? [];
-  return groups.map((group) => BASE32_ALPHABET[parseInt(group.padEnd(BASE32_GROUP_BITS, "0"), 2) & BASE32_MASK] ?? "").join("");
-};
-var constantTimeEqual = async (left, right) => {
-  const [leftDigest, rightDigest] = await Promise.all([
-    sha256(left),
-    sha256(right)
-  ]);
-  const leftView = new DataView(leftDigest.buffer, leftDigest.byteOffset, leftDigest.byteLength);
-  const rightView = new DataView(rightDigest.buffer, rightDigest.byteOffset, rightDigest.byteLength);
-  let mismatch = 0;
-  for (let index = 0;index < leftDigest.byteLength; index += 1) {
-    mismatch |= leftView.getUint8(index) ^ rightView.getUint8(index);
-  }
-  return mismatch === 0;
-};
-var createTotpKeyUri = ({
-  accountName,
-  digits = TOTP_DIGITS,
-  issuer,
-  period = TOTP_PERIOD_SECONDS,
-  secret
-}) => {
-  const params = new URLSearchParams({
-    algorithm: "SHA1",
-    digits: `${digits}`,
-    issuer,
-    period: `${period}`,
-    secret
-  });
-  const label = encodeURIComponent(`${issuer}:${accountName}`);
-  return `otpauth://totp/${label}?${params.toString()}`;
-};
-var decryptSecret = async (ciphertext, keyMaterial) => {
-  const key = await importAesKey(keyMaterial);
-  const combined = base64UrlDecode(ciphertext);
-  const nonce = combined.subarray(0, AES_IV_BYTES);
-  const data = combined.subarray(AES_IV_BYTES);
-  const plaintext = await crypto.subtle.decrypt({ iv: nonce, name: "AES-GCM" }, key, data);
-  return textDecoder.decode(plaintext);
-};
-var encryptSecret = async (plaintext, keyMaterial) => {
-  const key = await importAesKey(keyMaterial);
-  const nonce = new Uint8Array(AES_IV_BYTES);
-  crypto.getRandomValues(nonce);
-  const ciphertext = await crypto.subtle.encrypt({ iv: nonce, name: "AES-GCM" }, key, textEncoder.encode(plaintext));
-  const combined = new Uint8Array(nonce.byteLength + ciphertext.byteLength);
-  combined.set(nonce, 0);
-  combined.set(new Uint8Array(ciphertext), nonce.byteLength);
-  return base64UrlEncode(combined);
-};
-var generateEncryptionKey = () => generateSecureToken(AES_KEY_BYTES);
-var generateSecureToken = (byteLength = DEFAULT_TOKEN_BYTES) => {
-  const bytes = new Uint8Array(byteLength);
-  crypto.getRandomValues(bytes);
-  return base64UrlEncode(bytes);
-};
-var generateTotp = async ({
-  digits = TOTP_DIGITS,
-  now = Date.now(),
-  period = TOTP_PERIOD_SECONDS,
-  secret
-}) => {
-  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
-  return generateHotp(base32Decode(secret), counter, digits);
-};
-var generateTotpSecret = (byteLength = TOTP_SECRET_BYTES) => {
-  const bytes = new Uint8Array(byteLength);
-  crypto.getRandomValues(bytes);
-  return base32Encode(bytes);
-};
-var hashPassword = (password) => Bun.password.hash(password, { algorithm: "argon2id" });
-var hashToken = async (token) => base64UrlEncode(await sha256(token));
-var verifyPassword = (password, hash) => Bun.password.verify(password, hash);
-var verifyTotp = async ({
-  digits = TOTP_DIGITS,
-  now = Date.now(),
-  period = TOTP_PERIOD_SECONDS,
-  secret,
-  token,
-  window = DEFAULT_TOTP_WINDOW
-}) => {
-  const secretBytes = base32Decode(secret);
-  const counter = Math.floor(now / MILLISECONDS_IN_A_SECOND / period);
-  const drifts = Array.from({ length: window * 2 + 1 }, (_, offset) => counter - window + offset);
-  const candidates = await Promise.all(drifts.map((value) => generateHotp(secretBytes, value, digits)));
-  const matches = await Promise.all(candidates.map((candidate) => constantTimeEqual(candidate, token)));
-  return matches.includes(true);
-};
-
 // src/apikeys/config.ts
+init_constants();
+init_crypto();
 var DEFAULT_TOKEN_ROUTE = "/oauth2/token";
 var ACCESS_TOKEN_PREFIX = "at_";
 var API_KEY_PREFIX = "sk_";
@@ -3202,6 +3186,7 @@ var protectPermissionPlugin = ({
 import { Elysia as Elysia4, t as t4 } from "elysia";
 
 // src/utils.ts
+init_constants();
 var defineAuthConfig = (configuration) => configuration;
 var defineAuthHtmxConfig = (htmxConfig) => htmxConfig;
 var defineAuthSettings = (settings) => settings;
@@ -3542,9 +3527,11 @@ var complianceRoutes = ({
 import { Elysia as Elysia9 } from "elysia";
 
 // src/credentials/emailVerification.ts
+init_crypto();
 import { Elysia as Elysia5, t as t5 } from "elysia";
 
 // src/credentials/config.ts
+init_constants();
 var DEFAULT_CREDENTIAL_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY;
 var DEFAULT_RESET_TOKEN_TTL_MS = MILLISECONDS_IN_AN_HOUR;
 var DEFAULT_VERIFICATION_TOKEN_TTL_MS = MILLISECONDS_IN_A_DAY;
@@ -3586,9 +3573,12 @@ var credentialsEmailVerification = ({
 }, { body: t5.Object({ email: t5.String() }) });
 
 // src/credentials/login.ts
+init_constants();
+init_crypto();
 import { Elysia as Elysia6, t as t6 } from "elysia";
 
 // src/credentials/import.ts
+init_crypto();
 var normalizeEmail = (email) => email.trim().toLowerCase();
 var buildCredential = (email, emailVerified, passwordHash, userId) => ({
   createdAt: Date.now(),
@@ -3866,6 +3856,7 @@ var credentialsLogin = ({
 });
 
 // src/credentials/passwordReset.ts
+init_crypto();
 import { Elysia as Elysia7, t as t7 } from "elysia";
 var credentialsPasswordReset = ({
   credentialStore,
@@ -3924,6 +3915,7 @@ var credentialsPasswordReset = ({
 });
 
 // src/credentials/register.ts
+init_crypto();
 import { Elysia as Elysia8, t as t8 } from "elysia";
 var credentialsRegister = ({
   authSessionStore,
@@ -4201,6 +4193,7 @@ var createAuthHtmxRoutes = (config) => {
 };
 
 // src/lockout/config.ts
+init_constants();
 var DEFAULT_MAX_ATTEMPTS = 5;
 var LOCKOUT_WINDOW_MINUTES = 15;
 var DEFAULT_WINDOW_MS = MILLISECONDS_IN_A_MINUTE * LOCKOUT_WINDOW_MINUTES;
@@ -4237,9 +4230,11 @@ var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(a
 import { Elysia as Elysia14 } from "elysia";
 
 // src/mfa/challenge.ts
+init_crypto();
 import { Elysia as Elysia12, t as t10 } from "elysia";
 
 // src/mfa/backupCodes.ts
+init_crypto();
 var BACKUP_CODE_BYTES = 8;
 var consumeBackupCode = async (code, hashes) => {
   const codeHash = await hashToken(code);
@@ -4255,11 +4250,13 @@ var generateBackupCodes = async (count) => {
 };
 
 // src/mfa/config.ts
+init_constants();
 var DEFAULT_BACKUP_CODE_COUNT = 10;
 var DEFAULT_MFA_ISSUER = "AbsoluteAuth";
 var DEFAULT_MFA_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY;
 
 // src/mfa/secret.ts
+init_crypto();
 var decryptTotpSecret = (ciphertext, encryptionKey) => encryptionKey ? decryptSecret(ciphertext, encryptionKey) : Promise.resolve(ciphertext);
 var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret(secret, encryptionKey) : Promise.resolve(secret);
 
@@ -4337,6 +4334,7 @@ var mfaChallenge = ({
 });
 
 // src/mfa/totp.ts
+init_crypto();
 import { Elysia as Elysia13, t as t11 } from "elysia";
 var mfaTotpRoutes = ({
   authSessionStore,
@@ -4423,8 +4421,14 @@ var mfaTotpRoutes = ({
 var mfaRoutes = (config) => new Elysia14().use(mfaTotpRoutes(config)).use(mfaChallenge(config));
 
 // src/oidc/routes.ts
+init_constants();
+init_crypto();
 import { Elysia as Elysia15, t as t12 } from "elysia";
 
+// src/oidc/config.ts
+init_constants();
+init_crypto();
+
 // src/oidc/keys.ts
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
@@ -4939,6 +4943,7 @@ var exchangeBackchannelAuth = async ({
 };
 
 // src/oidc/clientAuth.ts
+init_constants();
 var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 var MAX_ASSERTION_LIFETIME_MINUTES = 5;
 var SECONDS_PER_MINUTE = 60;
@@ -5047,6 +5052,329 @@ var verifyJwtSignedByClient = ({
   client
 }) => verifyJwtSignedByClientImpl(client, jwt);
 
+// src/oidc/vci.ts
+init_crypto();
+
+// src/vc/sdJwt.ts
+var SALT_BYTES = 16;
+var SD_ALG = "sha-256";
+var toBase64Url2 = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
+var fromBase64Url2 = (value) => new Uint8Array(Buffer.from(value, "base64url"));
+var randomSalt = () => {
+  const bytes = new Uint8Array(SALT_BYTES);
+  crypto.getRandomValues(bytes);
+  return toBase64Url2(bytes);
+};
+var sha2562 = async (input) => {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  return toBase64Url2(digest);
+};
+var encodeDisclosure = (claimName, claimValue) => {
+  const salt = randomSalt();
+  const tuple = JSON.stringify([salt, claimName, claimValue]);
+  const encoded = Buffer.from(tuple).toString("base64url");
+  return { claimName, claimValue, encoded, salt };
+};
+var issueSdJwtVc = async (input) => {
+  const disclosures = Object.entries(input.selective).map(([name, value]) => encodeDisclosure(name, value));
+  const sdDigests = await Promise.all(disclosures.map((disclosure) => sha2562(disclosure.encoded)));
+  const payload = {
+    ...input.base,
+    _sd: sdDigests,
+    _sd_alg: SD_ALG
+  };
+  if (input.holderJwk !== undefined)
+    payload.cnf = { jwk: input.holderJwk };
+  const jwt = await signJwt(payload, input.signingKey);
+  const tail = disclosures.map((disclosure) => disclosure.encoded).join("~");
+  return `${jwt}~${tail}~`;
+};
+var parseSdJwtVc = (token) => {
+  const segments = token.split("~");
+  const jwt = segments[0] ?? "";
+  const tail = segments.slice(1);
+  const last = tail[tail.length - 1];
+  const hasKeyBinding = last !== undefined && last !== "";
+  const keyBindingJwt = hasKeyBinding ? last : undefined;
+  const disclosureCount = hasKeyBinding ? tail.length - 1 : tail.length - 1;
+  const disclosures = tail.slice(0, disclosureCount).filter((entry) => entry !== "");
+  return { disclosures, jwt, keyBindingJwt };
+};
+var presentSdJwtVc = (parsed, selectedClaims, keyBindingJwt) => {
+  const selectedSet = new Set(selectedClaims);
+  const kept = parsed.disclosures.filter((encoded) => {
+    const tuple = decodeDisclosure(encoded);
+    return tuple !== undefined && selectedSet.has(tuple.claimName);
+  });
+  const tail = kept.join("~");
+  const suffix = keyBindingJwt === undefined ? "" : keyBindingJwt;
+  return `${parsed.jwt}~${tail}~${suffix}`;
+};
+var DISCLOSURE_TUPLE_LENGTH = 3;
+var decodeDisclosure = (encoded) => {
+  try {
+    const raw = Buffer.from(encoded, "base64url").toString("utf8");
+    const tuple = JSON.parse(raw);
+    if (!Array.isArray(tuple) || tuple.length !== DISCLOSURE_TUPLE_LENGTH) {
+      return;
+    }
+    const [salt, claimName, claimValue] = tuple;
+    if (typeof salt !== "string" || typeof claimName !== "string") {
+      return;
+    }
+    const decoded = { claimName, claimValue, encoded, salt };
+    return decoded;
+  } catch {
+    return;
+  }
+};
+var verifySdJwtVc = async (input) => {
+  const parsed = parseSdJwtVc(input.token);
+  const decoded = await verifyJwt(parsed.jwt, input.issuerPublicJwk);
+  if (decoded === undefined)
+    return;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return;
+  const payload = { ...rawPayload };
+  const sdArray = payload._sd;
+  const sdAlg = payload._sd_alg;
+  if (!Array.isArray(sdArray) || sdAlg !== SD_ALG)
+    return;
+  const acceptedHashes = new Set(sdArray.filter((entry) => typeof entry === "string"));
+  const disclosedClaims = {};
+  for (const encoded of parsed.disclosures) {
+    const hash = await sha2562(encoded);
+    if (!acceptedHashes.has(hash))
+      return;
+    const tuple = decodeDisclosure(encoded);
+    if (tuple === undefined)
+      return;
+    disclosedClaims[tuple.claimName] = tuple.claimValue;
+  }
+  const protectedClaims = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "_sd" || key === "_sd_alg" || key === "cnf")
+      continue;
+    protectedClaims[key] = value;
+  }
+  const cnf = extractCnf(payload.cnf);
+  const result = {
+    cnf,
+    disclosedClaims,
+    keyBindingJwt: parsed.keyBindingJwt,
+    protectedClaims
+  };
+  return result;
+};
+var extractCnf = (value) => {
+  if (typeof value !== "object" || value === null)
+    return;
+  const jwk = Reflect.get(value, "jwk");
+  if (typeof jwk !== "object" || jwk === null)
+    return;
+  const candidate = jwk;
+  const narrowed = {
+    crv: typeof candidate.crv === "string" ? candidate.crv : undefined,
+    kty: typeof candidate.kty === "string" ? candidate.kty : undefined,
+    x: typeof candidate.x === "string" ? candidate.x : undefined,
+    y: typeof candidate.y === "string" ? candidate.y : undefined
+  };
+  return { jwk: narrowed };
+};
+
+// src/oidc/vci.ts
+var PRE_AUTHORIZED_CODE_GRANT = "urn:ietf:params:oauth:grant-type:pre-authorized_code";
+var MS_PER_SECOND2 = 1000;
+var DEFAULT_OFFER_TTL_MS = 600000;
+var DEFAULT_ACCESS_TTL_MS = 600000;
+var DEFAULT_NONCE_TTL_MS = 300000;
+var PRE_AUTH_CODE_BYTES = 32;
+var C_NONCE_BYTES = 16;
+var DEFAULT_VCI_ROUTE = "/vci";
+var nowSeconds2 = (timeMs) => Math.floor(timeMs / MS_PER_SECOND2);
+var createCredentialOffer = async ({
+  clientId,
+  configurationId,
+  now = Date.now(),
+  store,
+  ttlMs = DEFAULT_OFFER_TTL_MS,
+  userId
+}) => {
+  const preAuthorizedCode = generateSecureToken(PRE_AUTH_CODE_BYTES);
+  const preAuthorizedCodeHash = await hashToken(preAuthorizedCode);
+  const offer = {
+    clientId,
+    configurationId,
+    createdAt: now,
+    expiresAt: now + ttlMs,
+    preAuthorizedCodeHash,
+    redeemed: false,
+    userId
+  };
+  await store.saveOffer(offer);
+  return { offer, preAuthorizedCode };
+};
+var exchangePreAuthorizedCode = async ({
+  config,
+  issuer,
+  now = Date.now(),
+  preAuthorizedCode,
+  signingKey
+}) => {
+  const failFor = (error) => {
+    const failure = { error, ok: false };
+    return failure;
+  };
+  const hash = await hashToken(preAuthorizedCode);
+  const offer = await config.credentialOfferStore.consumeOffer(hash);
+  if (offer === undefined || offer.redeemed)
+    return failFor("invalid_grant");
+  if (offer.expiresAt < now)
+    return failFor("expired_token");
+  const ttlMs = config.accessTokenTtlMs ?? DEFAULT_ACCESS_TTL_MS;
+  const accessToken = await signJwt({
+    aud: issuer,
+    exp: nowSeconds2(now + ttlMs),
+    iat: nowSeconds2(now),
+    iss: issuer,
+    scope: `openid_credential:${offer.configurationId}`,
+    sub: offer.userId,
+    vci_configuration_id: offer.configurationId
+  }, signingKey);
+  const result = {
+    access_token: accessToken,
+    expires_in: Math.floor(ttlMs / MS_PER_SECOND2),
+    ok: true,
+    token_type: "Bearer"
+  };
+  if (config.credentialNonceStore !== undefined) {
+    const nonce = generateSecureToken(C_NONCE_BYTES);
+    const nonceTtlMs = config.nonceTtlMs ?? DEFAULT_NONCE_TTL_MS;
+    await config.credentialNonceStore.saveNonce({
+      expiresAt: now + nonceTtlMs,
+      nonceHash: await hashToken(nonce)
+    });
+    result.c_nonce = nonce;
+    result.c_nonce_expires_in = Math.floor(nonceTtlMs / MS_PER_SECOND2);
+  }
+  return result;
+};
+var decodeJwtHeader = (jwt) => {
+  const [header] = jwt.split(".");
+  if (header === undefined)
+    return;
+  try {
+    const decoded = JSON.parse(Buffer.from(header, "base64url").toString("utf8"));
+    if (typeof decoded !== "object" || decoded === null)
+      return;
+    return decoded;
+  } catch {
+    return;
+  }
+};
+var extractHolderJwk = (proofJwt) => {
+  const header = decodeJwtHeader(proofJwt);
+  if (header === undefined)
+    return;
+  const jwk = Reflect.get(header, "jwk");
+  if (typeof jwk !== "object" || jwk === null)
+    return;
+  const candidate = jwk;
+  return {
+    crv: typeof candidate.crv === "string" ? candidate.crv : undefined,
+    kty: typeof candidate.kty === "string" ? candidate.kty : undefined,
+    x: typeof candidate.x === "string" ? candidate.x : undefined,
+    y: typeof candidate.y === "string" ? candidate.y : undefined
+  };
+};
+var buildIssuerMetadata = ({
+  config,
+  issuer,
+  vciRoute
+}) => ({
+  credential_configurations_supported: Object.fromEntries(config.credentialConfigurations.map((configuration) => [
+    configuration.id,
+    {
+      claims: configuration.claims,
+      credential_signing_alg_values_supported: ["ES256"],
+      cryptographic_binding_methods_supported: ["jwk"],
+      display: configuration.display,
+      format: configuration.format,
+      order: configuration.order,
+      proof_types_supported: { jwt: { proof_signing_alg_values_supported: ["ES256"] } },
+      vct: configuration.vct
+    }
+  ])),
+  credential_endpoint: `${issuer}${vciRoute}/credential`,
+  credential_issuer: issuer,
+  nonce_endpoint: config.credentialNonceStore === undefined ? undefined : `${issuer}${vciRoute}/nonce`,
+  token_endpoint: `${issuer}/oauth2/token`
+});
+var issueOk = (credential) => {
+  const success = {
+    credential,
+    format: "vc+sd-jwt",
+    ok: true
+  };
+  return success;
+};
+var issueFail = (error) => {
+  const failure = { error, ok: false };
+  return failure;
+};
+var issueCredential = async ({
+  config,
+  input,
+  issuer,
+  now = Date.now(),
+  signingKey
+}) => {
+  const requested = input.requestedFormat ?? "vc+sd-jwt";
+  if (requested !== "vc+sd-jwt")
+    return issueFail("unsupported_credential_format");
+  const decoded = await verifyJwt(input.accessToken, signingKey.publicJwk);
+  if (decoded === undefined)
+    return issueFail("invalid_token");
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null) {
+    return issueFail("invalid_token");
+  }
+  const payload = { ...rawPayload };
+  if (typeof payload.exp === "number" && payload.exp * MS_PER_SECOND2 < now) {
+    return issueFail("invalid_token");
+  }
+  const userId = payload.sub;
+  const configurationId = payload.vci_configuration_id;
+  if (typeof userId !== "string" || typeof configurationId !== "string") {
+    return issueFail("invalid_token");
+  }
+  const configuration = config.credentialConfigurations.find((entry) => entry.id === configurationId);
+  if (configuration === undefined)
+    return issueFail("invalid_credential_request");
+  const holderJwk = input.proofJwt === undefined ? undefined : extractHolderJwk(input.proofJwt);
+  if (input.proofJwt !== undefined && holderJwk === undefined) {
+    return issueFail("invalid_proof");
+  }
+  const selective = await config.resolveCredentialClaims({
+    configurationId,
+    userId
+  });
+  const protectedClaims = config.resolveProtectedClaims ? await config.resolveProtectedClaims({ configurationId, userId }) : {};
+  const credential = await issueSdJwtVc({
+    base: {
+      iat: nowSeconds2(now),
+      iss: issuer,
+      ...protectedClaims,
+      vct: configuration.vct
+    },
+    holderJwk,
+    selective,
+    signingKey
+  });
+  return issueOk(credential);
+};
+
 // src/oidc/mtls.ts
 var RFC9440_HEADER = "client-cert";
 var SF_BINARY_PREFIX = ":";
@@ -5097,6 +5425,7 @@ var verifyCertificateBoundToken = async ({
 };
 
 // src/oidc/dpop.ts
+init_constants();
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
 var NONCE_WINDOW_SECONDS = 120;
@@ -5180,6 +5509,7 @@ var verifyDpopProof = async ({
 };
 
 // src/oidc/logout.ts
+init_constants();
 var BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
 var buildLogoutClaims = ({
   clientId,
@@ -5312,7 +5642,7 @@ var fanOutBackchannelLogout = async ({
 };
 
 // src/oidc/jar.ts
-var MS_PER_SECOND2 = 1000;
+var MS_PER_SECOND3 = 1000;
 var numberClaim = (value) => typeof value === "number" ? value : undefined;
 var stringClaim = (value) => typeof value === "string" ? value : undefined;
 var arrayClaim = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
@@ -5337,7 +5667,7 @@ var parseSignedRequestObject = async ({
   if (!audMatches) {
     return { error: "invalid_request_object", ok: false };
   }
-  if (exp !== undefined && exp * MS_PER_SECOND2 <= now) {
+  if (exp !== undefined && exp * MS_PER_SECOND3 <= now) {
     return { error: "invalid_request_object", ok: false };
   }
   const envelope = new Set(["aud", "exp", "iat", "iss", "jti", "nbf"]);
@@ -5346,6 +5676,8 @@ var parseSignedRequestObject = async ({
 };
 
 // src/oidc/par.ts
+init_constants();
+init_crypto();
 var REQUEST_URI_BYTES = 32;
 var DEFAULT_PAR_TTL_SECONDS = 90;
 var DEFAULT_PAR_TTL_MS = DEFAULT_PAR_TTL_SECONDS * MILLISECONDS_IN_A_SECOND;
@@ -5455,6 +5787,7 @@ var fetchUserInfo = async ({
 var userInfoChallengeHeader = (error) => `Bearer realm="userinfo", error="${error}"`;
 
 // src/oidc/registration.ts
+init_crypto();
 var REG_TOKEN_BYTES = 32;
 var CLIENT_ID_BYTES = 16;
 var mintRegistrationToken = async (clientId) => {
@@ -5976,6 +6309,9 @@ var oidcProviderRoutes = (config) => {
   if (config.backchannelAuthStore) {
     grantTypes.push(CIBA_GRANT_TYPE);
   }
+  if (config.vciConfig !== undefined) {
+    grantTypes.push(PRE_AUTHORIZED_CODE_GRANT);
+  }
   const discovery = {
     authorization_endpoint: `${issuer}${authorizeRoute}`,
     backchannel_logout_session_supported: false,
@@ -6209,6 +6545,27 @@ var oidcProviderRoutes = (config) => {
       state: t12.Optional(t12.String())
     })
   }).post(tokenRoute, async ({ body, headers, request }) => {
+    if (body.grant_type === PRE_AUTHORIZED_CODE_GRANT && config.vciConfig !== undefined) {
+      const preAuthorizedCode = body["pre-authorized_code"];
+      if (typeof preAuthorizedCode !== "string") {
+        return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
+      }
+      const result = await exchangePreAuthorizedCode({
+        config: config.vciConfig,
+        issuer: config.issuer,
+        preAuthorizedCode,
+        signingKey: config.vciConfig.signingKey ?? config.signingKey
+      });
+      if (!result.ok)
+        return oauthError2(HTTP_BAD_REQUEST2, result.error);
+      return jsonResponse({
+        access_token: result.access_token,
+        c_nonce: result.c_nonce,
+        c_nonce_expires_in: result.c_nonce_expires_in,
+        expires_in: result.expires_in,
+        token_type: result.token_type
+      }, HTTP_OK2);
+    }
     const basic = readBasicAuth2(headers.authorization);
     const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
@@ -6254,6 +6611,7 @@ var oidcProviderRoutes = (config) => {
       code_verifier: t12.Optional(t12.String()),
       device_code: t12.Optional(t12.String()),
       grant_type: t12.Optional(t12.String()),
+      "pre-authorized_code": t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
       refresh_token: t12.Optional(t12.String()),
       resource: t12.Optional(t12.String()),
@@ -6638,12 +6996,14 @@ var oidcProviderRoutes = (config) => {
 import { Elysia as Elysia16, t as t13 } from "elysia";
 
 // src/organizations/config.ts
+init_constants();
 var INVITATION_TTL_DAYS = 7;
 var DEFAULT_INVITATION_TTL_MS = MILLISECONDS_IN_A_DAY * INVITATION_TTL_DAYS;
 var DEFAULT_ORGANIZATIONS_ROUTE = "/auth/organizations";
 var DEFAULT_OWNER_ROLES = ["owner"];
 
 // src/organizations/operations.ts
+init_crypto();
 var acceptInvitation = async ({
   organizationStore,
   token,
@@ -6996,9 +7356,11 @@ var organizationRoutes = ({
 };
 
 // src/passwordless/routes.ts
+init_crypto();
 import { Elysia as Elysia17, t as t14 } from "elysia";
 
 // src/passwordless/config.ts
+init_constants();
 var SECONDS_IN_TEN_MINUTES = 600;
 var DEFAULT_OTP_DIGITS = 6;
 var DEFAULT_MAGIC_LINK_TTL_MS = MILLISECONDS_IN_A_SECOND * SECONDS_IN_TEN_MINUTES;
@@ -7132,6 +7494,7 @@ var passwordlessRoutes = ({
 import { Elysia as Elysia18, t as t15 } from "elysia";
 
 // src/scim/config.ts
+init_crypto();
 var DEFAULT_SCIM_ROUTE = "/scim/v2";
 var SCIM_TOKEN_BYTES = 32;
 var BEARER_PREFIX3 = "Bearer ";
@@ -7158,15 +7521,18 @@ var resolveScimOrganization = async (scimTokenStore, authorization) => {
 };
 
 // src/sso/config.ts
+init_constants();
 var DEFAULT_SSO_ROUTE = "/sso";
 var DEFAULT_SSO_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY;
 
 // src/portal/config.ts
+init_constants();
 var SETUP_TTL_DAYS = 3;
 var DEFAULT_PORTAL_ROUTE = "/auth/portal";
 var DEFAULT_SETUP_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY * SETUP_TTL_DAYS;
 
 // src/portal/operations.ts
+init_crypto();
 var BEARER_PREFIX4 = "Bearer ";
 var createSetupSession = async ({
   capabilities,
@@ -7593,6 +7959,7 @@ var resolveProviderClientConfiguration = ({
 };
 
 // src/routes/authorize.ts
+init_constants();
 import { Elysia as Elysia20, t as t17 } from "elysia";
 var parseReferer = (headerReferer) => {
   if (!headerReferer)
@@ -7968,6 +8335,7 @@ var profile = ({
 });
 
 // src/routes/refresh.ts
+init_constants();
 import { Elysia as Elysia23, t as t20 } from "elysia";
 var refresh = ({
   authSessionStore,
@@ -8315,10 +8683,26 @@ var GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
 var LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
 var ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 var SPC_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+var RESOURCE_TYPE_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
 var SCIM_CONTENT_TYPE = "application/scim+json";
 var FILTER_MAX_RESULTS = 200;
 var FILTER_PATTERN = /^\s*(\w[\w.]*)\s+eq\s+"([^"]*)"\s*$/u;
-var toUserResource = (user, location) => {
+var mergeCustomSchemas = (resource, custom, map) => {
+  if (custom === undefined || map === undefined)
+    return;
+  const extra = map.toScim(custom);
+  for (const [key, value] of Object.entries(extra)) {
+    resource[key] = value;
+  }
+  const extraSchemas = (map.schemas ?? []).map((schema) => schema.id);
+  if (extraSchemas.length === 0)
+    return;
+  const { schemas } = resource;
+  if (Array.isArray(schemas)) {
+    resource.schemas = [...schemas, ...extraSchemas];
+  }
+};
+var toUserResource = (user, location, map) => {
   const resource = {
     active: user.active,
     id: user.id,
@@ -8339,6 +8723,7 @@ var toUserResource = (user, location) => {
   if (user.email !== undefined) {
     resource.emails = [{ primary: true, value: user.email }];
   }
+  mergeCustomSchemas(resource, user.custom, map);
   return resource;
 };
 var stringField = (source, field) => {
@@ -8353,7 +8738,7 @@ var primaryEmail = (emails) => {
   const flagged = emails.find((entry) => typeof entry === "object" && entry !== null && Reflect.get(entry, "primary") === true);
   return stringField(flagged ?? emails[0], "value");
 };
-var parseUserInput = (body) => {
+var parseUserInput = (body, map) => {
   if (typeof body !== "object" || body === null)
     return;
   const userName = stringField(body, "userName");
@@ -8361,8 +8746,14 @@ var parseUserInput = (body) => {
     return;
   const active = Reflect.get(body, "active");
   const name = Reflect.get(body, "name");
+  const bodyRecord = {};
+  for (const key of Object.keys(body)) {
+    bodyRecord[key] = Reflect.get(body, key);
+  }
+  const custom = map === undefined ? undefined : map.fromScim(bodyRecord);
   return {
     active: typeof active === "boolean" ? active : true,
+    custom,
     displayName: stringField(body, "displayName"),
     email: primaryEmail(Reflect.get(body, "emails")),
     externalId: stringField(body, "externalId"),
@@ -8423,6 +8814,7 @@ var applyOperation = (target, operation) => {
 var applyPatch = (user, body) => {
   const next = {
     active: user.active,
+    custom: user.custom,
     displayName: user.displayName,
     email: user.email,
     externalId: user.externalId,
@@ -8468,6 +8860,15 @@ var scimJson = (resource, httpStatus) => new Response(JSON.stringify(resource),
   status: httpStatus
 });
 var serviceProviderConfig = (location) => ({
+  authenticationSchemes: [
+    {
+      description: "Authentication scheme using the OAuth Bearer Token Standard",
+      name: "OAuth Bearer Token",
+      primary: true,
+      specUri: "https://www.rfc-editor.org/info/rfc6750",
+      type: "oauthbearertoken"
+    }
+  ],
   bulk: { maxOperations: 0, maxPayloadSize: 0, supported: false },
   changePassword: { supported: false },
   etag: { supported: false },
@@ -8477,6 +8878,111 @@ var serviceProviderConfig = (location) => ({
   schemas: [SPC_SCHEMA],
   sort: { supported: false }
 });
+var CORE_USER_ATTRIBUTES = [
+  { multiValued: false, name: "userName", required: true, type: "string" },
+  { multiValued: false, name: "active", required: false, type: "boolean" },
+  { multiValued: false, name: "displayName", required: false, type: "string" },
+  { multiValued: false, name: "externalId", required: false, type: "string" },
+  {
+    multiValued: false,
+    name: "name",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "givenName", required: false, type: "string" },
+      { multiValued: false, name: "familyName", required: false, type: "string" }
+    ],
+    type: "complex"
+  },
+  {
+    multiValued: true,
+    name: "emails",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "value", required: false, type: "string" },
+      { multiValued: false, name: "primary", required: false, type: "boolean" }
+    ],
+    type: "complex"
+  }
+];
+var CORE_GROUP_ATTRIBUTES = [
+  { multiValued: false, name: "displayName", required: true, type: "string" },
+  { multiValued: false, name: "externalId", required: false, type: "string" },
+  {
+    multiValued: true,
+    name: "members",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "value", required: false, type: "string" },
+      { multiValued: false, name: "display", required: false, type: "string" }
+    ],
+    type: "complex"
+  }
+];
+var CORE_USER_SCHEMA = {
+  attributes: CORE_USER_ATTRIBUTES,
+  description: "User Account",
+  id: USER_SCHEMA,
+  name: "User"
+};
+var CORE_GROUP_SCHEMA = {
+  attributes: CORE_GROUP_ATTRIBUTES,
+  description: "Group",
+  id: GROUP_SCHEMA,
+  name: "Group"
+};
+var schemaResource = (schema, location) => ({
+  attributes: schema.attributes,
+  description: schema.description ?? schema.name,
+  id: schema.id,
+  meta: { location, resourceType: "Schema" },
+  name: schema.name
+});
+var schemaList = (location, extras = []) => {
+  const all = [CORE_USER_SCHEMA, CORE_GROUP_SCHEMA, ...extras];
+  const resources = all.map((schema) => schemaResource(schema, `${location}/${schema.id}`));
+  return listResponse(resources);
+};
+var schemaOne = (location, id, extras = []) => {
+  const all = [CORE_USER_SCHEMA, CORE_GROUP_SCHEMA, ...extras];
+  const found = all.find((schema) => schema.id === id);
+  if (found === undefined)
+    return;
+  return schemaResource(found, location);
+};
+var resourceTypeUser = (location, usersEndpoint, extensionSchemaIds) => ({
+  description: "User Account",
+  endpoint: usersEndpoint,
+  id: "User",
+  meta: { location, resourceType: "ResourceType" },
+  name: "User",
+  schema: USER_SCHEMA,
+  schemaExtensions: extensionSchemaIds.map((schema) => ({
+    required: false,
+    schema
+  })),
+  schemas: [RESOURCE_TYPE_SCHEMA]
+});
+var resourceTypeGroup = (location, groupsEndpoint) => ({
+  description: "Group",
+  endpoint: groupsEndpoint,
+  id: "Group",
+  meta: { location, resourceType: "ResourceType" },
+  name: "Group",
+  schema: GROUP_SCHEMA,
+  schemas: [RESOURCE_TYPE_SCHEMA]
+});
+var resourceTypeList = (location, usersEndpoint, groupsEndpoint, extras = []) => listResponse([
+  resourceTypeUser(`${location}/User`, usersEndpoint, extras.map((schema) => schema.id)),
+  resourceTypeGroup(`${location}/Group`, groupsEndpoint)
+]);
+var resourceTypeOne = (location, id, usersEndpoint, groupsEndpoint, extras = []) => {
+  if (id === "User") {
+    return resourceTypeUser(location, usersEndpoint, extras.map((schema) => schema.id));
+  }
+  if (id === "Group")
+    return resourceTypeGroup(location, groupsEndpoint);
+  return;
+};
 var REMOVE_MEMBER_PATTERN = /^members\[\s*value\s+eq\s+"([^"]*)"\s*\]$/iu;
 var parseMembers = (value) => {
   if (!Array.isArray(value))
@@ -8577,6 +9083,7 @@ var SCIM_CONTENT_TYPE2 = "application/scim+json";
 var unauthorized = () => scimError(SCIM_UNAUTHORIZED, "Invalid or missing SCIM bearer token");
 var notImplemented = () => scimError(SCIM_NOT_IMPLEMENTED, "Group provisioning is not configured");
 var scimRoutes = ({
+  customAttributes,
   getScimGroup,
   getScimUser,
   listScimGroups,
@@ -8595,8 +9102,17 @@ var scimRoutes = ({
   const groupsRoute = `${scimRoute}/Groups`;
   const groupRoute = `${scimRoute}/Groups/:id`;
   const spcRoute = `${scimRoute}/ServiceProviderConfig`;
+  const schemasRoute = `${scimRoute}/Schemas`;
+  const schemaRoute = `${scimRoute}/Schemas/:id`;
+  const resourceTypesRoute = `${scimRoute}/ResourceTypes`;
+  const resourceTypeRoute = `${scimRoute}/ResourceTypes/:id`;
+  const extensionSchemas = customAttributes?.schemas ?? [];
   const userLocation = (requestUrl, id) => `${new URL(requestUrl).origin}${scimRoute}/Users/${id}`;
   const groupLocation = (requestUrl, id) => `${new URL(requestUrl).origin}${scimRoute}/Groups/${id}`;
+  const schemasLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/Schemas`;
+  const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
+  const usersEndpoint = `${scimRoute}/Users`;
+  const groupsEndpoint = `${scimRoute}/Groups`;
   return new Elysia29().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8606,12 +9122,12 @@ var scimRoutes = ({
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
-    const input = parseUserInput(body);
+    const input = parseUserInput(body, customAttributes);
     if (input === undefined) {
       return scimError(SCIM_BAD_REQUEST, "Request body is not a valid SCIM User", "invalidValue");
     }
     const user = await onScimUserCreate({ input, organizationId });
-    return scimJson(toUserResource(user, userLocation(request.url, user.id)), SCIM_CREATED);
+    return scimJson(toUserResource(user, userLocation(request.url, user.id), customAttributes), SCIM_CREATED);
   }).get(usersRoute, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8620,7 +9136,7 @@ var scimRoutes = ({
       filter: parseFilter(query.filter),
       organizationId
     });
-    const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id)));
+    const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id), customAttributes));
     return scimJson(listResponse(resources), SCIM_OK);
   }, { query: t26.Object({ filter: t26.Optional(t26.String()) }) }).get(userRoute, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
@@ -8630,12 +9146,12 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).put(userRoute, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
-    const input = parseUserInput(body);
+    const input = parseUserInput(body, customAttributes);
     if (input === undefined) {
       return scimError(SCIM_BAD_REQUEST, "Request body is not a valid SCIM User", "invalidValue");
     }
@@ -8647,7 +9163,7 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).patch(userRoute, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8664,7 +9180,7 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).delete(userRoute, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8756,10 +9272,39 @@ var scimRoutes = ({
       return notImplemented();
     await onScimGroupDelete({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
+  }, { params: t26.Object({ id: t26.String() }) }).get(schemasRoute, async ({ headers, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    return scimJson(schemaList(schemasLocation(request.url), extensionSchemas), SCIM_OK);
+  }).get(schemaRoute, async ({ headers, params: { id }, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    const schema = schemaOne(`${schemasLocation(request.url)}/${id}`, id, extensionSchemas);
+    if (schema === undefined) {
+      return scimError(SCIM_NOT_FOUND, "Schema not found");
+    }
+    return scimJson(schema, SCIM_OK);
+  }, { params: t26.Object({ id: t26.String() }) }).get(resourceTypesRoute, async ({ headers, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    return scimJson(resourceTypeList(resourceTypesLocation(request.url), usersEndpoint, groupsEndpoint, extensionSchemas), SCIM_OK);
+  }).get(resourceTypeRoute, async ({ headers, params: { id }, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    const resourceType = resourceTypeOne(`${resourceTypesLocation(request.url)}/${id}`, id, usersEndpoint, groupsEndpoint, extensionSchemas);
+    if (resourceType === undefined) {
+      return scimError(SCIM_NOT_FOUND, "ResourceType not found");
+    }
+    return scimJson(resourceType, SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) });
 };
 
 // src/session/cleanup.ts
+init_constants();
 import { Elysia as Elysia30 } from "elysia";
 var sessionCleanup = ({
   authSessionStore,
@@ -9008,6 +9553,7 @@ var ssoDiscoveryRoute = ({
 };
 
 // src/sso/oidcRoutes.ts
+init_constants();
 import { Elysia as Elysia32, t as t28 } from "elysia";
 var makeSsoCookieOptions = (secure) => ({
   httpOnly: true,
@@ -9428,9 +9974,11 @@ var samlSsoRoutes = ({
 };
 
 // src/webauthn/routes.ts
+init_constants();
 import { Elysia as Elysia34, t as t30 } from "elysia";
 
 // src/webauthn/config.ts
+init_constants();
 var FIVE_MINUTES_MS = 300000;
 var DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS = FIVE_MINUTES_MS;
 var DEFAULT_WEBAUTHN_ROUTE = "/auth/webauthn";
@@ -9616,7 +10164,11 @@ var webauthnRoutes = ({
   });
 };
 
+// src/webhooks/dispatcher.ts
+init_constants();
+
 // src/webhooks/config.ts
+init_constants();
 var DEFAULT_TIMEOUT_SECONDS = 5;
 var DEFAULT_RETRY_ATTEMPTS = 3;
 var DEFAULT_RETRY_INITIAL_DELAY_MS = MILLISECONDS_IN_A_SECOND;
@@ -9629,6 +10181,7 @@ var DEFAULT_WEBHOOK_RETRY = {
 var DEFAULT_WEBHOOK_TIMEOUT_MS = MILLISECONDS_IN_A_SECOND * DEFAULT_TIMEOUT_SECONDS;
 
 // src/webhooks/sign.ts
+init_crypto();
 var textEncoder2 = new TextEncoder;
 var importHmacKey = (secret) => crypto.subtle.importKey("raw", textEncoder2.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
 var signWebhook = async ({
@@ -9856,6 +10409,7 @@ var createActionPipeline = (actions) => ({
   }
 });
 // src/compliance/cipher.ts
+init_crypto();
 var createSecretCipher = (keyMaterial) => ({
   decrypt: (ciphertext) => decryptSecret(ciphertext, keyMaterial),
   encrypt: (plaintext) => encryptSecret(plaintext, keyMaterial)
@@ -20615,6 +21169,7 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
   return { bindingStore, grantStore };
 };
 // src/session/impersonation.ts
+init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
 var endImpersonation = async ({
   authSessionStore,
@@ -20697,6 +21252,7 @@ var startImpersonation = async ({
   return sessionId;
 };
 // src/session/anonymous.ts
+init_constants();
 var DEFAULT_GUEST_TTL_MS = MILLISECONDS_IN_A_DAY;
 var createAnonymousSession = async ({
   authSessionStore,
@@ -20784,6 +21340,10 @@ var switchActiveSession = ({
   });
   return true;
 };
+
+// src/index.ts
+init_crypto();
+
 // src/tenancy.ts
 var hasOrganizationScope = (value) => typeof value.organizationId === "string" && value.organizationId.length > 0;
 // src/credentials/backgroundOps.ts
@@ -20793,7 +21353,7 @@ var DEFAULT_PAUSE_MS = 1700;
 var HIBP_NOT_FOUND = 404;
 var HIBP_RATE_LIMITED = 429;
 var MS_PER_DAY = 86400000;
-var MS_PER_SECOND3 = 1000;
+var MS_PER_SECOND4 = 1000;
 var sleep = (delayMs) => new Promise((resolve) => {
   setTimeout(resolve, delayMs);
 });
@@ -20819,7 +21379,7 @@ var checkEmailBreaches = async (email, apiKey, truncate) => {
   if (response.status === HIBP_RATE_LIMITED) {
     const retryAfter = Number(response.headers.get("retry-after") ?? "0");
     if (retryAfter > 0)
-      await sleep(retryAfter * MS_PER_SECOND3);
+      await sleep(retryAfter * MS_PER_SECOND4);
     return [];
   }
   if (!response.ok)
@@ -21474,6 +22034,7 @@ var defaultBotClassifier = (context) => {
   return "human";
 };
 // src/compliance/redaction.ts
+init_crypto();
 var createAuditRedactor = ({
   dropFields = [],
   hashFields = [],
@@ -21715,6 +22276,114 @@ var createPostgresAuditSink = (db) => ({
     return deleted.length;
   }
 });
+// src/scim/extensions.ts
+var defineScimAttributeMap = (map) => map;
+var diffScimGroupMembers = (current, next) => {
+  const currentValues = new Set(current.map((member) => member.value));
+  const nextValues = new Set(next.map((member) => member.value));
+  const added = next.filter((member) => !currentValues.has(member.value));
+  const removed = current.filter((member) => !nextValues.has(member.value));
+  return { added, removed };
+};
+// src/oidc/inMemoryVciStores.ts
+var createInMemoryCredentialNonceStore = () => {
+  const nonces = new Map;
+  return {
+    consumeNonce: async (nonceHash) => {
+      const record = nonces.get(nonceHash);
+      if (record === undefined)
+        return;
+      nonces.delete(nonceHash);
+      return record;
+    },
+    saveNonce: async (record) => {
+      nonces.set(record.nonceHash, record);
+    }
+  };
+};
+var createInMemoryCredentialOfferStore = () => {
+  const offers = new Map;
+  return {
+    consumeOffer: async (preAuthorizedCodeHash) => {
+      const offer = offers.get(preAuthorizedCodeHash);
+      if (offer === undefined)
+        return;
+      offers.set(preAuthorizedCodeHash, { ...offer, redeemed: true });
+      return offer;
+    },
+    saveOffer: async (offer) => {
+      offers.set(offer.preAuthorizedCodeHash, offer);
+    }
+  };
+};
+// src/oidc/vciRoutes.ts
+import { Elysia as Elysia35, t as t31 } from "elysia";
+var HTTP_OK3 = 200;
+var HTTP_BAD_REQUEST3 = 400;
+var HTTP_UNAUTHORIZED3 = 401;
+var BEARER_PREFIX5 = "Bearer ";
+var errorBody = (error, status) => new Response(JSON.stringify({ error }), {
+  headers: { "content-type": "application/json" },
+  status
+});
+var extractBearer = (authorization) => {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX5)) {
+    return;
+  }
+  const value = authorization.slice(BEARER_PREFIX5.length).trim();
+  return value.length === 0 ? undefined : value;
+};
+var vciRoutes = ({
+  issuerUrl,
+  signingKey,
+  vciConfig
+}) => {
+  const vciRoute = vciConfig.vciRoute ?? DEFAULT_VCI_ROUTE;
+  const credentialRoute = `${vciRoute}/credential`;
+  const nonceRoute = `${vciRoute}/nonce`;
+  const vciSigningKey = vciConfig.signingKey ?? signingKey;
+  return new Elysia35().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({ config: vciConfig, issuer: issuerUrl, vciRoute }))).post(credentialRoute, async ({ body, headers }) => {
+    const accessToken = extractBearer(headers.authorization);
+    if (accessToken === undefined) {
+      return errorBody("invalid_token", HTTP_UNAUTHORIZED3);
+    }
+    const result = await issueCredential({
+      config: vciConfig,
+      input: {
+        accessToken,
+        proofJwt: body.proof?.jwt,
+        requestedFormat: body.format
+      },
+      issuer: issuerUrl,
+      signingKey: vciSigningKey
+    });
+    if (!result.ok)
+      return errorBody(result.error, HTTP_BAD_REQUEST3);
+    return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK3 });
+  }, {
+    body: t31.Object({
+      format: t31.Optional(t31.Union([t31.Literal("vc+sd-jwt")])),
+      proof: t31.Optional(t31.Object({
+        jwt: t31.String(),
+        proof_type: t31.Literal("jwt")
+      }))
+    })
+  }).post(nonceRoute, async () => {
+    if (vciConfig.credentialNonceStore === undefined) {
+      return errorBody("not_supported", HTTP_BAD_REQUEST3);
+    }
+    const { generateSecureToken: generateSecureToken2, hashToken: hashToken2 } = await Promise.resolve().then(() => (init_crypto(), exports_crypto));
+    const nonceBytes = 16;
+    const nonce = generateSecureToken2(nonceBytes);
+    const ttlMs = vciConfig.nonceTtlMs ?? 300000;
+    await vciConfig.credentialNonceStore.saveNonce({
+      expiresAt: Date.now() + ttlMs,
+      nonceHash: await hashToken2(nonce)
+    });
+    const msPerSecond = 1000;
+    return Response.json({ c_nonce: nonce, c_nonce_expires_in: Math.floor(ttlMs / msPerSecond) }, { status: HTTP_OK3 });
+  });
+};
 // src/scim/inMemoryScimTokenStore.ts
 var createInMemoryScimTokenStore = () => {
   const tokens = new Map;
@@ -22585,6 +23254,7 @@ var createPostgresBackchannelAuthStore = (db) => ({
   }
 });
 // src/adaptive/config.ts
+init_constants();
 var DEFAULT_HISTORY_LIMIT = 50;
 var DEFAULT_MAX_TRAVEL_KMH = 900;
 var DEFAULT_VELOCITY_MAX_ATTEMPTS = 5;
@@ -22759,6 +23429,7 @@ var trustDevice = async (config, userId, deviceId, label) => {
   });
 };
 // src/adaptive/fingerprint.ts
+init_crypto();
 var canonical = (signals) => JSON.stringify(signals, (_key, value) => value === null || typeof value !== "object" || Array.isArray(value) ? value : Object.fromEntries(Object.entries(value).sort((left, right) => left[0].localeCompare(right[0]))));
 var fingerprintDevice = (signals) => hashToken(canonical(signals));
 // src/adaptive/inMemoryStores.ts
@@ -23876,18 +24547,18 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia35, t as t31 } from "elysia";
-var HTTP_BAD_REQUEST3 = 400;
-var HTTP_UNAUTHORIZED3 = 401;
+import { Elysia as Elysia36, t as t32 } from "elysia";
+var HTTP_BAD_REQUEST4 = 400;
+var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_FOUND2 = 302;
-var HTTP_OK3 = 200;
+var HTTP_OK4 = 200;
 var xmlResponse = (body) => new Response(body, {
   headers: { "content-type": "application/samlmetadata+xml" },
-  status: HTTP_OK3
+  status: HTTP_OK4
 });
 var htmlResponse = (body) => new Response(body, {
   headers: { "content-type": "text/html; charset=utf-8" },
-  status: HTTP_OK3
+  status: HTTP_OK4
 });
 var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
 var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
@@ -23939,7 +24610,7 @@ var samlIdpRoutes = ({
     userSessionIdValue
   }) => {
     if (body.SAMLRequest === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "missing_saml_request");
+      return errorJson(HTTP_BAD_REQUEST4, "missing_saml_request");
     }
     let firstPass;
     try {
@@ -23948,11 +24619,11 @@ var samlIdpRoutes = ({
         samlRequest: body.SAMLRequest
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST4, "invalid_authn_request");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST4, "unknown_service_provider");
     }
     let parsed;
     try {
@@ -23965,7 +24636,7 @@ var samlIdpRoutes = ({
         signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST4, "invalid_authn_request");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -23974,7 +24645,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined || parsed.forceAuthn === true) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED4, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -23986,7 +24657,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia35().use(sessionStore()).post(ssoIdpRoute, async ({
+  return new Elysia36().use(sessionStore()).post(ssoIdpRoute, async ({
     body,
     cookie: { user_session_id },
     request,
@@ -23998,12 +24669,12 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    body: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLRequest: t31.Optional(t31.String())
+    body: t32.Object({
+      RelayState: t32.Optional(t32.String()),
+      SAMLRequest: t32.Optional(t32.String())
     }),
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
+    cookie: t32.Cookie({
+      user_session_id: t32.Optional(userSessionIdTypebox)
     })
   }).get(ssoIdpRoute, async ({
     cookie: { user_session_id },
@@ -24017,14 +24688,14 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
+    cookie: t32.Cookie({
+      user_session_id: t32.Optional(userSessionIdTypebox)
     }),
-    query: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLRequest: t31.Optional(t31.String()),
-      SigAlg: t31.Optional(t31.String()),
-      Signature: t31.Optional(t31.String())
+    query: t32.Object({
+      RelayState: t32.Optional(t32.String()),
+      SAMLRequest: t32.Optional(t32.String()),
+      SigAlg: t32.Optional(t32.String()),
+      Signature: t32.Optional(t32.String())
     })
   }).get(idpInitiateRoute, async ({
     cookie: { user_session_id },
@@ -24033,11 +24704,11 @@ var samlIdpRoutes = ({
     store
   }) => {
     if (serviceProviderEntityId === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "missing_sp");
+      return errorJson(HTTP_BAD_REQUEST4, "missing_sp");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST4, "unknown_service_provider");
     }
     const userSession = authSessionStore === undefined ? await loadSessionFromSource({
       session: store.session,
@@ -24049,7 +24720,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED4, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -24060,12 +24731,12 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   }, {
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
+    cookie: t32.Cookie({
+      user_session_id: t32.Optional(userSessionIdTypebox)
     }),
-    query: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      sp: t31.Optional(t31.String())
+    query: t32.Object({
+      RelayState: t32.Optional(t32.String()),
+      sp: t32.Optional(t32.String())
     })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
@@ -24363,7 +25034,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  return new Elysia36().use(sessionCleanup({
+  return new Elysia37().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -24411,53 +25082,53 @@ var auth = async ({
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     lockoutGuard
-  }) : new Elysia36).use(auditedMfa ? mfaRoutes({
+  }) : new Elysia37).use(auditedMfa ? mfaRoutes({
     ...auditedMfa,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia36).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia37).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia36).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia36).use(sso ? oidcSsoRoutes({
+  }) : new Elysia37).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia37).use(sso ? oidcSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia36).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia37).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     samlAdapter: sso.samlAdapter
-  }) : new Elysia36).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+  }) : new Elysia37).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
     ssoConnectionStore: sso.ssoConnectionStore,
     ssoRoute: sso.ssoRoute
-  }) : new Elysia36).use(scim ? scimRoutes(scim) : new Elysia36).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia36).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia36).use(organizations ? organizationRoutes({
+  }) : new Elysia37).use(scim ? scimRoutes(scim) : new Elysia37).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia37).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia37).use(organizations ? organizationRoutes({
     ...organizations,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia36).use(roles ? roleRoutes({
+  }) : new Elysia37).use(roles ? roleRoutes({
     ...roles,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia36).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia36).use(webauthn ? webauthnRoutes({
+  }) : new Elysia37).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia37).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia36).use(compliance ? complianceRoutes({
+  }) : new Elysia37).use(compliance ? complianceRoutes({
     ...compliance,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia36).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
+  }) : new Elysia37).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
     ...authorization,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia36).use(htmx ? createAuthHtmxRoutes({
+  }) : new Elysia37).use(htmx ? createAuthHtmxRoutes({
     ...htmx,
     authSessionStore
-  }) : new Elysia36);
+  }) : new Elysia37);
 };
 export {
   writeWarrant,
@@ -24470,6 +25141,7 @@ export {
   verifyWebhookSignature,
   verifyTurnstile,
   verifyTotp,
+  verifySdJwtVc,
   verifyRecaptcha,
   verifyPkce,
   verifyPassword,
@@ -24486,6 +25158,7 @@ export {
   verifyAuditChain,
   verifyApiKey,
   verifyAccessToken,
+  vciRoutes,
   vaultEntriesTable,
   validateSession,
   validateEmailDeliverability,
@@ -24494,6 +25167,7 @@ export {
   updateRegisteredClient,
   trustDevice,
   toPublicJwk,
+  toBase64Url2 as toBase64Url,
   switchActiveSession,
   stepUpPlugin,
   startImpersonation,
@@ -24547,11 +25221,13 @@ export {
   providerOptions,
   protectRoutePlugin,
   protectPermissionPlugin,
+  presentSdJwtVc,
   portalRoutes,
   pkceProviderOptions,
   passwordlessTokensTable,
   passwordlessRoutes,
   parseSignedRequestObject,
+  parseSdJwtVc,
   parseSchema,
   organizationsTable,
   organizationRoutes,
@@ -24587,7 +25263,9 @@ export {
   knownDevicesTable,
   jwkThumbprint,
   issueTokenSet,
+  issueSdJwtVc,
   issueDeviceAuthorization,
+  issueCredential,
   issueBackchannelAuth,
   isValidUser,
   isValidProviderOption,
@@ -24626,6 +25304,7 @@ export {
   generateSecureToken,
   generateEncryptionKey,
   generateBackupCodes,
+  fromBase64Url2 as fromBase64Url,
   fingerprintDevice,
   fetchUserInfo,
   fanOutBackchannelLogout,
@@ -24634,6 +25313,7 @@ export {
   extractDpopNonceClaim,
   exportAuditCsv,
   exchangeToken,
+  exchangePreAuthorizedCode,
   exchangeDeviceCode,
   exchangeClientCredentials,
   exchangeBackchannelAuth,
@@ -24641,10 +25321,12 @@ export {
   endImpersonation,
   encryptTotpSecret,
   encryptSecret,
+  diffScimGroupMembers,
   denyDeviceAuthorization,
   denyBackchannelAuth,
   deleteWarrant,
   deleteRegisteredClient,
+  defineScimAttributeMap,
   defineProvidersConfiguration,
   defineAuthSettings,
   defineAuthHtmxConfig,
@@ -24766,6 +25448,8 @@ export {
   createInMemoryInitialAccessTokenStore,
   createInMemoryDeviceAuthorizationStore,
   createInMemoryCredentialStore,
+  createInMemoryCredentialOfferStore,
+  createInMemoryCredentialNonceStore,
   createInMemoryClientRegistrationTokenStore,
   createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
@@ -24778,6 +25462,7 @@ export {
   createInMemoryAccessTokenStore,
   createFgaEngine,
   createFederatedTokenStore,
+  createCredentialOffer,
   createAuthHtmxRoutes,
   createAuditRedactor,
   createAuditEmitter,
@@ -24792,6 +25477,7 @@ export {
   computeCertThumbprint,
   complianceRoutes,
   check,
+  buildIssuerMetadata,
   buildClientProviders,
   blockMigrations,
   base32Encode,
@@ -24813,12 +25499,14 @@ export {
   acceptInvitation,
   WEBAUTHN_CHALLENGE_COOKIE,
   REQUEST_URI_PREFIX,
+  PRE_AUTHORIZED_CODE_GRANT,
   DEFAULT_WEBHOOK_TIMEOUT_MS,
   DEFAULT_WEBHOOK_RETRY,
   DEFAULT_WEBAUTHN_SESSION_TTL_MS,
   DEFAULT_WEBAUTHN_ROUTE,
   DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS,
   DEFAULT_VERIFICATION_TOKEN_TTL_MS,
+  DEFAULT_VCI_ROUTE,
   DEFAULT_TOKEN_ROUTE,
   DEFAULT_SSO_SESSION_TTL_MS,
   DEFAULT_SSO_ROUTE,
@@ -24846,5 +25534,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=26C38ACE51F8A69A64756E2164756E21
+//# debugId=72970D27E7C7DE2F64756E2164756E21
 //# sourceMappingURL=index.js.map