@absolutejs/auth 0.57.8 → 0.58.0

package/dist/server.js

@@ -6849,6 +6849,7 @@ var DEFAULT_SMS_CODE_LENGTH = 6;
 var SMS_CODE_TTL_MINUTES = 5;
 var DEFAULT_SMS_CODE_TTL_MS = SMS_CODE_TTL_MINUTES * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_SMS_MAX_ATTEMPTS = 3;
+var DEFAULT_SMS_RESEND_COOLDOWN_MS = 30 * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 
 // src/mfa/secret.ts
@@ -6859,6 +6860,20 @@ var encryptTotpSecret = (secret, encryptionKey) => encryptionKey ? encryptSecret
 // src/mfa/sms.ts
 init_crypto();
 import { Elysia as Elysia17, t as t11 } from "elysia";
+
+// src/verification/types.ts
+class VerificationProviderError extends Error {
+  kind;
+  provider;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "VerificationProviderError";
+    this.kind = input.kind;
+    this.provider = input.provider;
+  }
+}
+
+// src/mfa/sms.ts
 var DECIMAL_RADIX2 = 10;
 var MASK_VISIBLE_DIGITS = 4;
 var E164_PATTERN = /^\+[1-9]\d{7,14}$/u;
@@ -6873,28 +6888,83 @@ var issueSmsCode = async (codeLength, ttlMs) => {
   const expiresAt = Date.now() + ttlMs;
   return { code, expiresAt, hash };
 };
+var checkWithVerificationProvider = async (provider, input) => {
+  try {
+    return { result: await provider.check(input) };
+  } catch (error) {
+    const mapped = mapVerificationProviderError(error);
+    if (mapped === undefined)
+      throw error;
+    return { error: mapped };
+  }
+};
 var isE164Phone = (phone) => E164_PATTERN.test(phone);
 var issueAndStoreSmsCode = async ({
   codeLength,
   enrollment,
   mfaStore,
   onSendSmsCode,
-  ttlMs
+  purpose,
+  verificationProvider,
+  ttlMs,
+  userId
 }) => {
   const phone = enrollment.smsPhone;
   if (phone === undefined)
     return;
+  if (verificationProvider !== undefined) {
+    const started = await verificationProvider.start({
+      channel: "sms",
+      purpose,
+      subject: userId,
+      to: phone
+    });
+    await mfaStore.saveEnrollment({
+      ...enrollment,
+      smsCodeSentAt: Date.now(),
+      smsFailedAttempts: 0,
+      smsPendingCodeExpiresAt: started.expiresAt,
+      smsPendingCodeHash: undefined,
+      smsPendingPurpose: purpose,
+      smsProviderReference: started.reference,
+      updatedAt: Date.now()
+    });
+    return started.expiresAt;
+  }
   const { code, expiresAt, hash } = await issueSmsCode(codeLength, ttlMs);
   await mfaStore.saveEnrollment({
     ...enrollment,
+    smsCodeSentAt: Date.now(),
     smsFailedAttempts: 0,
     smsPendingCodeExpiresAt: expiresAt,
     smsPendingCodeHash: hash,
+    smsPendingPurpose: purpose,
+    smsProviderReference: undefined,
     updatedAt: Date.now()
   });
-  await onSendSmsCode?.({ code, expiresAt, phone });
+  await onSendSmsCode?.({ code, expiresAt, phone, purpose, userId });
   return expiresAt;
 };
+var mapVerificationProviderError = (error) => {
+  if (!(error instanceof VerificationProviderError))
+    return;
+  if (error.kind === "rate_limited") {
+    return {
+      message: "Verification provider rate limit reached",
+      status: "Too Many Requests"
+    };
+  }
+  if (error.kind === "invalid_destination") {
+    return {
+      message: "Phone number cannot receive verification codes",
+      status: "Bad Request"
+    };
+  }
+  return {
+    message: "Verification provider unavailable",
+    status: "Service Unavailable"
+  };
+};
 var maskPhone = (phone) => {
   const visible = phone.slice(-MASK_VISIBLE_DIGITS);
   const maskedLength = Math.max(phone.length - MASK_VISIBLE_DIGITS, 0);
@@ -6906,9 +6976,11 @@ var mfaSmsRoutes = ({
   mfaStore,
   onMfaEnrolled,
   onSendSmsCode,
+  verificationProvider,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
 }) => new Elysia17().use(sessionStore()).post(smsSetupRoute, async ({
@@ -6917,7 +6989,7 @@ var mfaSmsRoutes = ({
   status,
   store: { session }
 }) => {
-  if (onSendSmsCode === undefined) {
+  if (onSendSmsCode === undefined && verificationProvider === undefined) {
     return status("Not Implemented", "SMS MFA is not configured");
   }
   const userSession = await loadSessionFromSource({
@@ -6934,21 +7006,51 @@ var mfaSmsRoutes = ({
   const userId = getUserId(userSession.user);
   const existing = await mfaStore.getEnrollment(userId);
   const now = Date.now();
-  const { code, expiresAt, hash } = await issueSmsCode(smsCodeLength, smsCodeTtlMs);
+  if (existing?.smsCodeSentAt !== undefined && now - existing.smsCodeSentAt < smsResendCooldownMs) {
+    return status("Too Many Requests", "SMS resend cooldown active");
+  }
+  let started;
+  try {
+    started = verificationProvider ? await verificationProvider.start({
+      channel: "sms",
+      purpose: "mfa_enrollment",
+      subject: userId,
+      to: phone
+    }) : undefined;
+  } catch (error) {
+    const mapped = mapVerificationProviderError(error);
+    if (mapped === undefined)
+      throw error;
+    return status(mapped.status, mapped.message);
+  }
+  const local = started ? undefined : await issueSmsCode(smsCodeLength, smsCodeTtlMs);
   await mfaStore.saveEnrollment({
     backupCodeHashes: existing?.backupCodeHashes ?? [],
     createdAt: existing?.createdAt ?? now,
+    lastUsedAt: existing?.lastUsedAt,
+    smsCodeSentAt: now,
     smsFailedAttempts: 0,
-    smsPendingCodeExpiresAt: expiresAt,
-    smsPendingCodeHash: hash,
+    smsPendingCodeExpiresAt: started?.expiresAt ?? local?.expiresAt,
+    smsPendingCodeHash: local?.hash,
+    smsPendingPurpose: "mfa_enrollment",
     smsPhone: phone,
+    smsProviderReference: started?.reference,
     smsVerified: false,
+    totpFailedAttempts: existing?.totpFailedAttempts ?? 0,
     totpSecretCiphertext: existing?.totpSecretCiphertext,
     totpVerified: existing?.totpVerified ?? false,
     updatedAt: now,
     userId
   });
-  await onSendSmsCode({ code, expiresAt, phone });
+  if (local !== undefined && onSendSmsCode !== undefined) {
+    await onSendSmsCode({
+      code: local.code,
+      expiresAt: local.expiresAt,
+      phone,
+      purpose: "mfa_enrollment",
+      userId
+    });
+  }
   return status("OK", { phone: maskPhone(phone) });
 }, {
   body: t11.Object({ phone: t11.String() }),
@@ -6969,29 +7071,58 @@ var mfaSmsRoutes = ({
   }
   const userId = getUserId(userSession.user);
   const enrollment = await mfaStore.getEnrollment(userId);
-  if (!enrollment?.smsPendingCodeHash || enrollment.smsPendingCodeExpiresAt === undefined) {
+  if (!enrollment?.smsPhone) {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
+  const localCodeHash = enrollment.smsPendingCodeHash;
+  const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
+  const providerReference = enrollment.smsProviderReference;
+  if (enrollment.smsPendingPurpose !== "mfa_enrollment" || localCodeExpiresAt === undefined) {
+    return status("Bad Request", "No SMS enrollment in progress");
+  }
+  if (verificationProvider === undefined && localCodeHash === undefined) {
     return status("Bad Request", "No SMS enrollment in progress");
   }
-  if (Date.now() > enrollment.smsPendingCodeExpiresAt) {
+  if (Date.now() > localCodeExpiresAt) {
     return status("Bad Request", "SMS code expired");
   }
   if ((enrollment.smsFailedAttempts ?? 0) >= smsMaxAttempts) {
     return status("Too Many Requests", "Too many attempts");
   }
-  const codeValid = await constantTimeEqual(await hashToken(code), enrollment.smsPendingCodeHash);
+  let providerResult;
+  if (verificationProvider !== undefined) {
+    if (providerReference === undefined) {
+      return status("Bad Request", "No SMS enrollment in progress");
+    }
+    const checked = await checkWithVerificationProvider(verificationProvider, {
+      channel: "sms",
+      code,
+      purpose: "mfa_enrollment",
+      reference: providerReference,
+      subject: userId,
+      to: enrollment.smsPhone
+    });
+    if (checked.error !== undefined) {
+      return status(checked.error.status, checked.error.message);
+    }
+    providerResult = checked.result;
+  }
+  const codeValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
   if (!codeValid) {
     await mfaStore.saveEnrollment({
       ...enrollment,
       smsFailedAttempts: (enrollment.smsFailedAttempts ?? 0) + 1,
       updatedAt: Date.now()
     });
-    return status("Bad Request", "Invalid SMS code");
+    return status(providerResult?.status === "max_attempts_reached" ? "Too Many Requests" : "Bad Request", providerResult?.status === "expired" ? "SMS code expired" : "Invalid SMS code");
   }
   await mfaStore.saveEnrollment({
     ...enrollment,
     smsFailedAttempts: 0,
     smsPendingCodeExpiresAt: undefined,
     smsPendingCodeHash: undefined,
+    smsPendingPurpose: undefined,
+    smsProviderReference: undefined,
     smsVerified: true,
     updatedAt: Date.now()
   });
@@ -7014,10 +7145,12 @@ var mfaChallenge = ({
   onMfaChallengeError,
   onMfaChallengeSuccess,
   onSendSmsCode,
+  verificationProvider,
   sessionDurationMs = DEFAULT_MFA_SESSION_TTL_MS,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
 }) => new Elysia18().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
@@ -7059,27 +7192,48 @@ var mfaChallenge = ({
     await onMfaChallengeSuccess?.({ user, userSessionId });
     return status("OK", { status: "authenticated" });
   };
-  const runSmsChallenge = async () => {
-    if (!enrollment.smsVerified || !enrollment.smsPhone) {
-      return status("Unauthorized", "No MFA challenge in progress");
+  const sendSmsChallenge = async () => {
+    if (enrollment.smsCodeSentAt !== undefined && Date.now() - enrollment.smsCodeSentAt < smsResendCooldownMs) {
+      return status("Too Many Requests", "SMS resend cooldown active");
     }
-    if (action === "send") {
+    try {
       await issueAndStoreSmsCode({
         codeLength: smsCodeLength,
         enrollment,
         mfaStore,
         onSendSmsCode,
-        ttlMs: smsCodeTtlMs
+        purpose: "mfa_challenge",
+        ttlMs: smsCodeTtlMs,
+        userId: getUserId(user),
+        verificationProvider
       });
-      return status("OK", { status: "sent" });
+    } catch (error) {
+      const mapped = mapVerificationProviderError(error);
+      if (mapped === undefined)
+        throw error;
+      return status(mapped.status, mapped.message);
     }
+    return status("OK", { status: "sent" });
+  };
+  const runSmsChallenge = async () => {
+    if (!enrollment.smsVerified || !enrollment.smsPhone) {
+      return status("Unauthorized", "No MFA challenge in progress");
+    }
+    if (action === "send")
+      return sendSmsChallenge();
     if (code === undefined) {
       return status("Bad Request", "SMS code required");
     }
-    if (!enrollment.smsPendingCodeHash || enrollment.smsPendingCodeExpiresAt === undefined) {
+    const localCodeHash = enrollment.smsPendingCodeHash;
+    const localCodeExpiresAt = enrollment.smsPendingCodeExpiresAt;
+    const providerReference = enrollment.smsProviderReference;
+    if (enrollment.smsPendingPurpose !== "mfa_challenge" || localCodeExpiresAt === undefined) {
       return status("Bad Request", "No SMS code in progress");
     }
-    if (Date.now() > enrollment.smsPendingCodeExpiresAt) {
+    if (verificationProvider === undefined && localCodeHash === undefined) {
+      return status("Bad Request", "No SMS code in progress");
+    }
+    if (Date.now() > localCodeExpiresAt) {
       return status("Unauthorized", "SMS code expired");
     }
     if ((enrollment.smsFailedAttempts ?? 0) >= smsMaxAttempts) {
@@ -7089,7 +7243,25 @@ var mfaChallenge = ({
       });
       return status("Unauthorized", "Too many attempts");
     }
-    const smsValid = await constantTimeEqual(await hashToken(code), enrollment.smsPendingCodeHash);
+    let providerResult;
+    if (verificationProvider !== undefined) {
+      if (providerReference === undefined) {
+        return status("Bad Request", "No SMS code in progress");
+      }
+      const checked = await checkWithVerificationProvider(verificationProvider, {
+        channel: "sms",
+        code,
+        purpose: "mfa_challenge",
+        reference: providerReference,
+        subject: getUserId(user),
+        to: enrollment.smsPhone
+      });
+      if (checked.error !== undefined) {
+        return status(checked.error.status, checked.error.message);
+      }
+      providerResult = checked.result;
+    }
+    const smsValid = providerResult ? providerResult.status === "approved" : localCodeHash !== undefined && await constantTimeEqual(await hashToken(code), localCodeHash);
     if (!smsValid) {
       await mfaStore.saveEnrollment({
         ...enrollment,
@@ -7100,7 +7272,7 @@ var mfaChallenge = ({
         error: new Error("invalid_mfa_code"),
         userId: getUserId(user)
       });
-      return status("Unauthorized", "Invalid MFA code");
+      return status(providerResult?.status === "max_attempts_reached" ? "Too Many Requests" : "Unauthorized", providerResult?.status === "expired" ? "SMS code expired" : "Invalid MFA code");
     }
     await mfaStore.saveEnrollment({
       ...enrollment,
@@ -7108,6 +7280,8 @@ var mfaChallenge = ({
       smsFailedAttempts: 0,
       smsPendingCodeExpiresAt: undefined,
       smsPendingCodeHash: undefined,
+      smsPendingPurpose: undefined,
+      smsProviderReference: undefined,
       updatedAt: Date.now()
     });
     return promote();
@@ -32836,12 +33010,15 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   backup_code_hashes: jsonb("backup_code_hashes").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
+  sms_code_sent_at_ms: bigint("sms_code_sent_at_ms", { mode: "number" }),
   sms_failed_attempts: smallint("sms_failed_attempts").notNull().default(0),
   sms_pending_code_expires_at_ms: bigint("sms_pending_code_expires_at_ms", {
     mode: "number"
   }),
   sms_pending_code_hash: text("sms_pending_code_hash"),
+  sms_pending_purpose: text("sms_pending_purpose").$type(),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
+  sms_provider_reference: text("sms_provider_reference"),
   sms_verified: boolean("sms_verified").notNull().default(false),
   totp_failed_attempts: smallint("totp_failed_attempts").notNull().default(0),
   totp_secret_ciphertext: text("totp_secret_ciphertext"),
@@ -32853,10 +33030,13 @@ var toEnrollment = (row) => ({
   backupCodeHashes: row.backup_code_hashes,
   createdAt: row.created_at_ms,
   lastUsedAt: row.last_used_at_ms ?? undefined,
+  smsCodeSentAt: row.sms_code_sent_at_ms ?? undefined,
   smsFailedAttempts: row.sms_failed_attempts,
   smsPendingCodeExpiresAt: row.sms_pending_code_expires_at_ms ?? undefined,
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
+  smsPendingPurpose: row.sms_pending_purpose ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
+  smsProviderReference: row.sms_provider_reference ?? undefined,
   smsVerified: row.sms_verified,
   totpFailedAttempts: row.totp_failed_attempts,
   totpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,
@@ -32882,10 +33062,13 @@ var createPostgresMfaStore = (db) => ({
       backup_code_hashes: enrollment.backupCodeHashes,
       created_at_ms: enrollment.createdAt,
       last_used_at_ms: enrollment.lastUsedAt ?? null,
+      sms_code_sent_at_ms: enrollment.smsCodeSentAt ?? null,
       sms_failed_attempts: enrollment.smsFailedAttempts ?? 0,
       sms_pending_code_expires_at_ms: enrollment.smsPendingCodeExpiresAt ?? null,
       sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
+      sms_pending_purpose: enrollment.smsPendingPurpose ?? null,
       sms_phone: enrollment.smsPhone ?? null,
+      sms_provider_reference: enrollment.smsProviderReference ?? null,
       sms_verified: enrollment.smsVerified,
       totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
       totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
@@ -34639,23 +34822,28 @@ var portableJsonb = customType({
   fromDriver: (value) => typeof value === "string" ? JSON.parse(value) : value,
   toDriver: (value) => JSON.stringify(value)
 });
-var agentDelegationsTable = pgTable("auth_agent_delegations", {
+var bunSqlJsonb = customType({
+  dataType: () => "jsonb",
+  fromDriver: (value) => typeof value === "string" ? JSON.parse(value) : value,
+  toDriver: (value) => value
+});
+var createAgentDelegationsTable = (json5) => pgTable("auth_agent_delegations", {
   agent_id: varchar("agent_id", { length: ID_LENGTH7 }).notNull(),
-  authorization_details: portableJsonb("authorization_details").$type(),
+  authorization_details: json5("authorization_details").$type(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   delegation_id: varchar("delegation_id", {
     length: ID_LENGTH7
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }),
   organization_id: varchar("organization_id", { length: ID_LENGTH7 }),
-  scopes: portableJsonb("scopes").$type().notNull().default([]),
+  scopes: json5("scopes").$type().notNull().default([]),
   status: varchar("status", { length: STATUS_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
   user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
 });
-var agentIdentityRegistrationsTable = pgTable("auth_agent_identity_registrations", {
+var createAgentIdentityRegistrationsTable = (json5) => pgTable("auth_agent_identity_registrations", {
   agent_id: varchar("agent_id", { length: ID_LENGTH7 }).notNull().unique(),
-  claim_attempt: portableJsonb("claim_attempt").$type(),
+  claim_attempt: json5("claim_attempt").$type(),
   claim_attempt_token_hash: varchar("claim_attempt_token_hash", {
     length: ID_LENGTH7
   }).unique(),
@@ -34665,8 +34853,12 @@ var agentIdentityRegistrationsTable = pgTable("auth_agent_identity_registrations
   claim_token_hash: varchar("claim_token_hash", {
     length: ID_LENGTH7
   }).notNull().unique(),
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  created_at_ms: bigint("created_at_ms", {
+    mode: "number"
+  }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", {
+    mode: "number"
+  }).notNull(),
   kind: varchar("kind", { length: 32 }).$type().notNull(),
   last_polled_at_ms: bigint("last_polled_at_ms", { mode: "number" }),
   login_hint: varchar("login_hint", { length: ID_LENGTH7 }),
@@ -34674,27 +34866,37 @@ var agentIdentityRegistrationsTable = pgTable("auth_agent_identity_registrations
     length: ID_LENGTH7
   }).primaryKey(),
   status: varchar("status", { length: STATUS_LENGTH2 }).$type().notNull(),
-  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
+  updated_at_ms: bigint("updated_at_ms", {
+    mode: "number"
+  }).notNull(),
   upstream_client_id: varchar("upstream_client_id", {
     length: ID_LENGTH7
   }),
   upstream_issuer: varchar("upstream_issuer", { length: ID_LENGTH7 }),
-  upstream_subject: varchar("upstream_subject", { length: ID_LENGTH7 }),
+  upstream_subject: varchar("upstream_subject", {
+    length: ID_LENGTH7
+  }),
   user_id: varchar("user_id", { length: ID_LENGTH7 }),
   version: integer("version").notNull()
 }, (table) => [
   uniqueIndex("auth_agent_identity_upstream_unique").on(table.upstream_issuer, table.upstream_subject, table.upstream_client_id)
 ]);
-var agentRegistrationsTable = pgTable("auth_agent_registrations", {
+var createAgentRegistrationsTable = (json5) => pgTable("auth_agent_registrations", {
   agent_id: varchar("agent_id", { length: ID_LENGTH7 }).primaryKey(),
-  allowed_scopes: portableJsonb("allowed_scopes").$type().notNull().default([]),
+  allowed_scopes: json5("allowed_scopes").$type().notNull().default([]),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).unique(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  metadata: portableJsonb("metadata").$type(),
+  metadata: json5("metadata").$type(),
   name: varchar("name", { length: NAME_LENGTH }).notNull(),
   status: varchar("status", { length: STATUS_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
+var agentDelegationsBunSqlTable = createAgentDelegationsTable(bunSqlJsonb);
+var agentDelegationsTable = createAgentDelegationsTable(portableJsonb);
+var agentIdentityRegistrationsBunSqlTable = createAgentIdentityRegistrationsTable(bunSqlJsonb);
+var agentIdentityRegistrationsTable = createAgentIdentityRegistrationsTable(portableJsonb);
+var agentRegistrationsBunSqlTable = createAgentRegistrationsTable(bunSqlJsonb);
+var agentRegistrationsTable = createAgentRegistrationsTable(portableJsonb);
 var toRegistration = (row) => ({
   agentId: row.agent_id,
   allowedScopes: row.allowed_scopes,
@@ -34761,24 +34963,24 @@ var identityRegistrationValues = (registration) => ({
 var createNeonAgentDelegationStore = (databaseUrl) => createDrizzleAgentDelegationStore(createNeonDatabase(databaseUrl));
 var createNeonAgentIdentityRegistrationStore = (databaseUrl) => createPostgresAgentIdentityRegistrationStore(createNeonDatabase(databaseUrl));
 var createNeonAgentRegistrationStore = (databaseUrl) => createPostgresAgentRegistrationStore(createNeonDatabase(databaseUrl));
-var createDrizzleAgentDelegationStore = (db) => ({
+var createDrizzleAgentDelegationStoreFor = (db, table) => ({
   findActiveDelegation: async ({
     agentId,
     now = Date.now(),
     organizationId,
     userId
   }) => {
-    const organizationCondition = organizationId === undefined ? isNull(agentDelegationsTable.organization_id) : eq(agentDelegationsTable.organization_id, organizationId);
-    const [row] = await db.select().from(agentDelegationsTable).where(and(eq(agentDelegationsTable.agent_id, agentId), eq(agentDelegationsTable.user_id, userId), organizationCondition, eq(agentDelegationsTable.status, "active"), or(isNull(agentDelegationsTable.expires_at_ms), gt(agentDelegationsTable.expires_at_ms, now)))).orderBy(desc(agentDelegationsTable.updated_at_ms)).limit(1);
+    const organizationCondition = organizationId === undefined ? isNull(table.organization_id) : eq(table.organization_id, organizationId);
+    const [row] = await db.select().from(table).where(and(eq(table.agent_id, agentId), eq(table.user_id, userId), organizationCondition, eq(table.status, "active"), or(isNull(table.expires_at_ms), gt(table.expires_at_ms, now)))).orderBy(desc(table.updated_at_ms)).limit(1);
     return row === undefined ? undefined : toDelegation(row);
   },
   findByDelegationId: async (delegationId) => {
-    const [row] = await db.select().from(agentDelegationsTable).where(eq(agentDelegationsTable.delegation_id, delegationId)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.delegation_id, delegationId)).limit(1);
     return row === undefined ? undefined : toDelegation(row);
   },
   listDelegations: async (agentId) => {
-    const base = db.select().from(agentDelegationsTable);
-    const rows = await (agentId === undefined ? base.orderBy(desc(agentDelegationsTable.created_at_ms)) : base.where(eq(agentDelegationsTable.agent_id, agentId)).orderBy(desc(agentDelegationsTable.created_at_ms)));
+    const base = db.select().from(table);
+    const rows = await (agentId === undefined ? base.orderBy(desc(table.created_at_ms)) : base.where(eq(table.agent_id, agentId)).orderBy(desc(table.created_at_ms)));
     return rows.map(toDelegation);
   },
   saveDelegation: async (delegation) => {
@@ -34794,36 +34996,38 @@ var createDrizzleAgentDelegationStore = (db) => ({
       updated_at_ms: delegation.updatedAt,
       user_id: delegation.userId
     };
-    await db.insert(agentDelegationsTable).values(values).onConflictDoUpdate({
+    await db.insert(table).values(values).onConflictDoUpdate({
       set: values,
-      target: agentDelegationsTable.delegation_id
+      target: table.delegation_id
     });
   }
 });
+var createDrizzleAgentDelegationStore = (db) => createDrizzleAgentDelegationStoreFor(db, agentDelegationsTable);
+var createBunSqlDrizzleAgentDelegationStore = (db) => createDrizzleAgentDelegationStoreFor(db, agentDelegationsBunSqlTable);
 var createPostgresAgentDelegationStore = createDrizzleAgentDelegationStore;
-var createPostgresAgentIdentityRegistrationStore = (db) => ({
+var createPostgresAgentIdentityRegistrationStoreFor = (db, table) => ({
   create: async (registration) => {
-    const rows = await db.insert(agentIdentityRegistrationsTable).values(identityRegistrationValues(registration)).onConflictDoNothing().returning({ id: agentIdentityRegistrationsTable.registration_id });
+    const rows = await db.insert(table).values(identityRegistrationValues(registration)).onConflictDoNothing().returning({ id: table.registration_id });
     return rows.length === 1;
   },
   findByAgentId: async (agentId) => {
-    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.agent_id, agentId)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.agent_id, agentId)).limit(1);
     return row === undefined ? undefined : toIdentityRegistration(row);
   },
   findByAttemptTokenHash: async (attemptTokenHash) => {
-    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.claim_attempt_token_hash, attemptTokenHash)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.claim_attempt_token_hash, attemptTokenHash)).limit(1);
     return row === undefined ? undefined : toIdentityRegistration(row);
   },
   findByClaimTokenHash: async (claimTokenHash) => {
-    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.claim_token_hash, claimTokenHash)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.claim_token_hash, claimTokenHash)).limit(1);
     return row === undefined ? undefined : toIdentityRegistration(row);
   },
   findByRegistrationId: async (registrationId) => {
-    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(eq(agentIdentityRegistrationsTable.registration_id, registrationId)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.registration_id, registrationId)).limit(1);
     return row === undefined ? undefined : toIdentityRegistration(row);
   },
   findByUpstreamIdentity: async ({ clientId, issuer, subject }) => {
-    const [row] = await db.select().from(agentIdentityRegistrationsTable).where(and(eq(agentIdentityRegistrationsTable.upstream_client_id, clientId), eq(agentIdentityRegistrationsTable.upstream_issuer, issuer), eq(agentIdentityRegistrationsTable.upstream_subject, subject))).limit(1);
+    const [row] = await db.select().from(table).where(and(eq(table.upstream_client_id, clientId), eq(table.upstream_issuer, issuer), eq(table.upstream_subject, subject))).limit(1);
     return row === undefined ? undefined : toIdentityRegistration(row);
   },
   replace: async (registration, expectedVersion) => {
@@ -34832,21 +35036,23 @@ var createPostgresAgentIdentityRegistrationStore = (db) => ({
       version: expectedVersion + 1
     };
     const values = identityRegistrationValues(next);
-    const rows = await db.update(agentIdentityRegistrationsTable).set(values).where(and(eq(agentIdentityRegistrationsTable.registration_id, registration.registrationId), eq(agentIdentityRegistrationsTable.version, expectedVersion))).returning({ id: agentIdentityRegistrationsTable.registration_id });
+    const rows = await db.update(table).set(values).where(and(eq(table.registration_id, registration.registrationId), eq(table.version, expectedVersion))).returning({ id: table.registration_id });
     return rows.length === 1;
   }
 });
-var createPostgresAgentRegistrationStore = (db) => ({
+var createBunSqlDrizzleAgentIdentityRegistrationStore = (db) => createPostgresAgentIdentityRegistrationStoreFor(db, agentIdentityRegistrationsBunSqlTable);
+var createPostgresAgentIdentityRegistrationStore = (db) => createPostgresAgentIdentityRegistrationStoreFor(db, agentIdentityRegistrationsTable);
+var createPostgresAgentRegistrationStoreFor = (db, table) => ({
   findByAgentId: async (agentId) => {
-    const [row] = await db.select().from(agentRegistrationsTable).where(eq(agentRegistrationsTable.agent_id, agentId)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.agent_id, agentId)).limit(1);
     return row === undefined ? undefined : toRegistration(row);
   },
   findByClientId: async (clientId) => {
-    const [row] = await db.select().from(agentRegistrationsTable).where(eq(agentRegistrationsTable.client_id, clientId)).limit(1);
+    const [row] = await db.select().from(table).where(eq(table.client_id, clientId)).limit(1);
     return row === undefined ? undefined : toRegistration(row);
   },
   listRegistrations: async () => {
-    const rows = await db.select().from(agentRegistrationsTable).orderBy(desc(agentRegistrationsTable.created_at_ms));
+    const rows = await db.select().from(table).orderBy(desc(table.created_at_ms));
     return rows.map(toRegistration);
   },
   saveRegistration: async (registration) => {
@@ -34860,12 +35066,14 @@ var createPostgresAgentRegistrationStore = (db) => ({
       status: registration.status,
       updated_at_ms: registration.updatedAt
     };
-    await db.insert(agentRegistrationsTable).values(values).onConflictDoUpdate({
+    await db.insert(table).values(values).onConflictDoUpdate({
       set: values,
-      target: agentRegistrationsTable.agent_id
+      target: table.agent_id
     });
   }
 });
+var createBunSqlDrizzleAgentRegistrationStore = (db) => createPostgresAgentRegistrationStoreFor(db, agentRegistrationsBunSqlTable);
+var createPostgresAgentRegistrationStore = (db) => createPostgresAgentRegistrationStoreFor(db, agentRegistrationsTable);
 // src/apikeys/inMemoryStores.ts
 var createInMemoryAccessTokenStore = () => {
   const tokens = new Map;
@@ -37209,6 +37417,15 @@ var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
 };
+var mfaSmsDeliveryPolicyMigration = {
+  id: "0004_sms_delivery_policy",
+  sql: [
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_code_sent_at_ms" bigint;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_pending_purpose" text;',
+    'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "sms_provider_reference" text;'
+  ].join(`
+`)
+};
 var oidcResourceAudienceMigration = {
   id: "0002_resource_audience",
   sql: [
@@ -37263,7 +37480,8 @@ var blockMigrations = {
     migrations: [
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
       mfaSmsColumnsMigration,
-      mfaTotpLockoutMigration
+      mfaTotpLockoutMigration,
+      mfaSmsDeliveryPolicyMigration
     ]
   },
   oidc: {
@@ -37776,6 +37994,7 @@ var buildAuthApplications = async (configuration) => {
     credentials,
     customProviders,
     mfa,
+    verificationProvider,
     passwordless,
     lockout,
     sessions,
@@ -38008,7 +38227,8 @@ var buildAuthApplications = async (configuration) => {
     auditedMfa ? mfaRoutes({
       ...auditedMfa,
       authSessionStore,
-      cookieSecure: resolvedCookieSecure
+      cookieSecure: resolvedCookieSecure,
+      verificationProvider
     }) : new Elysia45,
     passwordless ? passwordlessRoutes({
       ...passwordless,
@@ -38255,8 +38475,9 @@ export {
   createPostgresScimTokenStore,
   createNodeSamlAdapter,
   createAuthContext,
-  auth2 as auth
+  auth2 as auth,
+  VerificationProviderError
 };
 
-//# debugId=52D884157E2599DD64756E2164756E21
+//# debugId=AAFF3B14FB3E90D564756E2164756E21
 //# sourceMappingURL=server.js.map