@absolutejs/auth 0.40.0-beta.0 → 0.40.0-beta.2

package/dist/index.js

@@ -2672,7 +2672,7 @@ var createOAuth2Client = async (providerName, config) => {
 };
 
 // src/index.ts
-import { Elysia as Elysia37 } from "elysia";
+import { Elysia as Elysia39 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -5288,6 +5288,36 @@ var extractHolderJwk = (proofJwt) => {
     y: typeof candidate.y === "string" ? candidate.y : undefined
   };
 };
+var verifyProofJwt = async ({
+  config,
+  issuer,
+  now,
+  proofJwt
+}) => {
+  const holderJwk = extractHolderJwk(proofJwt);
+  if (holderJwk === undefined)
+    return;
+  const decoded = await verifyJwt(proofJwt, holderJwk);
+  if (decoded === undefined)
+    return;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return;
+  const payload = { ...rawPayload };
+  if (payload.aud !== issuer)
+    return;
+  if (typeof payload.iat !== "number")
+    return;
+  if (config.credentialNonceStore !== undefined) {
+    const { nonce } = payload;
+    if (typeof nonce !== "string")
+      return;
+    const record = await config.credentialNonceStore.consumeNonce(await hashToken(nonce));
+    if (record === undefined || record.expiresAt < now)
+      return;
+  }
+  return holderJwk;
+};
 var buildIssuerMetadata = ({
   config,
   issuer,
@@ -5352,9 +5382,16 @@ var issueCredential = async ({
   const configuration = config.credentialConfigurations.find((entry) => entry.id === configurationId);
   if (configuration === undefined)
     return issueFail("invalid_credential_request");
-  const holderJwk = input.proofJwt === undefined ? undefined : extractHolderJwk(input.proofJwt);
-  if (input.proofJwt !== undefined && holderJwk === undefined) {
-    return issueFail("invalid_proof");
+  let holderJwk;
+  if (input.proofJwt !== undefined) {
+    holderJwk = await verifyProofJwt({
+      config,
+      issuer,
+      now,
+      proofJwt: input.proofJwt
+    });
+    if (holderJwk === undefined)
+      return issueFail("invalid_proof");
   }
   const selective = await config.resolveCredentialClaims({
     configurationId,
@@ -22384,6 +22421,554 @@ var vciRoutes = ({
     return Response.json({ c_nonce: nonce, c_nonce_expires_in: Math.floor(ttlMs / msPerSecond) }, { status: HTTP_OK3 });
   });
 };
+// src/vc/statusList.ts
+var STATUS_LIST_TYP = "statuslist+jwt";
+var STATUS_LIST_SUB_TYP = "application/statuslist+jwt";
+var DEFAULT_LIST_SIZE = 131072;
+var BITS_PER_BYTE = 8;
+var MS_PER_SECOND5 = 1000;
+var BYTE_MASK = 255;
+var createStatusList = (size = DEFAULT_LIST_SIZE) => {
+  if (size % BITS_PER_BYTE !== 0) {
+    throw new Error("Status list size must be a multiple of 8");
+  }
+  return new Uint8Array(size / BITS_PER_BYTE);
+};
+var getCredentialStatus = (bits, idx) => {
+  const byteIndex = Math.floor(idx / BITS_PER_BYTE);
+  const bitIndex = idx % BITS_PER_BYTE;
+  if (byteIndex >= bits.length)
+    return;
+  const byte = bits[byteIndex] ?? 0;
+  return (byte >> bitIndex & 1) === 1 ? 1 : 0;
+};
+var setCredentialStatus = (bits, idx, value) => {
+  const byteIndex = Math.floor(idx / BITS_PER_BYTE);
+  const bitIndex = idx % BITS_PER_BYTE;
+  if (byteIndex >= bits.length) {
+    throw new Error(`Status idx ${idx} out of range for this list`);
+  }
+  const current = bits[byteIndex] ?? 0;
+  const mask = 1 << bitIndex;
+  const next = value === 1 ? current | mask : current & (BYTE_MASK ^ mask);
+  bits[byteIndex] = next;
+  return bits;
+};
+var compress = async (bits) => {
+  const blob = new Blob([new Uint8Array(bits)]);
+  const stream = new Response(blob.stream().pipeThrough(new CompressionStream("deflate")));
+  const compressed = new Uint8Array(await stream.arrayBuffer());
+  return Buffer.from(compressed).toString("base64url");
+};
+var decompress = async (encoded) => {
+  const compressed = Buffer.from(encoded, "base64url");
+  const blob = new Blob([new Uint8Array(compressed)]);
+  const stream = new Response(blob.stream().pipeThrough(new DecompressionStream("deflate")));
+  return new Uint8Array(await stream.arrayBuffer());
+};
+var nowSeconds3 = (timeMs) => Math.floor(timeMs / MS_PER_SECOND5);
+var buildStatusClaim = (idx, uri) => ({
+  status_list: { idx, uri }
+});
+var signStatusList = async ({
+  bits,
+  issuer,
+  listUri,
+  now = Date.now(),
+  signingKey,
+  ttlSeconds
+}) => {
+  const payload = {
+    iat: nowSeconds3(now),
+    iss: issuer,
+    status_list: {
+      bits: 1,
+      lst: await compress(bits)
+    },
+    sub: listUri,
+    ttl: ttlSeconds
+  };
+  if (ttlSeconds !== undefined) {
+    payload.exp = nowSeconds3(now) + ttlSeconds;
+  }
+  return signJwt(payload, signingKey);
+};
+var verifyStatusListJwt = async ({
+  issuerPublicJwk,
+  token
+}) => {
+  const decoded = await verifyJwt(token, issuerPublicJwk);
+  if (decoded === undefined)
+    return;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return;
+  const payload = { ...rawPayload };
+  const statusList = payload.status_list;
+  if (typeof statusList !== "object" || statusList === null)
+    return;
+  const lst = Reflect.get(statusList, "lst");
+  const bitsPerEntry = Reflect.get(statusList, "bits");
+  if (typeof lst !== "string")
+    return;
+  if (bitsPerEntry !== undefined && bitsPerEntry !== 1) {
+    return;
+  }
+  const bits = await decompress(lst);
+  return { bits, sub: typeof payload.sub === "string" ? payload.sub : undefined };
+};
+// src/vc/statusListRoutes.ts
+import { Elysia as Elysia36, t as t32 } from "elysia";
+var HTTP_OK4 = 200;
+var HTTP_NOT_FOUND = 404;
+var DEFAULT_STATUS_ROUTE = "/vc/status";
+var statusListRoutes = ({
+  getStatusList,
+  issuerUrl,
+  signingKey,
+  statusRoute = DEFAULT_STATUS_ROUTE,
+  ttlSeconds
+}) => {
+  const listRoute = `${statusRoute}/:listId`;
+  return new Elysia36().get(listRoute, async ({ params: { listId } }) => {
+    const bits = await getStatusList(listId);
+    if (bits === undefined) {
+      return new Response("Not found", { status: HTTP_NOT_FOUND });
+    }
+    const jwt = await signStatusList({
+      bits,
+      issuer: issuerUrl,
+      listUri: `${issuerUrl}${statusRoute}/${listId}`,
+      signingKey,
+      ttlSeconds
+    });
+    return new Response(jwt, {
+      headers: { "content-type": STATUS_LIST_SUB_TYP },
+      status: HTTP_OK4
+    });
+  }, { params: t32.Object({ listId: t32.String() }) });
+};
+// src/vc/openid4vp.ts
+init_crypto();
+var REQUEST_BYTES = 16;
+var DEFAULT_REQUEST_TTL_MS = 600000;
+var MS_PER_SECOND6 = 1000;
+var createPresentationRequest = async ({
+  config,
+  getRequestUri,
+  input,
+  issuer
+}) => {
+  const requestId = generateSecureToken(REQUEST_BYTES);
+  const nonce = generateSecureToken(REQUEST_BYTES);
+  const now = input.now ?? Date.now();
+  const ttlMs = config.requestTtlMs ?? DEFAULT_REQUEST_TTL_MS;
+  const request = {
+    clientId: input.clientId,
+    createdAt: now,
+    expectedIssuerPublicJwk: config.defaultExpectedIssuerPublicJwk,
+    expiresAt: now + ttlMs,
+    nonce,
+    requestedClaims: input.requestedClaims,
+    requestId,
+    responseUri: config.getResponseUri(requestId),
+    state: input.state
+  };
+  await config.requestStore.saveRequest(request);
+  const requestObject = await signJwt({
+    aud: "https://self-issued.me/v2",
+    client_id: input.clientId,
+    iat: Math.floor(now / MS_PER_SECOND6),
+    iss: issuer,
+    nonce,
+    presentation_definition: buildSimplePresentationDefinition(requestId, input.requestedClaims),
+    response_mode: "direct_post",
+    response_type: "vp_token",
+    response_uri: request.responseUri,
+    state: input.state
+  }, config.clientSigningKey);
+  return {
+    nonce,
+    request,
+    requestObject,
+    requestUri: getRequestUri(requestId)
+  };
+};
+var buildSimplePresentationDefinition = (requestId, requestedClaims) => ({
+  id: requestId,
+  input_descriptors: [
+    {
+      constraints: {
+        fields: requestedClaims.map((claim) => ({
+          path: [`$.${claim}`]
+        })),
+        limit_disclosure: "required"
+      },
+      format: { "vc+sd-jwt": { "sd-jwt_alg_values": ["ES256"] } },
+      id: "sd-jwt-vc",
+      name: "SD-JWT VC",
+      purpose: "Verify holder claims"
+    }
+  ]
+});
+var verifyPresentationResponse = async ({
+  config,
+  input,
+  now = Date.now()
+}) => {
+  const failFor = (error) => {
+    const failure = { error, ok: false };
+    return failure;
+  };
+  const request = await config.requestStore.consumeRequest(input.requestId);
+  if (request === undefined)
+    return failFor("unknown_request");
+  if (request.expiresAt < now)
+    return failFor("expired_request");
+  const verified = await verifySdJwtVc({
+    issuerPublicJwk: request.expectedIssuerPublicJwk,
+    token: input.vpToken
+  });
+  if (verified === undefined)
+    return failFor("invalid_signature");
+  if (verified.cnf !== undefined) {
+    if (verified.keyBindingJwt === undefined) {
+      return failFor("invalid_holder_binding");
+    }
+    const valid = await verifyHolderBinding({
+      audience: request.clientId,
+      holderJwk: verified.cnf.jwk,
+      keyBindingJwt: verified.keyBindingJwt,
+      nonce: request.nonce
+    });
+    if (!valid)
+      return failFor("invalid_holder_binding");
+  }
+  const missingClaims = request.requestedClaims.filter((claim) => !(claim in verified.disclosedClaims));
+  if (missingClaims.length > 0)
+    return failFor("missing_claims");
+  const statusValid = await checkStatus({
+    config,
+    credentialClaims: verified.protectedClaims
+  });
+  if (!statusValid)
+    return failFor("revoked_credential");
+  const success = {
+    ok: true,
+    verified: {
+      disclosedClaims: verified.disclosedClaims,
+      holderJwk: verified.cnf?.jwk,
+      missingClaims,
+      protectedClaims: verified.protectedClaims,
+      requestId: request.requestId,
+      statusValid: true
+    }
+  };
+  return success;
+};
+var verifyHolderBinding = async ({
+  audience,
+  holderJwk,
+  keyBindingJwt,
+  nonce
+}) => {
+  const decoded = await verifyJwt(keyBindingJwt, holderJwk);
+  if (decoded === undefined)
+    return false;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return false;
+  const payload = { ...rawPayload };
+  if (payload.aud !== audience)
+    return false;
+  if (payload.nonce !== nonce)
+    return false;
+  if (typeof payload.iat !== "number")
+    return false;
+  return true;
+};
+var checkStatus = async ({
+  config,
+  credentialClaims
+}) => {
+  if (config.statusListResolver === undefined)
+    return true;
+  if (config.statusListPublicJwk === undefined)
+    return true;
+  const { status } = credentialClaims;
+  if (typeof status !== "object" || status === null)
+    return true;
+  const list = Reflect.get(status, "status_list");
+  if (typeof list !== "object" || list === null)
+    return true;
+  const uri = Reflect.get(list, "uri");
+  const idx = Reflect.get(list, "idx");
+  if (typeof uri !== "string" || typeof idx !== "number")
+    return true;
+  const token = await config.statusListResolver(uri);
+  if (token === undefined)
+    return true;
+  const verified = await verifyStatusListJwt({
+    issuerPublicJwk: config.statusListPublicJwk,
+    token
+  });
+  if (verified === undefined)
+    return false;
+  const bitsPerByte = 8;
+  const byteIndex = Math.floor(idx / bitsPerByte);
+  const bitIndex = idx % bitsPerByte;
+  const byte = verified.bits[byteIndex] ?? 0;
+  return (byte >> bitIndex & 1) === 0;
+};
+var buildHolderKeyBindingJwt = async ({
+  audience,
+  holderKey,
+  nonce,
+  now = Date.now(),
+  sdHash
+}) => signJwt({
+  aud: audience,
+  iat: Math.floor(now / MS_PER_SECOND6),
+  nonce,
+  sd_hash: sdHash
+}, holderKey);
+var parsePresentationToken = (vpToken) => parseSdJwtVc(vpToken);
+// src/vc/inMemoryVpStores.ts
+var createInMemoryPresentationRequestStore = () => {
+  const requests = new Map;
+  return {
+    consumeRequest: async (requestId) => {
+      const request = requests.get(requestId);
+      if (request === undefined)
+        return;
+      requests.delete(requestId);
+      return request;
+    },
+    getRequest: async (requestId) => requests.get(requestId),
+    saveRequest: async (request) => {
+      requests.set(request.requestId, request);
+    }
+  };
+};
+// src/vc/vpRoutes.ts
+import { Elysia as Elysia37, t as t33 } from "elysia";
+var HTTP_OK5 = 200;
+var HTTP_BAD_REQUEST4 = 400;
+var HTTP_NOT_FOUND2 = 404;
+var errorBody2 = (error, status) => new Response(JSON.stringify({ error }), {
+  headers: { "content-type": "application/json" },
+  status
+});
+var DEFAULT_VP_ROUTE = "/vp";
+var vpRoutes = ({
+  defaultClientId,
+  issuerUrl,
+  onVerifiedPresentation,
+  vpConfig,
+  vpRoute = DEFAULT_VP_ROUTE
+}) => {
+  const authorizeRoute = `${vpRoute}/authorize`;
+  const requestRoute = `${vpRoute}/request/:id`;
+  const responseRoute = `${vpRoute}/response`;
+  return new Elysia37().post(authorizeRoute, async ({ body }) => {
+    const input = {
+      clientId: body.client_id ?? defaultClientId,
+      requestedClaims: body.requested_claims,
+      state: body.state
+    };
+    const result = await createPresentationRequest({
+      config: vpConfig,
+      input,
+      issuer: issuerUrl,
+      getRequestUri: (id) => `${issuerUrl}${vpRoute}/request/${id}`
+    });
+    return Response.json({
+      nonce: result.nonce,
+      request_uri: result.requestUri,
+      requestId: result.request.requestId
+    }, { status: HTTP_OK5 });
+  }, {
+    body: t33.Object({
+      client_id: t33.Optional(t33.String()),
+      requested_claims: t33.Array(t33.String()),
+      state: t33.Optional(t33.String())
+    })
+  }).get(requestRoute, async ({ params: { id } }) => {
+    const stored = await vpConfig.requestStore.getRequest(id);
+    if (stored === undefined) {
+      return errorBody2("unknown_request", HTTP_NOT_FOUND2);
+    }
+    const rebuilt = await createPresentationRequest({
+      config: { ...vpConfig, requestStore: passthroughStore(stored) },
+      input: {
+        clientId: stored.clientId,
+        requestedClaims: stored.requestedClaims,
+        state: stored.state
+      },
+      issuer: issuerUrl,
+      getRequestUri: () => `${issuerUrl}${vpRoute}/request/${id}`
+    });
+    return new Response(rebuilt.requestObject, {
+      headers: { "content-type": "application/oauth-authz-req+jwt" },
+      status: HTTP_OK5
+    });
+  }, { params: t33.Object({ id: t33.String() }) }).post(responseRoute, async ({ body }) => {
+    const requestId = body.state;
+    if (requestId === undefined) {
+      return errorBody2("missing_state", HTTP_BAD_REQUEST4);
+    }
+    const result = await verifyPresentationResponse({
+      config: vpConfig,
+      input: { requestId, vpToken: body.vp_token }
+    });
+    if (!result.ok)
+      return errorBody2(result.error, HTTP_BAD_REQUEST4);
+    if (onVerifiedPresentation !== undefined) {
+      await onVerifiedPresentation({ verified: result.verified });
+    }
+    return Response.json({
+      disclosed_claims: result.verified.disclosedClaims,
+      holder_jwk: result.verified.holderJwk,
+      protected_claims: result.verified.protectedClaims,
+      verified: true
+    }, { status: HTTP_OK5 });
+  }, {
+    body: t33.Object({
+      presentation_submission: t33.Optional(t33.Unknown()),
+      state: t33.Optional(t33.String()),
+      vp_token: t33.String()
+    })
+  });
+};
+var passthroughStore = (request) => ({
+  consumeRequest: async () => request,
+  getRequest: async () => request,
+  saveRequest: async () => {}
+});
+// src/vc/postgresVcStores.ts
+var ID_LENGTH5 = 255;
+var vcCredentialNoncesTable = pgTable("auth_vc_credential_nonces", {
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  nonce_hash: varchar("nonce_hash", { length: ID_LENGTH5 }).primaryKey()
+});
+var vcCredentialOffersTable = pgTable("auth_vc_credential_offers", {
+  client_id: varchar("client_id", { length: ID_LENGTH5 }).notNull(),
+  configuration_id: varchar("configuration_id", {
+    length: ID_LENGTH5
+  }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  pre_authorized_code_hash: varchar("pre_authorized_code_hash", {
+    length: ID_LENGTH5
+  }).primaryKey(),
+  redeemed: boolean("redeemed").notNull(),
+  user_id: varchar("user_id", { length: ID_LENGTH5 }).notNull()
+});
+var vcPresentationRequestsTable = pgTable("auth_vc_presentation_requests", {
+  client_id: varchar("client_id", { length: ID_LENGTH5 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expected_issuer_jwk_json: jsonb("expected_issuer_jwk_json").$type().notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  nonce: varchar("nonce", { length: ID_LENGTH5 }).notNull(),
+  request_id: varchar("request_id", { length: ID_LENGTH5 }).primaryKey(),
+  requested_claims: jsonb("requested_claims").$type().notNull(),
+  response_uri: varchar("response_uri", { length: ID_LENGTH5 }).notNull(),
+  state: varchar("state", { length: ID_LENGTH5 })
+});
+var toOffer = (row) => ({
+  clientId: row.client_id,
+  configurationId: row.configuration_id,
+  createdAt: row.created_at_ms,
+  expiresAt: row.expires_at_ms,
+  preAuthorizedCodeHash: row.pre_authorized_code_hash,
+  redeemed: row.redeemed,
+  userId: row.user_id
+});
+var toOfferValues = (offer) => ({
+  client_id: offer.clientId,
+  configuration_id: offer.configurationId,
+  created_at_ms: offer.createdAt,
+  expires_at_ms: offer.expiresAt,
+  pre_authorized_code_hash: offer.preAuthorizedCodeHash,
+  redeemed: offer.redeemed,
+  user_id: offer.userId
+});
+var toPresentationRequest = (row) => ({
+  clientId: row.client_id,
+  createdAt: row.created_at_ms,
+  expectedIssuerPublicJwk: row.expected_issuer_jwk_json,
+  expiresAt: row.expires_at_ms,
+  nonce: row.nonce,
+  requestedClaims: row.requested_claims,
+  requestId: row.request_id,
+  responseUri: row.response_uri,
+  state: row.state ?? undefined
+});
+var toPresentationRequestValues = (request) => ({
+  client_id: request.clientId,
+  created_at_ms: request.createdAt,
+  expected_issuer_jwk_json: request.expectedIssuerPublicJwk,
+  expires_at_ms: request.expiresAt,
+  nonce: request.nonce,
+  request_id: request.requestId,
+  requested_claims: request.requestedClaims,
+  response_uri: request.responseUri,
+  state: request.state ?? null
+});
+var createNeonCredentialNonceStore = (databaseUrl) => createPostgresCredentialNonceStore(createNeonDatabase(databaseUrl));
+var createNeonCredentialOfferStore = (databaseUrl) => createPostgresCredentialOfferStore(createNeonDatabase(databaseUrl));
+var createNeonPresentationRequestStore = (databaseUrl) => createPostgresPresentationRequestStore(createNeonDatabase(databaseUrl));
+var createPostgresCredentialNonceStore = (database) => ({
+  consumeNonce: async (nonceHash) => {
+    const rows = await database.select().from(vcCredentialNoncesTable).where(eq(vcCredentialNoncesTable.nonce_hash, nonceHash)).limit(1);
+    const [row] = rows;
+    if (row === undefined)
+      return;
+    await database.delete(vcCredentialNoncesTable).where(eq(vcCredentialNoncesTable.nonce_hash, nonceHash));
+    const record = {
+      expiresAt: row.expires_at_ms,
+      nonceHash: row.nonce_hash
+    };
+    return record;
+  },
+  saveNonce: async (record) => {
+    await database.insert(vcCredentialNoncesTable).values({
+      expires_at_ms: record.expiresAt,
+      nonce_hash: record.nonceHash
+    });
+  }
+});
+var createPostgresCredentialOfferStore = (database) => ({
+  consumeOffer: async (preAuthorizedCodeHash) => {
+    const rows = await database.select().from(vcCredentialOffersTable).where(eq(vcCredentialOffersTable.pre_authorized_code_hash, preAuthorizedCodeHash)).limit(1);
+    const [row] = rows;
+    if (row === undefined)
+      return;
+    await database.update(vcCredentialOffersTable).set({ redeemed: true }).where(eq(vcCredentialOffersTable.pre_authorized_code_hash, preAuthorizedCodeHash));
+    return toOffer(row);
+  },
+  saveOffer: async (offer) => {
+    await database.insert(vcCredentialOffersTable).values(toOfferValues(offer));
+  }
+});
+var createPostgresPresentationRequestStore = (database) => ({
+  consumeRequest: async (requestId) => {
+    const rows = await database.select().from(vcPresentationRequestsTable).where(eq(vcPresentationRequestsTable.request_id, requestId)).limit(1);
+    const [row] = rows;
+    if (row === undefined)
+      return;
+    await database.delete(vcPresentationRequestsTable).where(eq(vcPresentationRequestsTable.request_id, requestId));
+    return toPresentationRequest(row);
+  },
+  getRequest: async (requestId) => {
+    const rows = await database.select().from(vcPresentationRequestsTable).where(eq(vcPresentationRequestsTable.request_id, requestId)).limit(1);
+    const [row] = rows;
+    return row === undefined ? undefined : toPresentationRequest(row);
+  },
+  saveRequest: async (request) => {
+    await database.insert(vcPresentationRequestsTable).values(toPresentationRequestValues(request));
+  }
+});
 // src/scim/inMemoryScimTokenStore.ts
 var createInMemoryScimTokenStore = () => {
   const tokens = new Map;
@@ -22399,15 +22984,15 @@ var createInMemoryScimTokenStore = () => {
   };
 };
 // src/scim/postgresScimTokenStore.ts
-var ID_LENGTH5 = 255;
+var ID_LENGTH6 = 255;
 var scimTokensTable = pgTable("auth_scim_tokens", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  hashed_token: varchar("hashed_token", { length: ID_LENGTH5 }).notNull(),
+  hashed_token: varchar("hashed_token", { length: ID_LENGTH6 }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH5
+    length: ID_LENGTH6
   }).notNull(),
-  token_id: varchar("token_id", { length: ID_LENGTH5 }).primaryKey()
+  token_id: varchar("token_id", { length: ID_LENGTH6 }).primaryKey()
 });
 var toToken2 = (row) => ({
   createdAt: row.created_at_ms,
@@ -22496,33 +23081,33 @@ var createInMemoryApiKeyStore = () => {
   };
 };
 // src/apikeys/postgresStores.ts
-var ID_LENGTH6 = 255;
+var ID_LENGTH7 = 255;
 var accessTokensTable = pgTable("auth_access_tokens", {
-  client_id: varchar("client_id", { length: ID_LENGTH6 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  hashed_token: varchar("hashed_token", { length: ID_LENGTH6 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH6 }),
+  hashed_token: varchar("hashed_token", { length: ID_LENGTH7 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
   scopes: text("scopes").array().notNull(),
-  token_id: varchar("token_id", { length: ID_LENGTH6 }).primaryKey()
+  token_id: varchar("token_id", { length: ID_LENGTH7 }).primaryKey()
 });
 var apiClientsTable = pgTable("auth_api_clients", {
-  client_id: varchar("client_id", { length: ID_LENGTH6 }).primaryKey(),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH6 }).notNull(),
-  name: varchar("name", { length: ID_LENGTH6 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH6 }),
+  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
   scopes: text("scopes").array().notNull()
 });
 var apiKeysTable = pgTable("auth_api_keys", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }),
-  hashed_key: varchar("hashed_key", { length: ID_LENGTH6 }).notNull(),
-  key_id: varchar("key_id", { length: ID_LENGTH6 }).primaryKey(),
+  hashed_key: varchar("hashed_key", { length: ID_LENGTH7 }).notNull(),
+  key_id: varchar("key_id", { length: ID_LENGTH7 }).primaryKey(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
-  name: varchar("name", { length: ID_LENGTH6 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH6 }),
-  prefix: varchar("prefix", { length: ID_LENGTH6 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
+  prefix: varchar("prefix", { length: ID_LENGTH7 }).notNull(),
   scopes: text("scopes").array().notNull()
 });
 var toKey = (row) => ({
@@ -22831,11 +23416,11 @@ var createInMemoryPushedAuthorizationRequestStore = () => {
 // src/oidc/postgresStores.ts
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
-var ID_LENGTH7 = 255;
+var ID_LENGTH8 = 255;
 var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_requests", {
-  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH7 }).primaryKey(),
+  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH8 }).primaryKey(),
   binding_message: text("binding_message"),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   interval_seconds: bigint("interval_seconds", {
@@ -22844,30 +23429,30 @@ var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_req
   last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
-  user_sub: varchar("user_sub", { length: ID_LENGTH7 })
+  user_sub: varchar("user_sub", { length: ID_LENGTH8 })
 });
 var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   composite_key: varchar("composite_key", {
-    length: ID_LENGTH7
+    length: ID_LENGTH8
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  jti: varchar("jti", { length: ID_LENGTH7 }).notNull()
+  jti: varchar("jti", { length: ID_LENGTH8 }).notNull()
 });
 var oauthClientRegistrationTokensTable = pgTable("auth_oauth_client_registration_tokens", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey()
 });
 var oauthClientsTable = pgTable("auth_oauth_clients", {
   backchannel_logout_uri: varchar("backchannel_logout_uri", {
     length: URL_LENGTH
   }),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
-  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).primaryKey(),
+  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH8 }),
   jwks_json: jsonb("jwks_json").$type(),
   jwks_uri: varchar("jwks_uri", { length: URL_LENGTH }),
-  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH8 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
   require_pushed_authorization_requests: boolean("require_pushed_authorization_requests"),
@@ -22875,65 +23460,65 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
-  acr: varchar("acr", { length: ID_LENGTH7 }),
+  acr: varchar("acr", { length: ID_LENGTH8 }),
   claims_json: jsonb("claims_json").$type(),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
-  code_challenge: varchar("code_challenge", { length: ID_LENGTH7 }).notNull(),
-  code_hash: varchar("code_hash", { length: ID_LENGTH7 }).primaryKey(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  code_challenge: varchar("code_challenge", { length: ID_LENGTH8 }).notNull(),
+  code_hash: varchar("code_hash", { length: ID_LENGTH8 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH7 }),
+  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH8 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  nonce: varchar("nonce", { length: ID_LENGTH7 }),
-  redirect_uri: varchar("redirect_uri", { length: ID_LENGTH7 }).notNull(),
+  nonce: varchar("nonce", { length: ID_LENGTH8 }),
+  redirect_uri: varchar("redirect_uri", { length: ID_LENGTH8 }).notNull(),
   scopes: text("scopes").array().notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   device_code_hash: varchar("device_code_hash", {
-    length: ID_LENGTH7
+    length: ID_LENGTH8
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   interval_seconds: bigint("interval_seconds", { mode: "number" }).notNull(),
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
-  user_sub: varchar("user_sub", { length: ID_LENGTH7 })
+  user_sub: varchar("user_sub", { length: ID_LENGTH8 })
 });
 var oauthInitialAccessTokensTable = pgTable("auth_oauth_initial_access_tokens", {
-  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey()
 });
 var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   endpoint_url: varchar("endpoint_url", { length: URL_LENGTH }).notNull(),
-  id: varchar("id", { length: ID_LENGTH7 }).primaryKey(),
+  id: varchar("id", { length: ID_LENGTH8 }).primaryKey(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" }),
   logout_token: text("logout_token").notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var oauthPushedAuthorizationRequestsTable = pgTable("auth_oauth_pushed_authorization_requests", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   params_json: jsonb("params_json").$type().notNull(),
   request_uri_hash: varchar("request_uri_hash", {
-    length: ID_LENGTH7
+    length: ID_LENGTH8
   }).primaryKey()
 });
 var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
-  acr: varchar("acr", { length: ID_LENGTH7 }),
+  acr: varchar("acr", { length: ID_LENGTH8 }),
   claims_json: jsonb("claims_json").$type(),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH7 }),
+  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH8 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   scopes: text("scopes").array().notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey(),
-  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey(),
+  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var toClient2 = (row) => ({
   backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
@@ -23456,29 +24041,29 @@ var createInMemoryLoginHistoryStore = () => {
   };
 };
 // src/adaptive/postgresStores.ts
-var ID_LENGTH8 = 255;
+var ID_LENGTH9 = 255;
 var knownDevicesTable = pgTable("auth_known_devices", {
-  device_id: varchar("device_id", { length: ID_LENGTH8 }).notNull(),
+  device_id: varchar("device_id", { length: ID_LENGTH9 }).notNull(),
   first_seen_at_ms: bigint("first_seen_at_ms", {
     mode: "number"
   }).notNull(),
-  label: varchar("label", { length: ID_LENGTH8 }),
+  label: varchar("label", { length: ID_LENGTH9 }),
   last_seen_at_ms: bigint("last_seen_at_ms", {
     mode: "number"
   }).notNull(),
   trusted: boolean("trusted").notNull().default(false),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 }, (table) => [primaryKey({ columns: [table.user_id, table.device_id] })]);
 var loginHistoryTable = pgTable("auth_login_history", {
-  attempt_id: varchar("attempt_id", { length: ID_LENGTH8 }).primaryKey(),
-  country: varchar("country", { length: ID_LENGTH8 }),
-  device_id: varchar("device_id", { length: ID_LENGTH8 }).notNull(),
-  ip_address: varchar("ip_address", { length: ID_LENGTH8 }),
+  attempt_id: varchar("attempt_id", { length: ID_LENGTH9 }).primaryKey(),
+  country: varchar("country", { length: ID_LENGTH9 }),
+  device_id: varchar("device_id", { length: ID_LENGTH9 }).notNull(),
+  ip_address: varchar("ip_address", { length: ID_LENGTH9 }),
   latitude: doublePrecision("latitude"),
   longitude: doublePrecision("longitude"),
-  outcome: varchar("outcome", { length: ID_LENGTH8 }).notNull(),
+  outcome: varchar("outcome", { length: ID_LENGTH9 }).notNull(),
   timestamp_ms: bigint("timestamp_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 });
 var toRiskAction = (value) => {
   if (value === "deny")
@@ -23802,15 +24387,15 @@ var createRedisFgaCache = (redis, { keyPrefix = DEFAULT_PREFIX2, ttlMs = DEFAULT
   }
 });
 // src/fga/postgresStores.ts
-var ID_LENGTH9 = 255;
+var ID_LENGTH10 = 255;
 var warrantsTable = pgTable("auth_fga_warrants", {
-  id: varchar("id", { length: ID_LENGTH9 }).primaryKey(),
-  relation: varchar("relation", { length: ID_LENGTH9 }).notNull(),
-  resource_id: varchar("resource_id", { length: ID_LENGTH9 }).notNull(),
-  resource_type: varchar("resource_type", { length: ID_LENGTH9 }).notNull(),
-  subject_id: varchar("subject_id", { length: ID_LENGTH9 }).notNull(),
-  subject_relation: varchar("subject_relation", { length: ID_LENGTH9 }),
-  subject_type: varchar("subject_type", { length: ID_LENGTH9 }).notNull()
+  id: varchar("id", { length: ID_LENGTH10 }).primaryKey(),
+  relation: varchar("relation", { length: ID_LENGTH10 }).notNull(),
+  resource_id: varchar("resource_id", { length: ID_LENGTH10 }).notNull(),
+  resource_type: varchar("resource_type", { length: ID_LENGTH10 }).notNull(),
+  subject_id: varchar("subject_id", { length: ID_LENGTH10 }).notNull(),
+  subject_relation: varchar("subject_relation", { length: ID_LENGTH10 }),
+  subject_type: varchar("subject_type", { length: ID_LENGTH10 }).notNull()
 });
 var toWarrant = (row) => ({
   relation: row.relation,
@@ -23847,41 +24432,41 @@ var createPostgresWarrantStore = (db) => ({
 });
 
 // src/organizations/postgresOrganizationStore.ts
-var ID_LENGTH10 = 255;
+var ID_LENGTH11 = 255;
 var NAME_LENGTH = 255;
 var STATE_LENGTH = 16;
 var organizationInvitationsTable = pgTable("auth_organization_invitations", {
   accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  email: varchar("email", { length: ID_LENGTH10 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH11 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   invitation_id: varchar("invitation_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).primaryKey(),
-  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH10 }),
+  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH11 }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
-  token_hash: varchar("token_hash", { length: ID_LENGTH10 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH11 }).notNull().unique()
 });
 var organizationMembershipsTable = pgTable("auth_organization_memberships", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH10 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH11 }).notNull()
 }, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
 var organizationsTable = pgTable("auth_organizations", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   metadata: jsonb("metadata").$type(),
   name: varchar("name", { length: NAME_LENGTH }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).primaryKey(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -23999,11 +24584,11 @@ var createPostgresOrganizationStore = (db) => ({
 });
 
 // src/passwordless/postgresPasswordlessTokenStore.ts
-var ID_LENGTH11 = 255;
+var ID_LENGTH12 = 255;
 var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
-  email: varchar("email", { length: ID_LENGTH11 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH12 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH11 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).primaryKey()
 });
 var toToken3 = (row) => ({
   email: row.email,
@@ -24030,19 +24615,19 @@ var createPostgresPasswordlessTokenStore = (db) => ({
 });
 
 // src/portal/postgresSetupSessionStore.ts
-var ID_LENGTH12 = 255;
+var ID_LENGTH13 = 255;
 var setupSessionsTable = pgTable("auth_setup_sessions", {
   capabilities: jsonb("capabilities").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  created_by: varchar("created_by", { length: ID_LENGTH12 }),
+  created_by: varchar("created_by", { length: ID_LENGTH13 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).notNull(),
   setup_session_id: varchar("setup_session_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).primaryKey(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).notNull().unique()
 });
 var toSession = (row) => ({
   capabilities: row.capabilities,
@@ -24080,12 +24665,12 @@ var createPostgresSetupSessionStore = (db) => ({
 });
 
 // src/roles/postgresRoleStore.ts
-var ID_LENGTH13 = 255;
+var ID_LENGTH14 = 255;
 var SLUG_LENGTH = 128;
 var GLOBAL_SCOPE = "";
 var rolesTable = pgTable("auth_roles", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", { length: ID_LENGTH13 }).notNull().default(GLOBAL_SCOPE),
+  organization_id: varchar("organization_id", { length: ID_LENGTH14 }).notNull().default(GLOBAL_SCOPE),
   permissions: jsonb("permissions").$type().notNull().default([]),
   slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -24126,13 +24711,13 @@ var createPostgresRoleStore = (db) => ({
 });
 
 // src/sso/postgresSamlServiceProviderStore.ts
-var ID_LENGTH14 = 255;
+var ID_LENGTH15 = 255;
 var URL_LENGTH2 = 2048;
 var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
   acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
-  name_id_format: varchar("name_id_format", { length: ID_LENGTH14 }),
+  name_id_format: varchar("name_id_format", { length: ID_LENGTH15 }),
   signing_cert: text("signing_cert"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -24174,15 +24759,15 @@ var createPostgresSamlServiceProviderStore = (db) => ({
 });
 
 // src/sso/postgresSsoConnectionStore.ts
-var ID_LENGTH15 = 255;
+var ID_LENGTH16 = 255;
 var TYPE_LENGTH2 = 16;
 var ssoConnectionsTable = pgTable("auth_sso_connections", {
   config: jsonb("config").$type().notNull(),
-  connection_id: varchar("connection_id", { length: ID_LENGTH15 }).primaryKey(),
+  connection_id: varchar("connection_id", { length: ID_LENGTH16 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   enabled: boolean("enabled").notNull().default(true),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH15
+    length: ID_LENGTH16
   }).notNull(),
   type: varchar("type", { length: TYPE_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -24288,18 +24873,18 @@ var createPostgresSsoConnectionStore = (db) => ({
 });
 
 // src/webauthn/postgresWebAuthnCredentialStore.ts
-var ID_LENGTH16 = 255;
+var ID_LENGTH17 = 255;
 var DEVICE_TYPE_LENGTH = 32;
 var webauthnCredentialsTable = pgTable("auth_webauthn_credentials", {
   backed_up: boolean("backed_up"),
   counter: bigint("counter", { mode: "number" }).notNull().default(0),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  credential_id: varchar("credential_id", { length: ID_LENGTH16 }).primaryKey(),
+  credential_id: varchar("credential_id", { length: ID_LENGTH17 }).primaryKey(),
   device_type: varchar("device_type", { length: DEVICE_TYPE_LENGTH }),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   public_key: text("public_key").notNull(),
   transports: jsonb("transports").$type(),
-  user_id: varchar("user_id", { length: ID_LENGTH16 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH17 }).notNull()
 });
 var toCredential = (row) => ({
   backedUp: row.backed_up ?? undefined,
@@ -24346,14 +24931,14 @@ var createPostgresWebAuthnCredentialStore = (db) => ({
 });
 
 // src/webhooks/postgresStore.ts
-var ID_LENGTH17 = 255;
+var ID_LENGTH18 = 255;
 var URL_LENGTH3 = 2048;
 var DEFAULT_LIST_LIMIT3 = 100;
 var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
-  envelope_id: varchar("envelope_id", { length: ID_LENGTH17 }).primaryKey(),
+  envelope_id: varchar("envelope_id", { length: ID_LENGTH18 }).primaryKey(),
   envelope_json: jsonb("envelope_json").$type().notNull(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" })
@@ -24543,22 +25128,27 @@ var blockMigrations = {
   ]),
   sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
   vault: initMigration("vault", [vaultEntriesTable]),
+  vc: initMigration("vc", [
+    vcCredentialOffersTable,
+    vcCredentialNoncesTable,
+    vcPresentationRequestsTable
+  ]),
   webauthn: initMigration("webauthn", [webauthnCredentialsTable]),
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia36, t as t32 } from "elysia";
-var HTTP_BAD_REQUEST4 = 400;
+import { Elysia as Elysia38, t as t34 } from "elysia";
+var HTTP_BAD_REQUEST5 = 400;
 var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_FOUND2 = 302;
-var HTTP_OK4 = 200;
+var HTTP_OK6 = 200;
 var xmlResponse = (body) => new Response(body, {
   headers: { "content-type": "application/samlmetadata+xml" },
-  status: HTTP_OK4
+  status: HTTP_OK6
 });
 var htmlResponse = (body) => new Response(body, {
   headers: { "content-type": "text/html; charset=utf-8" },
-  status: HTTP_OK4
+  status: HTTP_OK6
 });
 var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
 var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
@@ -24610,7 +25200,7 @@ var samlIdpRoutes = ({
     userSessionIdValue
   }) => {
     if (body.SAMLRequest === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "missing_saml_request");
+      return errorJson(HTTP_BAD_REQUEST5, "missing_saml_request");
     }
     let firstPass;
     try {
@@ -24619,11 +25209,11 @@ var samlIdpRoutes = ({
         samlRequest: body.SAMLRequest
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST4, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
     }
     let parsed;
     try {
@@ -24636,7 +25226,7 @@ var samlIdpRoutes = ({
         signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
       });
     } catch {
-      return errorJson(HTTP_BAD_REQUEST4, "invalid_authn_request");
+      return errorJson(HTTP_BAD_REQUEST5, "invalid_authn_request");
     }
     const userSession = await loadSessionFromSource({
       authSessionStore,
@@ -24657,7 +25247,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia36().use(sessionStore()).post(ssoIdpRoute, async ({
+  return new Elysia38().use(sessionStore()).post(ssoIdpRoute, async ({
     body,
     cookie: { user_session_id },
     request,
@@ -24669,12 +25259,12 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    body: t32.Object({
-      RelayState: t32.Optional(t32.String()),
-      SAMLRequest: t32.Optional(t32.String())
+    body: t34.Object({
+      RelayState: t34.Optional(t34.String()),
+      SAMLRequest: t34.Optional(t34.String())
     }),
-    cookie: t32.Cookie({
-      user_session_id: t32.Optional(userSessionIdTypebox)
+    cookie: t34.Cookie({
+      user_session_id: t34.Optional(userSessionIdTypebox)
     })
   }).get(ssoIdpRoute, async ({
     cookie: { user_session_id },
@@ -24688,14 +25278,14 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    cookie: t32.Cookie({
-      user_session_id: t32.Optional(userSessionIdTypebox)
+    cookie: t34.Cookie({
+      user_session_id: t34.Optional(userSessionIdTypebox)
     }),
-    query: t32.Object({
-      RelayState: t32.Optional(t32.String()),
-      SAMLRequest: t32.Optional(t32.String()),
-      SigAlg: t32.Optional(t32.String()),
-      Signature: t32.Optional(t32.String())
+    query: t34.Object({
+      RelayState: t34.Optional(t34.String()),
+      SAMLRequest: t34.Optional(t34.String()),
+      SigAlg: t34.Optional(t34.String()),
+      Signature: t34.Optional(t34.String())
     })
   }).get(idpInitiateRoute, async ({
     cookie: { user_session_id },
@@ -24704,11 +25294,11 @@ var samlIdpRoutes = ({
     store
   }) => {
     if (serviceProviderEntityId === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "missing_sp");
+      return errorJson(HTTP_BAD_REQUEST5, "missing_sp");
     }
     const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
     if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST4, "unknown_service_provider");
+      return errorJson(HTTP_BAD_REQUEST5, "unknown_service_provider");
     }
     const userSession = authSessionStore === undefined ? await loadSessionFromSource({
       session: store.session,
@@ -24731,12 +25321,12 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   }, {
-    cookie: t32.Cookie({
-      user_session_id: t32.Optional(userSessionIdTypebox)
+    cookie: t34.Cookie({
+      user_session_id: t34.Optional(userSessionIdTypebox)
     }),
-    query: t32.Object({
-      RelayState: t32.Optional(t32.String()),
-      sp: t32.Optional(t32.String())
+    query: t34.Object({
+      RelayState: t34.Optional(t34.String()),
+      sp: t34.Optional(t34.String())
     })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
@@ -25034,7 +25624,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  return new Elysia37().use(sessionCleanup({
+  return new Elysia39().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -25082,53 +25672,53 @@ var auth = async ({
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     lockoutGuard
-  }) : new Elysia37).use(auditedMfa ? mfaRoutes({
+  }) : new Elysia39).use(auditedMfa ? mfaRoutes({
     ...auditedMfa,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia37).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia39).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia37).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia37).use(sso ? oidcSsoRoutes({
+  }) : new Elysia39).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia39).use(sso ? oidcSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure
-  }) : new Elysia37).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia39).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     samlAdapter: sso.samlAdapter
-  }) : new Elysia37).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+  }) : new Elysia39).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
     ssoConnectionStore: sso.ssoConnectionStore,
     ssoRoute: sso.ssoRoute
-  }) : new Elysia37).use(scim ? scimRoutes(scim) : new Elysia37).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia37).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia37).use(organizations ? organizationRoutes({
+  }) : new Elysia39).use(scim ? scimRoutes(scim) : new Elysia39).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia39).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia39).use(organizations ? organizationRoutes({
     ...organizations,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(roles ? roleRoutes({
+  }) : new Elysia39).use(roles ? roleRoutes({
     ...roles,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia37).use(webauthn ? webauthnRoutes({
+  }) : new Elysia39).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia39).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
     cookieSecure: resolvedCookieSecure,
     emit: auditEmit
-  }) : new Elysia37).use(compliance ? complianceRoutes({
+  }) : new Elysia39).use(compliance ? complianceRoutes({
     ...compliance,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
+  }) : new Elysia39).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
     ...authorization,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia37).use(htmx ? createAuthHtmxRoutes({
+  }) : new Elysia39).use(htmx ? createAuthHtmxRoutes({
     ...htmx,
     authSessionStore
-  }) : new Elysia37);
+  }) : new Elysia39);
 };
 export {
   writeWarrant,
@@ -25138,11 +25728,14 @@ export {
   webauthnCredentialsTable,
   warrantsTable,
   warrantKey,
+  vpRoutes,
   verifyWebhookSignature,
   verifyTurnstile,
   verifyTotp,
+  verifyStatusListJwt,
   verifySdJwtVc,
   verifyRecaptcha,
+  verifyPresentationResponse,
   verifyPkce,
   verifyPassword,
   verifyJwtSignedByClient,
@@ -25159,6 +25752,9 @@ export {
   verifyApiKey,
   verifyAccessToken,
   vciRoutes,
+  vcPresentationRequestsTable,
+  vcCredentialOffersTable,
+  vcCredentialNoncesTable,
   vaultEntriesTable,
   validateSession,
   validateEmailDeliverability,
@@ -25170,13 +25766,16 @@ export {
   toBase64Url2 as toBase64Url,
   switchActiveSession,
   stepUpPlugin,
+  statusListRoutes,
   startImpersonation,
   ssoDiscoveryRoute,
   ssoConnectionsTable,
   signWebhook,
+  signStatusList,
   signJwt,
   setupSessionsTable,
   setMemberRoles,
+  setCredentialStatus,
   sessionStore,
   sessionRoutes,
   sessionCleanup,
@@ -25229,6 +25828,7 @@ export {
   parseSignedRequestObject,
   parseSdJwtVc,
   parseSchema,
+  parsePresentationToken,
   organizationsTable,
   organizationRoutes,
   organizationMembershipsTable,
@@ -25298,6 +25898,7 @@ export {
   getStatus,
   getRegisteredClient,
   getOrRefreshFederatedTokens,
+  getCredentialStatus,
   generateTotpSecret,
   generateTotp,
   generateSigningKey,
@@ -25347,6 +25948,7 @@ export {
   createVault,
   createTotpKeyUri,
   createTamperEvidentSink,
+  createStatusList,
   createSiemLogStream,
   createSetupSession,
   createSecretCipher,
@@ -25355,6 +25957,7 @@ export {
   createRedisLockoutStore,
   createRedisFgaCache,
   createRedisAuthSessionStore,
+  createPresentationRequest,
   createPostgresWebhookDeliveryStore,
   createPostgresWebAuthnCredentialStore,
   createPostgresWarrantStore,
@@ -25365,6 +25968,7 @@ export {
   createPostgresSamlServiceProviderStore,
   createPostgresRoleStore,
   createPostgresPushedAuthorizationRequestStore,
+  createPostgresPresentationRequestStore,
   createPostgresPasswordlessTokenStore,
   createPostgresOrganizationStore,
   createPostgresOidcRefreshTokenStore,
@@ -25377,6 +25981,8 @@ export {
   createPostgresInitialAccessTokenStore,
   createPostgresDeviceAuthorizationStore,
   createPostgresCredentialStore,
+  createPostgresCredentialOfferStore,
+  createPostgresCredentialNonceStore,
   createPostgresClientRegistrationTokenStore,
   createPostgresClientAssertionJtiStore,
   createPostgresBackchannelAuthStore,
@@ -25397,6 +26003,7 @@ export {
   createNeonSamlServiceProviderStore,
   createNeonRoleStore,
   createNeonPushedAuthorizationRequestStore,
+  createNeonPresentationRequestStore,
   createNeonPasswordlessTokenStore,
   createNeonOrganizationStore,
   createNeonOidcRefreshTokenStore,
@@ -25412,6 +26019,8 @@ export {
   createNeonDeviceAuthorizationStore,
   createNeonDatabase,
   createNeonCredentialStore,
+  createNeonCredentialOfferStore,
+  createNeonCredentialNonceStore,
   createNeonClientRegistrationTokenStore,
   createNeonClientAssertionJtiStore,
   createNeonBackchannelAuthStore,
@@ -25435,6 +26044,7 @@ export {
   createInMemorySamlServiceProviderStore,
   createInMemoryRoleStore,
   createInMemoryPushedAuthorizationRequestStore,
+  createInMemoryPresentationRequestStore,
   createInMemoryPasswordlessTokenStore,
   createInMemoryOrganizationStore,
   createInMemoryOidcRefreshTokenStore,
@@ -25477,7 +26087,9 @@ export {
   computeCertThumbprint,
   complianceRoutes,
   check,
+  buildStatusClaim,
   buildIssuerMetadata,
+  buildHolderKeyBindingJwt,
   buildClientProviders,
   blockMigrations,
   base32Encode,
@@ -25498,6 +26110,8 @@ export {
   accessTokensTable,
   acceptInvitation,
   WEBAUTHN_CHALLENGE_COOKIE,
+  STATUS_LIST_TYP,
+  STATUS_LIST_SUB_TYP,
   REQUEST_URI_PREFIX,
   PRE_AUTHORIZED_CODE_GRANT,
   DEFAULT_WEBHOOK_TIMEOUT_MS,
@@ -25505,9 +26119,11 @@ export {
   DEFAULT_WEBAUTHN_SESSION_TTL_MS,
   DEFAULT_WEBAUTHN_ROUTE,
   DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS,
+  DEFAULT_VP_ROUTE,
   DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   DEFAULT_VCI_ROUTE,
   DEFAULT_TOKEN_ROUTE,
+  DEFAULT_STATUS_ROUTE,
   DEFAULT_SSO_SESSION_TTL_MS,
   DEFAULT_SSO_ROUTE,
   DEFAULT_SETUP_SESSION_TTL_MS,
@@ -25534,5 +26150,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=72970D27E7C7DE2F64756E2164756E21
+//# debugId=447AA182107369F564756E2164756E21
 //# sourceMappingURL=index.js.map