@absolutejs/auth 0.61.0 → 0.63.0

package/dist/credentials/config.d.ts

@@ -41,6 +41,13 @@ export type CredentialsConfig<UserType> = {
     onEmailVerified?: (context: {
         email: string;
     }) => void | Promise<void>;
+    /** Called (in the enumeration-safe default) when someone tries to register an
+     *  email that already exists — send the real owner a "you already have an
+     *  account, sign in" email out-of-band. Not called when
+     *  `revealRegistrationConflicts` is true. */
+    onExistingAccount?: (context: {
+        email: string;
+    }) => void | Promise<void>;
     onPasswordReset?: (context: {
         email: string;
     }) => void | Promise<void>;
@@ -55,9 +62,17 @@ export type CredentialsConfig<UserType> = {
      *  rejected until the email is verified. Default false = auto-login on register and
      *  verification acts as a soft, later gate. */
     requireEmailVerification?: boolean;
+    /** When true, `POST /register` returns 409 "Email is already registered" for a
+     *  known email. Default false = enumeration-safe: return the same generic
+     *  response a new pending registration does and call `onExistingAccount`
+     *  instead of confirming the account exists. */
+    revealRegistrationConflicts?: boolean;
     resetPasswordRoute?: RouteString;
     resetTokenDurationMs?: number;
     sessionDurationMs?: number;
+    /** When set, login/register reject requests whose `Origin` header is not in
+     *  this list (defense against login/registration CSRF). Omit to disable. */
+    trustedOrigins?: readonly string[];
     verificationTokenDurationMs?: number;
     verifyEmailRoute?: RouteString;
 };

package/dist/credentials/login.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;
@@ -30,7 +30,7 @@ export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreac
             headers: unknown;
             response: {
                 401: "Invalid email or password";
-                403: {
+                403: "Request origin is not allowed" | {
                     readonly status: "email_not_verified";
                 };
                 200: {

package/dist/credentials/register.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, onCreateCredentialUser, onCredentialsLoginSuccess, onRegistrationSuccess, onSendEmail, passwordPolicy, registerRoute, requireEmailVerification, sessionDurationMs, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/credentials/routes.d.ts

@@ -98,7 +98,7 @@ export declare const credentialRoutes: <UserType>(config: CredentialRouteProps<U
             headers: unknown;
             response: {
                 401: "Invalid email or password";
-                403: {
+                403: "Request origin is not allowed" | {
                     readonly status: "email_not_verified";
                 };
                 200: {

package/dist/csrf.d.ts

@@ -0,0 +1 @@
+export declare const isTrustedOrigin: (request: Request, trustedOrigins?: readonly string[]) => boolean;

package/dist/index.d.ts

@@ -815,7 +815,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                 headers: unknown;
                 response: {
                     401: "Invalid email or password";
-                    403: {
+                    403: "Request origin is not allowed" | {
                         readonly status: "email_not_verified";
                     };
                     200: {
@@ -3454,6 +3454,7 @@ export { createOAuthAccountLinkedProviderCredentialResolver, type OAuthLinkedPro
 export { createNeonLinkedProviderStores, createNeonOAuthLinkedProviderCredentialResolver } from './linkedProviders/neonStores';
 export { createInMemoryLinkedProviderStores } from './linkedProviders/inMemoryStores';
 export { protectRoutePlugin } from './routes/protectRoute';
+export { requireAuthPlugin } from './routes/requireAuth';
 export { sessionRoutes } from './routes/sessions';
 export { stepUpPlugin } from './routes/stepUp';
 export * from './session/sessionsConfig';
@@ -3468,6 +3469,7 @@ export { resolveAuthHtmxRenderers } from './htmx/renderers';
 export type { AuthHtmxConfig, AuthHtmxConnectorTarget, AuthHtmxProviderData, AuthHtmxProviderInfo, AuthHtmxRenderOverrides, AuthHtmxRenderersConfig, AuthHtmxUser, AuthIdentityPayload, LinkedProviderPayload } from './htmx/types';
 export * from './utils';
 export * from './redirect';
+export * from './csrf';
 export { buildClientProviders, resolveClientProviderEntry, resolveProviderClientConfiguration } from './providers/clients';
 export type { OAuth2TokenResponse, OAuth2Client, OAuth2ClientForConfig, CustomProviderCredentials, ProviderConfig, ProviderOption, PKCEProvider, OIDCProvider, RefreshableProvider, RevocableProvider, ScopeRequiredProvider, ProvidersMap, ProviderConfiguration, CredentialsFor } from 'citra';
 export { providers, providerOptions, createCustomOAuth2Client, defineProvider, refreshableProviderOptions, revocableProviderOptions, oidcProviderOptions, pkceProviderOptions, scopeRequiredProviderOptions, decodeJWT, extractPropFromIdentity, isValidProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isOIDCProviderOption, isPKCEProviderOption, isRevocableProviderOption, isRevocableOAuth2Client } from 'citra';

package/dist/index.js

@@ -2982,7 +2982,7 @@ var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Clien
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
-import { Elysia as Elysia45 } from "elysia";
+import { Elysia as Elysia46 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -5145,6 +5145,15 @@ init_constants();
 init_crypto();
 import { Elysia as Elysia11, t as t8 } from "elysia";
 
+// src/csrf.ts
+var isTrustedOrigin = (request, trustedOrigins) => {
+  if (trustedOrigins === undefined || trustedOrigins.length === 0) {
+    return true;
+  }
+  const origin = request.headers.get("origin");
+  return origin !== null && trustedOrigins.includes(origin);
+};
+
 // src/credentials/import.ts
 init_crypto();
 var normalizeEmail = (email) => email.trim().toLowerCase();
@@ -5349,7 +5358,8 @@ var credentialsLogin = ({
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
-  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
+  sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins
 }) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
   body: { email, password },
   cookie: { user_session_id },
@@ -5357,6 +5367,9 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const headerBag = {};
   request.headers.forEach((value, key) => {
     headerBag[key] = value;
@@ -5514,19 +5527,26 @@ var credentialsRegister = ({
   credentialStore,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
+  onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
+  revealRegistrationConflicts = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
+  trustedOrigins,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
 }) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
+  request,
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
+  if (!isTrustedOrigin(request, trustedOrigins)) {
+    return status("Forbidden", "Request origin is not allowed");
+  }
   const normalizedEmail = email.trim().toLowerCase();
   if (!normalizedEmail.includes("@")) {
     return status("Bad Request", "A valid email is required");
@@ -5540,7 +5560,13 @@ var credentialsRegister = ({
   }
   const existing = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (existing) {
-    return status("Conflict", "Email is already registered");
+    if (revealRegistrationConflicts) {
+      return status("Conflict", "Email is already registered");
+    }
+    await onExistingAccount?.({ email: normalizedEmail });
+    return status("Created", {
+      status: "verification_required"
+    });
   }
   const created = await onCreateCredentialUser({
     ...extraFields,
@@ -31506,6 +31532,21 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
   };
   return { bindingStore, grantStore };
 };
+// src/routes/requireAuth.ts
+import { Elysia as Elysia41, t as t33 } from "elysia";
+var requireAuthPlugin = ({
+  authSessionStore
+} = {}) => new Elysia41({
+  name: "@absolutejs/auth/require-auth",
+  seed: pluginDependencySeed(authSessionStore)
+}).use(sessionStore()).guard({ cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }) }).resolve(async ({ store: { session }, cookie: { user_session_id } }) => {
+  const { user } = await getStatusFromSource({
+    authSessionStore,
+    session,
+    user_session_id
+  });
+  return { user: user ?? null };
+}).onBeforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
 // src/session/impersonation.ts
 init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
@@ -32924,7 +32965,7 @@ var createInMemoryCredentialOfferStore = () => {
   };
 };
 // src/oidc/vciRoutes.ts
-import { Elysia as Elysia41, t as t33 } from "elysia";
+import { Elysia as Elysia42, t as t34 } from "elysia";
 var HTTP_OK4 = 200;
 var HTTP_BAD_REQUEST4 = 400;
 var HTTP_UNAUTHORIZED5 = 401;
@@ -32949,7 +32990,7 @@ var vciRoutes = ({
   const credentialRoute = `${vciRoute}/credential`;
   const nonceRoute = `${vciRoute}/nonce`;
   const vciSigningKey = vciConfig.signingKey ?? signingKey;
-  return new Elysia41().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
+  return new Elysia42().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
@@ -32972,11 +33013,11 @@ var vciRoutes = ({
       return errorBody(result.error, HTTP_BAD_REQUEST4);
     return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
   }, {
-    body: t33.Object({
-      format: t33.Optional(t33.Union([t33.Literal("vc+sd-jwt")])),
-      proof: t33.Optional(t33.Object({
-        jwt: t33.String(),
-        proof_type: t33.Literal("jwt")
+    body: t34.Object({
+      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
+      proof: t34.Optional(t34.Object({
+        jwt: t34.String(),
+        proof_type: t34.Literal("jwt")
       }))
     })
   }).post(nonceRoute, async () => {
@@ -33098,7 +33139,7 @@ var verifyStatusListJwt = async ({
   };
 };
 // src/vc/statusListRoutes.ts
-import { Elysia as Elysia42, t as t34 } from "elysia";
+import { Elysia as Elysia43, t as t35 } from "elysia";
 var HTTP_OK5 = 200;
 var HTTP_NOT_FOUND = 404;
 var DEFAULT_STATUS_ROUTE = "/vc/status";
@@ -33110,7 +33151,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia42().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia43().get(listRoute, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -33126,7 +33167,7 @@ var statusListRoutes = ({
       headers: { "content-type": STATUS_LIST_SUB_TYP },
       status: HTTP_OK5
     });
-  }, { params: t34.Object({ listId: t34.String() }) });
+  }, { params: t35.Object({ listId: t35.String() }) });
 };
 // src/vc/openid4vp.ts
 init_crypto();
@@ -33331,7 +33372,7 @@ var createInMemoryPresentationRequestStore = () => {
   };
 };
 // src/vc/vpRoutes.ts
-import { Elysia as Elysia43, t as t35 } from "elysia";
+import { Elysia as Elysia44, t as t36 } from "elysia";
 var HTTP_OK6 = 200;
 var HTTP_BAD_REQUEST5 = 400;
 var HTTP_NOT_FOUND2 = 404;
@@ -33350,7 +33391,7 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia43().post(authorizeRoute, async ({ body }) => {
+  return new Elysia44().post(authorizeRoute, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -33368,10 +33409,10 @@ var vpRoutes = ({
       requestId: result.request.requestId
     }, { status: HTTP_OK6 });
   }, {
-    body: t35.Object({
-      client_id: t35.Optional(t35.String()),
-      requested_claims: t35.Array(t35.String()),
-      state: t35.Optional(t35.String())
+    body: t36.Object({
+      client_id: t36.Optional(t36.String()),
+      requested_claims: t36.Array(t36.String()),
+      state: t36.Optional(t36.String())
     })
   }).get(requestRoute, async ({ params: { id } }) => {
     const stored = await vpConfig.requestStore.getRequest(id);
@@ -33397,7 +33438,7 @@ var vpRoutes = ({
       },
       status: HTTP_OK6
     });
-  }, { params: t35.Object({ id: t35.String() }) }).post(responseRoute, async ({ body }) => {
+  }, { params: t36.Object({ id: t36.String() }) }).post(responseRoute, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
       return errorBody2("missing_state", HTTP_BAD_REQUEST5);
@@ -33418,10 +33459,10 @@ var vpRoutes = ({
       verified: true
     }, { status: HTTP_OK6 });
   }, {
-    body: t35.Object({
-      presentation_submission: t35.Optional(t35.Unknown()),
-      state: t35.Optional(t35.String()),
-      vp_token: t35.String()
+    body: t36.Object({
+      presentation_submission: t36.Optional(t36.Unknown()),
+      state: t36.Optional(t36.String()),
+      vp_token: t36.String()
     })
   });
 };
@@ -36777,7 +36818,7 @@ var blockMigrations = {
   webhooks: initMigration("webhooks", [webhookDeliveriesTable])
 };
 // src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia44, t as t36 } from "elysia";
+import { Elysia as Elysia45, t as t37 } from "elysia";
 var HTTP_BAD_REQUEST6 = 400;
 var HTTP_UNAUTHORIZED6 = 401;
 var HTTP_FOUND2 = 302;
@@ -36887,19 +36928,19 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia44().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
     binding: "POST",
     body,
     inMemorySession: store.session,
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    body: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      SAMLRequest: t36.Optional(t36.String())
+    body: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      SAMLRequest: t37.Optional(t37.String())
     }),
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     })
   }).get(ssoIdpRoute, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
     binding: "Redirect",
@@ -36908,14 +36949,14 @@ var samlIdpRoutes = ({
     request,
     userSessionIdValue: user_session_id.value
   }), {
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     }),
-    query: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      SAMLRequest: t36.Optional(t36.String()),
-      SigAlg: t36.Optional(t36.String()),
-      Signature: t36.Optional(t36.String())
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      SAMLRequest: t37.Optional(t37.String()),
+      SigAlg: t37.Optional(t37.String()),
+      Signature: t37.Optional(t37.String())
     })
   }).get(idpInitiateRoute, async ({
     cookie: { user_session_id },
@@ -36951,12 +36992,12 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   }, {
-    cookie: t36.Cookie({
-      user_session_id: t36.Optional(userSessionIdTypebox)
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
     }),
-    query: t36.Object({
-      RelayState: t36.Optional(t36.String()),
-      sp: t36.Optional(t36.String())
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      sp: t37.Optional(t37.String())
     })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
@@ -37405,7 +37446,7 @@ var buildAuthApplications = async (configuration) => {
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
   const pluginSeed = pluginDependencySeed(configuration);
-  const coreRoutes = new Elysia45({
+  const coreRoutes = new Elysia46({
     name: "@absolutejs/auth/core-routes",
     seed: pluginSeed
   }).use([
@@ -37462,7 +37503,7 @@ var buildAuthApplications = async (configuration) => {
       profileRoute
     })
   ]);
-  const featureRoutes = new Elysia45({
+  const featureRoutes = new Elysia46({
     name: "@absolutejs/auth/feature-routes",
     seed: pluginSeed
   }).use([
@@ -37471,64 +37512,64 @@ var buildAuthApplications = async (configuration) => {
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       lockoutGuard
-    }) : new Elysia45,
+    }) : new Elysia46,
     auditedMfa ? mfaRoutes({
       ...auditedMfa,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       verificationProvider
-    }) : new Elysia45,
+    }) : new Elysia46,
     passwordless ? passwordlessRoutes({
       ...passwordless,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       emit: auditEmit
-    }) : new Elysia45,
-    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia45,
+    }) : new Elysia46,
+    sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia46,
     sso ? oidcSsoRoutes({
       ...sso,
       authSessionStore,
       cookieSecure: resolvedCookieSecure
-    }) : new Elysia45,
+    }) : new Elysia46,
     sso && sso.samlAdapter ? samlSsoRoutes({
       ...sso,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       samlAdapter: sso.samlAdapter
-    }) : new Elysia45,
+    }) : new Elysia46,
     sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
       getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
       ssoConnectionStore: sso.ssoConnectionStore,
       ssoRoute: sso.ssoRoute
-    }) : new Elysia45,
-    scim ? scimRoutes(scim) : new Elysia45,
-    apikeys ? apiKeysRoutes(apikeys) : new Elysia45,
+    }) : new Elysia46,
+    scim ? scimRoutes(scim) : new Elysia46,
+    apikeys ? apiKeysRoutes(apikeys) : new Elysia46,
     oidcConfig ? oidcProviderRoutes({
       ...oidcConfig,
       authSessionStore
-    }) : new Elysia45,
+    }) : new Elysia46,
     organizations ? organizationRoutes({
       ...organizations,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     roles ? roleRoutes({
       ...roles,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
-    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia45,
+    }) : new Elysia46,
+    portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia46,
     webauthn ? webauthnRoutes({
       ...webauthn,
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     compliance ? complianceRoutes({
       ...compliance,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia45,
+    }) : new Elysia46,
     createConfiguredAuthHtmxRoutes({ authSessionStore, config: htmx }),
     agentAuthRoutes(resolvedAgentAuth)
   ]);
@@ -37543,7 +37584,7 @@ var buildAuthApplications = async (configuration) => {
 };
 var auth = async (configuration) => {
   const { authContext, coreRoutes, featureRoutes } = await buildAuthApplications(configuration);
-  const application = new Elysia45({
+  const application = new Elysia46({
     name: "@absolutejs/auth",
     seed: pluginDependencySeed(configuration)
   });
@@ -37646,6 +37687,7 @@ export {
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   resolveAgentPrincipal,
+  requireAuthPlugin,
   removeFromSessionRing,
   rehashCredentialPassword,
   registerClient,
@@ -37716,6 +37758,7 @@ export {
   isValidUser,
   isValidProviderOption,
   isUserSessionId,
+  isTrustedOrigin,
   isSafeLocalPath,
   isRevocableProviderOption,
   isRevocableOAuth2Client,
@@ -38057,5 +38100,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=60AF00D018199BB164756E2164756E21
+//# debugId=A719E0625663B7E664756E2164756E21
 //# sourceMappingURL=index.js.map