@absolutejs/auth 0.55.5 → 0.55.6

package/dist/index.js

@@ -2824,7 +2824,7 @@ var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Clien
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
-import { Elysia as Elysia42 } from "elysia";
+import { Elysia as Elysia45 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -3044,6 +3044,24 @@ var apiKeysRoutes = ({
   });
 };
 
+// src/agents/routes.ts
+import { Elysia as Elysia3 } from "elysia";
+
+// src/pluginIdentity.ts
+var dependencyIds = new WeakMap;
+var nextDependencyId = 1;
+var pluginDependencySeed = (dependency) => {
+  if (dependency === undefined)
+    return "default";
+  const existing = dependencyIds.get(dependency);
+  if (existing !== undefined)
+    return existing;
+  const identity = nextDependencyId;
+  nextDependencyId += 1;
+  dependencyIds.set(dependency, identity);
+  return identity;
+};
+
 // src/agents/config.ts
 var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resource";
 var agentProtectedResourceMetadata = (config) => ({
@@ -3155,14 +3173,19 @@ var failureResponse = (config, failure, requiredScopes) => new Response(JSON.str
   },
   status: failure.code === "Forbidden" ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED2
 });
-var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => ({
+var agentAuthContextPlugin = (config) => new Elysia2({
+  name: "@absolutejs/auth/agent-context",
+  seed: pluginDependencySeed(config)
+}).derive(({ request }) => ({
   protectAgent: async (requiredScopes, handleAuth, handleAuthFail) => {
     if (config === undefined) {
       const failure = {
         code: "Unauthorized",
         message: "Agent is not authenticated"
       };
-      return await handleAuthFail?.(failure) ?? new Response(failure.message, { status: HTTP_UNAUTHORIZED2 });
+      return await handleAuthFail?.(failure) ?? new Response(failure.message, {
+        status: HTTP_UNAUTHORIZED2
+      });
     }
     const principal = await resolveAgentPrincipal(request, config);
     if (principal === undefined) {
@@ -3181,7 +3204,7 @@ var agentAuthContextPlugin = (config) => new Elysia2().derive(({ request }) => (
     }
     return handleAuth(principal);
   }
-}));
+})).as("global");
 
 // src/agents/registration.ts
 init_constants();
@@ -3915,8 +3938,15 @@ var parseRegistrationInput = (value) => {
   return input;
 };
 var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-var agentAuthPlugin = (config) => {
-  const plugin = agentAuthContextPlugin(config);
+var agentAuthPlugin = (config) => new Elysia3({
+  name: "@absolutejs/auth/agent",
+  seed: pluginDependencySeed(config)
+}).use(agentAuthContextPlugin(config)).use(agentAuthRoutes(config)).as("global");
+var agentAuthRoutes = (config) => {
+  const plugin = new Elysia3({
+    name: "@absolutejs/auth/agent-routes",
+    seed: pluginDependencySeed(config)
+  });
   if (config === undefined)
     return plugin.as("global");
   if (config.agentRegistration === undefined) {
@@ -4109,8 +4139,11 @@ var composeSignOutAudit = (onSignOut, emit) => async (context) => {
   return onSignOut?.(context);
 };
 
+// src/authContext.ts
+import { Elysia as Elysia8 } from "elysia";
+
 // src/authorization/protectPermission.ts
-import { Elysia as Elysia4, t as t3 } from "elysia";
+import { Elysia as Elysia5, t as t3 } from "elysia";
 
 // src/session/access.ts
 var collectSessionEntries = (session) => Object.entries(session).filter((entry) => isUserSessionId(entry[0]));
@@ -4224,11 +4257,11 @@ var loadSessionFromSource = async ({
 };
 
 // src/session/state.ts
-import { Elysia as Elysia3 } from "elysia";
+import { Elysia as Elysia4 } from "elysia";
 var sessionStore = () => {
   const initialSession = {};
   const initialUnregisteredSession = {};
-  return new Elysia3({ name: "sessionStore" }).state({
+  return new Elysia4({ name: "sessionStore" }).state({
     session: initialSession,
     unregisteredSession: initialUnregisteredSession
   });
@@ -4250,7 +4283,10 @@ var protectPermissionPlugin = ({
   authSessionStore,
   emit,
   hasPermission
-}) => new Elysia4().use(sessionStore()).guard({ cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}) => new Elysia5({
+  name: "@absolutejs/auth/permission",
+  seed: pluginDependencySeed(hasPermission)
+}).use(sessionStore()).guard({ cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectPermission: (check, handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -4286,8 +4322,80 @@ var protectPermissionPlugin = ({
   })
 })).as("global");
 
+// src/routes/protectRoute.ts
+import { Elysia as Elysia6, t as t4 } from "elysia";
+var protectRoutePlugin = ({
+  authSessionStore
+} = {}) => new Elysia6({
+  name: "@absolutejs/auth/protect-route",
+  seed: pluginDependencySeed(authSessionStore)
+}).use(sessionStore()).guard({ cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+  protectRoute: (handleAuth, handleAuthFail) => getStatusFromSource({
+    authSessionStore,
+    session,
+    user_session_id
+  }).then(async ({ user, error }) => {
+    if (error) {
+      return handleAuthFail?.(error) ?? status(error.code, error.message);
+    }
+    if (!user) {
+      return handleAuthFail?.({
+        code: "Unauthorized",
+        message: "User is not authenticated"
+      }) ?? status("Unauthorized", "User is not authenticated");
+    }
+    return handleAuth(user);
+  })
+})).as("global");
+
+// src/routes/stepUp.ts
+import { Elysia as Elysia7, t as t5 } from "elysia";
+var stepUpPlugin = ({
+  authSessionStore
+} = {}) => new Elysia7({
+  name: "@absolutejs/auth/step-up",
+  seed: pluginDependencySeed(authSessionStore)
+}).use(sessionStore()).guard({ cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+  requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
+    authSessionStore,
+    session,
+    userSessionId: user_session_id.value
+  }).then((userSession) => {
+    const authenticatedAt = userSession?.authenticatedAt;
+    const isRecent = authenticatedAt !== undefined && Date.now() - authenticatedAt <= maxAgeMs;
+    if (!userSession || !isRecent) {
+      return handleAuthFail?.({
+        code: "Unauthorized",
+        message: "Recent authentication required"
+      }) ?? status("Unauthorized", "Recent authentication required");
+    }
+    return handleAuth(userSession.user);
+  })
+})).as("global");
+
+// src/authContext.ts
+var createAuthContext = ({
+  agentAuth,
+  authSessionStore,
+  authorization,
+  emit,
+  seedSource
+}) => new Elysia8({
+  name: "@absolutejs/auth/context",
+  seed: pluginDependencySeed(seedSource)
+}).use([
+  protectRoutePlugin({ authSessionStore }),
+  stepUpPlugin({ authSessionStore }),
+  authorization ? protectPermissionPlugin({
+    ...authorization,
+    authSessionStore,
+    emit
+  }) : new Elysia8,
+  agentAuthContextPlugin(agentAuth)
+]);
+
 // src/compliance/routes.ts
-import { Elysia as Elysia5, t as t4 } from "elysia";
+import { Elysia as Elysia9, t as t6 } from "elysia";
 
 // src/utils.ts
 init_constants();
@@ -4618,7 +4726,7 @@ var complianceRoutes = ({
   emit,
   exportUserData,
   getUserId
-}) => new Elysia5().use(sessionStore()).get(`${complianceRoute}/export`, async ({
+}) => new Elysia9().use(sessionStore()).get(`${complianceRoute}/export`, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -4638,7 +4746,7 @@ var complianceRoutes = ({
     userId: getUserId?.(current.user)
   });
   return status("OK", data);
-}, { cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(complianceRoute, async ({
+}, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(complianceRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -4671,14 +4779,14 @@ var complianceRoutes = ({
     userId
   });
   return status("OK", { deleted: true });
-}, { cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }) });
+}, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) });
 
 // src/credentials/routes.ts
-import { Elysia as Elysia10 } from "elysia";
+import { Elysia as Elysia14 } from "elysia";
 
 // src/credentials/emailVerification.ts
 init_crypto();
-import { Elysia as Elysia6, t as t5 } from "elysia";
+import { Elysia as Elysia10, t as t7 } from "elysia";
 
 // src/credentials/config.ts
 init_constants();
@@ -4693,7 +4801,7 @@ var credentialsEmailVerification = ({
   onSendEmail,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   verifyEmailRoute = "/auth/verify-email"
-}) => new Elysia6().post(verifyEmailRoute, async ({ body: { token }, status }) => {
+}) => new Elysia10().post(verifyEmailRoute, async ({ body: { token }, status }) => {
   const consumed = await credentialStore.consumeVerificationToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired verification token");
@@ -4701,7 +4809,7 @@ var credentialsEmailVerification = ({
   await credentialStore.setEmailVerified(consumed.email);
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
-}, { body: t5.Object({ token: t5.String() }) }).post(`${verifyEmailRoute}/request`, async ({ body: { email }, status }) => {
+}, { body: t7.Object({ token: t7.String() }) }).post(`${verifyEmailRoute}/request`, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && !credential.emailVerified) {
@@ -4720,12 +4828,12 @@ var credentialsEmailVerification = ({
     });
   }
   return status("OK", { status: "verification_requested" });
-}, { body: t5.Object({ email: t5.String() }) });
+}, { body: t7.Object({ email: t7.String() }) });
 
 // src/credentials/login.ts
 init_constants();
 init_crypto();
-import { Elysia as Elysia7, t as t6 } from "elysia";
+import { Elysia as Elysia11, t as t8 } from "elysia";
 
 // src/credentials/import.ts
 init_crypto();
@@ -4923,7 +5031,7 @@ var credentialsLogin = ({
   rehashOnLogin = false,
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
-}) => new Elysia7().use(sessionStore()).post(loginRoute, async ({
+}) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
   body: { email, password },
   cookie: { user_session_id },
   request,
@@ -5006,13 +5114,13 @@ var credentialsLogin = ({
     status: "authenticated"
   });
 }), {
-  body: t6.Object({ email: t6.String(), password: t6.String() }),
-  cookie: t6.Cookie({ user_session_id: userSessionIdTypebox })
+  body: t8.Object({ email: t8.String(), password: t8.String() }),
+  cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/credentials/passwordReset.ts
 init_crypto();
-import { Elysia as Elysia8, t as t7 } from "elysia";
+import { Elysia as Elysia12, t as t9 } from "elysia";
 var credentialsPasswordReset = ({
   credentialStore,
   onPasswordReset,
@@ -5020,7 +5128,7 @@ var credentialsPasswordReset = ({
   passwordPolicy,
   resetPasswordRoute = "/auth/reset-password",
   resetTokenDurationMs = DEFAULT_RESET_TOKEN_TTL_MS
-}) => new Elysia8().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
+}) => new Elysia12().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && credential.status === "active") {
@@ -5039,7 +5147,7 @@ var credentialsPasswordReset = ({
     });
   }
   return status("OK", { status: "reset_requested" });
-}, { body: t7.Object({ email: t7.String() }) }).post(resetPasswordRoute, async ({ body: { password, token }, status }) => {
+}, { body: t9.Object({ email: t9.String() }) }).post(resetPasswordRoute, async ({ body: { password, token }, status }) => {
   const consumed = await credentialStore.consumeResetToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired reset token");
@@ -5066,12 +5174,12 @@ var credentialsPasswordReset = ({
   await onPasswordReset?.({ email: consumed.email });
   return status("OK", { status: "password_reset" });
 }, {
-  body: t7.Object({ password: t7.String(), token: t7.String() })
+  body: t9.Object({ password: t9.String(), token: t9.String() })
 });
 
 // src/credentials/register.ts
 init_crypto();
-import { Elysia as Elysia9, t as t8 } from "elysia";
+import { Elysia as Elysia13, t as t10 } from "elysia";
 var credentialsRegister = ({
   authSessionStore,
   cookieSecure,
@@ -5085,7 +5193,7 @@ var credentialsRegister = ({
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
-}) => new Elysia9().use(sessionStore()).post(registerRoute, async ({
+}) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
   status,
@@ -5158,38 +5266,18 @@ var credentialsRegister = ({
   });
   return status("Created", { status: "authenticated" });
 }), {
-  body: t8.Object({ email: t8.String(), password: t8.String() }, { additionalProperties: true }),
-  cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
+  body: t10.Object({ email: t10.String(), password: t10.String() }, { additionalProperties: true }),
+  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/credentials/routes.ts
-var credentialRoutes = (config) => new Elysia10().use(credentialsRegister(config)).use(credentialsEmailVerification(config)).use(credentialsLogin(config)).use(credentialsPasswordReset(config));
+var credentialRoutes = (config) => new Elysia14().use(credentialsRegister(config)).use(credentialsEmailVerification(config)).use(credentialsLogin(config)).use(credentialsPasswordReset(config));
 
-// src/htmx/routes.ts
-import { Elysia as Elysia12 } from "elysia";
+// src/htmx/configuredRoutes.ts
+import { Elysia as Elysia16 } from "elysia";
 
-// src/routes/protectRoute.ts
-import { Elysia as Elysia11, t as t9 } from "elysia";
-var protectRoutePlugin = ({
-  authSessionStore
-} = {}) => new Elysia11().use(sessionStore()).guard({ cookie: t9.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
-  protectRoute: (handleAuth, handleAuthFail) => getStatusFromSource({
-    authSessionStore,
-    session,
-    user_session_id
-  }).then(async ({ user, error }) => {
-    if (error) {
-      return handleAuthFail?.(error) ?? status(error.code, error.message);
-    }
-    if (!user) {
-      return handleAuthFail?.({
-        code: "Unauthorized",
-        message: "User is not authenticated"
-      }) ?? status("Unauthorized", "User is not authenticated");
-    }
-    return handleAuth(user);
-  })
-})).as("global");
+// src/htmx/routes.ts
+import { Elysia as Elysia15 } from "elysia";
 
 // src/htmx/renderers.ts
 var escapeHtml2 = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
@@ -5281,7 +5369,7 @@ var signInPrompt = `<section class="auth-content"><h1 class="page-heading">Not a
 var createAuthHtmxRoutes = (config) => {
   const renderers = resolveAuthHtmxRenderers(config);
   const authorizationHref = config.authorizationHref ?? ((provider) => `/oauth2/${provider}/authorization`);
-  return new Elysia12().use(protectRoutePlugin({
+  return new Elysia15().use(protectRoutePlugin({
     authSessionStore: config.authSessionStore
   })).get("/htmx/login", () => html(renderers.providerLogin("Sign in with", true))).get("/htmx/link", () => html(renderers.providerLogin("Link", false))).get("/htmx/connector-links", () => html(renderers.connectorLinks())).get("/htmx/auth-menu", ({ protectRoute }) => protectRoute((user) => html(renderers.authMenu(user)), () => html(renderers.authMenu(null)))).get("/htmx/me", ({ protectRoute }) => protectRoute((user) => html(renderers.protected(user)), () => html(signInPrompt))).get("/htmx/account", ({ protectRoute }) => protectRoute((user) => html(renderers.account(user)), () => html(signInPrompt))).get("/htmx/identities", ({ protectRoute, query }) => protectRoute(async (user) => {
     const search = typeof query.query === "string" ? query.query : "";
@@ -5352,6 +5440,39 @@ var createAuthHtmxRoutes = (config) => {
   });
 };
 
+// src/htmx/configuredRoutes.ts
+var isNullableString = (value) => value === undefined || value === null || typeof value === "string";
+var isAuthHtmxUser = (value) => {
+  if (typeof value !== "object" || value === null)
+    return false;
+  return typeof Reflect.get(value, "sub") === "string" && isNullableString(Reflect.get(value, "email")) && isNullableString(Reflect.get(value, "first_name")) && isNullableString(Reflect.get(value, "last_name")) && isNullableString(Reflect.get(value, "primary_auth_identity_id"));
+};
+var htmxSessionSource = (store) => {
+  if (store === undefined)
+    return;
+  return {
+    getSession: async (id) => {
+      const session = await store.getSession(id);
+      if (session === undefined || !isAuthHtmxUser(session.user)) {
+        return;
+      }
+      const result = {
+        ...session,
+        user: session.user
+      };
+      return result;
+    },
+    removeSession: (id) => store.removeSession(id)
+  };
+};
+var createConfiguredAuthHtmxRoutes = ({
+  authSessionStore,
+  config
+}) => config === undefined ? new Elysia16 : createAuthHtmxRoutes({
+  ...config,
+  authSessionStore: htmxSessionSource(authSessionStore)
+});
+
 // src/lockout/config.ts
 init_constants();
 var DEFAULT_MAX_ATTEMPTS = 5;
@@ -5387,11 +5508,11 @@ var isMfaEnrolled = (enrollment) => enrollment !== undefined && (enrollment.totp
 var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(await mfaStore.getEnrollment(getUserId(user)));
 
 // src/mfa/routes.ts
-import { Elysia as Elysia17 } from "elysia";
+import { Elysia as Elysia21 } from "elysia";
 
 // src/mfa/challenge.ts
 init_crypto();
-import { Elysia as Elysia14, t as t11 } from "elysia";
+import { Elysia as Elysia18, t as t12 } from "elysia";
 
 // src/mfa/backupCodes.ts
 init_crypto();
@@ -5427,7 +5548,7 @@ var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret
 
 // src/mfa/sms.ts
 init_crypto();
-import { Elysia as Elysia13, t as t10 } from "elysia";
+import { Elysia as Elysia17, t as t11 } from "elysia";
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
@@ -5480,7 +5601,7 @@ var mfaSmsRoutes = ({
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
-}) => new Elysia13().use(sessionStore()).post(smsSetupRoute, async ({
+}) => new Elysia17().use(sessionStore()).post(smsSetupRoute, async ({
   body: { phone },
   cookie: { user_session_id },
   status,
@@ -5520,8 +5641,8 @@ var mfaSmsRoutes = ({
   await onSendSmsCode({ code, expiresAt, phone });
   return status("OK", { phone: maskPhone(phone) });
 }, {
-  body: t10.Object({ phone: t10.String() }),
-  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
+  body: t11.Object({ phone: t11.String() }),
+  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
 }).post(smsVerifyRoute, async ({
   body: { code },
   cookie: { user_session_id },
@@ -5567,8 +5688,8 @@ var mfaSmsRoutes = ({
   await onMfaEnrolled?.({ userId });
   return status("OK", { status: "enrolled" });
 }, {
-  body: t10.Object({ code: t10.String() }),
-  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
+  body: t11.Object({ code: t11.String() }),
+  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/challenge.ts
@@ -5588,7 +5709,7 @@ var mfaChallenge = ({
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
-}) => new Elysia14().use(sessionStore()).post(challengeRoute, async ({
+}) => new Elysia18().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
   cookie: { user_session_id },
   status,
@@ -5719,16 +5840,16 @@ var mfaChallenge = ({
   });
   return promote();
 }), {
-  body: t11.Object({
-    action: t11.Optional(t11.Union([t11.Literal("send"), t11.Literal("verify")])),
-    code: t11.Optional(t11.String()),
-    factor: t11.Optional(t11.Literal("sms"))
+  body: t12.Object({
+    action: t12.Optional(t12.Union([t12.Literal("send"), t12.Literal("verify")])),
+    code: t12.Optional(t12.String()),
+    factor: t12.Optional(t12.Literal("sms"))
   }),
-  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
+  cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/management.ts
-import { Elysia as Elysia15, t as t12 } from "elysia";
+import { Elysia as Elysia19, t as t13 } from "elysia";
 var maskPhone2 = (phone) => {
   if (!phone)
     return null;
@@ -5741,7 +5862,7 @@ var mfaManagementRoutes = ({
   getUserId,
   managementRoute = "/auth/mfa",
   mfaStore
-}) => new Elysia15().use(sessionStore()).get(managementRoute, async ({
+}) => new Elysia19().use(sessionStore()).get(managementRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -5765,7 +5886,7 @@ var mfaManagementRoutes = ({
     totp: { enabled: enrollment?.totpVerified ?? false }
   };
   return status("OK", response);
-}, { cookie: t12.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(managementRoute, async ({
+}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(managementRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -5780,11 +5901,11 @@ var mfaManagementRoutes = ({
   }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
-}, { cookie: t12.Cookie({ user_session_id: userSessionIdTypebox }) });
+}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) });
 
 // src/mfa/totp.ts
 init_crypto();
-import { Elysia as Elysia16, t as t13 } from "elysia";
+import { Elysia as Elysia20, t as t14 } from "elysia";
 var mfaTotpRoutes = ({
   authSessionStore,
   backupCodeCount = DEFAULT_BACKUP_CODE_COUNT,
@@ -5795,7 +5916,7 @@ var mfaTotpRoutes = ({
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
   totpVerifyRoute = "/auth/mfa/totp/verify"
-}) => new Elysia16().use(sessionStore()).post(totpSetupRoute, async ({
+}) => new Elysia20().use(sessionStore()).post(totpSetupRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -5833,7 +5954,7 @@ var mfaTotpRoutes = ({
       secret
     })
   });
-}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }).post(totpVerifyRoute, async ({
+}, { cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }) }).post(totpVerifyRoute, async ({
   body: { code },
   cookie: { user_session_id },
   status,
@@ -5867,17 +5988,17 @@ var mfaTotpRoutes = ({
   await onMfaEnrolled?.({ userId });
   return status("OK", { backupCodes: codes });
 }, {
-  body: t13.Object({ code: t13.String() }),
-  cookie: t13.Cookie({ user_session_id: userSessionIdTypebox })
+  body: t14.Object({ code: t14.String() }),
+  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/routes.ts
-var mfaRoutes = (config) => new Elysia17().use(mfaManagementRoutes(config)).use(mfaTotpRoutes(config)).use(mfaSmsRoutes(config)).use(mfaChallenge(config));
+var mfaRoutes = (config) => new Elysia21().use(mfaManagementRoutes(config)).use(mfaTotpRoutes(config)).use(mfaSmsRoutes(config)).use(mfaChallenge(config));
 
 // src/oidc/routes.ts
 init_constants();
 init_crypto();
-import { Elysia as Elysia18, t as t14 } from "elysia";
+import { Elysia as Elysia22, t as t15 } from "elysia";
 
 // src/oidc/config.ts
 init_constants();
@@ -7916,7 +8037,7 @@ var oidcProviderRoutes = (config) => {
       url.searchParams.set("state", query.state);
     return redirectTo(url.toString());
   };
-  return new Elysia18().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia22().use(sessionStore()).get(authorizeRoute, async ({
     cookie: { user_session_id },
     query,
     request,
@@ -8071,26 +8192,26 @@ var oidcProviderRoutes = (config) => {
       params.state = state;
     return respondToClient(redirectUri, responseMode, params);
   }, {
-    cookie: t14.Cookie({
-      user_session_id: t14.Optional(userSessionIdTypebox)
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
     }),
-    query: t14.Object({
-      acr_values: t14.Optional(t14.String()),
-      claims: t14.Optional(t14.String()),
-      client_id: t14.Optional(t14.String()),
-      code_challenge: t14.Optional(t14.String()),
-      code_challenge_method: t14.Optional(t14.String()),
-      id_token_hint: t14.Optional(t14.String()),
-      max_age: t14.Optional(t14.String()),
-      nonce: t14.Optional(t14.String()),
-      prompt: t14.Optional(t14.String()),
-      redirect_uri: t14.Optional(t14.String()),
-      request: t14.Optional(t14.String()),
-      request_uri: t14.Optional(t14.String()),
-      response_mode: t14.Optional(t14.String()),
-      response_type: t14.Optional(t14.String()),
-      scope: t14.Optional(t14.String()),
-      state: t14.Optional(t14.String())
+    query: t15.Object({
+      acr_values: t15.Optional(t15.String()),
+      claims: t15.Optional(t15.String()),
+      client_id: t15.Optional(t15.String()),
+      code_challenge: t15.Optional(t15.String()),
+      code_challenge_method: t15.Optional(t15.String()),
+      id_token_hint: t15.Optional(t15.String()),
+      max_age: t15.Optional(t15.String()),
+      nonce: t15.Optional(t15.String()),
+      prompt: t15.Optional(t15.String()),
+      redirect_uri: t15.Optional(t15.String()),
+      request: t15.Optional(t15.String()),
+      request_uri: t15.Optional(t15.String()),
+      response_mode: t15.Optional(t15.String()),
+      response_type: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String()),
+      state: t15.Optional(t15.String())
     })
   }).post(tokenRoute, async ({ body, headers, request }) => {
     if (body.grant_type === PRE_AUTHORIZED_CODE_GRANT && config.vciConfig !== undefined) {
@@ -8157,26 +8278,26 @@ var oidcProviderRoutes = (config) => {
     }
     return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
   }, {
-    body: t14.Object({
-      assertion: t14.Optional(t14.String()),
-      audience: t14.Optional(t14.String()),
-      auth_req_id: t14.Optional(t14.String()),
-      claim_token: t14.Optional(t14.String()),
-      client_assertion: t14.Optional(t14.String()),
-      client_assertion_type: t14.Optional(t14.String()),
-      client_id: t14.Optional(t14.String()),
-      client_secret: t14.Optional(t14.String()),
-      code: t14.Optional(t14.String()),
-      code_verifier: t14.Optional(t14.String()),
-      device_code: t14.Optional(t14.String()),
-      grant_type: t14.Optional(t14.String()),
-      "pre-authorized_code": t14.Optional(t14.String()),
-      redirect_uri: t14.Optional(t14.String()),
-      refresh_token: t14.Optional(t14.String()),
-      resource: t14.Optional(t14.String()),
-      scope: t14.Optional(t14.String()),
-      subject_token: t14.Optional(t14.String()),
-      subject_token_type: t14.Optional(t14.String())
+    body: t15.Object({
+      assertion: t15.Optional(t15.String()),
+      audience: t15.Optional(t15.String()),
+      auth_req_id: t15.Optional(t15.String()),
+      claim_token: t15.Optional(t15.String()),
+      client_assertion: t15.Optional(t15.String()),
+      client_assertion_type: t15.Optional(t15.String()),
+      client_id: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      code: t15.Optional(t15.String()),
+      code_verifier: t15.Optional(t15.String()),
+      device_code: t15.Optional(t15.String()),
+      grant_type: t15.Optional(t15.String()),
+      "pre-authorized_code": t15.Optional(t15.String()),
+      redirect_uri: t15.Optional(t15.String()),
+      refresh_token: t15.Optional(t15.String()),
+      resource: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String()),
+      subject_token: t15.Optional(t15.String()),
+      subject_token_type: t15.Optional(t15.String())
     })
   }).post(parRoute, async ({ body, headers, request }) => {
     if (config.pushedAuthorizationRequestStore === undefined) {
@@ -8206,25 +8327,25 @@ var oidcProviderRoutes = (config) => {
     });
     return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
   }, {
-    body: t14.Object({
-      acr_values: t14.Optional(t14.String()),
-      audience: t14.Optional(t14.String()),
-      claims: t14.Optional(t14.String()),
-      client_assertion: t14.Optional(t14.String()),
-      client_assertion_type: t14.Optional(t14.String()),
-      client_id: t14.Optional(t14.String()),
-      client_secret: t14.Optional(t14.String()),
-      code_challenge: t14.Optional(t14.String()),
-      code_challenge_method: t14.Optional(t14.String()),
-      nonce: t14.Optional(t14.String()),
-      redirect_uri: t14.Optional(t14.String()),
-      resource: t14.Optional(t14.String()),
-      response_type: t14.Optional(t14.String()),
-      scope: t14.Optional(t14.String()),
-      state: t14.Optional(t14.String())
+    body: t15.Object({
+      acr_values: t15.Optional(t15.String()),
+      audience: t15.Optional(t15.String()),
+      claims: t15.Optional(t15.String()),
+      client_assertion: t15.Optional(t15.String()),
+      client_assertion_type: t15.Optional(t15.String()),
+      client_id: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      code_challenge: t15.Optional(t15.String()),
+      code_challenge_method: t15.Optional(t15.String()),
+      nonce: t15.Optional(t15.String()),
+      redirect_uri: t15.Optional(t15.String()),
+      resource: t15.Optional(t15.String()),
+      response_type: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String()),
+      state: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).post(introspectRoute, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
@@ -8245,14 +8366,14 @@ var oidcProviderRoutes = (config) => {
     });
     return jsonResponse(result, HTTP_OK3);
   }, {
-    body: t14.Object({
-      client_id: t14.Optional(t14.String()),
-      client_secret: t14.Optional(t14.String()),
-      token: t14.String(),
-      token_type_hint: t14.Optional(t14.String())
+    body: t15.Object({
+      client_id: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      token: t15.String(),
+      token_type_hint: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).post(revokeRoute, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
@@ -8270,14 +8391,14 @@ var oidcProviderRoutes = (config) => {
     }
     return new Response(null, { status: HTTP_OK3 });
   }, {
-    body: t14.Object({
-      client_id: t14.Optional(t14.String()),
-      client_secret: t14.Optional(t14.String()),
-      token: t14.String(),
-      token_type_hint: t14.Optional(t14.String())
+    body: t15.Object({
+      client_id: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      token: t15.String(),
+      token_type_hint: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
     if (config.backchannelAuthStore === undefined) {
@@ -8313,15 +8434,15 @@ var oidcProviderRoutes = (config) => {
       interval: result.interval
     }, HTTP_OK3);
   }, {
-    body: t14.Object({
-      binding_message: t14.Optional(t14.String()),
-      client_id: t14.Optional(t14.String()),
-      client_secret: t14.Optional(t14.String()),
-      login_hint: t14.Optional(t14.String()),
-      scope: t14.Optional(t14.String())
+    body: t15.Object({
+      binding_message: t15.Optional(t15.String()),
+      client_id: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      login_hint: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
@@ -8346,13 +8467,13 @@ var oidcProviderRoutes = (config) => {
     });
     return jsonResponse(response, HTTP_OK3);
   }, {
-    body: t14.Object({
-      client_id: t14.Optional(t14.String()),
-      client_secret: t14.Optional(t14.String()),
-      scope: t14.Optional(t14.String())
+    body: t15.Object({
+      client_id: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).post(deviceApproveRoute, async ({ body, cookie: { user_session_id }, store }) => {
     if (config.deviceAuthorizationStore === undefined) {
@@ -8378,40 +8499,40 @@ var oidcProviderRoutes = (config) => {
       return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({ ok: true }, HTTP_OK3);
   }, {
-    body: t14.Object({
-      action: t14.Optional(t14.Union([t14.Literal("approve"), t14.Literal("deny")])),
-      user_code: t14.String()
+    body: t15.Object({
+      action: t15.Optional(t15.Union([t15.Literal("approve"), t15.Literal("deny")])),
+      user_code: t15.String()
     }),
-    cookie: t14.Cookie({
-      user_session_id: t14.Optional(userSessionIdTypebox)
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
     })
   }).get(endSessionRoute, async ({ cookie: { user_session_id }, query, store }) => handleEndSession({
     cookie: user_session_id,
     inMemorySession: store.session,
     query
   }), {
-    cookie: t14.Cookie({
-      user_session_id: t14.Optional(userSessionIdTypebox)
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
     }),
-    query: t14.Object({
-      client_id: t14.Optional(t14.String()),
-      id_token_hint: t14.Optional(t14.String()),
-      post_logout_redirect_uri: t14.Optional(t14.String()),
-      state: t14.Optional(t14.String())
+    query: t15.Object({
+      client_id: t15.Optional(t15.String()),
+      id_token_hint: t15.Optional(t15.String()),
+      post_logout_redirect_uri: t15.Optional(t15.String()),
+      state: t15.Optional(t15.String())
     })
   }).post(endSessionRoute, async ({ body, cookie: { user_session_id }, store }) => handleEndSession({
     cookie: user_session_id,
     inMemorySession: store.session,
     query: body
   }), {
-    body: t14.Object({
-      client_id: t14.Optional(t14.String()),
-      id_token_hint: t14.Optional(t14.String()),
-      post_logout_redirect_uri: t14.Optional(t14.String()),
-      state: t14.Optional(t14.String())
+    body: t15.Object({
+      client_id: t15.Optional(t15.String()),
+      id_token_hint: t15.Optional(t15.String()),
+      post_logout_redirect_uri: t15.Optional(t15.String()),
+      state: t15.Optional(t15.String())
     }),
-    cookie: t14.Cookie({
-      user_session_id: t14.Optional(userSessionIdTypebox)
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
     })
   }).post(registrationRoute, async ({ body, headers }) => {
     if (config.clientRegistrationTokenStore === undefined) {
@@ -8430,18 +8551,18 @@ var oidcProviderRoutes = (config) => {
     });
     return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
   }, {
-    body: t14.Object({
-      backchannel_logout_uri: t14.Optional(t14.String()),
-      client_name: t14.Optional(t14.String()),
-      grant_types: t14.Optional(t14.Array(t14.String())),
-      jwks: t14.Optional(t14.Any()),
-      jwks_uri: t14.Optional(t14.String()),
-      post_logout_redirect_uris: t14.Optional(t14.Array(t14.String())),
-      redirect_uris: t14.Optional(t14.Array(t14.String())),
-      scope: t14.Optional(t14.String())
+    body: t15.Object({
+      backchannel_logout_uri: t15.Optional(t15.String()),
+      client_name: t15.Optional(t15.String()),
+      grant_types: t15.Optional(t15.Array(t15.String())),
+      jwks: t15.Optional(t15.Any()),
+      jwks_uri: t15.Optional(t15.String()),
+      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
+      redirect_uris: t15.Optional(t15.Array(t15.String())),
+      scope: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).get(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
@@ -8455,10 +8576,10 @@ var oidcProviderRoutes = (config) => {
     });
     return jsonResponse(result.body, result.status);
   }, {
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     }),
-    params: t14.Object({ clientId: t14.String() })
+    params: t15.Object({ clientId: t15.String() })
   }).put(`${registrationRoute}/:clientId`, async ({ body, headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
@@ -8473,20 +8594,20 @@ var oidcProviderRoutes = (config) => {
     });
     return jsonResponse(result.body, result.status);
   }, {
-    body: t14.Object({
-      backchannel_logout_uri: t14.Optional(t14.String()),
-      client_name: t14.Optional(t14.String()),
-      grant_types: t14.Optional(t14.Array(t14.String())),
-      jwks: t14.Optional(t14.Any()),
-      jwks_uri: t14.Optional(t14.String()),
-      post_logout_redirect_uris: t14.Optional(t14.Array(t14.String())),
-      redirect_uris: t14.Optional(t14.Array(t14.String())),
-      scope: t14.Optional(t14.String())
+    body: t15.Object({
+      backchannel_logout_uri: t15.Optional(t15.String()),
+      client_name: t15.Optional(t15.String()),
+      grant_types: t15.Optional(t15.Array(t15.String())),
+      jwks: t15.Optional(t15.Any()),
+      jwks_uri: t15.Optional(t15.String()),
+      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
+      redirect_uris: t15.Optional(t15.Array(t15.String())),
+      scope: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     }),
-    params: t14.Object({ clientId: t14.String() })
+    params: t15.Object({ clientId: t15.String() })
   }).delete(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
@@ -8502,10 +8623,10 @@ var oidcProviderRoutes = (config) => {
     }
     return jsonResponse(result.body, result.status);
   }, {
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     }),
-    params: t14.Object({ clientId: t14.String() })
+    params: t15.Object({ clientId: t15.String() })
   }).get(userinfoRoute, async ({ headers }) => {
     const token = readUserInfoBearer(headers.authorization);
     const result = await fetchUserInfo({ config, token });
@@ -8520,8 +8641,8 @@ var oidcProviderRoutes = (config) => {
     }
     return jsonResponse(result.body, HTTP_OK3);
   }, {
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).post(userinfoRoute, async ({ headers, body }) => {
     const token = readUserInfoBearer(headers.authorization) ?? body.access_token;
@@ -8537,17 +8658,17 @@ var oidcProviderRoutes = (config) => {
     }
     return jsonResponse(result.body, HTTP_OK3);
   }, {
-    body: t14.Object({
-      access_token: t14.Optional(t14.String())
+    body: t15.Object({
+      access_token: t15.Optional(t15.String())
     }),
-    headers: t14.Object({
-      authorization: t14.Optional(t14.String())
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
   }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
 };
 
 // src/organizations/routes.ts
-import { Elysia as Elysia19, t as t15 } from "elysia";
+import { Elysia as Elysia23, t as t16 } from "elysia";
 
 // src/organizations/config.ts
 init_constants();
@@ -8663,7 +8784,7 @@ var organizationRoutes = ({
   organizationStore,
   ownerRoles
 }) => {
-  const cookie = t15.Cookie({ user_session_id: userSessionIdTypebox });
+  const cookie = t16.Cookie({ user_session_id: userSessionIdTypebox });
   const requireUser = async (userSessionId, session) => {
     const current = await loadSessionFromSource({
       authSessionStore,
@@ -8679,7 +8800,7 @@ var organizationRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia19().use(sessionStore()).get(organizationsRoute, async ({
+  return new Elysia23().use(sessionStore()).get(organizationsRoute, async ({
     cookie: { user_session_id },
     status,
     store: { session }
@@ -8726,9 +8847,9 @@ var organizationRoutes = ({
     });
     return status("OK", { organization });
   }, {
-    body: t15.Object({
-      metadata: t15.Optional(t15.Record(t15.String(), t15.Unknown())),
-      name: t15.String()
+    body: t16.Object({
+      metadata: t16.Optional(t16.Record(t16.String(), t16.Unknown())),
+      name: t16.String()
     }),
     cookie
   }).post(`${organizationsRoute}/:organizationId/invitations`, async ({
@@ -8772,12 +8893,12 @@ var organizationRoutes = ({
       token
     });
   }, {
-    body: t15.Object({
-      email: t15.String(),
-      roles: t15.Optional(t15.Array(t15.String()))
+    body: t16.Object({
+      email: t16.String(),
+      roles: t16.Optional(t16.Array(t16.String()))
     }),
     cookie,
-    params: t15.Object({ organizationId: t15.String() })
+    params: t16.Object({ organizationId: t16.String() })
   }).get(`${organizationsRoute}/:organizationId/invitations`, async ({
     cookie: { user_session_id },
     params: { organizationId },
@@ -8801,7 +8922,7 @@ var organizationRoutes = ({
         state: invitation.state
       }))
     });
-  }, { cookie, params: t15.Object({ organizationId: t15.String() }) }).delete(`${organizationsRoute}/:organizationId/invitations/:invitationId`, async ({
+  }, { cookie, params: t16.Object({ organizationId: t16.String() }) }).delete(`${organizationsRoute}/:organizationId/invitations/:invitationId`, async ({
     cookie: { user_session_id },
     params: { invitationId, organizationId },
     status,
@@ -8825,9 +8946,9 @@ var organizationRoutes = ({
     return status("OK", { revoked: invitationId });
   }, {
     cookie,
-    params: t15.Object({
-      invitationId: t15.String(),
-      organizationId: t15.String()
+    params: t16.Object({
+      invitationId: t16.String(),
+      organizationId: t16.String()
     })
   }).post(`${organizationsRoute}/invitations/accept`, async ({
     body: { token },
@@ -8862,7 +8983,7 @@ var organizationRoutes = ({
       organizationId: membership.organizationId,
       roles: membership.roles
     });
-  }, { body: t15.Object({ token: t15.String() }), cookie }).get(`${organizationsRoute}/:organizationId/members`, async ({
+  }, { body: t16.Object({ token: t16.String() }), cookie }).get(`${organizationsRoute}/:organizationId/members`, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -8878,7 +8999,7 @@ var organizationRoutes = ({
     }
     const members = await organizationStore.listMembershipsByOrganization(organizationId);
     return status("OK", { members });
-  }, { cookie, params: t15.Object({ organizationId: t15.String() }) }).delete(`${organizationsRoute}/:organizationId/members/:userId`, async ({
+  }, { cookie, params: t16.Object({ organizationId: t16.String() }) }).delete(`${organizationsRoute}/:organizationId/members/:userId`, async ({
     cookie: { user_session_id },
     params: { organizationId, userId },
     status,
@@ -8902,16 +9023,16 @@ var organizationRoutes = ({
     return status("OK", { removed: userId });
   }, {
     cookie,
-    params: t15.Object({
-      organizationId: t15.String(),
-      userId: t15.String()
+    params: t16.Object({
+      organizationId: t16.String(),
+      userId: t16.String()
     })
   });
 };
 
 // src/passwordless/routes.ts
 init_crypto();
-import { Elysia as Elysia20, t as t16 } from "elysia";
+import { Elysia as Elysia24, t as t17 } from "elysia";
 
 // src/passwordless/config.ts
 init_constants();
@@ -8947,8 +9068,8 @@ var passwordlessRoutes = ({
   passwordlessTokenStore,
   sessionDurationMs = DEFAULT_PASSWORDLESS_SESSION_TTL_MS
 }) => {
-  const cookie = t16.Cookie({
-    user_session_id: t16.Optional(userSessionIdTypebox)
+  const cookie = t17.Cookie({
+    user_session_id: t17.Optional(userSessionIdTypebox)
   });
   const completeLogin = async (email, userSessionCookie, session) => {
     const existing = await getUserByEmail(email);
@@ -8972,7 +9093,7 @@ var passwordlessRoutes = ({
     await onPasswordlessLogin?.({ user, userSessionId });
     return userSessionId;
   };
-  const magicLink = onSendMagicLink ? new Elysia20().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, async ({ body: { email }, status }) => {
+  const magicLink = onSendMagicLink ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const token = generateSecureToken();
     const expiresAt = Date.now() + magicLinkTokenDurationMs;
@@ -8987,7 +9108,7 @@ var passwordlessRoutes = ({
       token
     });
     return status("OK", { status: "magic_link_sent" });
-  }, { body: t16.Object({ email: t16.String() }) }).post(`${passwordlessRoute}/magic-link/verify`, async ({
+  }, { body: t17.Object({ email: t17.String() }) }).post(`${passwordlessRoute}/magic-link/verify`, async ({
     body: { token },
     cookie: { user_session_id },
     status,
@@ -9002,8 +9123,8 @@ var passwordlessRoutes = ({
       return status("Unauthorized", "No account for this email");
     }
     return status("OK", { status: "authenticated" });
-  }, { body: t16.Object({ token: t16.String() }), cookie }) : new Elysia20;
-  const otp = onSendOtp ? new Elysia20().use(sessionStore()).post(`${passwordlessRoute}/otp`, async ({ body: { email }, status }) => {
+  }, { body: t17.Object({ token: t17.String() }), cookie }) : new Elysia24;
+  const otp = onSendOtp ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/otp`, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const code = generateOtpCode(otpLength);
     const expiresAt = Date.now() + otpDurationMs;
@@ -9018,7 +9139,7 @@ var passwordlessRoutes = ({
       expiresAt
     });
     return status("OK", { status: "otp_sent" });
-  }, { body: t16.Object({ email: t16.String() }) }).post(`${passwordlessRoute}/otp/verify`, async ({
+  }, { body: t17.Object({ email: t17.String() }) }).post(`${passwordlessRoute}/otp/verify`, async ({
     body: { code, email },
     cookie: { user_session_id },
     status,
@@ -9035,17 +9156,17 @@ var passwordlessRoutes = ({
     }
     return status("OK", { status: "authenticated" });
   }, {
-    body: t16.Object({
-      code: t16.String(),
-      email: t16.String()
+    body: t17.Object({
+      code: t17.String(),
+      email: t17.String()
     }),
     cookie
-  }) : new Elysia20;
-  return new Elysia20().use(magicLink).use(otp);
+  }) : new Elysia24;
+  return new Elysia24().use(magicLink).use(otp);
 };
 
 // src/portal/routes.ts
-import { Elysia as Elysia21, t as t17 } from "elysia";
+import { Elysia as Elysia25, t as t18 } from "elysia";
 
 // src/scim/config.ts
 init_crypto();
@@ -9140,7 +9261,7 @@ var portalRoutes = ({
 }) => {
   const loadSession = (authorization) => resolveSetupSession({ authorization, setupSessionStore });
   const oidcRedirectUri = (origin, organizationId) => `${origin}${ssoRoute}/oidc/${organizationId}/callback`;
-  return new Elysia21().get(`${portalRoute}/session`, async ({ headers, request, status }) => {
+  return new Elysia25().get(`${portalRoute}/session`, async ({ headers, request, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
       return status("Unauthorized", "Invalid or expired setup link");
@@ -9203,11 +9324,11 @@ var portalRoutes = ({
     });
     return status("OK", { configured: true, type: "saml" });
   }, {
-    body: t17.Object({
-      idpEntityId: t17.String(),
-      idpSloUrl: t17.Optional(t17.String()),
-      idpSsoUrl: t17.String(),
-      idpX509Cert: t17.String()
+    body: t18.Object({
+      idpEntityId: t18.String(),
+      idpSloUrl: t18.Optional(t18.String()),
+      idpSsoUrl: t18.String(),
+      idpX509Cert: t18.String()
     })
   }).put(`${portalRoute}/connection/oidc`, async ({ body, headers, request, status }) => {
     const session = await loadSession(headers.authorization);
@@ -9251,12 +9372,12 @@ var portalRoutes = ({
     });
     return status("OK", { configured: true, type: "oidc" });
   }, {
-    body: t17.Object({
-      clientId: t17.String(),
-      clientSecret: t17.String(),
-      issuer: t17.String(),
-      redirectUri: t17.Optional(t17.String()),
-      scopes: t17.Optional(t17.Array(t17.String()))
+    body: t18.Object({
+      clientId: t18.String(),
+      clientSecret: t18.String(),
+      issuer: t18.String(),
+      redirectUri: t18.Optional(t18.String()),
+      scopes: t18.Optional(t18.Array(t18.String()))
     })
   }).post(`${portalRoute}/scim/token`, async ({ headers, request, status }) => {
     const session = await loadSession(headers.authorization);
@@ -9287,7 +9408,7 @@ var portalRoutes = ({
 };
 
 // src/roles/routes.ts
-import { Elysia as Elysia22, t as t18 } from "elysia";
+import { Elysia as Elysia26, t as t19 } from "elysia";
 
 // src/roles/config.ts
 var DEFAULT_ROLES_ROUTE = "/auth/roles";
@@ -9322,7 +9443,7 @@ var roleRoutes = ({
   roleStore,
   rolesRoute = DEFAULT_ROLES_ROUTE
 }) => {
-  const cookie = t18.Cookie({ user_session_id: userSessionIdTypebox });
+  const cookie = t19.Cookie({ user_session_id: userSessionIdTypebox });
   const requireUser = async (userSessionId, session) => {
     const current = await loadSessionFromSource({
       authSessionStore,
@@ -9338,7 +9459,7 @@ var roleRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia22().use(sessionStore()).get(`${rolesRoute}/:organizationId`, async ({
+  return new Elysia26().use(sessionStore()).get(`${rolesRoute}/:organizationId`, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -9356,7 +9477,7 @@ var roleRoutes = ({
       roleStore.listRoles()
     ]);
     return status("OK", { roles: [...scoped, ...global] });
-  }, { cookie, params: t18.Object({ organizationId: t18.String() }) }).put(`${rolesRoute}/:organizationId/members/:userId`, async ({
+  }, { cookie, params: t19.Object({ organizationId: t19.String() }) }).put(`${rolesRoute}/:organizationId/members/:userId`, async ({
     body: { roles },
     cookie: { user_session_id },
     params: { organizationId, userId },
@@ -9389,11 +9510,11 @@ var roleRoutes = ({
     await onRolesAssigned?.({ organizationId, roles, userId });
     return status("OK", { roles: updated.roles });
   }, {
-    body: t18.Object({ roles: t18.Array(t18.String()) }),
+    body: t19.Object({ roles: t19.Array(t19.String()) }),
     cookie,
-    params: t18.Object({
-      organizationId: t18.String(),
-      userId: t18.String()
+    params: t19.Object({
+      organizationId: t19.String(),
+      userId: t19.String()
     })
   });
 };
@@ -9561,7 +9682,7 @@ var resolveProviderClientConfiguration = ({
 
 // src/routes/authorize.ts
 init_constants();
-import { Elysia as Elysia23, t as t19 } from "elysia";
+import { Elysia as Elysia27, t as t20 } from "elysia";
 var parseReferer = (headerReferer) => {
   if (!headerReferer)
     return "/";
@@ -9583,7 +9704,7 @@ var authorize = ({
   onAuthorizeError
 }) => {
   const secure = resolveCookieSecure(cookieSecure);
-  return new Elysia23().get(authorizeRoute, async ({
+  return new Elysia27().get(authorizeRoute, async ({
     status,
     redirect,
     cookie: {
@@ -9700,15 +9821,15 @@ var authorize = ({
       return status("Internal Server Error", "Failed to create authorization URL");
     }
   }, {
-    cookie: t19.Cookie({
+    cookie: t20.Cookie({
       auth_client: authClientOption,
       auth_intent: authIntentOption,
-      auth_provider: t19.Optional(authProviderOption)
+      auth_provider: t20.Optional(authProviderOption)
     }),
-    params: t19.Object({
+    params: t20.Object({
       provider: authProviderOption
     }),
-    query: t19.Object({
+    query: t20.Object({
       client: authClientOption,
       intent: authIntentOption
     })
@@ -9716,7 +9837,7 @@ var authorize = ({
 };
 
 // src/routes/callback.ts
-import { Elysia as Elysia24, t as t20 } from "elysia";
+import { Elysia as Elysia28, t as t21 } from "elysia";
 
 // src/errors.ts
 class AuthIdentityConflictError extends Error {
@@ -9739,7 +9860,7 @@ var callback = ({
   onLinkIdentityConflict,
   onLinkConnector,
   onCallbackError
-}) => new Elysia24().use(sessionStore()).get(callbackRoute, async ({
+}) => new Elysia28().use(sessionStore()).get(callbackRoute, async ({
   status,
   redirect,
   store: { session, unregisteredSession },
@@ -9874,25 +9995,25 @@ var callback = ({
   }
   return redirect(originUrl);
 }), {
-  cookie: t20.Cookie({
+  cookie: t21.Cookie({
     auth_client: authClientOption,
     auth_intent: authIntentOption,
-    auth_provider: t20.Optional(authProviderOption),
-    code_verifier: t20.Optional(t20.String()),
-    origin_url: t20.Optional(t20.String()),
-    state: t20.Optional(t20.String()),
-    user_session_id: t20.Optional(userSessionIdTypebox)
+    auth_provider: t21.Optional(authProviderOption),
+    code_verifier: t21.Optional(t21.String()),
+    origin_url: t21.Optional(t21.String()),
+    state: t21.Optional(t21.String()),
+    user_session_id: t21.Optional(userSessionIdTypebox)
   })
 });
 
 // src/routes/profile.ts
-import { Elysia as Elysia25, t as t21 } from "elysia";
+import { Elysia as Elysia29, t as t22 } from "elysia";
 var profile = ({
   clientProviders,
   profileRoute = "/oauth2/profile",
   onProfileSuccess,
   onProfileError
-}) => new Elysia25().use(sessionStore()).get(profileRoute, async ({
+}) => new Elysia29().use(sessionStore()).get(profileRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -9942,7 +10063,7 @@ var profile = ({
     return err instanceof Error ? status("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : status("Internal Server Error", `Failed to validate authorization code: Unknown status: ${err}`);
   }
 }, {
-  cookie: t21.Cookie({
+  cookie: t22.Cookie({
     auth_client: authClientOption,
     auth_provider: authProviderOption,
     user_session_id: userSessionIdTypebox
@@ -9951,7 +10072,7 @@ var profile = ({
 
 // src/routes/refresh.ts
 init_constants();
-import { Elysia as Elysia26, t as t22 } from "elysia";
+import { Elysia as Elysia30, t as t23 } from "elysia";
 var refresh = ({
   authSessionStore,
   clientProviders,
@@ -9959,7 +10080,7 @@ var refresh = ({
   onRefreshSuccess,
   onRefreshError,
   sessionDurationMs = MILLISECONDS_IN_A_DAY
-}) => new Elysia26().use(sessionStore()).post(refreshRoute, async ({
+}) => new Elysia30().use(sessionStore()).post(refreshRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -10028,7 +10149,7 @@ var refresh = ({
     return status("Internal Server Error", "Failed to refresh token");
   }
 }, {
-  cookie: t22.Cookie({
+  cookie: t23.Cookie({
     auth_client: authClientOption,
     auth_provider: authProviderOption,
     user_session_id: userSessionIdTypebox
@@ -10036,14 +10157,14 @@ var refresh = ({
 });
 
 // src/routes/revoke.ts
-import { Elysia as Elysia27, t as t23 } from "elysia";
+import { Elysia as Elysia31, t as t24 } from "elysia";
 var revoke = ({
   authSessionStore,
   clientProviders,
   revokeRoute = "/oauth2/revocation",
   onRevocationSuccess,
   onRevocationError
-}) => new Elysia27().use(sessionStore()).post(revokeRoute, async ({
+}) => new Elysia31().use(sessionStore()).post(revokeRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -10108,7 +10229,7 @@ var revoke = ({
     return status("Internal Server Error", "Failed to revoke token");
   }
 }, {
-  cookie: t23.Cookie({
+  cookie: t24.Cookie({
     auth_client: authClientOption,
     auth_provider: authProviderOption,
     user_session_id: userSessionIdTypebox
@@ -10116,12 +10237,12 @@ var revoke = ({
 });
 
 // src/routes/sessions.ts
-import { Elysia as Elysia28, t as t24 } from "elysia";
+import { Elysia as Elysia32, t as t25 } from "elysia";
 var sessionRoutes = ({
   authSessionStore,
   getUserId,
   sessionsRoute = "/auth/sessions"
-}) => new Elysia28().use(sessionStore()).get(sessionsRoute, async ({
+}) => new Elysia32().use(sessionStore()).get(sessionsRoute, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -10149,7 +10270,7 @@ var sessionRoutes = ({
     id: entry.id
   }));
   return status("OK", { sessions: list });
-}, { cookie: t24.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(`${sessionsRoute}/:id`, async ({
+}, { cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(`${sessionsRoute}/:id`, async ({
   cookie: { user_session_id },
   params: { id },
   status,
@@ -10176,34 +10297,12 @@ var sessionRoutes = ({
   await authSessionStore.removeSession(id);
   return status("OK", { revoked: id });
 }, {
-  cookie: t24.Cookie({ user_session_id: userSessionIdTypebox }),
-  params: t24.Object({ id: t24.String() })
+  cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }),
+  params: t25.Object({ id: t25.String() })
 });
 
-// src/routes/stepUp.ts
-import { Elysia as Elysia29, t as t25 } from "elysia";
-var stepUpPlugin = ({
-  authSessionStore
-} = {}) => new Elysia29().use(sessionStore()).guard({ cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
-  requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
-    authSessionStore,
-    session,
-    userSessionId: user_session_id.value
-  }).then((userSession) => {
-    const authenticatedAt = userSession?.authenticatedAt;
-    const isRecent = authenticatedAt !== undefined && Date.now() - authenticatedAt <= maxAgeMs;
-    if (!userSession || !isRecent) {
-      return handleAuthFail?.({
-        code: "Unauthorized",
-        message: "Recent authentication required"
-      }) ?? status("Unauthorized", "Recent authentication required");
-    }
-    return handleAuth(userSession.user);
-  })
-})).as("global");
-
 // src/routes/signout.ts
-import { Elysia as Elysia30, t as t26 } from "elysia";
+import { Elysia as Elysia33, t as t26 } from "elysia";
 var sessionForSignOut = ({
   authSessionStore,
   currentSession,
@@ -10233,7 +10332,7 @@ var signout = ({
   authSessionStore,
   signoutRoute = "/oauth2/signout",
   onSignOut
-}) => new Elysia30().use(sessionStore()).delete(signoutRoute, async ({
+}) => new Elysia33().use(sessionStore()).delete(signoutRoute, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider }
@@ -10280,12 +10379,12 @@ var signout = ({
 });
 
 // src/routes/userStatus.ts
-import { Elysia as Elysia31, t as t27 } from "elysia";
+import { Elysia as Elysia34, t as t27 } from "elysia";
 var userStatus = ({
   authSessionStore,
   statusRoute = "/oauth2/status",
   onStatus
-}) => new Elysia31().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
+}) => new Elysia34().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
   const { user, impersonator, error } = await getStatusFromSource({
     authSessionStore,
     session,
@@ -10303,7 +10402,7 @@ var userStatus = ({
 }, { cookie: t27.Cookie({ user_session_id: userSessionIdTypebox }) });
 
 // src/scim/routes.ts
-import { Elysia as Elysia32, t as t28 } from "elysia";
+import { Elysia as Elysia35, t as t28 } from "elysia";
 
 // src/scim/serialize.ts
 var USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -10776,7 +10875,7 @@ var scimRoutes = ({
   const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
   const usersEndpoint = `${scimRoute}/Users`;
   const groupsEndpoint = `${scimRoute}/Groups`;
-  return new Elysia32().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
+  return new Elysia35().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -10968,7 +11067,7 @@ var scimRoutes = ({
 
 // src/session/cleanup.ts
 init_constants();
-import { Elysia as Elysia33 } from "elysia";
+import { Elysia as Elysia36 } from "elysia";
 var sessionCleanup = ({
   authSessionStore,
   cleanupIntervalMs = MILLISECONDS_IN_AN_HOUR,
@@ -10976,7 +11075,7 @@ var sessionCleanup = ({
   onSessionCleanup
 }) => {
   let intervalId = null;
-  return new Elysia33({ name: "sessionCleanup" }).use(sessionStore()).onStart(({ store: { session, unregisteredSession } }) => {
+  return new Elysia36({ name: "sessionCleanup" }).use(sessionStore()).onStart(({ store: { session, unregisteredSession } }) => {
     intervalId = setInterval(async () => {
       await performCleanup({
         authSessionStore,
@@ -11204,7 +11303,7 @@ var performCleanup = async ({
 };
 
 // src/sso/discoveryRoute.ts
-import { Elysia as Elysia34, t as t29 } from "elysia";
+import { Elysia as Elysia37, t as t29 } from "elysia";
 var emailDomain = (email) => {
   const atIndex = email.lastIndexOf("@");
   if (atIndex === -1)
@@ -11217,7 +11316,7 @@ var ssoDiscoveryRoute = ({
   ssoRoute = DEFAULT_SSO_ROUTE
 }) => {
   const discoveryRoute = `${ssoRoute}/authorize`;
-  return new Elysia34().get(discoveryRoute, async ({ query: { email }, redirect, status }) => {
+  return new Elysia37().get(discoveryRoute, async ({ query: { email }, redirect, status }) => {
     if (!isNonEmptyString(email)) {
       return status("Bad Request", 'An "email" query parameter is required');
     }
@@ -11239,7 +11338,7 @@ var ssoDiscoveryRoute = ({
 
 // src/sso/oidcRoutes.ts
 init_constants();
-import { Elysia as Elysia35, t as t30 } from "elysia";
+import { Elysia as Elysia38, t as t30 } from "elysia";
 var makeSsoCookieOptions = (secure) => ({
   httpOnly: true,
   maxAge: COOKIE_DURATION,
@@ -11278,7 +11377,7 @@ var oidcSsoRoutes = ({
   const ssoCookieOptions = makeSsoCookieOptions(resolveCookieSecure(cookieSecure));
   const authorizeRoute = `${ssoRoute}/oidc/:organizationId/authorize`;
   const callbackRoute = `${ssoRoute}/oidc/:organizationId/callback`;
-  return new Elysia35().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia38().use(sessionStore()).get(authorizeRoute, async ({
     cookie: {
       sso_nonce,
       sso_organization,
@@ -11404,7 +11503,7 @@ var oidcSsoRoutes = ({
 };
 
 // src/sso/samlRoutes.ts
-import { Elysia as Elysia36, t as t31 } from "elysia";
+import { Elysia as Elysia39, t as t31 } from "elysia";
 var toLocalPath = (value) => {
   if (value === undefined || value.length === 0)
     return "/";
@@ -11454,7 +11553,7 @@ var samlSsoRoutes = ({
     const target = authSessionStore ? compatibilityLayer.session : inMemorySession;
     return target[userSessionId]?.samlLogout;
   };
-  return new Elysia36().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia39().use(sessionStore()).get(authorizeRoute, async ({
     headers,
     params: { organizationId },
     redirect,
@@ -11676,7 +11775,7 @@ var samlSsoRoutes = ({
 
 // src/webauthn/routes.ts
 init_constants();
-import { Elysia as Elysia37, t as t32 } from "elysia";
+import { Elysia as Elysia40, t as t32 } from "elysia";
 
 // src/webauthn/config.ts
 init_constants();
@@ -11718,7 +11817,7 @@ var webauthnRoutes = ({
     secure,
     value: challenge
   });
-  return new Elysia37().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
+  return new Elysia40().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
     cookie: { user_session_id, webauthn_challenge },
     status,
     store: { session }
@@ -25052,7 +25151,7 @@ var createInMemoryCredentialOfferStore = () => {
   };
 };
 // src/oidc/vciRoutes.ts
-import { Elysia as Elysia38, t as t33 } from "elysia";
+import { Elysia as Elysia41, t as t33 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_BAD_REQUEST4 = 400;
 var HTTP_UNAUTHORIZED5 = 401;
@@ -25077,7 +25176,7 @@ var vciRoutes = ({
   const credentialRoute = `${vciRoute}/credential`;
   const nonceRoute = `${vciRoute}/nonce`;
   const vciSigningKey = vciConfig.signingKey ?? signingKey;
-  return new Elysia38().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
+  return new Elysia41().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
@@ -25226,7 +25325,7 @@ var verifyStatusListJwt = async ({
   };
 };
 // src/vc/statusListRoutes.ts
-import { Elysia as Elysia39, t as t34 } from "elysia";
+import { Elysia as Elysia42, t as t34 } from "elysia";
 var HTTP_OK5 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
@@ -25238,7 +25337,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia39().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia42().get(listRoute, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -25459,7 +25558,7 @@ var createInMemoryPresentationRequestStore = () => {
   };
 };
 // src/vc/vpRoutes.ts
-import { Elysia as Elysia40, t as t35 } from "elysia";
+import { Elysia as Elysia43, t as t35 } from "elysia";
 var HTTP_OK6 = 200;
 var HTTP_BAD_REQUEST5 = 400;
 var HTTP_NOT_FOUND2 = 404;
@@ -25478,7 +25577,7 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia40().post(authorizeRoute, async ({ body }) => {
+  return new Elysia43().post(authorizeRoute, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -28653,7 +28752,7 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia41, t as t36 } from "elysia";
+import { Elysia as Elysia44, t as t36 } from "elysia";
 var HTTP_BAD_REQUEST6 = 400;
 var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
@@ -28763,7 +28862,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia41().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+  return new Elysia44().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
     binding: "POST",
     body,
     inMemorySession: store.session,
@@ -29060,59 +29159,67 @@ var createInMemorySetupSessionStore = () => {
 };
 
 // src/index.ts
-var auth = async ({
-  providersConfiguration,
-  authorizeRoute,
-  cookieSecure,
-  callbackRoute,
-  profileRoute,
-  signoutRoute,
-  statusRoute,
-  refreshRoute,
-  revokeRoute,
-  cleanupIntervalMs,
-  maxSessions,
-  sessionDurationMs,
-  authSessionStore,
-  audit,
-  credentials,
-  customProviders,
-  mfa,
-  passwordless,
-  lockout,
-  sessions,
-  sso,
-  scim,
-  apikeys,
-  agentAuth,
-  oidc,
-  organizations,
-  roles,
-  portal,
-  authorization,
-  compliance,
-  webauthn,
-  webhooks,
-  htmx,
-  tracing,
-  resolveAuthIntent,
-  onAuthorizeSuccess,
-  onAuthorizeError,
-  onProfileSuccess,
-  onProfileError,
-  onCallbackSuccess,
-  onLinkIdentity,
-  onLinkIdentityConflict,
-  onLinkConnector,
-  onCallbackError,
-  onStatus,
-  onRefreshSuccess,
-  onRefreshError,
-  onSignOut,
-  onRevocationSuccess,
-  onRevocationError,
-  onSessionCleanup
-}) => {
+var validatePositiveOptions = (prefix, options) => {
+  for (const [name2, value] of Object.entries(options)) {
+    if (value !== undefined && (!Number.isFinite(value) || value <= 0)) {
+      throw new Error(`${prefix}.${name2} must be positive`);
+    }
+  }
+};
+var buildAuthApplications = async (configuration) => {
+  const {
+    providersConfiguration,
+    authorizeRoute,
+    cookieSecure,
+    callbackRoute,
+    profileRoute,
+    signoutRoute,
+    statusRoute,
+    refreshRoute,
+    revokeRoute,
+    cleanupIntervalMs,
+    maxSessions,
+    sessionDurationMs,
+    authSessionStore,
+    audit,
+    credentials,
+    customProviders,
+    mfa,
+    passwordless,
+    lockout,
+    sessions,
+    sso,
+    scim,
+    apikeys,
+    agentAuth,
+    oidc,
+    organizations,
+    roles,
+    portal,
+    authorization,
+    compliance,
+    webauthn,
+    webhooks,
+    htmx,
+    tracing,
+    resolveAuthIntent,
+    onAuthorizeSuccess,
+    onAuthorizeError,
+    onProfileSuccess,
+    onProfileError,
+    onCallbackSuccess,
+    onLinkIdentity,
+    onLinkIdentityConflict,
+    onLinkConnector,
+    onCallbackError,
+    onStatus,
+    onRefreshSuccess,
+    onRefreshError,
+    onSignOut,
+    onRevocationSuccess,
+    onRevocationError,
+    onSessionCleanup
+  } = configuration;
   if (agentAuth?.agentRegistration !== undefined) {
     if (oidc === undefined) {
       throw new Error("agentAuth.agentRegistration requires the OIDC provider");
@@ -29131,7 +29238,7 @@ var auth = async ({
     if (registration2.allowAnonymous === true && registration2.revokeAccessTokens === undefined) {
       throw new Error("Anonymous agent registration requires revokeAccessTokens");
     }
-    for (const [name2, value] of Object.entries({
+    validatePositiveOptions("agentAuth.agentRegistration", {
       assertionTtlMs: registration2.assertionTtlMs,
       attemptTtlMs: registration2.attemptTtlMs,
       claimTtlMs: registration2.claimTtlMs,
@@ -29139,11 +29246,7 @@ var auth = async ({
       maxCodeAttempts: registration2.maxCodeAttempts,
       pollIntervalSeconds: registration2.pollIntervalSeconds,
       tokenTtlMs: registration2.tokenTtlMs
-    })) {
-      if (value !== undefined && (!Number.isFinite(value) || value <= 0)) {
-        throw new Error(`agentAuth.agentRegistration.${name2} must be positive`);
-      }
-    }
+    });
   }
   if (tracing !== undefined)
     await initTracing(tracing);
@@ -29246,107 +29349,152 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  const composedAuth = new Elysia42().use(sessionCleanup({
-    authSessionStore,
-    cleanupIntervalMs,
-    maxSessions,
-    onSessionCleanup
-  })).use(signout({
-    authSessionStore,
-    onSignOut: auditedOnSignOut,
-    signoutRoute
-  })).use(revoke({
-    authSessionStore,
-    clientProviders,
-    onRevocationError,
-    onRevocationSuccess: auditedOnRevocationSuccess,
-    revokeRoute
-  })).use(userStatus({ authSessionStore, onStatus, statusRoute })).use(refresh({
-    authSessionStore,
-    clientProviders,
-    onRefreshError,
-    onRefreshSuccess,
-    refreshRoute,
-    sessionDurationMs
-  })).use(authorize({
-    authorizeRoute,
-    clientProviders,
-    cookieSecure: resolvedCookieSecure,
-    onAuthorizeError,
-    onAuthorizeSuccess
-  })).use(callback({
-    authSessionStore,
-    callbackRoute,
-    clientProviders,
-    onCallbackError,
-    onCallbackSuccess: auditedOnCallbackSuccess,
-    onLinkConnector,
-    onLinkIdentity,
-    onLinkIdentityConflict,
-    resolveAuthIntent
-  })).use(profile({
-    clientProviders,
-    onProfileError,
-    onProfileSuccess,
-    profileRoute
-  })).use(auditedCredentials ? credentialRoutes({
-    ...auditedCredentials,
-    authSessionStore,
-    cookieSecure: resolvedCookieSecure,
-    lockoutGuard
-  }) : new Elysia42).use(auditedMfa ? mfaRoutes({
-    ...auditedMfa,
-    authSessionStore,
-    cookieSecure: resolvedCookieSecure
-  }) : new Elysia42).use(passwordless ? passwordlessRoutes({
-    ...passwordless,
-    authSessionStore,
-    cookieSecure: resolvedCookieSecure,
-    emit: auditEmit
-  }) : new Elysia42).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia42).use(sso ? oidcSsoRoutes({
-    ...sso,
-    authSessionStore,
-    cookieSecure: resolvedCookieSecure
-  }) : new Elysia42).use(sso && sso.samlAdapter ? samlSsoRoutes({
-    ...sso,
-    authSessionStore,
-    cookieSecure: resolvedCookieSecure,
-    samlAdapter: sso.samlAdapter
-  }) : new Elysia42).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
-    getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
-    ssoConnectionStore: sso.ssoConnectionStore,
-    ssoRoute: sso.ssoRoute
-  }) : new Elysia42).use(scim ? scimRoutes(scim) : new Elysia42).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia42).use(oidcConfig ? oidcProviderRoutes({
-    ...oidcConfig,
-    authSessionStore
-  }) : new Elysia42).use(organizations ? organizationRoutes({
-    ...organizations,
-    authSessionStore,
-    emit: auditEmit
-  }) : new Elysia42).use(roles ? roleRoutes({
-    ...roles,
-    authSessionStore,
-    emit: auditEmit
-  }) : new Elysia42).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia42).use(webauthn ? webauthnRoutes({
-    ...webauthn,
-    authSessionStore,
-    cookieSecure: resolvedCookieSecure,
-    emit: auditEmit
-  }) : new Elysia42).use(compliance ? complianceRoutes({
-    ...compliance,
-    authSessionStore,
-    emit: auditEmit
-  }) : new Elysia42).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
-    ...authorization,
+  const pluginSeed = pluginDependencySeed(configuration);
+  const coreRoutes = new Elysia45({
+    name: "@absolutejs/auth/core-routes",
+    seed: pluginSeed
+  }).use([
+    sessionCleanup({
+      authSessionStore,
+      cleanupIntervalMs,
+      maxSessions,
+      onSessionCleanup
+    }),
+    signout({
+      authSessionStore,
+      onSignOut: auditedOnSignOut,
+      signoutRoute
+    }),
+    revoke({
+      authSessionStore,
+      clientProviders,
+      onRevocationError,
+      onRevocationSuccess: auditedOnRevocationSuccess,
+      revokeRoute
+    }),
+    userStatus({ authSessionStore, onStatus, statusRoute }),
+    refresh({
+      authSessionStore,
+      clientProviders,
+      onRefreshError,
+      onRefreshSuccess,
+      refreshRoute,
+      sessionDurationMs
+    }),
+    authorize({
+      authorizeRoute,
+      clientProviders,
+      cookieSecure: resolvedCookieSecure,
+      onAuthorizeError,
+      onAuthorizeSuccess
+    }),
+    callback({
+      authSessionStore,
+      callbackRoute,
+      clientProviders,
+      onCallbackError,
+      onCallbackSuccess: auditedOnCallbackSuccess,
+      onLinkConnector,
+      onLinkIdentity,
+      onLinkIdentityConflict,
+      resolveAuthIntent
+    }),
+    profile({
+      clientProviders,
+      onProfileError,
+      onProfileSuccess,
+      profileRoute
+    })
+  ]);
+  const featureRoutes = new Elysia45({
+    name: "@absolutejs/auth/feature-routes",
+    seed: pluginSeed
+  }).use([
+    auditedCredentials ? credentialRoutes({
+      ...auditedCredentials,
+      authSessionStore,
+      cookieSecure: resolvedCookieSecure,
+      lockoutGuard
+    }) : new Elysia45,
+    auditedMfa ? mfaRoutes({
+      ...auditedMfa,
+      authSessionStore,
+      cookieSecure: resolvedCookieSecure
+    }) : new Elysia45,
+    passwordless ? passwordlessRoutes({
+      ...passwordless,
+      authSessionStore,
+      cookieSecure: resolvedCookieSecure,
+      emit: auditEmit
+    }) : new Elysia45,
+    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia45,
+    sso ? oidcSsoRoutes({
+      ...sso,
+      authSessionStore,
+      cookieSecure: resolvedCookieSecure
+    }) : new Elysia45,
+    sso && sso.samlAdapter ? samlSsoRoutes({
+      ...sso,
+      authSessionStore,
+      cookieSecure: resolvedCookieSecure,
+      samlAdapter: sso.samlAdapter
+    }) : new Elysia45,
+    sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+      getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
+      ssoConnectionStore: sso.ssoConnectionStore,
+      ssoRoute: sso.ssoRoute
+    }) : new Elysia45,
+    scim ? scimRoutes(scim) : new Elysia45,
+    apikeys ? apiKeysRoutes(apikeys) : new Elysia45,
+    oidcConfig ? oidcProviderRoutes({
+      ...oidcConfig,
+      authSessionStore
+    }) : new Elysia45,
+    organizations ? organizationRoutes({
+      ...organizations,
+      authSessionStore,
+      emit: auditEmit
+    }) : new Elysia45,
+    roles ? roleRoutes({
+      ...roles,
+      authSessionStore,
+      emit: auditEmit
+    }) : new Elysia45,
+    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia45,
+    webauthn ? webauthnRoutes({
+      ...webauthn,
+      authSessionStore,
+      cookieSecure: resolvedCookieSecure,
+      emit: auditEmit
+    }) : new Elysia45,
+    compliance ? complianceRoutes({
+      ...compliance,
+      authSessionStore,
+      emit: auditEmit
+    }) : new Elysia45,
+    createConfiguredAuthHtmxRoutes({ authSessionStore, config: htmx }),
+    agentAuthRoutes(resolvedAgentAuth)
+  ]);
+  const authContext = createAuthContext({
+    agentAuth: resolvedAgentAuth,
+    authorization,
     authSessionStore,
-    emit: auditEmit
-  }) : new Elysia42).use(htmx ? createAuthHtmxRoutes({
-    ...htmx,
-    authSessionStore
-  }) : new Elysia42);
-  const authWithAgent = composedAuth.use(agentAuthPlugin(resolvedAgentAuth));
-  return authWithAgent;
+    emit: auditEmit,
+    seedSource: configuration
+  });
+  return { authContext, coreRoutes, featureRoutes };
+};
+var auth = async (configuration) => {
+  const { authContext, coreRoutes, featureRoutes } = await buildAuthApplications(configuration);
+  const application = new Elysia45({
+    name: "@absolutejs/auth",
+    seed: pluginDependencySeed(configuration)
+  });
+  application.use(coreRoutes);
+  application.use(featureRoutes);
+  return application.use(authContext);
 };
+var createAuthApplications = async (configuration) => buildAuthApplications(configuration);
 export {
   writeWarrant,
   withSpan,
@@ -29730,6 +29878,8 @@ export {
   createCredentialOffer,
   createClientIdMetadataResolver,
   createAuthHtmxRoutes,
+  createAuthContext,
+  createAuthApplications,
   createAuditRedactor,
   createAuditEmitter,
   createApiKey,
@@ -29829,5 +29979,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=394E6CA4C2DE944764756E2164756E21
+//# debugId=C32E620BB25CD5D564756E2164756E21
 //# sourceMappingURL=index.js.map