@absolutejs/auth 0.55.1 → 0.55.3

package/dist/mfa/routes.d.ts

@@ -138,10 +138,10 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             response: {
                 400: "Phone must be in E.164 format";
                 401: "Authentication required";
-                501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
                 };
+                501: "SMS MFA is not configured";
                 422: {
                     type: "validation";
                     on: string;
@@ -169,6 +169,7 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                 200: {
                     readonly status: "enrolled";
                 };
+                429: "Too many attempts";
                 422: {
                     type: "validation";
                     on: string;
@@ -178,7 +179,6 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
             };
         };
     };

package/dist/mfa/sms.d.ts

@@ -40,10 +40,10 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
             response: {
                 400: "Phone must be in E.164 format";
                 401: "Authentication required";
-                501: "SMS MFA is not configured";
                 200: {
                     readonly phone: string;
                 };
+                501: "SMS MFA is not configured";
                 422: {
                     type: "validation";
                     on: string;
@@ -71,6 +71,7 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                 200: {
                     readonly status: "enrolled";
                 };
+                429: "Too many attempts";
                 422: {
                     type: "validation";
                     on: string;
@@ -80,7 +81,6 @@ export declare const mfaSmsRoutes: <UserType>({ authSessionStore, getUserId, mfa
                     property?: string;
                     expected?: string;
                 };
-                429: "Too many attempts";
             };
         };
     };

package/dist/oidc/routes.d.ts

@@ -27,8 +27,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             body: unknown;
             params: {};
             query: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
+                client_id?: string | undefined;
                 nonce?: string | undefined;
                 claims?: string | undefined;
                 request?: string | undefined;
@@ -63,18 +63,18 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                client_id?: string | undefined;
+                grant_type?: string | undefined;
+                claim_token?: string | undefined;
                 scope?: string | undefined;
-                audience?: string | undefined;
+                assertion?: string | undefined;
                 resource?: string | undefined;
+                client_id?: string | undefined;
+                audience?: string | undefined;
                 refresh_token?: string | undefined;
                 device_code?: string | undefined;
                 auth_req_id?: string | undefined;
-                grant_type?: string | undefined;
-                claim_token?: string | undefined;
-                assertion?: string | undefined;
-                code?: string | undefined;
                 client_secret?: string | undefined;
+                code?: string | undefined;
                 redirect_uri?: string | undefined;
                 client_assertion?: string | undefined;
                 client_assertion_type?: string | undefined;
@@ -104,12 +104,12 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
+                resource?: string | undefined;
+                client_id?: string | undefined;
                 nonce?: string | undefined;
                 audience?: string | undefined;
                 claims?: string | undefined;
-                resource?: string | undefined;
                 client_secret?: string | undefined;
                 redirect_uri?: string | undefined;
                 acr_values?: string | undefined;
@@ -199,10 +199,10 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
-                login_hint?: string | undefined;
+                client_id?: string | undefined;
                 client_secret?: string | undefined;
+                login_hint?: string | undefined;
                 binding_message?: string | undefined;
             };
             params: {};
@@ -228,8 +228,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                client_id?: string | undefined;
                 scope?: string | undefined;
+                client_id?: string | undefined;
                 client_secret?: string | undefined;
             };
             params: {};
@@ -331,8 +331,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
     [x: string]: {
         post: {
             body: {
-                jwks?: any;
                 scope?: string | undefined;
+                jwks?: any;
                 backchannel_logout_uri?: string | undefined;
                 client_name?: string | undefined;
                 grant_types?: string[] | undefined;
@@ -391,8 +391,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
         ":clientId": {
             put: {
                 body: {
-                    jwks?: any;
                     scope?: string | undefined;
+                    jwks?: any;
                     backchannel_logout_uri?: string | undefined;
                     client_name?: string | undefined;
                     grant_types?: string[] | undefined;

package/dist/organizations/routes.d.ts

@@ -162,10 +162,10 @@ export declare const organizationRoutes: <UserType>({ authSessionStore, canCreat
                         response: {
                             401: "Authentication required";
                             403: "Cannot manage members";
-                            404: "Invitation not found";
                             200: {
                                 readonly revoked: string;
                             };
+                            404: "Invitation not found";
                             422: {
                                 type: "validation";
                                 on: string;

package/dist/portal/routes.d.ts

@@ -66,11 +66,11 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
                     response: {
                         401: "Invalid or expired setup link";
                         403: "This setup link cannot configure SAML";
-                        501: "SSO is not configured";
                         200: {
                             readonly configured: true;
                             readonly type: "saml";
                         };
+                        501: "SSO is not configured";
                         422: {
                             type: "validation";
                             on: string;
@@ -103,11 +103,11 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
                     response: {
                         401: "Invalid or expired setup link";
                         403: "This setup link cannot configure OIDC";
-                        501: "SSO is not configured";
                         200: {
                             readonly configured: true;
                             readonly type: "oidc";
                         };
+                        501: "SSO is not configured";
                         422: {
                             type: "validation";
                             on: string;
@@ -134,12 +134,12 @@ export declare const portalRoutes: ({ emit, onScimTokenCreated, onSsoConnectionC
                     response: {
                         401: "Invalid or expired setup link";
                         403: "This setup link cannot configure SCIM";
-                        501: "SCIM is not configured";
                         200: {
                             readonly baseUrl: `${string}/${string}`;
                             readonly token: string;
                             readonly tokenId: string;
                         };
+                        501: "SCIM is not configured";
                     };
                 };
             };

package/dist/roles/routes.d.ts

@@ -66,10 +66,10 @@ export declare const roleRoutes: <UserType>({ authSessionStore, canManageRoles,
                         response: {
                             401: "Authentication required";
                             403: "Cannot manage roles";
-                            404: "Membership not found";
                             200: {
                                 readonly roles: string[];
                             };
+                            404: "Membership not found";
                             422: {
                                 type: "validation";
                                 on: string;

package/dist/routes/refresh.d.ts

@@ -37,8 +37,8 @@ export declare const refresh: <UserType>({ authSessionStore, clientProviders, re
             response: {
                 400: "Cookies are missing" | "Invalid provider" | "No refresh token found";
                 401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found" | "No auth provider found" | "No user session found";
-                501: "Provider is not refreshable";
                 200: Response;
+                501: "Provider is not refreshable";
                 422: {
                     type: "validation";
                     on: string;

package/dist/routes/revoke.d.ts

@@ -36,8 +36,8 @@ export declare const revoke: <UserType>({ authSessionStore, clientProviders, rev
             response: {
                 400: "Cookies are missing" | "Invalid provider" | "Session has no access token to revoke";
                 401: "Provider is required" | "Client provider not found" | "Client variant is required" | "Client variant not found" | "No auth provider found" | "No user session found";
-                501: "Provider does not support revocation";
                 200: Response;
+                501: "Provider does not support revocation";
                 422: {
                     type: "validation";
                     on: string;

package/dist/routes/sessions.d.ts

@@ -34,10 +34,10 @@ export declare const sessionRoutes: <UserType>({ authSessionStore, getUserId, se
             headers: unknown;
             response: {
                 401: "Authentication required";
-                501: "Session management requires an authSessionStore";
                 200: {
                     readonly sessions: SessionSummary[];
                 };
+                501: "Session management requires an authSessionStore";
                 422: {
                     type: "validation";
                     on: string;
@@ -63,11 +63,11 @@ export declare const sessionRoutes: <UserType>({ authSessionStore, getUserId, se
                 response: {
                     400: "Invalid session id";
                     401: "Authentication required";
-                    501: "Session management requires an authSessionStore";
-                    404: "Session not found";
                     200: {
                         readonly revoked: `${string}-${string}-${string}-${string}-${string}`;
                     };
+                    501: "Session management requires an authSessionStore";
+                    404: "Session not found";
                     422: {
                         type: "validation";
                         on: string;

package/dist/server.js

@@ -3044,9 +3044,6 @@ var apiKeysRoutes = ({
   });
 };
 
-// src/agents/routes.ts
-import { Elysia as Elysia2 } from "elysia";
-
 // src/agents/config.ts
 var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
 var agentProtectedResourceMetadata = (config) => ({
@@ -3058,6 +3055,9 @@ var agentProtectedResourceMetadata = (config) => ({
   scopes_supported: config.scopes
 });
 
+// src/agents/context.ts
+import { Elysia as Elysia2 } from "elysia";
+
 // src/agents/principal.ts
 var intersectScopes = (...sets) => {
   if (sets.length === 0)
@@ -3112,6 +3112,77 @@ var resolveAgentPrincipal = async (request, config) => {
   };
 };
 
+// src/agents/context.ts
+var DELETE_CODE_POINT = 127;
+var HTTP_FORBIDDEN = 403;
+var HTTP_UNAUTHORIZED2 = 401;
+var MINIMUM_PRINTABLE_CODE_POINT = 32;
+var quoteHeaderValue = (value) => {
+  const printable = [...value].filter((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
+  }).join("");
+  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
+};
+var agentAuthChallenge = ({
+  config,
+  error,
+  requiredScopes = []
+}) => {
+  const parameters = [
+    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
+  ];
+  if (requiredScopes.length > 0) {
+    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
+  }
+  if (error !== undefined) {
+    parameters.push(`error=${quoteHeaderValue(error)}`);
+  }
+  return `Bearer ${parameters.join(", ")}`;
+};
+var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
+var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
+  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+  error_description: failure.message
+}), {
+  headers: {
+    "content-type": "application/json",
+    "www-authenticate": agentAuthChallenge({
+      config,
+      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
+      requiredScopes
+    })
+  },
+  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
+});
+var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
+  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
+    if (config === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: HTTP_UNAUTHORIZED2 });
+    }
+    const principal = await resolveAgentPrincipal(request, config);
+    if (principal === undefined) {
+      const failure = {
+        code: "Unauthorized",
+        message: "Agent is not authenticated"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    if (!agentHasScopes(principal, requiredScopes)) {
+      const failure = {
+        code: "Forbidden",
+        message: "Insufficient agent scopes"
+      };
+      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
+    }
+    return handleAuth(principal);
+  }
+}));
+
 // src/agents/registration.ts
 init_constants();
 init_crypto();
@@ -3780,50 +3851,9 @@ var revokeAgentIdentityRegistration = async (config, registrationId, now = Date.
 };
 
 // src/agents/routes.ts
-var DELETE_CODE_POINT = 127;
 var HTTP_BAD_REQUEST2 = 400;
-var HTTP_FORBIDDEN = 403;
 var HTTP_OK2 = 200;
-var HTTP_UNAUTHORIZED2 = 401;
-var MINIMUM_PRINTABLE_CODE_POINT = 32;
-var quoteHeaderValue = (value) => {
-  const printable = [...value].filter((character) => {
-    const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint >= MINIMUM_PRINTABLE_CODE_POINT && codePoint !== DELETE_CODE_POINT;
-  }).join("");
-  return `"${printable.replace(/[\\"]/g, "\\$&")}"`;
-};
-var agentAuthChallenge = ({
-  config,
-  error,
-  requiredScopes = []
-}) => {
-  const parameters = [
-    `resource_metadata=${quoteHeaderValue(agentResourceMetadataUrl(config))}`
-  ];
-  if (requiredScopes.length > 0) {
-    parameters.push(`scope=${quoteHeaderValue(requiredScopes.join(" "))}`);
-  }
-  if (error !== undefined) {
-    parameters.push(`error=${quoteHeaderValue(error)}`);
-  }
-  return `Bearer ${parameters.join(", ")}`;
-};
-var agentResourceMetadataUrl = (config) => new URL(config.metadataRoute ?? DEFAULT_AGENT_RESOURCE_METADATA_ROUTE, config.resource).toString();
-var failureResponse = (config, failure, requiredScopes) => new Response(JSON.stringify({
-  error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
-  error_description: failure.message
-}), {
-  headers: {
-    "content-type": "application/json",
-    "www-authenticate": agentAuthChallenge({
-      config,
-      error: failure.code === "Forbidden" ? "insufficient_scope" : "invalid_token",
-      requiredScopes
-    })
-  },
-  status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
-});
+var HTTP_UNAUTHORIZED3 = 401;
 var json = (value, status = HTTP_OK2) => new Response(JSON.stringify(value), {
   headers: {
     "cache-control": "no-store",
@@ -3858,7 +3888,7 @@ var registrationResponse = (result) => {
       ...body,
       error: "interaction_required",
       error_description: "Authenticate at the service and confirm the account link."
-    }, HTTP_UNAUTHORIZED2);
+    }, HTTP_UNAUTHORIZED3);
   }
   return json(body);
 };
@@ -3885,33 +3915,6 @@ var parseRegistrationInput = (value) => {
   return input;
 };
 var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
-  protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
-    if (config === undefined) {
-      const failure = {
-        code: "Unauthorized",
-        message: "Agent is not authenticated"
-      };
-      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: 401 });
-    }
-    const principal = await resolveAgentPrincipal(request, config);
-    if (principal === undefined) {
-      const failure = {
-        code: "Unauthorized",
-        message: "Agent is not authenticated"
-      };
-      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-    }
-    if (!agentHasScopes(principal, requiredScopes)) {
-      const failure = {
-        code: "Forbidden",
-        message: "Insufficient agent scopes"
-      };
-      return await handleAuthFail?.(failure) ?? failureResponse(config, failure, requiredScopes);
-    }
-    return handleAuth(principal);
-  }
-}));
 var agentAuthPlugin = (config) => {
   const plugin = agentAuthContextPlugin(config);
   if (config === undefined)
@@ -7460,7 +7463,7 @@ var HTTP_OK3 = 200;
 var HTTP_NO_CONTENT = 204;
 var HTTP_FOUND = 302;
 var HTTP_BAD_REQUEST3 = 400;
-var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_UNAUTHORIZED4 = 401;
 var HTTP_NOT_IMPLEMENTED = 501;
 var CODE_TTL_MINUTES = 10;
 var CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * CODE_TTL_MINUTES;
@@ -7634,7 +7637,7 @@ var oidcProviderRoutes = (config) => {
         "dpop-nonce": fresh,
         "www-authenticate": 'DPoP error="use_dpop_nonce"'
       },
-      status: HTTP_UNAUTHORIZED3
+      status: HTTP_UNAUTHORIZED4
     });
   };
   const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
@@ -8010,7 +8013,7 @@ var oidcProviderRoutes = (config) => {
       if (wantsSilent) {
         return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
       }
-      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED3) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
+      return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED4) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(canonicalizeRequestUrl(request.url, issuer))}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
     if (config.consentUrl !== undefined && await config.needsConsent?.({
@@ -8131,7 +8134,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
@@ -8190,7 +8193,7 @@ var oidcProviderRoutes = (config) => {
       requestHeaders: request.headers
     });
     if (auth === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
@@ -8228,11 +8231,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const result = await introspectToken({
       config,
@@ -8256,11 +8259,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     if (body.token_type_hint !== "access_token") {
       await revokeRefreshToken(config, body.token);
@@ -8284,11 +8287,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     if (body.login_hint === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "invalid_request");
@@ -8328,11 +8331,11 @@ var oidcProviderRoutes = (config) => {
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
     if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const client = await authenticateClient(clientId, clientSecret);
     if (client === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "invalid_client");
+      return oauthError2(HTTP_UNAUTHORIZED4, "invalid_client");
     }
     const requested = body.scope === undefined || body.scope.length === 0 ? client.scopes : body.scope.split(" ").filter((entry) => client.scopes.includes(entry));
     const response = await issueDeviceAuthorization({
@@ -8361,7 +8364,7 @@ var oidcProviderRoutes = (config) => {
       userSessionId: user_session_id.value
     });
     if (userSession === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED3, "login_required");
+      return oauthError2(HTTP_UNAUTHORIZED4, "login_required");
     }
     const result = body.action === "deny" ? await denyDeviceAuthorization({
       config,
@@ -8512,7 +8515,7 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED3
+        status: HTTP_UNAUTHORIZED4
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
@@ -8529,7 +8532,7 @@ var oidcProviderRoutes = (config) => {
           "content-type": "application/json",
           "www-authenticate": userInfoChallengeHeader(result.error)
         },
-        status: HTTP_UNAUTHORIZED3
+        status: HTTP_UNAUTHORIZED4
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
@@ -25052,7 +25055,7 @@ var createInMemoryCredentialOfferStore = () => {
 import { Elysia as Elysia38, t as t33 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_BAD_REQUEST4 = 400;
-var HTTP_UNAUTHORIZED4 = 401;
+var HTTP_UNAUTHORIZED5 = 401;
 var BEARER_PREFIX5 = "Bearer ";
 var errorBody = (error, status) => new Response(JSON.stringify({ error }), {
   headers: { "content-type": "application/json" },
@@ -25081,7 +25084,7 @@ var vciRoutes = ({
   }))).post(credentialRoute, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
-      return errorBody("invalid_token", HTTP_UNAUTHORIZED4);
+      return errorBody("invalid_token", HTTP_UNAUTHORIZED5);
     }
     const result = await issueCredential({
       config: vciConfig,
@@ -28652,7 +28655,7 @@ var blockMigrations = {
 // src/sso/samlIdpRoutes.ts
 import { Elysia as Elysia41, t as t36 } from "elysia";
 var HTTP_BAD_REQUEST6 = 400;
-var HTTP_UNAUTHORIZED5 = 401;
+var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
 var HTTP_OK7 = 200;
 var xmlResponse = (body) => new Response(body, {
@@ -28748,7 +28751,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined || parsed.forceAuthn === true) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED5, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED6, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -28813,7 +28816,7 @@ var samlIdpRoutes = ({
     });
     if (userSession === undefined) {
       if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED5, "login_required");
+        return errorJson(HTTP_UNAUTHORIZED6, "login_required");
       }
       return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
@@ -29358,5 +29361,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=D6C26946999A57D364756E2164756E21
+//# debugId=1844495EF9D2CC3164756E2164756E21
 //# sourceMappingURL=server.js.map