@absolutejs/auth 0.40.0-beta.0 → 0.40.0-beta.1

package/dist/index.js

@@ -2672,7 +2672,7 @@ var createOAuth2Client = async (providerName, config) => {
 };
 
 // src/index.ts
-import { Elysia as Elysia37 } from "elysia";
+import { Elysia as Elysia39 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -22384,6 +22384,430 @@ var vciRoutes = ({
     return Response.json({ c_nonce: nonce, c_nonce_expires_in: Math.floor(ttlMs / msPerSecond) }, { status: HTTP_OK3 });
   });
 };
+// src/vc/statusList.ts
+var STATUS_LIST_TYP = "statuslist+jwt";
+var STATUS_LIST_SUB_TYP = "application/statuslist+jwt";
+var DEFAULT_LIST_SIZE = 131072;
+var BITS_PER_BYTE = 8;
+var MS_PER_SECOND5 = 1000;
+var BYTE_MASK = 255;
+var createStatusList = (size = DEFAULT_LIST_SIZE) => {
+  if (size % BITS_PER_BYTE !== 0) {
+    throw new Error("Status list size must be a multiple of 8");
+  }
+  return new Uint8Array(size / BITS_PER_BYTE);
+};
+var getCredentialStatus = (bits, idx) => {
+  const byteIndex = Math.floor(idx / BITS_PER_BYTE);
+  const bitIndex = idx % BITS_PER_BYTE;
+  if (byteIndex >= bits.length)
+    return;
+  const byte = bits[byteIndex] ?? 0;
+  return (byte >> bitIndex & 1) === 1 ? 1 : 0;
+};
+var setCredentialStatus = (bits, idx, value) => {
+  const byteIndex = Math.floor(idx / BITS_PER_BYTE);
+  const bitIndex = idx % BITS_PER_BYTE;
+  if (byteIndex >= bits.length) {
+    throw new Error(`Status idx ${idx} out of range for this list`);
+  }
+  const current = bits[byteIndex] ?? 0;
+  const mask = 1 << bitIndex;
+  const next = value === 1 ? current | mask : current & (BYTE_MASK ^ mask);
+  bits[byteIndex] = next;
+  return bits;
+};
+var compress = async (bits) => {
+  const blob = new Blob([new Uint8Array(bits)]);
+  const stream = new Response(blob.stream().pipeThrough(new CompressionStream("deflate")));
+  const compressed = new Uint8Array(await stream.arrayBuffer());
+  return Buffer.from(compressed).toString("base64url");
+};
+var decompress = async (encoded) => {
+  const compressed = Buffer.from(encoded, "base64url");
+  const blob = new Blob([new Uint8Array(compressed)]);
+  const stream = new Response(blob.stream().pipeThrough(new DecompressionStream("deflate")));
+  return new Uint8Array(await stream.arrayBuffer());
+};
+var nowSeconds3 = (timeMs) => Math.floor(timeMs / MS_PER_SECOND5);
+var buildStatusClaim = (idx, uri) => ({
+  status_list: { idx, uri }
+});
+var signStatusList = async ({
+  bits,
+  issuer,
+  listUri,
+  now = Date.now(),
+  signingKey,
+  ttlSeconds
+}) => {
+  const payload = {
+    iat: nowSeconds3(now),
+    iss: issuer,
+    status_list: {
+      bits: 1,
+      lst: await compress(bits)
+    },
+    sub: listUri,
+    ttl: ttlSeconds
+  };
+  if (ttlSeconds !== undefined) {
+    payload.exp = nowSeconds3(now) + ttlSeconds;
+  }
+  return signJwt(payload, signingKey);
+};
+var verifyStatusListJwt = async ({
+  issuerPublicJwk,
+  token
+}) => {
+  const decoded = await verifyJwt(token, issuerPublicJwk);
+  if (decoded === undefined)
+    return;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return;
+  const payload = { ...rawPayload };
+  const statusList = payload.status_list;
+  if (typeof statusList !== "object" || statusList === null)
+    return;
+  const lst = Reflect.get(statusList, "lst");
+  const bitsPerEntry = Reflect.get(statusList, "bits");
+  if (typeof lst !== "string")
+    return;
+  if (bitsPerEntry !== undefined && bitsPerEntry !== 1) {
+    return;
+  }
+  const bits = await decompress(lst);
+  return { bits, sub: typeof payload.sub === "string" ? payload.sub : undefined };
+};
+// src/vc/statusListRoutes.ts
+import { Elysia as Elysia36, t as t32 } from "elysia";
+var HTTP_OK4 = 200;
+var HTTP_NOT_FOUND = 404;
+var DEFAULT_STATUS_ROUTE = "/vc/status";
+var statusListRoutes = ({
+  getStatusList,
+  issuerUrl,
+  signingKey,
+  statusRoute = DEFAULT_STATUS_ROUTE,
+  ttlSeconds
+}) => {
+  const listRoute = `${statusRoute}/:listId`;
+  return new Elysia36().get(listRoute, async ({ params: { listId } }) => {
+    const bits = await getStatusList(listId);
+    if (bits === undefined) {
+      return new Response("Not found", { status: HTTP_NOT_FOUND });
+    }
+    const jwt = await signStatusList({
+      bits,
+      issuer: issuerUrl,
+      listUri: `${issuerUrl}${statusRoute}/${listId}`,
+      signingKey,
+      ttlSeconds
+    });
+    return new Response(jwt, {
+      headers: { "content-type": STATUS_LIST_SUB_TYP },
+      status: HTTP_OK4
+    });
+  }, { params: t32.Object({ listId: t32.String() }) });
+};
+// src/vc/openid4vp.ts
+init_crypto();
+var REQUEST_BYTES = 16;
+var DEFAULT_REQUEST_TTL_MS = 600000;
+var MS_PER_SECOND6 = 1000;
+var createPresentationRequest = async ({
+  config,
+  getRequestUri,
+  input,
+  issuer
+}) => {
+  const requestId = generateSecureToken(REQUEST_BYTES);
+  const nonce = generateSecureToken(REQUEST_BYTES);
+  const now = input.now ?? Date.now();
+  const ttlMs = config.requestTtlMs ?? DEFAULT_REQUEST_TTL_MS;
+  const request = {
+    clientId: input.clientId,
+    createdAt: now,
+    expectedIssuerPublicJwk: config.defaultExpectedIssuerPublicJwk,
+    expiresAt: now + ttlMs,
+    nonce,
+    requestedClaims: input.requestedClaims,
+    requestId,
+    responseUri: config.getResponseUri(requestId),
+    state: input.state
+  };
+  await config.requestStore.saveRequest(request);
+  const requestObject = await signJwt({
+    aud: "https://self-issued.me/v2",
+    client_id: input.clientId,
+    iat: Math.floor(now / MS_PER_SECOND6),
+    iss: issuer,
+    nonce,
+    presentation_definition: buildSimplePresentationDefinition(requestId, input.requestedClaims),
+    response_mode: "direct_post",
+    response_type: "vp_token",
+    response_uri: request.responseUri,
+    state: input.state
+  }, config.clientSigningKey);
+  return {
+    nonce,
+    request,
+    requestObject,
+    requestUri: getRequestUri(requestId)
+  };
+};
+var buildSimplePresentationDefinition = (requestId, requestedClaims) => ({
+  id: requestId,
+  input_descriptors: [
+    {
+      constraints: {
+        fields: requestedClaims.map((claim) => ({
+          path: [`$.${claim}`]
+        })),
+        limit_disclosure: "required"
+      },
+      format: { "vc+sd-jwt": { "sd-jwt_alg_values": ["ES256"] } },
+      id: "sd-jwt-vc",
+      name: "SD-JWT VC",
+      purpose: "Verify holder claims"
+    }
+  ]
+});
+var verifyPresentationResponse = async ({
+  config,
+  input,
+  now = Date.now()
+}) => {
+  const failFor = (error) => {
+    const failure = { error, ok: false };
+    return failure;
+  };
+  const request = await config.requestStore.consumeRequest(input.requestId);
+  if (request === undefined)
+    return failFor("unknown_request");
+  if (request.expiresAt < now)
+    return failFor("expired_request");
+  const verified = await verifySdJwtVc({
+    issuerPublicJwk: request.expectedIssuerPublicJwk,
+    token: input.vpToken
+  });
+  if (verified === undefined)
+    return failFor("invalid_signature");
+  if (verified.cnf !== undefined) {
+    if (verified.keyBindingJwt === undefined) {
+      return failFor("invalid_holder_binding");
+    }
+    const valid = await verifyHolderBinding({
+      audience: request.clientId,
+      holderJwk: verified.cnf.jwk,
+      keyBindingJwt: verified.keyBindingJwt,
+      nonce: request.nonce
+    });
+    if (!valid)
+      return failFor("invalid_holder_binding");
+  }
+  const missingClaims = request.requestedClaims.filter((claim) => !(claim in verified.disclosedClaims));
+  if (missingClaims.length > 0)
+    return failFor("missing_claims");
+  const statusValid = await checkStatus({
+    config,
+    credentialClaims: verified.protectedClaims
+  });
+  if (!statusValid)
+    return failFor("revoked_credential");
+  const success = {
+    ok: true,
+    verified: {
+      disclosedClaims: verified.disclosedClaims,
+      holderJwk: verified.cnf?.jwk,
+      missingClaims,
+      protectedClaims: verified.protectedClaims,
+      requestId: request.requestId,
+      statusValid: true
+    }
+  };
+  return success;
+};
+var verifyHolderBinding = async ({
+  audience,
+  holderJwk,
+  keyBindingJwt,
+  nonce
+}) => {
+  const decoded = await verifyJwt(keyBindingJwt, holderJwk);
+  if (decoded === undefined)
+    return false;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return false;
+  const payload = { ...rawPayload };
+  if (payload.aud !== audience)
+    return false;
+  if (payload.nonce !== nonce)
+    return false;
+  if (typeof payload.iat !== "number")
+    return false;
+  return true;
+};
+var checkStatus = async ({
+  config,
+  credentialClaims
+}) => {
+  if (config.statusListResolver === undefined)
+    return true;
+  if (config.statusListPublicJwk === undefined)
+    return true;
+  const { status } = credentialClaims;
+  if (typeof status !== "object" || status === null)
+    return true;
+  const list = Reflect.get(status, "status_list");
+  if (typeof list !== "object" || list === null)
+    return true;
+  const uri = Reflect.get(list, "uri");
+  const idx = Reflect.get(list, "idx");
+  if (typeof uri !== "string" || typeof idx !== "number")
+    return true;
+  const token = await config.statusListResolver(uri);
+  if (token === undefined)
+    return true;
+  const verified = await verifyStatusListJwt({
+    issuerPublicJwk: config.statusListPublicJwk,
+    token
+  });
+  if (verified === undefined)
+    return false;
+  const bitsPerByte = 8;
+  const byteIndex = Math.floor(idx / bitsPerByte);
+  const bitIndex = idx % bitsPerByte;
+  const byte = verified.bits[byteIndex] ?? 0;
+  return (byte >> bitIndex & 1) === 0;
+};
+var buildHolderKeyBindingJwt = async ({
+  audience,
+  holderKey,
+  nonce,
+  now = Date.now(),
+  sdHash
+}) => signJwt({
+  aud: audience,
+  iat: Math.floor(now / MS_PER_SECOND6),
+  nonce,
+  sd_hash: sdHash
+}, holderKey);
+var parsePresentationToken = (vpToken) => parseSdJwtVc(vpToken);
+// src/vc/inMemoryVpStores.ts
+var createInMemoryPresentationRequestStore = () => {
+  const requests = new Map;
+  return {
+    consumeRequest: async (requestId) => {
+      const request = requests.get(requestId);
+      if (request === undefined)
+        return;
+      requests.delete(requestId);
+      return request;
+    },
+    getRequest: async (requestId) => requests.get(requestId),
+    saveRequest: async (request) => {
+      requests.set(request.requestId, request);
+    }
+  };
+};
+// src/vc/vpRoutes.ts
+import { Elysia as Elysia37, t as t33 } from "elysia";
+var HTTP_OK5 = 200;
+var HTTP_BAD_REQUEST4 = 400;
+var HTTP_NOT_FOUND2 = 404;
+var errorBody2 = (error, status) => new Response(JSON.stringify({ error }), {
+  headers: { "content-type": "application/json" },
+  status
+});
+var DEFAULT_VP_ROUTE = "/vp";
+var vpRoutes = ({
+  defaultClientId,
+  issuerUrl,
+  onVerifiedPresentation,
+  vpConfig,
+  vpRoute = DEFAULT_VP_ROUTE
+}) => {
+  const authorizeRoute = `${vpRoute}/authorize`;
+  const requestRoute = `${vpRoute}/request/:id`;
+  const responseRoute = `${vpRoute}/response`;
+  return new Elysia37().post(authorizeRoute, async ({ body }) => {
+    const input = {
+      clientId: body.client_id ?? defaultClientId,
+      requestedClaims: body.requested_claims,
+      state: body.state
+    };
+    const result = await createPresentationRequest({
+      config: vpConfig,
+      input,
+      issuer: issuerUrl,
+      getRequestUri: (id) => `${issuerUrl}${vpRoute}/request/${id}`
+    });
+    return Response.json({
+      nonce: result.nonce,
+      request_uri: result.requestUri,
+      requestId: result.request.requestId
+    }, { status: HTTP_OK5 });
+  }, {
+    body: t33.Object({
+      client_id: t33.Optional(t33.String()),
+      requested_claims: t33.Array(t33.String()),
+      state: t33.Optional(t33.String())
+    })
+  }).get(requestRoute, async ({ params: { id } }) => {
+    const stored = await vpConfig.requestStore.getRequest(id);
+    if (stored === undefined) {
+      return errorBody2("unknown_request", HTTP_NOT_FOUND2);
+    }
+    const rebuilt = await createPresentationRequest({
+      config: { ...vpConfig, requestStore: passthroughStore(stored) },
+      input: {
+        clientId: stored.clientId,
+        requestedClaims: stored.requestedClaims,
+        state: stored.state
+      },
+      issuer: issuerUrl,
+      getRequestUri: () => `${issuerUrl}${vpRoute}/request/${id}`
+    });
+    return new Response(rebuilt.requestObject, {
+      headers: { "content-type": "application/oauth-authz-req+jwt" },
+      status: HTTP_OK5
+    });
+  }, { params: t33.Object({ id: t33.String() }) }).post(responseRoute, async ({ body }) => {
+    const requestId = body.state;
+    if (requestId === undefined) {
+      return errorBody2("missing_state", HTTP_BAD_REQUEST4);
+    }
+    const result = await verifyPresentationResponse({
+      config: vpConfig,
+      input: { requestId, vpToken: body.vp_token }
+    });
+    if (!result.ok)
+      return errorBody2(result.error, HTTP_BAD_REQUEST4);
+    if (onVerifiedPresentation !== undefined) {
+      await onVerifiedPresentation({ verified: result.verified });
+    }
+    return Response.json({
+      disclosed_claims: result.verified.disclosedClaims,
+      holder_jwk: result.verified.holderJwk,
+      protected_claims: result.verified.protectedClaims,
+      verified: true
+    }, { status: HTTP_OK5 });
+  }, {
+    body: t33.Object({
+      presentation_submission: t33.Optional(t33.Unknown()),
+      state: t33.Optional(t33.String()),
+      vp_token: t33.String()
+    })
+  });
+};
+var passthroughStore = (request) => ({
+  consumeRequest: async () => request,
+  getRequest: async () => request,
+  saveRequest: async () => {}
+});
 // src/scim/inMemoryScimTokenStore.ts
 var createInMemoryScimTokenStore = () => {
   const tokens = new Map;
@@ -24547,18 +24971,18 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia36, t as t32 } from "elysia";
-var HTTP_BAD_REQUEST4 = 400;
+import { Elysia as Elysia38, t as t34 } from "elysia";
+var HTTP_BAD_REQUEST5 = 400;
 var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_FOUND2 = 302;
-var HTTP_OK4 = 200;
+var HTTP_OK6 = 200;
 var xmlResponse = (body) => new Response(body, {
   headers: { "content-type": "application/samlmetadata+xml" },
-  status: HTTP_OK4
+  status: HTTP_OK6
 });
 var htmlResponse = (body) => new Response(body, {
   headers: { "content-type": "text/html; charset=utf-8" },
-  status: HTTP_OK4
+  status: HTTP_OK6
 });
 var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
 var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
@@ -24610,7 +25034,7 @@ var samlIdpRoutes = ({
     userSessionIdValue
   }) => {
     if (body.SAMLRequest === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "missing_saml_request");
+      return errorJson(HTTP_BAD_REQUEST5, "missing_saml_request");
     }
     let firstPass;
     try {
@@ -24619,11 +25043,11 @@ var samlIdpRoutes = ({
         samlRequest: body.SAMLRequest
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST4, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
     }
     let parsed;
     try {
@@ -24636,7 +25060,7 @@ var samlIdpRoutes = ({
         signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST4, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -24657,7 +25081,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia36().use(sessionStore()).post(ssoIdpRoute, async ({
+  return new Elysia38().use(sessionStore()).post(ssoIdpRoute, async ({
     body,
     cookie: { user_session_id },
     request,
@@ -24669,12 +25093,12 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    body: t32.Object({
-      RelayState: t32.Optional(t32.String()),
-      SAMLRequest: t32.Optional(t32.String())
+    body: t34.Object({
+      RelayState: t34.Optional(t34.String()),
+      SAMLRequest: t34.Optional(t34.String())
     }),
-    cookie: t32.Cookie({
-      user_session_id: t32.Optional(userSessionIdTypebox)
+    cookie: t34.Cookie({
+      user_session_id: t34.Optional(userSessionIdTypebox)
     })
   }).get(ssoIdpRoute, async ({
     cookie: { user_session_id },
@@ -24688,14 +25112,14 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    cookie: t32.Cookie({
-      user_session_id: t32.Optional(userSessionIdTypebox)
+    cookie: t34.Cookie({
+      user_session_id: t34.Optional(userSessionIdTypebox)
     }),
-    query: t32.Object({
-      RelayState: t32.Optional(t32.String()),
-      SAMLRequest: t32.Optional(t32.String()),
-      SigAlg: t32.Optional(t32.String()),
-      Signature: t32.Optional(t32.String())
+    query: t34.Object({
+      RelayState: t34.Optional(t34.String()),
+      SAMLRequest: t34.Optional(t34.String()),
+      SigAlg: t34.Optional(t34.String()),
+      Signature: t34.Optional(t34.String())
     })
   }).get(idpInitiateRoute, async ({
     cookie: { user_session_id },
@@ -24704,11 +25128,11 @@ var samlIdpRoutes = ({
     store
   }) => {
     if (serviceProviderEntityId === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "missing_sp");
+      return errorJson(HTTP_BAD_REQUEST5, "missing_sp");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
     }
     const userSession = authSessionStore === undefined ? await loadSessionFromSource({
       session: store.session,
@@ -24731,12 +25155,12 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   }, {
-    cookie: t32.Cookie({
-      user_session_id: t32.Optional(userSessionIdTypebox)
+    cookie: t34.Cookie({
+      user_session_id: t34.Optional(userSessionIdTypebox)
     }),
-    query: t32.Object({
-      RelayState: t32.Optional(t32.String()),
-      sp: t32.Optional(t32.String())
+    query: t34.Object({
+      RelayState: t34.Optional(t34.String()),
+      sp: t34.Optional(t34.String())
     })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
@@ -25034,7 +25458,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  return new Elysia37().use(sessionCleanup({
+  return new Elysia39().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -25082,53 +25506,53 @@ var auth = async ({
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     lockoutGuard
-  }) : new Elysia37).use(auditedMfa ? mfaRoutes({
+  }) : new Elysia39).use(auditedMfa ? mfaRoutes({
     ...auditedMfa,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia37).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia39).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia37).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia37).use(sso ? oidcSsoRoutes({
+  }) : new Elysia39).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia39).use(sso ? oidcSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia37).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia39).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     samlAdapter: sso.samlAdapter
-  }) : new Elysia37).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+  }) : new Elysia39).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
     ssoConnectionStore: sso.ssoConnectionStore,
     ssoRoute: sso.ssoRoute
-  }) : new Elysia37).use(scim ? scimRoutes(scim) : new Elysia37).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia37).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia37).use(organizations ? organizationRoutes({
+  }) : new Elysia39).use(scim ? scimRoutes(scim) : new Elysia39).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia39).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia39).use(organizations ? organizationRoutes({
     ...organizations,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(roles ? roleRoutes({
+  }) : new Elysia39).use(roles ? roleRoutes({
     ...roles,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia37).use(webauthn ? webauthnRoutes({
+  }) : new Elysia39).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia39).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia37).use(compliance ? complianceRoutes({
+  }) : new Elysia39).use(compliance ? complianceRoutes({
     ...compliance,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
+  }) : new Elysia39).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
     ...authorization,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(htmx ? createAuthHtmxRoutes({
+  }) : new Elysia39).use(htmx ? createAuthHtmxRoutes({
     ...htmx,
     authSessionStore
-  }) : new Elysia37);
+  }) : new Elysia39);
 };
 export {
   writeWarrant,
@@ -25138,11 +25562,14 @@ export {
   webauthnCredentialsTable,
   warrantsTable,
   warrantKey,
+  vpRoutes,
   verifyWebhookSignature,
   verifyTurnstile,
   verifyTotp,
+  verifyStatusListJwt,
   verifySdJwtVc,
   verifyRecaptcha,
+  verifyPresentationResponse,
   verifyPkce,
   verifyPassword,
   verifyJwtSignedByClient,
@@ -25170,13 +25597,16 @@ export {
   toBase64Url2 as toBase64Url,
   switchActiveSession,
   stepUpPlugin,
+  statusListRoutes,
   startImpersonation,
   ssoDiscoveryRoute,
   ssoConnectionsTable,
   signWebhook,
+  signStatusList,
   signJwt,
   setupSessionsTable,
   setMemberRoles,
+  setCredentialStatus,
   sessionStore,
   sessionRoutes,
   sessionCleanup,
@@ -25229,6 +25659,7 @@ export {
   parseSignedRequestObject,
   parseSdJwtVc,
   parseSchema,
+  parsePresentationToken,
   organizationsTable,
   organizationRoutes,
   organizationMembershipsTable,
@@ -25298,6 +25729,7 @@ export {
   getStatus,
   getRegisteredClient,
   getOrRefreshFederatedTokens,
+  getCredentialStatus,
   generateTotpSecret,
   generateTotp,
   generateSigningKey,
@@ -25347,6 +25779,7 @@ export {
   createVault,
   createTotpKeyUri,
   createTamperEvidentSink,
+  createStatusList,
   createSiemLogStream,
   createSetupSession,
   createSecretCipher,
@@ -25355,6 +25788,7 @@ export {
   createRedisLockoutStore,
   createRedisFgaCache,
   createRedisAuthSessionStore,
+  createPresentationRequest,
   createPostgresWebhookDeliveryStore,
   createPostgresWebAuthnCredentialStore,
   createPostgresWarrantStore,
@@ -25435,6 +25869,7 @@ export {
   createInMemorySamlServiceProviderStore,
   createInMemoryRoleStore,
   createInMemoryPushedAuthorizationRequestStore,
+  createInMemoryPresentationRequestStore,
   createInMemoryPasswordlessTokenStore,
   createInMemoryOrganizationStore,
   createInMemoryOidcRefreshTokenStore,
@@ -25477,7 +25912,9 @@ export {
   computeCertThumbprint,
   complianceRoutes,
   check,
+  buildStatusClaim,
   buildIssuerMetadata,
+  buildHolderKeyBindingJwt,
   buildClientProviders,
   blockMigrations,
   base32Encode,
@@ -25498,6 +25935,8 @@ export {
   accessTokensTable,
   acceptInvitation,
   WEBAUTHN_CHALLENGE_COOKIE,
+  STATUS_LIST_TYP,
+  STATUS_LIST_SUB_TYP,
   REQUEST_URI_PREFIX,
   PRE_AUTHORIZED_CODE_GRANT,
   DEFAULT_WEBHOOK_TIMEOUT_MS,
@@ -25505,9 +25944,11 @@ export {
   DEFAULT_WEBAUTHN_SESSION_TTL_MS,
   DEFAULT_WEBAUTHN_ROUTE,
   DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS,
+  DEFAULT_VP_ROUTE,
   DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   DEFAULT_VCI_ROUTE,
   DEFAULT_TOKEN_ROUTE,
+  DEFAULT_STATUS_ROUTE,
   DEFAULT_SSO_SESSION_TTL_MS,
   DEFAULT_SSO_ROUTE,
   DEFAULT_SETUP_SESSION_TTL_MS,
@@ -25534,5 +25975,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=72970D27E7C7DE2F64756E2164756E21
+//# debugId=6D61B26FBEAED15664756E2164756E21
 //# sourceMappingURL=index.js.map