@absolutejs/auth 0.65.5 → 0.66.0

package/dist/index.js

@@ -77,8 +77,8 @@ var DEFAULT_TOKEN_BYTES = 32, AES_KEY_BYTES = 32, AES_IV_BYTES = 12, HOTP_COUNTE
   const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(input));
   return new Uint8Array(digest);
 }, hmacSha1 = async (key, message) => {
-  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, message);
+  const cryptoKey = await crypto.subtle.importKey("raw", Uint8Array.from(key), { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, Uint8Array.from(message));
   return new Uint8Array(signature);
 }, counterToBytes = (counter) => {
   const bytes = new Uint8Array(HOTP_COUNTER_BYTES);
@@ -3159,7 +3159,14 @@ var apiKeysRoutes = ({
   if (apiClientStore === undefined || accessTokenStore === undefined) {
     return new Elysia;
   }
-  return new Elysia().post(tokenRoute, async ({ body, headers }) => {
+  return new Elysia().post(tokenRoute, {
+    body: t.Object({
+      client_id: t.Optional(t.String()),
+      client_secret: t.Optional(t.String()),
+      grant_type: t.Optional(t.String()),
+      scope: t.Optional(t.String())
+    })
+  }, async ({ body, headers }) => {
     if (body.grant_type !== GRANT_CLIENT_CREDENTIALS) {
       return oauthError(HTTP_BAD_REQUEST, "unsupported_grant_type");
     }
@@ -3192,13 +3199,6 @@ var apiKeysRoutes = ({
       },
       status: HTTP_OK
     });
-  }, {
-    body: t.Object({
-      client_id: t.Optional(t.String()),
-      client_secret: t.Optional(t.String()),
-      grant_type: t.Optional(t.String()),
-      scope: t.Optional(t.String())
-    })
   });
 };
 
@@ -4546,14 +4546,10 @@ var loadSessionFromSource = async ({
 
 // src/session/state.ts
 import { Elysia as Elysia4 } from "elysia";
-var sessionStore = () => {
-  const initialSession = {};
-  const initialUnregisteredSession = {};
-  return new Elysia4({ name: "sessionStore" }).state({
-    session: initialSession,
-    unregisteredSession: initialUnregisteredSession
-  });
-};
+var sessionStore = (initialSession = {}, initialUnregisteredSession = {}) => new Elysia4({ name: "sessionStore" }).state({
+  session: initialSession,
+  unregisteredSession: initialUnregisteredSession
+});
 
 // src/typebox.ts
 import { t as t2 } from "elysia";
@@ -4574,7 +4570,10 @@ var protectPermissionPlugin = ({
 }) => new Elysia5({
   name: "@absolutejs/auth/permission",
   seed: pluginDependencySeed(hasPermission)
-}).use(sessionStore()).guard({ cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}).use(sessionStore()).guard({
+  cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectPermission: (check, handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -4617,7 +4616,10 @@ var protectRoutePlugin = ({
 } = {}) => new Elysia6({
   name: "@absolutejs/auth/protect-route",
   seed: pluginDependencySeed(authSessionStore)
-}).use(sessionStore()).guard({ cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}).use(sessionStore()).guard({
+  cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectRoute: (handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -4643,7 +4645,10 @@ var stepUpPlugin = ({
 } = {}) => new Elysia7({
   name: "@absolutejs/auth/step-up",
   seed: pluginDependencySeed(authSessionStore)
-}).use(sessionStore()).guard({ cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}).use(sessionStore()).guard({
+  cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
     authSessionStore,
     session,
@@ -4689,7 +4694,7 @@ import { Elysia as Elysia9, t as t6 } from "elysia";
 init_constants();
 
 // src/types.ts
-function isJsonValue(value) {
+var isJsonValue = (value) => {
   if (value === null || typeof value === "boolean" || typeof value === "string")
     return true;
   if (typeof value === "number")
@@ -4699,7 +4704,7 @@ function isJsonValue(value) {
   if (typeof value !== "object")
     return false;
   return Object.values(value).every(isJsonValue);
-}
+};
 var parseJsonObject = (value) => {
   if (!isJsonValue(value) || value === null || Array.isArray(value) || typeof value !== "object")
     throw new TypeError("Expected a JSON object");
@@ -5053,7 +5058,7 @@ var complianceRoutes = ({
   emit,
   exportUserData,
   getUserId
-}) => new Elysia9().use(sessionStore()).get(`${complianceRoute}/export`, async ({
+}) => new Elysia9().use(sessionStore()).get(`${complianceRoute}/export`, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -5073,7 +5078,7 @@ var complianceRoutes = ({
     userId: getUserId?.(current.user)
   });
   return status("OK", data);
-}, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(complianceRoute, async ({
+}).delete(complianceRoute, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -5106,7 +5111,7 @@ var complianceRoutes = ({
     userId
   });
   return status("OK", { deleted: true });
-}, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) });
+});
 
 // src/credentials/routes.ts
 import { Elysia as Elysia14 } from "elysia";
@@ -5132,7 +5137,7 @@ var credentialsEmailVerification = ({
   requireEmailVerification = false,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   verifyEmailRoute = "/auth/verify-email"
-}) => new Elysia10().post(verifyEmailRoute, async ({ body: { token }, status }) => {
+}) => new Elysia10().post(verifyEmailRoute, { body: t7.Object({ token: t7.String() }) }, async ({ body: { token }, status }) => {
   const consumed = await credentialStore.consumeVerificationToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired verification token");
@@ -5172,7 +5177,7 @@ var credentialsEmailVerification = ({
   }
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
-}, { body: t7.Object({ token: t7.String() }) }).post(`${verifyEmailRoute}/request`, async ({ body: { email }, status }) => {
+}).post(`${verifyEmailRoute}/request`, { body: t7.Object({ email: t7.String() }) }, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && !credential.emailVerified) {
@@ -5191,7 +5196,7 @@ var credentialsEmailVerification = ({
     });
   }
   return status("OK", { status: "verification_requested" });
-}, { body: t7.Object({ email: t7.String() }) });
+});
 
 // src/credentials/login.ts
 init_constants();
@@ -5305,7 +5310,7 @@ var constantTimeEqualBytes = (left, right) => {
   return diff === 0;
 };
 var base64Decode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64"));
-var sha256Bytes = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", input));
+var sha256Bytes = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(input)));
 var isLegacyHash = (storedHash) => !storedHash.startsWith("$argon2id$") && !storedHash.startsWith("$2");
 var verifyAuth0Pbkdf2 = async (plainPassword, wrappedHash) => {
   const parts = wrappedHash.split(":");
@@ -5429,7 +5434,10 @@ var credentialsLogin = ({
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   trustedOrigins
-}) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
+}) => new Elysia11().use(sessionStore()).post(loginRoute, {
+  body: t8.Object({ email: t8.String(), password: t8.String() }),
+  cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { email, password },
   cookie: { user_session_id },
   request,
@@ -5525,10 +5533,7 @@ var credentialsLogin = ({
     passwordCompromised,
     status: "authenticated"
   });
-}), {
-  body: t8.Object({ email: t8.String(), password: t8.String() }),
-  cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
-});
+}));
 
 // src/credentials/passwordReset.ts
 init_crypto();
@@ -5540,7 +5545,7 @@ var credentialsPasswordReset = ({
   passwordPolicy,
   resetPasswordRoute = "/auth/reset-password",
   resetTokenDurationMs = DEFAULT_RESET_TOKEN_TTL_MS
-}) => new Elysia12().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
+}) => new Elysia12().post(`${resetPasswordRoute}/request`, { body: t9.Object({ email: t9.String() }) }, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && credential.status === "active" && credential.registrationData === undefined) {
@@ -5559,7 +5564,9 @@ var credentialsPasswordReset = ({
     });
   }
   return status("OK", { status: "reset_requested" });
-}, { body: t9.Object({ email: t9.String() }) }).post(resetPasswordRoute, async ({ body: { password, token }, status }) => {
+}).post(resetPasswordRoute, {
+  body: t9.Object({ password: t9.String(), token: t9.String() })
+}, async ({ body: { password, token }, status }) => {
   const consumed = await credentialStore.consumeResetToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired reset token");
@@ -5588,8 +5595,6 @@ var credentialsPasswordReset = ({
   });
   await onPasswordReset?.({ email: consumed.email });
   return status("OK", { status: "password_reset" });
-}, {
-  body: t9.Object({ password: t9.String(), token: t9.String() })
 });
 
 // src/credentials/register.ts
@@ -5614,7 +5619,10 @@ var credentialsRegister = ({
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   trustedOrigins,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
-}) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
+}) => new Elysia13().use(sessionStore()).post(registerRoute, {
+  body: t10.Object({ email: t10.String(), password: t10.String() }, { additionalProperties: true }),
+  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
   request,
@@ -5712,10 +5720,7 @@ var credentialsRegister = ({
     userSessionId
   });
   return status("Created", { status: "authenticated" });
-}), {
-  body: t10.Object({ email: t10.String(), password: t10.String() }, { additionalProperties: true }),
-  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
-});
+}));
 
 // src/credentials/routes.ts
 var credentialRoutes = (config) => new Elysia14().use(credentialsRegister(config)).use(credentialsEmailVerification(config)).use(credentialsLogin(config)).use(credentialsPasswordReset(config));
@@ -6189,7 +6194,10 @@ var mfaSmsRoutes = ({
   smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
-}) => new Elysia17().use(sessionStore()).post(smsSetupRoute, async ({
+}) => new Elysia17().use(sessionStore()).post(smsSetupRoute, {
+  body: t11.Object({ phone: t11.String() }),
+  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { phone },
   cookie: { user_session_id },
   status,
@@ -6250,10 +6258,10 @@ var mfaSmsRoutes = ({
     return status(mapped.status, mapped.message);
   }
   return status("OK", { phone: maskPhone(phone) });
-}, {
-  body: t11.Object({ phone: t11.String() }),
+}).post(smsVerifyRoute, {
+  body: t11.Object({ code: t11.String() }),
   cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
-}).post(smsVerifyRoute, async ({
+}, async ({
   body: { code },
   cookie: { user_session_id },
   status,
@@ -6328,9 +6336,6 @@ var mfaSmsRoutes = ({
   }
   await onMfaEnrolled?.({ userId });
   return status("OK", { status: "enrolled" });
-}, {
-  body: t11.Object({ code: t11.String() }),
-  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/challenge.ts
@@ -6352,7 +6357,14 @@ var mfaChallenge = ({
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
-}) => new Elysia18().use(sessionStore()).post(challengeRoute, async ({
+}) => new Elysia18().use(sessionStore()).post(challengeRoute, {
+  body: t12.Object({
+    action: t12.Optional(t12.Union([t12.Literal("send"), t12.Literal("verify")])),
+    code: t12.Optional(t12.String()),
+    factor: t12.Optional(t12.Literal("sms"))
+  }),
+  cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { action, code, factor },
   cookie: { user_session_id },
   status,
@@ -6525,14 +6537,7 @@ var mfaChallenge = ({
     updatedAt: Date.now()
   });
   return promote();
-}), {
-  body: t12.Object({
-    action: t12.Optional(t12.Union([t12.Literal("send"), t12.Literal("verify")])),
-    code: t12.Optional(t12.String()),
-    factor: t12.Optional(t12.Literal("sms"))
-  }),
-  cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
-});
+}));
 
 // src/mfa/management.ts
 import { Elysia as Elysia19, t as t13 } from "elysia";
@@ -6549,7 +6554,7 @@ var mfaManagementRoutes = ({
   managementRoute = "/auth/mfa",
   managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   mfaStore
-}) => new Elysia19().use(sessionStore()).get(managementRoute, async ({
+}) => new Elysia19().use(sessionStore()).get(managementRoute, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6573,7 +6578,7 @@ var mfaManagementRoutes = ({
     totp: { enabled: enrollment?.totpVerified ?? false }
   };
   return status("OK", response);
-}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(managementRoute, async ({
+}).delete(managementRoute, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6591,7 +6596,7 @@ var mfaManagementRoutes = ({
   }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
-}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) });
+});
 
 // src/mfa/totp.ts
 init_crypto();
@@ -6607,7 +6612,7 @@ var mfaTotpRoutes = ({
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
   totpVerifyRoute = "/auth/mfa/totp/verify"
-}) => new Elysia20().use(sessionStore()).post(totpSetupRoute, async ({
+}) => new Elysia20().use(sessionStore()).post(totpSetupRoute, { cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6648,7 +6653,10 @@ var mfaTotpRoutes = ({
       secret
     })
   });
-}, { cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }) }).post(totpVerifyRoute, async ({
+}).post(totpVerifyRoute, {
+  body: t14.Object({ code: t14.String() }),
+  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { code },
   cookie: { user_session_id },
   status,
@@ -6684,9 +6692,6 @@ var mfaTotpRoutes = ({
   });
   await onMfaEnrolled?.({ userId });
   return status("OK", { backupCodes: codes });
-}, {
-  body: t14.Object({ code: t14.String() }),
-  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/routes.ts
@@ -7658,7 +7663,7 @@ var base64UrlEncode2 = (bytes) => {
   return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
 };
 var computeCertThumbprint = async (derBytes) => {
-  const digest = await crypto.subtle.digest("SHA-256", derBytes);
+  const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(derBytes));
   return base64UrlEncode2(new Uint8Array(digest));
 };
 var extractRfc9440ClientCert = (headers) => {
@@ -8752,7 +8757,30 @@ var oidcProviderRoutes = (config) => {
       url.searchParams.set("state", query.state);
     return redirectTo(url.toString());
   };
-  return new Elysia22().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia22().use(sessionStore()).get(authorizeRoute, {
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
+    }),
+    query: t15.Object({
+      acr_values: t15.Optional(t15.String()),
+      claims: t15.Optional(t15.String()),
+      client_id: t15.Optional(t15.String()),
+      code_challenge: t15.Optional(t15.String()),
+      code_challenge_method: t15.Optional(t15.String()),
+      id_token_hint: t15.Optional(t15.String()),
+      max_age: t15.Optional(t15.String()),
+      nonce: t15.Optional(t15.String()),
+      prompt: t15.Optional(t15.String()),
+      redirect_uri: t15.Optional(t15.String()),
+      request: t15.Optional(t15.String()),
+      request_uri: t15.Optional(t15.String()),
+      resource: t15.Optional(t15.String()),
+      response_mode: t15.Optional(t15.String()),
+      response_type: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String()),
+      state: t15.Optional(t15.String())
+    })
+  }, async ({
     cookie: { user_session_id },
     query,
     request,
@@ -8838,7 +8866,7 @@ var oidcProviderRoutes = (config) => {
     const wantsSilent = promptValues.includes("none");
     const wantsLogin = promptValues.includes("login") || promptValues.includes("consent");
     const maxAge = effectiveQuery.max_age === undefined ? undefined : Number(effectiveQuery.max_age);
-    const sessionStaleByMaxAge = userSession !== undefined && maxAge !== undefined && !Number.isNaN(maxAge) && maxAge >= 0 && (userSession.authenticatedAt ?? 0) < Date.now() - maxAge * 1000;
+    const sessionStaleByMaxAge = userSession !== undefined && maxAge !== undefined && !Number.isNaN(maxAge) && maxAge >= 0 && (maxAge === 0 || (userSession.authenticatedAt ?? 0) < Date.now() - maxAge * 1000);
     const hintSub = effectiveQuery.id_token_hint === undefined ? undefined : (await verifyIdTokenHint({
       config,
       idTokenHint: effectiveQuery.id_token_hint
@@ -8913,30 +8941,29 @@ var oidcProviderRoutes = (config) => {
     if (state !== undefined)
       params.state = state;
     return respondToClient(redirectUri, responseMode, params);
-  }, {
-    cookie: t15.Cookie({
-      user_session_id: t15.Optional(userSessionIdTypebox)
-    }),
-    query: t15.Object({
-      acr_values: t15.Optional(t15.String()),
-      claims: t15.Optional(t15.String()),
+  }).post(tokenRoute, {
+    body: t15.Object({
+      assertion: t15.Optional(t15.String()),
+      audience: t15.Optional(t15.String()),
+      auth_req_id: t15.Optional(t15.String()),
+      claim_token: t15.Optional(t15.String()),
+      client_assertion: t15.Optional(t15.String()),
+      client_assertion_type: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
-      code_challenge: t15.Optional(t15.String()),
-      code_challenge_method: t15.Optional(t15.String()),
-      id_token_hint: t15.Optional(t15.String()),
-      max_age: t15.Optional(t15.String()),
-      nonce: t15.Optional(t15.String()),
-      prompt: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      code: t15.Optional(t15.String()),
+      code_verifier: t15.Optional(t15.String()),
+      device_code: t15.Optional(t15.String()),
+      grant_type: t15.Optional(t15.String()),
+      "pre-authorized_code": t15.Optional(t15.String()),
       redirect_uri: t15.Optional(t15.String()),
-      request: t15.Optional(t15.String()),
-      request_uri: t15.Optional(t15.String()),
+      refresh_token: t15.Optional(t15.String()),
       resource: t15.Optional(t15.String()),
-      response_mode: t15.Optional(t15.String()),
-      response_type: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String()),
-      state: t15.Optional(t15.String())
+      subject_token: t15.Optional(t15.String()),
+      subject_token_type: t15.Optional(t15.String())
     })
-  }).post(tokenRoute, async ({ body, headers, request }) => {
+  }, async ({ body, headers, request }) => {
     if (body.grant_type === PRE_AUTHORIZED_CODE_GRANT && config.vciConfig !== undefined) {
       const preAuthorizedCode = body["pre-authorized_code"];
       if (typeof preAuthorizedCode !== "string") {
@@ -9000,29 +9027,28 @@ var oidcProviderRoutes = (config) => {
       return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
     }
     return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
-  }, {
+  }).post(parRoute, {
     body: t15.Object({
-      assertion: t15.Optional(t15.String()),
+      acr_values: t15.Optional(t15.String()),
       audience: t15.Optional(t15.String()),
-      auth_req_id: t15.Optional(t15.String()),
-      claim_token: t15.Optional(t15.String()),
+      claims: t15.Optional(t15.String()),
       client_assertion: t15.Optional(t15.String()),
       client_assertion_type: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      code: t15.Optional(t15.String()),
-      code_verifier: t15.Optional(t15.String()),
-      device_code: t15.Optional(t15.String()),
-      grant_type: t15.Optional(t15.String()),
-      "pre-authorized_code": t15.Optional(t15.String()),
+      code_challenge: t15.Optional(t15.String()),
+      code_challenge_method: t15.Optional(t15.String()),
+      nonce: t15.Optional(t15.String()),
       redirect_uri: t15.Optional(t15.String()),
-      refresh_token: t15.Optional(t15.String()),
       resource: t15.Optional(t15.String()),
+      response_type: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String()),
-      subject_token: t15.Optional(t15.String()),
-      subject_token_type: t15.Optional(t15.String())
+      state: t15.Optional(t15.String())
+    }),
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
-  }).post(parRoute, async ({ body, headers, request }) => {
+  }, async ({ body, headers, request }) => {
     if (config.pushedAuthorizationRequestStore === undefined) {
       return oauthError2(HTTP_NOT_IMPLEMENTED, "unsupported_response_type");
     }
@@ -9049,28 +9075,17 @@ var oidcProviderRoutes = (config) => {
       ttlMs: config.pushedAuthorizationRequestTtlMs
     });
     return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
-  }, {
+  }).post(introspectRoute, {
     body: t15.Object({
-      acr_values: t15.Optional(t15.String()),
-      audience: t15.Optional(t15.String()),
-      claims: t15.Optional(t15.String()),
-      client_assertion: t15.Optional(t15.String()),
-      client_assertion_type: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      code_challenge: t15.Optional(t15.String()),
-      code_challenge_method: t15.Optional(t15.String()),
-      nonce: t15.Optional(t15.String()),
-      redirect_uri: t15.Optional(t15.String()),
-      resource: t15.Optional(t15.String()),
-      response_type: t15.Optional(t15.String()),
-      scope: t15.Optional(t15.String()),
-      state: t15.Optional(t15.String())
+      token: t15.String(),
+      token_type_hint: t15.Optional(t15.String())
     }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(introspectRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
@@ -9088,7 +9103,7 @@ var oidcProviderRoutes = (config) => {
       token: body.token
     });
     return jsonResponse(result, HTTP_OK3);
-  }, {
+  }).post(revokeRoute, {
     body: t15.Object({
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
@@ -9098,7 +9113,7 @@ var oidcProviderRoutes = (config) => {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(revokeRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
@@ -9113,17 +9128,18 @@ var oidcProviderRoutes = (config) => {
       await revokeRefreshToken(config, body.token);
     }
     return new Response(null, { status: HTTP_OK3 });
-  }, {
+  }).post(backchannelAuthorizationRoute, {
     body: t15.Object({
+      binding_message: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      token: t15.String(),
-      token_type_hint: t15.Optional(t15.String())
+      login_hint: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String())
     }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     if (config.backchannelAuthStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
@@ -9156,18 +9172,16 @@ var oidcProviderRoutes = (config) => {
       expires_in: result.expires_in,
       interval: result.interval
     }, HTTP_OK3);
-  }, {
+  }).post(deviceAuthorizationRoute, {
     body: t15.Object({
-      binding_message: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      login_hint: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String())
     }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
@@ -9189,16 +9203,15 @@ var oidcProviderRoutes = (config) => {
       requestedScopes: requested
     });
     return jsonResponse(response, HTTP_OK3);
-  }, {
+  }).post(deviceApproveRoute, {
     body: t15.Object({
-      client_id: t15.Optional(t15.String()),
-      client_secret: t15.Optional(t15.String()),
-      scope: t15.Optional(t15.String())
+      action: t15.Optional(t15.Union([t15.Literal("approve"), t15.Literal("deny")])),
+      user_code: t15.String()
     }),
-    headers: t15.Object({
-      authorization: t15.Optional(t15.String())
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
     })
-  }).post(deviceApproveRoute, async ({ body, cookie: { user_session_id }, store }) => {
+  }, async ({ body, cookie: { user_session_id }, store }) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
@@ -9221,19 +9234,7 @@ var oidcProviderRoutes = (config) => {
     if (!result.ok)
       return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({ ok: true }, HTTP_OK3);
-  }, {
-    body: t15.Object({
-      action: t15.Optional(t15.Union([t15.Literal("approve"), t15.Literal("deny")])),
-      user_code: t15.String()
-    }),
-    cookie: t15.Cookie({
-      user_session_id: t15.Optional(userSessionIdTypebox)
-    })
-  }).get(endSessionRoute, async ({ cookie: { user_session_id }, query, store }) => handleEndSession({
-    cookie: user_session_id,
-    inMemorySession: store.session,
-    query
-  }), {
+  }).get(endSessionRoute, {
     cookie: t15.Cookie({
       user_session_id: t15.Optional(userSessionIdTypebox)
     }),
@@ -9243,11 +9244,11 @@ var oidcProviderRoutes = (config) => {
       post_logout_redirect_uri: t15.Optional(t15.String()),
       state: t15.Optional(t15.String())
     })
-  }).post(endSessionRoute, async ({ body, cookie: { user_session_id }, store }) => handleEndSession({
+  }, async ({ cookie: { user_session_id }, query, store }) => handleEndSession({
     cookie: user_session_id,
     inMemorySession: store.session,
-    query: body
-  }), {
+    query
+  })).post(endSessionRoute, {
     body: t15.Object({
       client_id: t15.Optional(t15.String()),
       id_token_hint: t15.Optional(t15.String()),
@@ -9257,7 +9258,25 @@ var oidcProviderRoutes = (config) => {
     cookie: t15.Cookie({
       user_session_id: t15.Optional(userSessionIdTypebox)
     })
-  }).post(registrationRoute, async ({ body, headers }) => {
+  }, async ({ body, cookie: { user_session_id }, store }) => handleEndSession({
+    cookie: user_session_id,
+    inMemorySession: store.session,
+    query: body
+  })).post(registrationRoute, {
+    body: t15.Object({
+      backchannel_logout_uri: t15.Optional(t15.String()),
+      client_name: t15.Optional(t15.String()),
+      grant_types: t15.Optional(t15.Array(t15.String())),
+      jwks: t15.Optional(t15.Any()),
+      jwks_uri: t15.Optional(t15.String()),
+      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
+      redirect_uris: t15.Optional(t15.Array(t15.String())),
+      scope: t15.Optional(t15.String())
+    }),
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
+    })
+  }, async ({ body, headers }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -9273,21 +9292,12 @@ var oidcProviderRoutes = (config) => {
       registrationTokenStore: config.clientRegistrationTokenStore
     });
     return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
-  }, {
-    body: t15.Object({
-      backchannel_logout_uri: t15.Optional(t15.String()),
-      client_name: t15.Optional(t15.String()),
-      grant_types: t15.Optional(t15.Array(t15.String())),
-      jwks: t15.Optional(t15.Any()),
-      jwks_uri: t15.Optional(t15.String()),
-      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
-      redirect_uris: t15.Optional(t15.Array(t15.String())),
-      scope: t15.Optional(t15.String())
-    }),
+  }).get(`${registrationRoute}/:clientId`, {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
-    })
-  }).get(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+    }),
+    params: t15.Object({ clientId: t15.String() })
+  }, async ({ headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -9298,12 +9308,22 @@ var oidcProviderRoutes = (config) => {
       registrationTokenStore: config.clientRegistrationTokenStore
     });
     return jsonResponse(result.body, result.status);
-  }, {
+  }).put(`${registrationRoute}/:clientId`, {
+    body: t15.Object({
+      backchannel_logout_uri: t15.Optional(t15.String()),
+      client_name: t15.Optional(t15.String()),
+      grant_types: t15.Optional(t15.Array(t15.String())),
+      jwks: t15.Optional(t15.Any()),
+      jwks_uri: t15.Optional(t15.String()),
+      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
+      redirect_uris: t15.Optional(t15.Array(t15.String())),
+      scope: t15.Optional(t15.String())
+    }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     }),
     params: t15.Object({ clientId: t15.String() })
-  }).put(`${registrationRoute}/:clientId`, async ({ body, headers, params: { clientId } }) => {
+  }, async ({ body, headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -9316,22 +9336,12 @@ var oidcProviderRoutes = (config) => {
       registrationTokenStore: config.clientRegistrationTokenStore
     });
     return jsonResponse(result.body, result.status);
-  }, {
-    body: t15.Object({
-      backchannel_logout_uri: t15.Optional(t15.String()),
-      client_name: t15.Optional(t15.String()),
-      grant_types: t15.Optional(t15.Array(t15.String())),
-      jwks: t15.Optional(t15.Any()),
-      jwks_uri: t15.Optional(t15.String()),
-      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
-      redirect_uris: t15.Optional(t15.Array(t15.String())),
-      scope: t15.Optional(t15.String())
-    }),
+  }).delete(`${registrationRoute}/:clientId`, {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     }),
     params: t15.Object({ clientId: t15.String() })
-  }).delete(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+  }, async ({ headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -9345,12 +9355,11 @@ var oidcProviderRoutes = (config) => {
       return new Response(null, { status: HTTP_NO_CONTENT });
     }
     return jsonResponse(result.body, result.status);
-  }, {
+  }).get(userinfoRoute, {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
-    }),
-    params: t15.Object({ clientId: t15.String() })
-  }).get(userinfoRoute, async ({ headers }) => {
+    })
+  }, async ({ headers }) => {
     const token = readUserInfoBearer(headers.authorization);
     const result = await fetchUserInfo({ config, token });
     if (!result.ok) {
@@ -9363,11 +9372,14 @@ var oidcProviderRoutes = (config) => {
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
-  }, {
+  }).post(userinfoRoute, {
+    body: t15.Object({
+      access_token: t15.Optional(t15.String())
+    }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(userinfoRoute, async ({ headers, body }) => {
+  }, async ({ headers, body }) => {
     const token = readUserInfoBearer(headers.authorization) ?? body.access_token;
     const result = await fetchUserInfo({ config, token });
     if (!result.ok) {
@@ -9380,13 +9392,6 @@ var oidcProviderRoutes = (config) => {
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
-  }, {
-    body: t15.Object({
-      access_token: t15.Optional(t15.String())
-    }),
-    headers: t15.Object({
-      authorization: t15.Optional(t15.String())
-    })
   }).get(jwksRoute, () => ({
     keys: signingVerificationKeys(signingKey, config.previousSigningKeys).map(toPublicJwk)
   })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
@@ -9525,7 +9530,7 @@ var organizationRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia23().use(sessionStore()).get(organizationsRoute, async ({
+  return new Elysia23().use(sessionStore()).get(organizationsRoute, { cookie }, async ({
     cookie: { user_session_id },
     status,
     store: { session }
@@ -9539,7 +9544,13 @@ var organizationRoutes = ({
       userId: getUserId(user)
     });
     return status("OK", { organizations });
-  }, { cookie }).post(organizationsRoute, async ({
+  }).post(organizationsRoute, {
+    body: t16.Object({
+      metadata: t16.Optional(t16.Record(t16.String(), t16.Unknown())),
+      name: t16.String()
+    }),
+    cookie
+  }, async ({
     body: { metadata, name },
     cookie: { user_session_id },
     status,
@@ -9571,13 +9582,14 @@ var organizationRoutes = ({
       ownerUserId
     });
     return status("OK", { organization });
-  }, {
+  }).post(`${organizationsRoute}/:organizationId/invitations`, {
     body: t16.Object({
-      metadata: t16.Optional(t16.Record(t16.String(), t16.Unknown())),
-      name: t16.String()
+      email: t16.String(),
+      roles: t16.Optional(t16.Array(t16.String()))
     }),
-    cookie
-  }).post(`${organizationsRoute}/:organizationId/invitations`, async ({
+    cookie,
+    params: t16.Object({ organizationId: t16.String() })
+  }, async ({
     body: { email, roles },
     cookie: { user_session_id },
     params: { organizationId },
@@ -9617,14 +9629,7 @@ var organizationRoutes = ({
       invitationId: invitation.invitationId,
       token
     });
-  }, {
-    body: t16.Object({
-      email: t16.String(),
-      roles: t16.Optional(t16.Array(t16.String()))
-    }),
-    cookie,
-    params: t16.Object({ organizationId: t16.String() })
-  }).get(`${organizationsRoute}/:organizationId/invitations`, async ({
+  }).get(`${organizationsRoute}/:organizationId/invitations`, { cookie, params: t16.Object({ organizationId: t16.String() }) }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -9647,7 +9652,13 @@ var organizationRoutes = ({
         state: invitation.state
       }))
     });
-  }, { cookie, params: t16.Object({ organizationId: t16.String() }) }).delete(`${organizationsRoute}/:organizationId/invitations/:invitationId`, async ({
+  }).delete(`${organizationsRoute}/:organizationId/invitations/:invitationId`, {
+    cookie,
+    params: t16.Object({
+      invitationId: t16.String(),
+      organizationId: t16.String()
+    })
+  }, async ({
     cookie: { user_session_id },
     params: { invitationId, organizationId },
     status,
@@ -9669,13 +9680,7 @@ var organizationRoutes = ({
       state: "revoked"
     });
     return status("OK", { revoked: invitationId });
-  }, {
-    cookie,
-    params: t16.Object({
-      invitationId: t16.String(),
-      organizationId: t16.String()
-    })
-  }).post(`${organizationsRoute}/invitations/accept`, async ({
+  }).post(`${organizationsRoute}/invitations/accept`, { body: t16.Object({ token: t16.String() }), cookie }, async ({
     body: { token },
     cookie: { user_session_id },
     status,
@@ -9708,7 +9713,7 @@ var organizationRoutes = ({
       organizationId: membership.organizationId,
       roles: membership.roles
     });
-  }, { body: t16.Object({ token: t16.String() }), cookie }).get(`${organizationsRoute}/:organizationId/members`, async ({
+  }).get(`${organizationsRoute}/:organizationId/members`, { cookie, params: t16.Object({ organizationId: t16.String() }) }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -9724,7 +9729,13 @@ var organizationRoutes = ({
     }
     const members = await organizationStore.listMembershipsByOrganization(organizationId);
     return status("OK", { members });
-  }, { cookie, params: t16.Object({ organizationId: t16.String() }) }).delete(`${organizationsRoute}/:organizationId/members/:userId`, async ({
+  }).delete(`${organizationsRoute}/:organizationId/members/:userId`, {
+    cookie,
+    params: t16.Object({
+      organizationId: t16.String(),
+      userId: t16.String()
+    })
+  }, async ({
     cookie: { user_session_id },
     params: { organizationId, userId },
     status,
@@ -9746,12 +9757,6 @@ var organizationRoutes = ({
     });
     await onMembershipRemoved?.({ organizationId, userId });
     return status("OK", { removed: userId });
-  }, {
-    cookie,
-    params: t16.Object({
-      organizationId: t16.String(),
-      userId: t16.String()
-    })
   });
 };
 
@@ -9818,7 +9823,7 @@ var passwordlessRoutes = ({
     await onPasswordlessLogin?.({ user, userSessionId });
     return userSessionId;
   };
-  const magicLink = onSendMagicLink ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, async ({ body: { email }, status }) => {
+  const magicLink = onSendMagicLink ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, { body: t17.Object({ email: t17.String() }) }, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const token = generateSecureToken();
     const expiresAt = Date.now() + magicLinkTokenDurationMs;
@@ -9833,7 +9838,7 @@ var passwordlessRoutes = ({
       token
     });
     return status("OK", { status: "magic_link_sent" });
-  }, { body: t17.Object({ email: t17.String() }) }).post(`${passwordlessRoute}/magic-link/verify`, async ({
+  }).post(`${passwordlessRoute}/magic-link/verify`, { body: t17.Object({ token: t17.String() }), cookie }, async ({
     body: { token },
     cookie: { user_session_id },
     status,
@@ -9848,8 +9853,8 @@ var passwordlessRoutes = ({
       return status("Unauthorized", "No account for this email");
     }
     return status("OK", { status: "authenticated" });
-  }, { body: t17.Object({ token: t17.String() }), cookie }) : new Elysia24;
-  const otp = onSendOtp ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/otp`, async ({ body: { email }, status }) => {
+  }) : new Elysia24;
+  const otp = onSendOtp ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/otp`, { body: t17.Object({ email: t17.String() }) }, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const code = generateOtpCode(otpLength);
     const expiresAt = Date.now() + otpDurationMs;
@@ -9864,7 +9869,13 @@ var passwordlessRoutes = ({
       expiresAt
     });
     return status("OK", { status: "otp_sent" });
-  }, { body: t17.Object({ email: t17.String() }) }).post(`${passwordlessRoute}/otp/verify`, async ({
+  }).post(`${passwordlessRoute}/otp/verify`, {
+    body: t17.Object({
+      code: t17.String(),
+      email: t17.String()
+    }),
+    cookie
+  }, async ({
     body: { code, email },
     cookie: { user_session_id },
     status,
@@ -9880,12 +9891,6 @@ var passwordlessRoutes = ({
       return status("Unauthorized", "No account for this email");
     }
     return status("OK", { status: "authenticated" });
-  }, {
-    body: t17.Object({
-      code: t17.String(),
-      email: t17.String()
-    }),
-    cookie
   }) : new Elysia24;
   return new Elysia24().use(magicLink).use(otp);
 };
@@ -10009,7 +10014,14 @@ var portalRoutes = ({
       } : undefined,
       scim: capabilities.includes("scim") ? { baseUrl: `${origin}${scimRoute}` } : undefined
     });
-  }).put(`${portalRoute}/connection/saml`, async ({ body, headers, status }) => {
+  }).put(`${portalRoute}/connection/saml`, {
+    body: t18.Object({
+      idpEntityId: t18.String(),
+      idpSloUrl: t18.Optional(t18.String()),
+      idpSsoUrl: t18.String(),
+      idpX509Cert: t18.String()
+    })
+  }, async ({ body, headers, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
       return status("Unauthorized", "Invalid or expired setup link");
@@ -10048,14 +10060,15 @@ var portalRoutes = ({
       type: "saml"
     });
     return status("OK", { configured: true, type: "saml" });
-  }, {
+  }).put(`${portalRoute}/connection/oidc`, {
     body: t18.Object({
-      idpEntityId: t18.String(),
-      idpSloUrl: t18.Optional(t18.String()),
-      idpSsoUrl: t18.String(),
-      idpX509Cert: t18.String()
+      clientId: t18.String(),
+      clientSecret: t18.String(),
+      issuer: t18.String(),
+      redirectUri: t18.Optional(t18.String()),
+      scopes: t18.Optional(t18.Array(t18.String()))
     })
-  }).put(`${portalRoute}/connection/oidc`, async ({ body, headers, request, status }) => {
+  }, async ({ body, headers, request, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
       return status("Unauthorized", "Invalid or expired setup link");
@@ -10096,14 +10109,6 @@ var portalRoutes = ({
       type: "oidc"
     });
     return status("OK", { configured: true, type: "oidc" });
-  }, {
-    body: t18.Object({
-      clientId: t18.String(),
-      clientSecret: t18.String(),
-      issuer: t18.String(),
-      redirectUri: t18.Optional(t18.String()),
-      scopes: t18.Optional(t18.Array(t18.String()))
-    })
   }).post(`${portalRoute}/scim/token`, async ({ headers, request, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
@@ -10184,7 +10189,7 @@ var roleRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia26().use(sessionStore()).get(`${rolesRoute}/:organizationId`, async ({
+  return new Elysia26().use(sessionStore()).get(`${rolesRoute}/:organizationId`, { cookie, params: t19.Object({ organizationId: t19.String() }) }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -10202,7 +10207,14 @@ var roleRoutes = ({
       roleStore.listRoles()
     ]);
     return status("OK", { roles: [...scoped, ...global] });
-  }, { cookie, params: t19.Object({ organizationId: t19.String() }) }).put(`${rolesRoute}/:organizationId/members/:userId`, async ({
+  }).put(`${rolesRoute}/:organizationId/members/:userId`, {
+    body: t19.Object({ roles: t19.Array(t19.String()) }),
+    cookie,
+    params: t19.Object({
+      organizationId: t19.String(),
+      userId: t19.String()
+    })
+  }, async ({
     body: { roles },
     cookie: { user_session_id },
     params: { organizationId, userId },
@@ -10234,13 +10246,6 @@ var roleRoutes = ({
     });
     await onRolesAssigned?.({ organizationId, roles, userId });
     return status("OK", { roles: updated.roles });
-  }, {
-    body: t19.Object({ roles: t19.Array(t19.String()) }),
-    cookie,
-    params: t19.Object({
-      organizationId: t19.String(),
-      userId: t19.String()
-    })
   });
 };
 
@@ -10432,7 +10437,20 @@ var authorize = ({
   onAuthorizeError
 }) => {
   const secure = resolveCookieSecure(cookieSecure);
-  return new Elysia27().get(authorizeRoute, async ({
+  return new Elysia27().get(authorizeRoute, {
+    cookie: t20.Cookie({
+      auth_client: authClientOption,
+      auth_intent: authIntentOption,
+      auth_provider: t20.Optional(authProviderOption)
+    }),
+    params: t20.Object({
+      provider: authProviderOption
+    }),
+    query: t20.Object({
+      client: authClientOption,
+      intent: authIntentOption
+    })
+  }, async ({
     status,
     redirect,
     cookie: {
@@ -10548,19 +10566,6 @@ var authorize = ({
       });
       return status("Internal Server Error", "Failed to create authorization URL");
     }
-  }, {
-    cookie: t20.Cookie({
-      auth_client: authClientOption,
-      auth_intent: authIntentOption,
-      auth_provider: t20.Optional(authProviderOption)
-    }),
-    params: t20.Object({
-      provider: authProviderOption
-    }),
-    query: t20.Object({
-      client: authClientOption,
-      intent: authIntentOption
-    })
   });
 };
 
@@ -10588,7 +10593,17 @@ var callback = ({
   onLinkIdentityConflict,
   onLinkConnector,
   onCallbackError
-}) => new Elysia28().use(sessionStore()).get(callbackRoute, async ({
+}) => new Elysia28().use(sessionStore()).get(callbackRoute, {
+  cookie: t21.Cookie({
+    auth_client: authClientOption,
+    auth_intent: authIntentOption,
+    auth_provider: t21.Optional(authProviderOption),
+    code_verifier: t21.Optional(t21.String()),
+    origin_url: t21.Optional(t21.String()),
+    state: t21.Optional(t21.String()),
+    user_session_id: t21.Optional(userSessionIdTypebox)
+  })
+}, async ({
   status,
   redirect,
   store: { session, unregisteredSession },
@@ -10722,17 +10737,7 @@ var callback = ({
     return response;
   }
   return redirect(originUrl);
-}), {
-  cookie: t21.Cookie({
-    auth_client: authClientOption,
-    auth_intent: authIntentOption,
-    auth_provider: t21.Optional(authProviderOption),
-    code_verifier: t21.Optional(t21.String()),
-    origin_url: t21.Optional(t21.String()),
-    state: t21.Optional(t21.String()),
-    user_session_id: t21.Optional(userSessionIdTypebox)
-  })
-});
+}));
 
 // src/routes/profile.ts
 import { Elysia as Elysia29, t as t22 } from "elysia";
@@ -10742,7 +10747,13 @@ var profile = ({
   profileRoute = "/oauth2/profile",
   onProfileSuccess,
   onProfileError
-}) => new Elysia29().use(sessionStore()).get(profileRoute, async ({
+}) => new Elysia29().use(sessionStore()).get(profileRoute, {
+  cookie: t22.Cookie({
+    auth_client: authClientOption,
+    auth_provider: authProviderOption,
+    user_session_id: userSessionIdTypebox
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -10795,12 +10806,6 @@ var profile = ({
     });
     return err instanceof Error ? status("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : status("Internal Server Error", `Failed to validate authorization code: Unknown status: ${err}`);
   }
-}, {
-  cookie: t22.Cookie({
-    auth_client: authClientOption,
-    auth_provider: authProviderOption,
-    user_session_id: userSessionIdTypebox
-  })
 });
 
 // src/routes/refresh.ts
@@ -10813,7 +10818,13 @@ var refresh = ({
   onRefreshSuccess,
   onRefreshError,
   sessionDurationMs = MILLISECONDS_IN_A_DAY
-}) => new Elysia30().use(sessionStore()).post(refreshRoute, async ({
+}) => new Elysia30().use(sessionStore()).post(refreshRoute, {
+  cookie: t23.Cookie({
+    auth_client: authClientOption,
+    auth_provider: authProviderOption,
+    user_session_id: userSessionIdTypebox
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -10878,12 +10889,6 @@ var refresh = ({
     });
     return status("Internal Server Error", "Failed to refresh token");
   }
-}, {
-  cookie: t23.Cookie({
-    auth_client: authClientOption,
-    auth_provider: authProviderOption,
-    user_session_id: userSessionIdTypebox
-  })
 });
 
 // src/routes/revoke.ts
@@ -10894,7 +10899,13 @@ var revoke = ({
   revokeRoute = "/oauth2/revocation",
   onRevocationSuccess,
   onRevocationError
-}) => new Elysia31().use(sessionStore()).post(revokeRoute, async ({
+}) => new Elysia31().use(sessionStore()).post(revokeRoute, {
+  cookie: t24.Cookie({
+    auth_client: authClientOption,
+    auth_provider: authProviderOption,
+    user_session_id: userSessionIdTypebox
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -10960,12 +10971,6 @@ var revoke = ({
     });
     return status("Internal Server Error", "Failed to revoke token");
   }
-}, {
-  cookie: t24.Cookie({
-    auth_client: authClientOption,
-    auth_provider: authProviderOption,
-    user_session_id: userSessionIdTypebox
-  })
 });
 
 // src/routes/sessions.ts
@@ -10974,7 +10979,7 @@ var sessionRoutes = ({
   authSessionStore,
   getUserId,
   sessionsRoute = "/auth/sessions"
-}) => new Elysia32().use(sessionStore()).get(sessionsRoute, async ({
+}) => new Elysia32().use(sessionStore()).get(sessionsRoute, { cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -11002,7 +11007,10 @@ var sessionRoutes = ({
     id: entry.id
   }));
   return status("OK", { sessions: list });
-}, { cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(`${sessionsRoute}/:id`, async ({
+}).delete(`${sessionsRoute}/:id`, {
+  cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }),
+  params: t25.Object({ id: t25.String() })
+}, async ({
   cookie: { user_session_id },
   params: { id },
   status,
@@ -11028,9 +11036,6 @@ var sessionRoutes = ({
   }
   await authSessionStore.removeSession(id);
   return status("OK", { revoked: id });
-}, {
-  cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }),
-  params: t25.Object({ id: t25.String() })
 });
 
 // src/routes/signout.ts
@@ -11064,7 +11069,12 @@ var signout = ({
   authSessionStore,
   signoutRoute = "/oauth2/signout",
   onSignOut
-}) => new Elysia33().use(sessionStore()).delete(signoutRoute, async ({
+}) => new Elysia33().use(sessionStore()).delete(signoutRoute, {
+  cookie: t26.Cookie({
+    auth_provider: t26.Optional(authProviderOption),
+    user_session_id: t26.Optional(t26.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"))
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider }
@@ -11103,12 +11113,7 @@ var signout = ({
   user_session_id.remove();
   auth_provider?.remove();
   return new Response(null, { status: 204 });
-}), {
-  cookie: t26.Cookie({
-    auth_provider: t26.Optional(authProviderOption),
-    user_session_id: t26.Optional(t26.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"))
-  })
-});
+}));
 
 // src/routes/userStatus.ts
 import { Elysia as Elysia34, t as t27 } from "elysia";
@@ -11116,7 +11121,11 @@ var userStatus = ({
   authSessionStore,
   statusRoute = "/oauth2/status",
   onStatus
-}) => new Elysia34().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
+}) => new Elysia34().use(sessionStore()).get(statusRoute, { cookie: t27.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
+  status,
+  cookie: { user_session_id },
+  store: { session }
+}) => {
   const { user, impersonator, error } = await getStatusFromSource({
     authSessionStore,
     session,
@@ -11131,7 +11140,7 @@ var userStatus = ({
     return err instanceof Error ? status("Internal Server Error", `Error: ${err.message} - ${err.stack ?? ""}`) : status("Internal Server Error", `Unknown Error: ${String(err)}`);
   }
   return { impersonator, user };
-}, { cookie: t27.Cookie({ user_session_id: userSessionIdTypebox }) });
+});
 
 // src/scim/routes.ts
 import { Elysia as Elysia35, t as t28 } from "elysia";
@@ -11607,7 +11616,7 @@ var scimRoutes = ({
   const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
   const usersEndpoint = `${scimRoute}/Users`;
   const groupsEndpoint = `${scimRoute}/Groups`;
-  return new Elysia35().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
+  return new Elysia35().parse(({ contentType, request }) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11622,7 +11631,7 @@ var scimRoutes = ({
     }
     const user = await onScimUserCreate({ input, organizationId });
     return scimJson(toUserResource(user, userLocation(request.url, user.id), customAttributes), SCIM_CREATED);
-  }).get(usersRoute, async ({ headers, query, request }) => {
+  }).get(usersRoute, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11632,7 +11641,7 @@ var scimRoutes = ({
     });
     const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id), customAttributes));
     return scimJson(listResponse(resources), SCIM_OK);
-  }, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }).get(userRoute, async ({ headers, params: { id }, request }) => {
+  }).get(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11641,7 +11650,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
     return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).put(userRoute, async ({ body, headers, params: { id }, request }) => {
+  }).put(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11658,7 +11667,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
     return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).patch(userRoute, async ({ body, headers, params: { id }, request }) => {
+  }).patch(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11675,13 +11684,13 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
     return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).delete(userRoute, async ({ headers, params: { id } }) => {
+  }).delete(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
     await onScimUserDeactivate({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
-  }, { params: t28.Object({ id: t28.String() }) }).post(groupsRoute, async ({ body, headers, request }) => {
+  }).post(groupsRoute, async ({ body, headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11696,7 +11705,7 @@ var scimRoutes = ({
       organizationId
     });
     return scimJson(toGroupResource(group, groupLocation(request.url, group.id)), SCIM_CREATED);
-  }).get(groupsRoute, async ({ headers, query, request }) => {
+  }).get(groupsRoute, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11708,7 +11717,7 @@ var scimRoutes = ({
     });
     const resources = groups.map((group) => toGroupResource(group, groupLocation(request.url, group.id)));
     return scimJson(listResponse(resources), SCIM_OK);
-  }, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }).get(groupRoute, async ({ headers, params: { id }, request }) => {
+  }).get(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11719,7 +11728,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Group not found");
     }
     return scimJson(toGroupResource(group, groupLocation(request.url, id)), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).put(groupRoute, async ({ body, headers, params: { id }, request }) => {
+  }).put(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11738,7 +11747,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Group not found");
     }
     return scimJson(toGroupResource(group, groupLocation(request.url, id)), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).patch(groupRoute, async ({ body, headers, params: { id }, request }) => {
+  }).patch(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11758,7 +11767,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Group not found");
     }
     return scimJson(toGroupResource(group, groupLocation(request.url, id)), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).delete(groupRoute, async ({ headers, params: { id } }) => {
+  }).delete(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11766,12 +11775,12 @@ var scimRoutes = ({
       return notImplemented();
     await onScimGroupDelete({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
-  }, { params: t28.Object({ id: t28.String() }) }).get(schemasRoute, async ({ headers, request }) => {
+  }).get(schemasRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
     return scimJson(schemaList(schemasLocation(request.url), extensionSchemas), SCIM_OK);
-  }).get(schemaRoute, async ({ headers, params: { id }, request }) => {
+  }).get(schemaRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11780,12 +11789,12 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Schema not found");
     }
     return scimJson(schema, SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).get(resourceTypesRoute, async ({ headers, request }) => {
+  }).get(resourceTypesRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
     return scimJson(resourceTypeList(resourceTypesLocation(request.url), usersEndpoint, groupsEndpoint, extensionSchemas), SCIM_OK);
-  }).get(resourceTypeRoute, async ({ headers, params: { id }, request }) => {
+  }).get(resourceTypeRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -11794,7 +11803,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "ResourceType not found");
     }
     return scimJson(resourceType, SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) });
+  });
 };
 
 // src/session/cleanup.ts
@@ -11807,17 +11816,19 @@ var sessionCleanup = ({
   onSessionCleanup
 }) => {
   let intervalId = null;
-  return new Elysia36({ name: "sessionCleanup" }).use(sessionStore()).onStart(({ store: { session, unregisteredSession } }) => {
+  const sessionState = {};
+  const unregisteredSessionState = {};
+  return new Elysia36({ name: "sessionCleanup" }).use(sessionStore(sessionState, unregisteredSessionState)).setup(() => {
     intervalId = setInterval(async () => {
       await performCleanup({
         authSessionStore,
         maxSessions,
         onSessionCleanup,
-        session,
-        unregisteredSession
+        session: sessionState,
+        unregisteredSession: unregisteredSessionState
       });
     }, cleanupIntervalMs);
-  }).onStop(() => {
+  }).cleanup(() => {
     if (intervalId) {
       clearInterval(intervalId);
       intervalId = null;
@@ -12053,7 +12064,7 @@ var ssoDiscoveryRoute = ({
   ssoRoute = DEFAULT_SSO_ROUTE
 }) => {
   const discoveryRoute = `${ssoRoute}/authorize`;
-  return new Elysia37().get(discoveryRoute, async ({ query: { email }, redirect, status }) => {
+  return new Elysia37().get(discoveryRoute, { query: t29.Object({ email: t29.Optional(t29.String()) }) }, async ({ query: { email }, redirect, status }) => {
     if (!isNonEmptyString(email)) {
       return status("Bad Request", 'An "email" query parameter is required');
     }
@@ -12070,7 +12081,7 @@ var ssoDiscoveryRoute = ({
       return status("Not Found", "No SSO connection is configured for this organization");
     }
     return redirect(`${ssoRoute}/${connection.type}/${organizationId}/authorize`);
-  }, { query: t29.Object({ email: t29.Optional(t29.String()) }) });
+  });
 };
 
 // src/sso/oidcRoutes.ts
@@ -12114,7 +12125,10 @@ var oidcSsoRoutes = ({
   const ssoCookieOptions = makeSsoCookieOptions(resolveCookieSecure(cookieSecure));
   const authorizeRoute = `${ssoRoute}/oidc/:organizationId/authorize`;
   const callbackRoute = `${ssoRoute}/oidc/:organizationId/callback`;
-  return new Elysia38().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia38().use(sessionStore()).get(authorizeRoute, {
+    cookie: ssoCookieSchema,
+    params: t30.Object({ organizationId: t30.String() })
+  }, async ({
     cookie: {
       sso_nonce,
       sso_organization,
@@ -12152,10 +12166,14 @@ var oidcSsoRoutes = ({
       state
     });
     return redirect(authorizationUrl.toString());
-  }, {
+  }).get(callbackRoute, {
     cookie: ssoCookieSchema,
-    params: t30.Object({ organizationId: t30.String() })
-  }).get(callbackRoute, async ({
+    params: t30.Object({ organizationId: t30.String() }),
+    query: t30.Object({
+      code: t30.Optional(t30.String()),
+      state: t30.Optional(t30.String())
+    })
+  }, async ({
     cookie: {
       sso_nonce,
       sso_organization,
@@ -12229,13 +12247,6 @@ var oidcSsoRoutes = ({
       await onSsoCallbackError?.({ error, organizationId });
       return status("Internal Server Error", "OIDC sign-in failed");
     }
-  }, {
-    cookie: ssoCookieSchema,
-    params: t30.Object({ organizationId: t30.String() }),
-    query: t30.Object({
-      code: t30.Optional(t30.String()),
-      state: t30.Optional(t30.String())
-    })
   });
 };
 
@@ -12285,7 +12296,7 @@ var samlSsoRoutes = ({
     const target = authSessionStore ? compatibilityLayer.session : inMemorySession;
     return target[userSessionId]?.samlLogout;
   };
-  return new Elysia39().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia39().use(sessionStore()).get(authorizeRoute, { params: t31.Object({ organizationId: t31.String() }) }, async ({
     headers,
     params: { organizationId },
     redirect,
@@ -12302,7 +12313,16 @@ var samlSsoRoutes = ({
       relayState: refererPath(headers["referer"])
     });
     return redirect(url);
-  }, { params: t31.Object({ organizationId: t31.String() }) }).post(acsRoute, async ({
+  }).post(acsRoute, {
+    body: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLResponse: t31.String()
+    }),
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    params: t31.Object({ organizationId: t31.String() })
+  }, async ({
     body,
     cookie: { user_session_id },
     params: { organizationId },
@@ -12355,16 +12375,7 @@ var samlSsoRoutes = ({
       await onSsoCallbackError?.({ error, organizationId });
       return status("Internal Server Error", "SAML sign-in failed");
     }
-  }, {
-    body: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLResponse: t31.String()
-    }),
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    }),
-    params: t31.Object({ organizationId: t31.String() })
-  }).get(metadataRoute, async ({ params: { organizationId }, request, status }) => {
+  }).get(metadataRoute, { params: t31.Object({ organizationId: t31.String() }) }, async ({ params: { organizationId }, request, status }) => {
     const connection = await ssoConnectionStore.getConnectionByOrganization(organizationId, "saml");
     if (connection === undefined || connection.type !== "saml") {
       return status("Not Found", "No SAML connection is configured for this organization");
@@ -12377,7 +12388,12 @@ var samlSsoRoutes = ({
     return new Response(metadata, {
       headers: { "content-type": "application/xml" }
     });
-  }, { params: t31.Object({ organizationId: t31.String() }) }).get(logoutRoute, async ({
+  }).get(logoutRoute, {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    params: t31.Object({ organizationId: t31.String() })
+  }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     redirect,
@@ -12404,12 +12420,19 @@ var samlSsoRoutes = ({
       return redirect(url);
     }
     return redirect(idpSloUrl ?? "/");
-  }, {
+  }).get(sloRoute, {
     cookie: t31.Cookie({
       user_session_id: t31.Optional(userSessionIdTypebox)
     }),
-    params: t31.Object({ organizationId: t31.String() })
-  }).get(sloRoute, async ({
+    params: t31.Object({ organizationId: t31.String() }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String()),
+      SAMLResponse: t31.Optional(t31.String()),
+      SigAlg: t31.Optional(t31.String()),
+      Signature: t31.Optional(t31.String())
+    })
+  }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     query: {
@@ -12490,18 +12513,6 @@ var samlSsoRoutes = ({
       return redirect(url);
     }
     return redirect(toSafeLocalPath(info.relayState ?? RelayState));
-  }, {
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    }),
-    params: t31.Object({ organizationId: t31.String() }),
-    query: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLRequest: t31.Optional(t31.String()),
-      SAMLResponse: t31.Optional(t31.String()),
-      SigAlg: t31.Optional(t31.String()),
-      Signature: t31.Optional(t31.String())
-    })
   });
 };
 
@@ -12549,7 +12560,7 @@ var webauthnRoutes = ({
     secure,
     value: challenge
   });
-  return new Elysia40().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
+  return new Elysia40().use(sessionStore()).post(`${webauthnRoute}/register/options`, { cookie: challengeCookie }, async ({
     cookie: { user_session_id, webauthn_challenge },
     status,
     store: { session }
@@ -12578,7 +12589,10 @@ var webauthnRoutes = ({
     });
     setChallenge(webauthn_challenge, challenge);
     return status("OK", options);
-  }, { cookie: challengeCookie }).post(`${webauthnRoute}/register/verify`, async ({
+  }).post(`${webauthnRoute}/register/verify`, {
+    body: t32.Object({}, { additionalProperties: true }),
+    cookie: challengeCookie
+  }, async ({
     body,
     cookie: { user_session_id, webauthn_challenge },
     status,
@@ -12626,17 +12640,17 @@ var webauthnRoutes = ({
       credentialId: result.credential.credentialId,
       verified: true
     });
-  }, {
-    body: t32.Object({}, { additionalProperties: true }),
-    cookie: challengeCookie
-  }).post(`${webauthnRoute}/authenticate/options`, async ({ cookie: { webauthn_challenge }, status }) => {
+  }).post(`${webauthnRoute}/authenticate/options`, { cookie: challengeCookie }, async ({ cookie: { webauthn_challenge }, status }) => {
     const { challenge, options } = await webauthnAdapter.createAuthenticationOptions({
       allowCredentials: [],
       rpId
     });
     setChallenge(webauthn_challenge, challenge);
     return status("OK", options);
-  }, { cookie: challengeCookie }).post(`${webauthnRoute}/authenticate/verify`, async ({
+  }).post(`${webauthnRoute}/authenticate/verify`, {
+    body: t32.Object({ id: t32.String() }, { additionalProperties: true }),
+    cookie: challengeCookie
+  }, async ({
     body,
     cookie: { user_session_id, webauthn_challenge },
     status,
@@ -12690,9 +12704,6 @@ var webauthnRoutes = ({
     });
     await onWebAuthnAuthenticated?.({ user, userSessionId });
     return status("OK", { status: "authenticated" });
-  }, {
-    body: t32.Object({ id: t32.String() }, { additionalProperties: true }),
-    cookie: challengeCookie
   });
 };
 
@@ -31572,7 +31583,7 @@ var createNeonLinkedProviderGrantStore = (db) => ({
         owner_ref: grant.ownerRef,
         provider_family: grant.providerFamily,
         provider_subject: grant.providerSubject,
-        refresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,
+        refresh_token_ciphertext: sql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,
         status: grant.status,
         token_type: grant.tokenType ?? null,
         updated_at: new Date(grant.updatedAt)
@@ -31631,7 +31642,11 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
       [...bindings.entries()].filter(([, binding]) => binding.grantId === id).forEach(([bindingId2]) => bindings.delete(bindingId2));
     },
     saveGrant: async (grant) => {
-      grants.set(grant.id, cloneGrant(grant));
+      const existing = grants.get(grant.id);
+      grants.set(grant.id, cloneGrant({
+        ...grant,
+        refreshTokenCiphertext: grant.refreshTokenCiphertext ?? existing?.refreshTokenCiphertext
+      }));
     }
   };
   const bindingStore = {
@@ -31657,14 +31672,17 @@ var requireAuthPlugin = ({
 } = {}) => new Elysia41({
   name: "@absolutejs/auth/require-auth",
   seed: pluginDependencySeed(authSessionStore)
-}).use(sessionStore()).guard({ cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }) }).resolve(async ({ store: { session }, cookie: { user_session_id } }) => {
+}).use(sessionStore()).guard({
+  cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(async ({ store: { session }, cookie: { user_session_id } }) => {
   const { user } = await getStatusFromSource({
     authSessionStore,
     session,
     user_session_id
   });
   return { user: user ?? null };
-}).onBeforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
+}).beforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
 // src/session/impersonation.ts
 init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
@@ -33116,7 +33134,15 @@ var vciRoutes = ({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
-  }))).post(credentialRoute, async ({ body, headers }) => {
+  }))).post(credentialRoute, {
+    body: t34.Object({
+      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
+      proof: t34.Optional(t34.Object({
+        jwt: t34.String(),
+        proof_type: t34.Literal("jwt")
+      }))
+    })
+  }, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
       return errorBody("invalid_token", HTTP_UNAUTHORIZED5);
@@ -33134,14 +33160,6 @@ var vciRoutes = ({
     if (!result.ok)
       return errorBody(result.error, HTTP_BAD_REQUEST4);
     return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
-  }, {
-    body: t34.Object({
-      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
-      proof: t34.Optional(t34.Object({
-        jwt: t34.String(),
-        proof_type: t34.Literal("jwt")
-      }))
-    })
   }).post(nonceRoute, async () => {
     if (vciConfig.credentialNonceStore === undefined) {
       return errorBody("not_supported", HTTP_BAD_REQUEST4);
@@ -33273,7 +33291,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia43().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia43().get(listRoute, { params: t35.Object({ listId: t35.String() }) }, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -33289,7 +33307,7 @@ var statusListRoutes = ({
       headers: { "content-type": STATUS_LIST_SUB_TYP },
       status: HTTP_OK5
     });
-  }, { params: t35.Object({ listId: t35.String() }) });
+  });
 };
 // src/vc/openid4vp.ts
 init_crypto();
@@ -33513,7 +33531,13 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia44().post(authorizeRoute, async ({ body }) => {
+  return new Elysia44().post(authorizeRoute, {
+    body: t36.Object({
+      client_id: t36.Optional(t36.String()),
+      requested_claims: t36.Array(t36.String()),
+      state: t36.Optional(t36.String())
+    })
+  }, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -33530,13 +33554,7 @@ var vpRoutes = ({
       request_uri: result.requestUri,
       requestId: result.request.requestId
     }, { status: HTTP_OK6 });
-  }, {
-    body: t36.Object({
-      client_id: t36.Optional(t36.String()),
-      requested_claims: t36.Array(t36.String()),
-      state: t36.Optional(t36.String())
-    })
-  }).get(requestRoute, async ({ params: { id } }) => {
+  }).get(requestRoute, { params: t36.Object({ id: t36.String() }) }, async ({ params: { id } }) => {
     const stored = await vpConfig.requestStore.getRequest(id);
     if (stored === undefined) {
       return errorBody2("unknown_request", HTTP_NOT_FOUND2);
@@ -33560,7 +33578,13 @@ var vpRoutes = ({
       },
       status: HTTP_OK6
     });
-  }, { params: t36.Object({ id: t36.String() }) }).post(responseRoute, async ({ body }) => {
+  }).post(responseRoute, {
+    body: t36.Object({
+      presentation_submission: t36.Optional(t36.Unknown()),
+      state: t36.Optional(t36.String()),
+      vp_token: t36.String()
+    })
+  }, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
       return errorBody2("missing_state", HTTP_BAD_REQUEST5);
@@ -33580,12 +33604,6 @@ var vpRoutes = ({
       protected_claims: result.verified.protectedClaims,
       verified: true
     }, { status: HTTP_OK6 });
-  }, {
-    body: t36.Object({
-      presentation_submission: t36.Optional(t36.Unknown()),
-      state: t36.Optional(t36.String()),
-      vp_token: t36.String()
-    })
   });
 };
 var passthroughStore = (request) => ({
@@ -37060,13 +37078,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
-    binding: "POST",
-    body,
-    inMemorySession: store.session,
-    request,
-    userSessionIdValue: user_session_id.value
-  }), {
+  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, {
     body: t37.Object({
       RelayState: t37.Optional(t37.String()),
       SAMLRequest: t37.Optional(t37.String())
@@ -37074,13 +37086,13 @@ var samlIdpRoutes = ({
     cookie: t37.Cookie({
       user_session_id: t37.Optional(userSessionIdTypebox)
     })
-  }).get(ssoIdpRoute, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
-    binding: "Redirect",
-    body: query,
+  }, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+    binding: "POST",
+    body,
     inMemorySession: store.session,
     request,
     userSessionIdValue: user_session_id.value
-  }), {
+  })).get(ssoIdpRoute, {
     cookie: t37.Cookie({
       user_session_id: t37.Optional(userSessionIdTypebox)
     }),
@@ -37090,7 +37102,21 @@ var samlIdpRoutes = ({
       SigAlg: t37.Optional(t37.String()),
       Signature: t37.Optional(t37.String())
     })
-  }).get(idpInitiateRoute, async ({
+  }, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
+    binding: "Redirect",
+    body: query,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  })).get(idpInitiateRoute, {
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
+    }),
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      sp: t37.Optional(t37.String())
+    })
+  }, async ({
     cookie: { user_session_id },
     query: { sp: serviceProviderEntityId, RelayState: relayState },
     request,
@@ -37123,14 +37149,6 @@ var samlIdpRoutes = ({
       serviceProviderEntityId: serviceProvider.entityId,
       user: userSession.user
     });
-  }, {
-    cookie: t37.Cookie({
-      user_session_id: t37.Optional(userSessionIdTypebox)
-    }),
-    query: t37.Object({
-      RelayState: t37.Optional(t37.String()),
-      sp: t37.Optional(t37.String())
-    })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
     ssoUrl: ssoUrlFor(request.url)
@@ -37635,10 +37653,7 @@ var buildAuthApplications = async (configuration) => {
       profileRoute
     })
   ]);
-  const featureRoutes = new Elysia46({
-    name: "@absolutejs/auth/feature-routes",
-    seed: pluginSeed
-  }).use([
+  const identityFeatureRoutes = new Elysia46().use([
     auditedCredentials ? credentialRoutes({
       ...auditedCredentials,
       authSessionStore,
@@ -37668,7 +37683,9 @@ var buildAuthApplications = async (configuration) => {
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       samlAdapter: sso.samlAdapter
-    }) : new Elysia46,
+    }) : new Elysia46
+  ]);
+  const organizationFeatureRoutes = new Elysia46().use([
     sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
       getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
       ssoConnectionStore: sso.ssoConnectionStore,
@@ -37689,7 +37706,9 @@ var buildAuthApplications = async (configuration) => {
       ...roles,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia46,
+    }) : new Elysia46
+  ]);
+  const extendedFeatureRoutes = new Elysia46().use([
     portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia46,
     webauthn ? webauthnRoutes({
       ...webauthn,
@@ -37705,6 +37724,14 @@ var buildAuthApplications = async (configuration) => {
     createConfiguredAuthHtmxRoutes({ authSessionStore, config: htmx }),
     agentAuthRoutes(resolvedAgentAuth)
   ]);
+  const featureRoutes = new Elysia46({
+    name: "@absolutejs/auth/feature-routes",
+    seed: pluginSeed
+  }).use([
+    identityFeatureRoutes,
+    organizationFeatureRoutes,
+    extendedFeatureRoutes
+  ]);
   const authContext = createAuthContext({
     agentAuth: resolvedAgentAuth,
     authorization,
@@ -38236,5 +38263,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=BB9E2E153512DF2164756E2164756E21
+//# debugId=E40C83F26EA3C8B964756E2164756E21
 //# sourceMappingURL=index.js.map