@absolutejs/auth 0.40.0-beta.1 → 0.40.0

package/dist/index.js

@@ -5288,6 +5288,36 @@ var extractHolderJwk = (proofJwt) => {
     y: typeof candidate.y === "string" ? candidate.y : undefined
   };
 };
+var verifyProofJwt = async ({
+  config,
+  issuer,
+  now,
+  proofJwt
+}) => {
+  const holderJwk = extractHolderJwk(proofJwt);
+  if (holderJwk === undefined)
+    return;
+  const decoded = await verifyJwt(proofJwt, holderJwk);
+  if (decoded === undefined)
+    return;
+  const rawPayload = decoded.payload;
+  if (typeof rawPayload !== "object" || rawPayload === null)
+    return;
+  const payload = { ...rawPayload };
+  if (payload.aud !== issuer)
+    return;
+  if (typeof payload.iat !== "number")
+    return;
+  if (config.credentialNonceStore !== undefined) {
+    const { nonce } = payload;
+    if (typeof nonce !== "string")
+      return;
+    const record = await config.credentialNonceStore.consumeNonce(await hashToken(nonce));
+    if (record === undefined || record.expiresAt < now)
+      return;
+  }
+  return holderJwk;
+};
 var buildIssuerMetadata = ({
   config,
   issuer,
@@ -5352,9 +5382,16 @@ var issueCredential = async ({
   const configuration = config.credentialConfigurations.find((entry) => entry.id === configurationId);
   if (configuration === undefined)
     return issueFail("invalid_credential_request");
-  const holderJwk = input.proofJwt === undefined ? undefined : extractHolderJwk(input.proofJwt);
-  if (input.proofJwt !== undefined && holderJwk === undefined) {
-    return issueFail("invalid_proof");
+  let holderJwk;
+  if (input.proofJwt !== undefined) {
+    holderJwk = await verifyProofJwt({
+      config,
+      issuer,
+      now,
+      proofJwt: input.proofJwt
+    });
+    if (holderJwk === undefined)
+      return issueFail("invalid_proof");
   }
   const selective = await config.resolveCredentialClaims({
     configurationId,
@@ -22808,6 +22845,130 @@ var passthroughStore = (request) => ({
   getRequest: async () => request,
   saveRequest: async () => {}
 });
+// src/vc/postgresVcStores.ts
+var ID_LENGTH5 = 255;
+var vcCredentialNoncesTable = pgTable("auth_vc_credential_nonces", {
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  nonce_hash: varchar("nonce_hash", { length: ID_LENGTH5 }).primaryKey()
+});
+var vcCredentialOffersTable = pgTable("auth_vc_credential_offers", {
+  client_id: varchar("client_id", { length: ID_LENGTH5 }).notNull(),
+  configuration_id: varchar("configuration_id", {
+    length: ID_LENGTH5
+  }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  pre_authorized_code_hash: varchar("pre_authorized_code_hash", {
+    length: ID_LENGTH5
+  }).primaryKey(),
+  redeemed: boolean("redeemed").notNull(),
+  user_id: varchar("user_id", { length: ID_LENGTH5 }).notNull()
+});
+var vcPresentationRequestsTable = pgTable("auth_vc_presentation_requests", {
+  client_id: varchar("client_id", { length: ID_LENGTH5 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  expected_issuer_jwk_json: jsonb("expected_issuer_jwk_json").$type().notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  nonce: varchar("nonce", { length: ID_LENGTH5 }).notNull(),
+  request_id: varchar("request_id", { length: ID_LENGTH5 }).primaryKey(),
+  requested_claims: jsonb("requested_claims").$type().notNull(),
+  response_uri: varchar("response_uri", { length: ID_LENGTH5 }).notNull(),
+  state: varchar("state", { length: ID_LENGTH5 })
+});
+var toOffer = (row) => ({
+  clientId: row.client_id,
+  configurationId: row.configuration_id,
+  createdAt: row.created_at_ms,
+  expiresAt: row.expires_at_ms,
+  preAuthorizedCodeHash: row.pre_authorized_code_hash,
+  redeemed: row.redeemed,
+  userId: row.user_id
+});
+var toOfferValues = (offer) => ({
+  client_id: offer.clientId,
+  configuration_id: offer.configurationId,
+  created_at_ms: offer.createdAt,
+  expires_at_ms: offer.expiresAt,
+  pre_authorized_code_hash: offer.preAuthorizedCodeHash,
+  redeemed: offer.redeemed,
+  user_id: offer.userId
+});
+var toPresentationRequest = (row) => ({
+  clientId: row.client_id,
+  createdAt: row.created_at_ms,
+  expectedIssuerPublicJwk: row.expected_issuer_jwk_json,
+  expiresAt: row.expires_at_ms,
+  nonce: row.nonce,
+  requestedClaims: row.requested_claims,
+  requestId: row.request_id,
+  responseUri: row.response_uri,
+  state: row.state ?? undefined
+});
+var toPresentationRequestValues = (request) => ({
+  client_id: request.clientId,
+  created_at_ms: request.createdAt,
+  expected_issuer_jwk_json: request.expectedIssuerPublicJwk,
+  expires_at_ms: request.expiresAt,
+  nonce: request.nonce,
+  request_id: request.requestId,
+  requested_claims: request.requestedClaims,
+  response_uri: request.responseUri,
+  state: request.state ?? null
+});
+var createNeonCredentialNonceStore = (databaseUrl) => createPostgresCredentialNonceStore(createNeonDatabase(databaseUrl));
+var createNeonCredentialOfferStore = (databaseUrl) => createPostgresCredentialOfferStore(createNeonDatabase(databaseUrl));
+var createNeonPresentationRequestStore = (databaseUrl) => createPostgresPresentationRequestStore(createNeonDatabase(databaseUrl));
+var createPostgresCredentialNonceStore = (database) => ({
+  consumeNonce: async (nonceHash) => {
+    const rows = await database.select().from(vcCredentialNoncesTable).where(eq(vcCredentialNoncesTable.nonce_hash, nonceHash)).limit(1);
+    const [row] = rows;
+    if (row === undefined)
+      return;
+    await database.delete(vcCredentialNoncesTable).where(eq(vcCredentialNoncesTable.nonce_hash, nonceHash));
+    const record = {
+      expiresAt: row.expires_at_ms,
+      nonceHash: row.nonce_hash
+    };
+    return record;
+  },
+  saveNonce: async (record) => {
+    await database.insert(vcCredentialNoncesTable).values({
+      expires_at_ms: record.expiresAt,
+      nonce_hash: record.nonceHash
+    });
+  }
+});
+var createPostgresCredentialOfferStore = (database) => ({
+  consumeOffer: async (preAuthorizedCodeHash) => {
+    const rows = await database.select().from(vcCredentialOffersTable).where(eq(vcCredentialOffersTable.pre_authorized_code_hash, preAuthorizedCodeHash)).limit(1);
+    const [row] = rows;
+    if (row === undefined)
+      return;
+    await database.update(vcCredentialOffersTable).set({ redeemed: true }).where(eq(vcCredentialOffersTable.pre_authorized_code_hash, preAuthorizedCodeHash));
+    return toOffer(row);
+  },
+  saveOffer: async (offer) => {
+    await database.insert(vcCredentialOffersTable).values(toOfferValues(offer));
+  }
+});
+var createPostgresPresentationRequestStore = (database) => ({
+  consumeRequest: async (requestId) => {
+    const rows = await database.select().from(vcPresentationRequestsTable).where(eq(vcPresentationRequestsTable.request_id, requestId)).limit(1);
+    const [row] = rows;
+    if (row === undefined)
+      return;
+    await database.delete(vcPresentationRequestsTable).where(eq(vcPresentationRequestsTable.request_id, requestId));
+    return toPresentationRequest(row);
+  },
+  getRequest: async (requestId) => {
+    const rows = await database.select().from(vcPresentationRequestsTable).where(eq(vcPresentationRequestsTable.request_id, requestId)).limit(1);
+    const [row] = rows;
+    return row === undefined ? undefined : toPresentationRequest(row);
+  },
+  saveRequest: async (request) => {
+    await database.insert(vcPresentationRequestsTable).values(toPresentationRequestValues(request));
+  }
+});
 // src/scim/inMemoryScimTokenStore.ts
 var createInMemoryScimTokenStore = () => {
   const tokens = new Map;
@@ -22823,15 +22984,15 @@ var createInMemoryScimTokenStore = () => {
   };
 };
 // src/scim/postgresScimTokenStore.ts
-var ID_LENGTH5 = 255;
+var ID_LENGTH6 = 255;
 var scimTokensTable = pgTable("auth_scim_tokens", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  hashed_token: varchar("hashed_token", { length: ID_LENGTH5 }).notNull(),
+  hashed_token: varchar("hashed_token", { length: ID_LENGTH6 }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH5
+    length: ID_LENGTH6
   }).notNull(),
-  token_id: varchar("token_id", { length: ID_LENGTH5 }).primaryKey()
+  token_id: varchar("token_id", { length: ID_LENGTH6 }).primaryKey()
 });
 var toToken2 = (row) => ({
   createdAt: row.created_at_ms,
@@ -22920,33 +23081,33 @@ var createInMemoryApiKeyStore = () => {
   };
 };
 // src/apikeys/postgresStores.ts
-var ID_LENGTH6 = 255;
+var ID_LENGTH7 = 255;
 var accessTokensTable = pgTable("auth_access_tokens", {
-  client_id: varchar("client_id", { length: ID_LENGTH6 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  hashed_token: varchar("hashed_token", { length: ID_LENGTH6 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH6 }),
+  hashed_token: varchar("hashed_token", { length: ID_LENGTH7 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
   scopes: text("scopes").array().notNull(),
-  token_id: varchar("token_id", { length: ID_LENGTH6 }).primaryKey()
+  token_id: varchar("token_id", { length: ID_LENGTH7 }).primaryKey()
 });
 var apiClientsTable = pgTable("auth_api_clients", {
-  client_id: varchar("client_id", { length: ID_LENGTH6 }).primaryKey(),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH6 }).notNull(),
-  name: varchar("name", { length: ID_LENGTH6 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH6 }),
+  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
   scopes: text("scopes").array().notNull()
 });
 var apiKeysTable = pgTable("auth_api_keys", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }),
-  hashed_key: varchar("hashed_key", { length: ID_LENGTH6 }).notNull(),
-  key_id: varchar("key_id", { length: ID_LENGTH6 }).primaryKey(),
+  hashed_key: varchar("hashed_key", { length: ID_LENGTH7 }).notNull(),
+  key_id: varchar("key_id", { length: ID_LENGTH7 }).primaryKey(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
-  name: varchar("name", { length: ID_LENGTH6 }).notNull(),
-  owner_id: varchar("owner_id", { length: ID_LENGTH6 }),
-  prefix: varchar("prefix", { length: ID_LENGTH6 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  owner_id: varchar("owner_id", { length: ID_LENGTH7 }),
+  prefix: varchar("prefix", { length: ID_LENGTH7 }).notNull(),
   scopes: text("scopes").array().notNull()
 });
 var toKey = (row) => ({
@@ -23255,11 +23416,11 @@ var createInMemoryPushedAuthorizationRequestStore = () => {
 // src/oidc/postgresStores.ts
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
-var ID_LENGTH7 = 255;
+var ID_LENGTH8 = 255;
 var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_requests", {
-  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH7 }).primaryKey(),
+  auth_req_id: varchar("auth_req_id", { length: ID_LENGTH8 }).primaryKey(),
   binding_message: text("binding_message"),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   interval_seconds: bigint("interval_seconds", {
@@ -23268,30 +23429,30 @@ var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_req
   last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
-  user_sub: varchar("user_sub", { length: ID_LENGTH7 })
+  user_sub: varchar("user_sub", { length: ID_LENGTH8 })
 });
 var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   composite_key: varchar("composite_key", {
-    length: ID_LENGTH7
+    length: ID_LENGTH8
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  jti: varchar("jti", { length: ID_LENGTH7 }).notNull()
+  jti: varchar("jti", { length: ID_LENGTH8 }).notNull()
 });
 var oauthClientRegistrationTokensTable = pgTable("auth_oauth_client_registration_tokens", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey()
 });
 var oauthClientsTable = pgTable("auth_oauth_clients", {
   backchannel_logout_uri: varchar("backchannel_logout_uri", {
     length: URL_LENGTH
   }),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
-  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).primaryKey(),
+  hashed_secret: varchar("hashed_secret", { length: ID_LENGTH8 }),
   jwks_json: jsonb("jwks_json").$type(),
   jwks_uri: varchar("jwks_uri", { length: URL_LENGTH }),
-  name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  name: varchar("name", { length: ID_LENGTH8 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
   require_pushed_authorization_requests: boolean("require_pushed_authorization_requests"),
@@ -23299,65 +23460,65 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
   scopes: text("scopes").array().notNull()
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
-  acr: varchar("acr", { length: ID_LENGTH7 }),
+  acr: varchar("acr", { length: ID_LENGTH8 }),
   claims_json: jsonb("claims_json").$type(),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
-  code_challenge: varchar("code_challenge", { length: ID_LENGTH7 }).notNull(),
-  code_hash: varchar("code_hash", { length: ID_LENGTH7 }).primaryKey(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
+  code_challenge: varchar("code_challenge", { length: ID_LENGTH8 }).notNull(),
+  code_hash: varchar("code_hash", { length: ID_LENGTH8 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH7 }),
+  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH8 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  nonce: varchar("nonce", { length: ID_LENGTH7 }),
-  redirect_uri: varchar("redirect_uri", { length: ID_LENGTH7 }).notNull(),
+  nonce: varchar("nonce", { length: ID_LENGTH8 }),
+  redirect_uri: varchar("redirect_uri", { length: ID_LENGTH8 }).notNull(),
   scopes: text("scopes").array().notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   device_code_hash: varchar("device_code_hash", {
-    length: ID_LENGTH7
+    length: ID_LENGTH8
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   interval_seconds: bigint("interval_seconds", { mode: "number" }).notNull(),
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
-  user_sub: varchar("user_sub", { length: ID_LENGTH7 })
+  user_sub: varchar("user_sub", { length: ID_LENGTH8 })
 });
 var oauthInitialAccessTokensTable = pgTable("auth_oauth_initial_access_tokens", {
-  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey()
 });
 var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   endpoint_url: varchar("endpoint_url", { length: URL_LENGTH }).notNull(),
-  id: varchar("id", { length: ID_LENGTH7 }).primaryKey(),
+  id: varchar("id", { length: ID_LENGTH8 }).primaryKey(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" }),
   logout_token: text("logout_token").notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var oauthPushedAuthorizationRequestsTable = pgTable("auth_oauth_pushed_authorization_requests", {
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   params_json: jsonb("params_json").$type().notNull(),
   request_uri_hash: varchar("request_uri_hash", {
-    length: ID_LENGTH7
+    length: ID_LENGTH8
   }).primaryKey()
 });
 var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
-  acr: varchar("acr", { length: ID_LENGTH7 }),
+  acr: varchar("acr", { length: ID_LENGTH8 }),
   claims_json: jsonb("claims_json").$type(),
-  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH8 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH7 }),
+  dpop_jkt: varchar("dpop_jkt", { length: ID_LENGTH8 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   scopes: text("scopes").array().notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey(),
-  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+  token_hash: varchar("token_hash", { length: ID_LENGTH8 }).primaryKey(),
+  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
 });
 var toClient2 = (row) => ({
   backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
@@ -23880,29 +24041,29 @@ var createInMemoryLoginHistoryStore = () => {
   };
 };
 // src/adaptive/postgresStores.ts
-var ID_LENGTH8 = 255;
+var ID_LENGTH9 = 255;
 var knownDevicesTable = pgTable("auth_known_devices", {
-  device_id: varchar("device_id", { length: ID_LENGTH8 }).notNull(),
+  device_id: varchar("device_id", { length: ID_LENGTH9 }).notNull(),
   first_seen_at_ms: bigint("first_seen_at_ms", {
     mode: "number"
   }).notNull(),
-  label: varchar("label", { length: ID_LENGTH8 }),
+  label: varchar("label", { length: ID_LENGTH9 }),
   last_seen_at_ms: bigint("last_seen_at_ms", {
     mode: "number"
   }).notNull(),
   trusted: boolean("trusted").notNull().default(false),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 }, (table) => [primaryKey({ columns: [table.user_id, table.device_id] })]);
 var loginHistoryTable = pgTable("auth_login_history", {
-  attempt_id: varchar("attempt_id", { length: ID_LENGTH8 }).primaryKey(),
-  country: varchar("country", { length: ID_LENGTH8 }),
-  device_id: varchar("device_id", { length: ID_LENGTH8 }).notNull(),
-  ip_address: varchar("ip_address", { length: ID_LENGTH8 }),
+  attempt_id: varchar("attempt_id", { length: ID_LENGTH9 }).primaryKey(),
+  country: varchar("country", { length: ID_LENGTH9 }),
+  device_id: varchar("device_id", { length: ID_LENGTH9 }).notNull(),
+  ip_address: varchar("ip_address", { length: ID_LENGTH9 }),
   latitude: doublePrecision("latitude"),
   longitude: doublePrecision("longitude"),
-  outcome: varchar("outcome", { length: ID_LENGTH8 }).notNull(),
+  outcome: varchar("outcome", { length: ID_LENGTH9 }).notNull(),
   timestamp_ms: bigint("timestamp_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH8 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH9 }).notNull()
 });
 var toRiskAction = (value) => {
   if (value === "deny")
@@ -24226,15 +24387,15 @@ var createRedisFgaCache = (redis, { keyPrefix = DEFAULT_PREFIX2, ttlMs = DEFAULT
   }
 });
 // src/fga/postgresStores.ts
-var ID_LENGTH9 = 255;
+var ID_LENGTH10 = 255;
 var warrantsTable = pgTable("auth_fga_warrants", {
-  id: varchar("id", { length: ID_LENGTH9 }).primaryKey(),
-  relation: varchar("relation", { length: ID_LENGTH9 }).notNull(),
-  resource_id: varchar("resource_id", { length: ID_LENGTH9 }).notNull(),
-  resource_type: varchar("resource_type", { length: ID_LENGTH9 }).notNull(),
-  subject_id: varchar("subject_id", { length: ID_LENGTH9 }).notNull(),
-  subject_relation: varchar("subject_relation", { length: ID_LENGTH9 }),
-  subject_type: varchar("subject_type", { length: ID_LENGTH9 }).notNull()
+  id: varchar("id", { length: ID_LENGTH10 }).primaryKey(),
+  relation: varchar("relation", { length: ID_LENGTH10 }).notNull(),
+  resource_id: varchar("resource_id", { length: ID_LENGTH10 }).notNull(),
+  resource_type: varchar("resource_type", { length: ID_LENGTH10 }).notNull(),
+  subject_id: varchar("subject_id", { length: ID_LENGTH10 }).notNull(),
+  subject_relation: varchar("subject_relation", { length: ID_LENGTH10 }),
+  subject_type: varchar("subject_type", { length: ID_LENGTH10 }).notNull()
 });
 var toWarrant = (row) => ({
   relation: row.relation,
@@ -24271,41 +24432,41 @@ var createPostgresWarrantStore = (db) => ({
 });
 
 // src/organizations/postgresOrganizationStore.ts
-var ID_LENGTH10 = 255;
+var ID_LENGTH11 = 255;
 var NAME_LENGTH = 255;
 var STATE_LENGTH = 16;
 var organizationInvitationsTable = pgTable("auth_organization_invitations", {
   accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  email: varchar("email", { length: ID_LENGTH10 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH11 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   invitation_id: varchar("invitation_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).primaryKey(),
-  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH10 }),
+  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH11 }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
-  token_hash: varchar("token_hash", { length: ID_LENGTH10 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH11 }).notNull().unique()
 });
 var organizationMembershipsTable = pgTable("auth_organization_memberships", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH10 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH11 }).notNull()
 }, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
 var organizationsTable = pgTable("auth_organizations", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   metadata: jsonb("metadata").$type(),
   name: varchar("name", { length: NAME_LENGTH }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).primaryKey(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -24423,11 +24584,11 @@ var createPostgresOrganizationStore = (db) => ({
 });
 
 // src/passwordless/postgresPasswordlessTokenStore.ts
-var ID_LENGTH11 = 255;
+var ID_LENGTH12 = 255;
 var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
-  email: varchar("email", { length: ID_LENGTH11 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH12 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH11 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).primaryKey()
 });
 var toToken3 = (row) => ({
   email: row.email,
@@ -24454,19 +24615,19 @@ var createPostgresPasswordlessTokenStore = (db) => ({
 });
 
 // src/portal/postgresSetupSessionStore.ts
-var ID_LENGTH12 = 255;
+var ID_LENGTH13 = 255;
 var setupSessionsTable = pgTable("auth_setup_sessions", {
   capabilities: jsonb("capabilities").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  created_by: varchar("created_by", { length: ID_LENGTH12 }),
+  created_by: varchar("created_by", { length: ID_LENGTH13 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).notNull(),
   setup_session_id: varchar("setup_session_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).primaryKey(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).notNull().unique()
 });
 var toSession = (row) => ({
   capabilities: row.capabilities,
@@ -24504,12 +24665,12 @@ var createPostgresSetupSessionStore = (db) => ({
 });
 
 // src/roles/postgresRoleStore.ts
-var ID_LENGTH13 = 255;
+var ID_LENGTH14 = 255;
 var SLUG_LENGTH = 128;
 var GLOBAL_SCOPE = "";
 var rolesTable = pgTable("auth_roles", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", { length: ID_LENGTH13 }).notNull().default(GLOBAL_SCOPE),
+  organization_id: varchar("organization_id", { length: ID_LENGTH14 }).notNull().default(GLOBAL_SCOPE),
   permissions: jsonb("permissions").$type().notNull().default([]),
   slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -24550,13 +24711,13 @@ var createPostgresRoleStore = (db) => ({
 });
 
 // src/sso/postgresSamlServiceProviderStore.ts
-var ID_LENGTH14 = 255;
+var ID_LENGTH15 = 255;
 var URL_LENGTH2 = 2048;
 var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
   acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
-  name_id_format: varchar("name_id_format", { length: ID_LENGTH14 }),
+  name_id_format: varchar("name_id_format", { length: ID_LENGTH15 }),
   signing_cert: text("signing_cert"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -24598,15 +24759,15 @@ var createPostgresSamlServiceProviderStore = (db) => ({
 });
 
 // src/sso/postgresSsoConnectionStore.ts
-var ID_LENGTH15 = 255;
+var ID_LENGTH16 = 255;
 var TYPE_LENGTH2 = 16;
 var ssoConnectionsTable = pgTable("auth_sso_connections", {
   config: jsonb("config").$type().notNull(),
-  connection_id: varchar("connection_id", { length: ID_LENGTH15 }).primaryKey(),
+  connection_id: varchar("connection_id", { length: ID_LENGTH16 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   enabled: boolean("enabled").notNull().default(true),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH15
+    length: ID_LENGTH16
   }).notNull(),
   type: varchar("type", { length: TYPE_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -24712,18 +24873,18 @@ var createPostgresSsoConnectionStore = (db) => ({
 });
 
 // src/webauthn/postgresWebAuthnCredentialStore.ts
-var ID_LENGTH16 = 255;
+var ID_LENGTH17 = 255;
 var DEVICE_TYPE_LENGTH = 32;
 var webauthnCredentialsTable = pgTable("auth_webauthn_credentials", {
   backed_up: boolean("backed_up"),
   counter: bigint("counter", { mode: "number" }).notNull().default(0),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  credential_id: varchar("credential_id", { length: ID_LENGTH16 }).primaryKey(),
+  credential_id: varchar("credential_id", { length: ID_LENGTH17 }).primaryKey(),
   device_type: varchar("device_type", { length: DEVICE_TYPE_LENGTH }),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   public_key: text("public_key").notNull(),
   transports: jsonb("transports").$type(),
-  user_id: varchar("user_id", { length: ID_LENGTH16 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH17 }).notNull()
 });
 var toCredential = (row) => ({
   backedUp: row.backed_up ?? undefined,
@@ -24770,14 +24931,14 @@ var createPostgresWebAuthnCredentialStore = (db) => ({
 });
 
 // src/webhooks/postgresStore.ts
-var ID_LENGTH17 = 255;
+var ID_LENGTH18 = 255;
 var URL_LENGTH3 = 2048;
 var DEFAULT_LIST_LIMIT3 = 100;
 var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
-  envelope_id: varchar("envelope_id", { length: ID_LENGTH17 }).primaryKey(),
+  envelope_id: varchar("envelope_id", { length: ID_LENGTH18 }).primaryKey(),
   envelope_json: jsonb("envelope_json").$type().notNull(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" })
@@ -24967,6 +25128,11 @@ var blockMigrations = {
   ]),
   sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
   vault: initMigration("vault", [vaultEntriesTable]),
+  vc: initMigration("vc", [
+    vcCredentialOffersTable,
+    vcCredentialNoncesTable,
+    vcPresentationRequestsTable
+  ]),
   webauthn: initMigration("webauthn", [webauthnCredentialsTable]),
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
@@ -25586,6 +25752,9 @@ export {
   verifyApiKey,
   verifyAccessToken,
   vciRoutes,
+  vcPresentationRequestsTable,
+  vcCredentialOffersTable,
+  vcCredentialNoncesTable,
   vaultEntriesTable,
   validateSession,
   validateEmailDeliverability,
@@ -25799,6 +25968,7 @@ export {
   createPostgresSamlServiceProviderStore,
   createPostgresRoleStore,
   createPostgresPushedAuthorizationRequestStore,
+  createPostgresPresentationRequestStore,
   createPostgresPasswordlessTokenStore,
   createPostgresOrganizationStore,
   createPostgresOidcRefreshTokenStore,
@@ -25811,6 +25981,8 @@ export {
   createPostgresInitialAccessTokenStore,
   createPostgresDeviceAuthorizationStore,
   createPostgresCredentialStore,
+  createPostgresCredentialOfferStore,
+  createPostgresCredentialNonceStore,
   createPostgresClientRegistrationTokenStore,
   createPostgresClientAssertionJtiStore,
   createPostgresBackchannelAuthStore,
@@ -25831,6 +26003,7 @@ export {
   createNeonSamlServiceProviderStore,
   createNeonRoleStore,
   createNeonPushedAuthorizationRequestStore,
+  createNeonPresentationRequestStore,
   createNeonPasswordlessTokenStore,
   createNeonOrganizationStore,
   createNeonOidcRefreshTokenStore,
@@ -25846,6 +26019,8 @@ export {
   createNeonDeviceAuthorizationStore,
   createNeonDatabase,
   createNeonCredentialStore,
+  createNeonCredentialOfferStore,
+  createNeonCredentialNonceStore,
   createNeonClientRegistrationTokenStore,
   createNeonClientAssertionJtiStore,
   createNeonBackchannelAuthStore,
@@ -25975,5 +26150,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=6D61B26FBEAED15664756E2164756E21
+//# debugId=447AA182107369F564756E2164756E21
 //# sourceMappingURL=index.js.map