@absolutejs/auth 0.65.5 → 0.66.0

package/dist/server.js

@@ -77,8 +77,8 @@ var DEFAULT_TOKEN_BYTES = 32, AES_KEY_BYTES = 32, AES_IV_BYTES = 12, HOTP_COUNTE
   const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(input));
   return new Uint8Array(digest);
 }, hmacSha1 = async (key, message) => {
-  const cryptoKey = await crypto.subtle.importKey("raw", key, { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, message);
+  const cryptoKey = await crypto.subtle.importKey("raw", Uint8Array.from(key), { hash: "SHA-1", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, Uint8Array.from(message));
   return new Uint8Array(signature);
 }, counterToBytes = (counter) => {
   const bytes = new Uint8Array(HOTP_COUNTER_BYTES);
@@ -4155,7 +4155,14 @@ var apiKeysRoutes = ({
   if (apiClientStore === undefined || accessTokenStore === undefined) {
     return new Elysia;
   }
-  return new Elysia().post(tokenRoute, async ({ body, headers }) => {
+  return new Elysia().post(tokenRoute, {
+    body: t.Object({
+      client_id: t.Optional(t.String()),
+      client_secret: t.Optional(t.String()),
+      grant_type: t.Optional(t.String()),
+      scope: t.Optional(t.String())
+    })
+  }, async ({ body, headers }) => {
     if (body.grant_type !== GRANT_CLIENT_CREDENTIALS) {
       return oauthError(HTTP_BAD_REQUEST, "unsupported_grant_type");
     }
@@ -4188,13 +4195,6 @@ var apiKeysRoutes = ({
       },
       status: HTTP_OK
     });
-  }, {
-    body: t.Object({
-      client_id: t.Optional(t.String()),
-      client_secret: t.Optional(t.String()),
-      grant_type: t.Optional(t.String()),
-      scope: t.Optional(t.String())
-    })
   });
 };
 
@@ -5542,14 +5542,10 @@ var loadSessionFromSource = async ({
 
 // src/session/state.ts
 import { Elysia as Elysia4 } from "elysia";
-var sessionStore = () => {
-  const initialSession = {};
-  const initialUnregisteredSession = {};
-  return new Elysia4({ name: "sessionStore" }).state({
-    session: initialSession,
-    unregisteredSession: initialUnregisteredSession
-  });
-};
+var sessionStore = (initialSession = {}, initialUnregisteredSession = {}) => new Elysia4({ name: "sessionStore" }).state({
+  session: initialSession,
+  unregisteredSession: initialUnregisteredSession
+});
 
 // src/typebox.ts
 import { t as t2 } from "elysia";
@@ -5570,7 +5566,10 @@ var protectPermissionPlugin = ({
 }) => new Elysia5({
   name: "@absolutejs/auth/permission",
   seed: pluginDependencySeed(hasPermission)
-}).use(sessionStore()).guard({ cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}).use(sessionStore()).guard({
+  cookie: t3.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectPermission: (check, handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -5613,7 +5612,10 @@ var protectRoutePlugin = ({
 } = {}) => new Elysia6({
   name: "@absolutejs/auth/protect-route",
   seed: pluginDependencySeed(authSessionStore)
-}).use(sessionStore()).guard({ cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}).use(sessionStore()).guard({
+  cookie: t4.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   protectRoute: (handleAuth, handleAuthFail) => getStatusFromSource({
     authSessionStore,
     session,
@@ -5639,7 +5641,10 @@ var stepUpPlugin = ({
 } = {}) => new Elysia7({
   name: "@absolutejs/auth/step-up",
   seed: pluginDependencySeed(authSessionStore)
-}).use(sessionStore()).guard({ cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }) }).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
+}).use(sessionStore()).guard({
+  cookie: t5.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(({ store: { session }, cookie: { user_session_id }, status }) => ({
   requireRecentAuth: (maxAgeMs, handleAuth, handleAuthFail) => loadSessionFromSource({
     authSessionStore,
     session,
@@ -5685,7 +5690,7 @@ import { Elysia as Elysia9, t as t6 } from "elysia";
 init_constants();
 
 // src/types.ts
-function isJsonValue(value) {
+var isJsonValue = (value) => {
   if (value === null || typeof value === "boolean" || typeof value === "string")
     return true;
   if (typeof value === "number")
@@ -5695,7 +5700,7 @@ function isJsonValue(value) {
   if (typeof value !== "object")
     return false;
   return Object.values(value).every(isJsonValue);
-}
+};
 var parseJsonObject = (value) => {
   if (!isJsonValue(value) || value === null || Array.isArray(value) || typeof value !== "object")
     throw new TypeError("Expected a JSON object");
@@ -6049,7 +6054,7 @@ var complianceRoutes = ({
   emit,
   exportUserData,
   getUserId
-}) => new Elysia9().use(sessionStore()).get(`${complianceRoute}/export`, async ({
+}) => new Elysia9().use(sessionStore()).get(`${complianceRoute}/export`, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6069,7 +6074,7 @@ var complianceRoutes = ({
     userId: getUserId?.(current.user)
   });
   return status("OK", data);
-}, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(complianceRoute, async ({
+}).delete(complianceRoute, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -6102,7 +6107,7 @@ var complianceRoutes = ({
     userId
   });
   return status("OK", { deleted: true });
-}, { cookie: t6.Cookie({ user_session_id: userSessionIdTypebox }) });
+});
 
 // src/credentials/routes.ts
 import { Elysia as Elysia14 } from "elysia";
@@ -6128,7 +6133,7 @@ var credentialsEmailVerification = ({
   requireEmailVerification = false,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   verifyEmailRoute = "/auth/verify-email"
-}) => new Elysia10().post(verifyEmailRoute, async ({ body: { token }, status }) => {
+}) => new Elysia10().post(verifyEmailRoute, { body: t7.Object({ token: t7.String() }) }, async ({ body: { token }, status }) => {
   const consumed = await credentialStore.consumeVerificationToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired verification token");
@@ -6168,7 +6173,7 @@ var credentialsEmailVerification = ({
   }
   await onEmailVerified?.({ email: consumed.email });
   return status("OK", { status: "email_verified" });
-}, { body: t7.Object({ token: t7.String() }) }).post(`${verifyEmailRoute}/request`, async ({ body: { email }, status }) => {
+}).post(`${verifyEmailRoute}/request`, { body: t7.Object({ email: t7.String() }) }, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && !credential.emailVerified) {
@@ -6187,7 +6192,7 @@ var credentialsEmailVerification = ({
     });
   }
   return status("OK", { status: "verification_requested" });
-}, { body: t7.Object({ email: t7.String() }) });
+});
 
 // src/credentials/login.ts
 init_constants();
@@ -6301,7 +6306,7 @@ var constantTimeEqualBytes = (left, right) => {
   return diff === 0;
 };
 var base64Decode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64"));
-var sha256Bytes = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", input));
+var sha256Bytes = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(input)));
 var isLegacyHash = (storedHash) => !storedHash.startsWith("$argon2id$") && !storedHash.startsWith("$2");
 var verifyAuth0Pbkdf2 = async (plainPassword, wrappedHash) => {
   const parts = wrappedHash.split(":");
@@ -6425,7 +6430,10 @@ var credentialsLogin = ({
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   trustedOrigins
-}) => new Elysia11().use(sessionStore()).post(loginRoute, async ({
+}) => new Elysia11().use(sessionStore()).post(loginRoute, {
+  body: t8.Object({ email: t8.String(), password: t8.String() }),
+  cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { email, password },
   cookie: { user_session_id },
   request,
@@ -6521,10 +6529,7 @@ var credentialsLogin = ({
     passwordCompromised,
     status: "authenticated"
   });
-}), {
-  body: t8.Object({ email: t8.String(), password: t8.String() }),
-  cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
-});
+}));
 
 // src/credentials/passwordReset.ts
 init_crypto();
@@ -6536,7 +6541,7 @@ var credentialsPasswordReset = ({
   passwordPolicy,
   resetPasswordRoute = "/auth/reset-password",
   resetTokenDurationMs = DEFAULT_RESET_TOKEN_TTL_MS
-}) => new Elysia12().post(`${resetPasswordRoute}/request`, async ({ body: { email }, status }) => {
+}) => new Elysia12().post(`${resetPasswordRoute}/request`, { body: t9.Object({ email: t9.String() }) }, async ({ body: { email }, status }) => {
   const normalizedEmail = email.trim().toLowerCase();
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   if (credential && credential.status === "active" && credential.registrationData === undefined) {
@@ -6555,7 +6560,9 @@ var credentialsPasswordReset = ({
     });
   }
   return status("OK", { status: "reset_requested" });
-}, { body: t9.Object({ email: t9.String() }) }).post(resetPasswordRoute, async ({ body: { password, token }, status }) => {
+}).post(resetPasswordRoute, {
+  body: t9.Object({ password: t9.String(), token: t9.String() })
+}, async ({ body: { password, token }, status }) => {
   const consumed = await credentialStore.consumeResetToken(await hashToken(token));
   if (!consumed) {
     return status("Bad Request", "Invalid or expired reset token");
@@ -6584,8 +6591,6 @@ var credentialsPasswordReset = ({
   });
   await onPasswordReset?.({ email: consumed.email });
   return status("OK", { status: "password_reset" });
-}, {
-  body: t9.Object({ password: t9.String(), token: t9.String() })
 });
 
 // src/credentials/register.ts
@@ -6610,7 +6615,10 @@ var credentialsRegister = ({
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   trustedOrigins,
   verificationTokenDurationMs = DEFAULT_VERIFICATION_TOKEN_TTL_MS
-}) => new Elysia13().use(sessionStore()).post(registerRoute, async ({
+}) => new Elysia13().use(sessionStore()).post(registerRoute, {
+  body: t10.Object({ email: t10.String(), password: t10.String() }, { additionalProperties: true }),
+  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { email, password, ...extraFields },
   cookie: { user_session_id },
   request,
@@ -6708,10 +6716,7 @@ var credentialsRegister = ({
     userSessionId
   });
   return status("Created", { status: "authenticated" });
-}), {
-  body: t10.Object({ email: t10.String(), password: t10.String() }, { additionalProperties: true }),
-  cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
-});
+}));
 
 // src/credentials/routes.ts
 var credentialRoutes = (config) => new Elysia14().use(credentialsRegister(config)).use(credentialsEmailVerification(config)).use(credentialsLogin(config)).use(credentialsPasswordReset(config));
@@ -7185,7 +7190,10 @@ var mfaSmsRoutes = ({
   smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   smsSetupRoute = "/auth/mfa/sms/setup",
   smsVerifyRoute = "/auth/mfa/sms/verify"
-}) => new Elysia17().use(sessionStore()).post(smsSetupRoute, async ({
+}) => new Elysia17().use(sessionStore()).post(smsSetupRoute, {
+  body: t11.Object({ phone: t11.String() }),
+  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { phone },
   cookie: { user_session_id },
   status,
@@ -7246,10 +7254,10 @@ var mfaSmsRoutes = ({
     return status(mapped.status, mapped.message);
   }
   return status("OK", { phone: maskPhone(phone) });
-}, {
-  body: t11.Object({ phone: t11.String() }),
+}).post(smsVerifyRoute, {
+  body: t11.Object({ code: t11.String() }),
   cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
-}).post(smsVerifyRoute, async ({
+}, async ({
   body: { code },
   cookie: { user_session_id },
   status,
@@ -7324,9 +7332,6 @@ var mfaSmsRoutes = ({
   }
   await onMfaEnrolled?.({ userId });
   return status("OK", { status: "enrolled" });
-}, {
-  body: t11.Object({ code: t11.String() }),
-  cookie: t11.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/challenge.ts
@@ -7348,7 +7353,14 @@ var mfaChallenge = ({
   smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
   smsResendCooldownMs = DEFAULT_SMS_RESEND_COOLDOWN_MS,
   totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
-}) => new Elysia18().use(sessionStore()).post(challengeRoute, async ({
+}) => new Elysia18().use(sessionStore()).post(challengeRoute, {
+  body: t12.Object({
+    action: t12.Optional(t12.Union([t12.Literal("send"), t12.Literal("verify")])),
+    code: t12.Optional(t12.String()),
+    factor: t12.Optional(t12.Literal("sms"))
+  }),
+  cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { action, code, factor },
   cookie: { user_session_id },
   status,
@@ -7521,14 +7533,7 @@ var mfaChallenge = ({
     updatedAt: Date.now()
   });
   return promote();
-}), {
-  body: t12.Object({
-    action: t12.Optional(t12.Union([t12.Literal("send"), t12.Literal("verify")])),
-    code: t12.Optional(t12.String()),
-    factor: t12.Optional(t12.Literal("sms"))
-  }),
-  cookie: t12.Cookie({ user_session_id: userSessionIdTypebox })
-});
+}));
 
 // src/mfa/management.ts
 import { Elysia as Elysia19, t as t13 } from "elysia";
@@ -7545,7 +7550,7 @@ var mfaManagementRoutes = ({
   managementRoute = "/auth/mfa",
   managementAuthMaxAgeMs = DEFAULT_MFA_MANAGEMENT_AUTH_MAX_AGE_MS,
   mfaStore
-}) => new Elysia19().use(sessionStore()).get(managementRoute, async ({
+}) => new Elysia19().use(sessionStore()).get(managementRoute, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7569,7 +7574,7 @@ var mfaManagementRoutes = ({
     totp: { enabled: enrollment?.totpVerified ?? false }
   };
   return status("OK", response);
-}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(managementRoute, async ({
+}).delete(managementRoute, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7587,7 +7592,7 @@ var mfaManagementRoutes = ({
   }
   await mfaStore.removeEnrollment(getUserId(userSession.user));
   return status("OK", { status: "disabled" });
-}, { cookie: t13.Cookie({ user_session_id: userSessionIdTypebox }) });
+});
 
 // src/mfa/totp.ts
 init_crypto();
@@ -7603,7 +7608,7 @@ var mfaTotpRoutes = ({
   onMfaEnrolled,
   totpSetupRoute = "/auth/mfa/totp/setup",
   totpVerifyRoute = "/auth/mfa/totp/verify"
-}) => new Elysia20().use(sessionStore()).post(totpSetupRoute, async ({
+}) => new Elysia20().use(sessionStore()).post(totpSetupRoute, { cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -7644,7 +7649,10 @@ var mfaTotpRoutes = ({
       secret
     })
   });
-}, { cookie: t14.Cookie({ user_session_id: userSessionIdTypebox }) }).post(totpVerifyRoute, async ({
+}).post(totpVerifyRoute, {
+  body: t14.Object({ code: t14.String() }),
+  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox })
+}, async ({
   body: { code },
   cookie: { user_session_id },
   status,
@@ -7680,9 +7688,6 @@ var mfaTotpRoutes = ({
   });
   await onMfaEnrolled?.({ userId });
   return status("OK", { backupCodes: codes });
-}, {
-  body: t14.Object({ code: t14.String() }),
-  cookie: t14.Cookie({ user_session_id: userSessionIdTypebox })
 });
 
 // src/mfa/routes.ts
@@ -8654,7 +8659,7 @@ var base64UrlEncode2 = (bytes) => {
   return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
 };
 var computeCertThumbprint = async (derBytes) => {
-  const digest = await crypto.subtle.digest("SHA-256", derBytes);
+  const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(derBytes));
   return base64UrlEncode2(new Uint8Array(digest));
 };
 var extractRfc9440ClientCert = (headers) => {
@@ -9748,7 +9753,30 @@ var oidcProviderRoutes = (config) => {
       url.searchParams.set("state", query.state);
     return redirectTo(url.toString());
   };
-  return new Elysia22().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia22().use(sessionStore()).get(authorizeRoute, {
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
+    }),
+    query: t15.Object({
+      acr_values: t15.Optional(t15.String()),
+      claims: t15.Optional(t15.String()),
+      client_id: t15.Optional(t15.String()),
+      code_challenge: t15.Optional(t15.String()),
+      code_challenge_method: t15.Optional(t15.String()),
+      id_token_hint: t15.Optional(t15.String()),
+      max_age: t15.Optional(t15.String()),
+      nonce: t15.Optional(t15.String()),
+      prompt: t15.Optional(t15.String()),
+      redirect_uri: t15.Optional(t15.String()),
+      request: t15.Optional(t15.String()),
+      request_uri: t15.Optional(t15.String()),
+      resource: t15.Optional(t15.String()),
+      response_mode: t15.Optional(t15.String()),
+      response_type: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String()),
+      state: t15.Optional(t15.String())
+    })
+  }, async ({
     cookie: { user_session_id },
     query,
     request,
@@ -9834,7 +9862,7 @@ var oidcProviderRoutes = (config) => {
     const wantsSilent = promptValues.includes("none");
     const wantsLogin = promptValues.includes("login") || promptValues.includes("consent");
     const maxAge = effectiveQuery.max_age === undefined ? undefined : Number(effectiveQuery.max_age);
-    const sessionStaleByMaxAge = userSession !== undefined && maxAge !== undefined && !Number.isNaN(maxAge) && maxAge >= 0 && (userSession.authenticatedAt ?? 0) < Date.now() - maxAge * 1000;
+    const sessionStaleByMaxAge = userSession !== undefined && maxAge !== undefined && !Number.isNaN(maxAge) && maxAge >= 0 && (maxAge === 0 || (userSession.authenticatedAt ?? 0) < Date.now() - maxAge * 1000);
     const hintSub = effectiveQuery.id_token_hint === undefined ? undefined : (await verifyIdTokenHint({
       config,
       idTokenHint: effectiveQuery.id_token_hint
@@ -9909,30 +9937,29 @@ var oidcProviderRoutes = (config) => {
     if (state !== undefined)
       params.state = state;
     return respondToClient(redirectUri, responseMode, params);
-  }, {
-    cookie: t15.Cookie({
-      user_session_id: t15.Optional(userSessionIdTypebox)
-    }),
-    query: t15.Object({
-      acr_values: t15.Optional(t15.String()),
-      claims: t15.Optional(t15.String()),
+  }).post(tokenRoute, {
+    body: t15.Object({
+      assertion: t15.Optional(t15.String()),
+      audience: t15.Optional(t15.String()),
+      auth_req_id: t15.Optional(t15.String()),
+      claim_token: t15.Optional(t15.String()),
+      client_assertion: t15.Optional(t15.String()),
+      client_assertion_type: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
-      code_challenge: t15.Optional(t15.String()),
-      code_challenge_method: t15.Optional(t15.String()),
-      id_token_hint: t15.Optional(t15.String()),
-      max_age: t15.Optional(t15.String()),
-      nonce: t15.Optional(t15.String()),
-      prompt: t15.Optional(t15.String()),
+      client_secret: t15.Optional(t15.String()),
+      code: t15.Optional(t15.String()),
+      code_verifier: t15.Optional(t15.String()),
+      device_code: t15.Optional(t15.String()),
+      grant_type: t15.Optional(t15.String()),
+      "pre-authorized_code": t15.Optional(t15.String()),
       redirect_uri: t15.Optional(t15.String()),
-      request: t15.Optional(t15.String()),
-      request_uri: t15.Optional(t15.String()),
+      refresh_token: t15.Optional(t15.String()),
       resource: t15.Optional(t15.String()),
-      response_mode: t15.Optional(t15.String()),
-      response_type: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String()),
-      state: t15.Optional(t15.String())
+      subject_token: t15.Optional(t15.String()),
+      subject_token_type: t15.Optional(t15.String())
     })
-  }).post(tokenRoute, async ({ body, headers, request }) => {
+  }, async ({ body, headers, request }) => {
     if (body.grant_type === PRE_AUTHORIZED_CODE_GRANT && config.vciConfig !== undefined) {
       const preAuthorizedCode = body["pre-authorized_code"];
       if (typeof preAuthorizedCode !== "string") {
@@ -9996,29 +10023,28 @@ var oidcProviderRoutes = (config) => {
       return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
     }
     return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
-  }, {
+  }).post(parRoute, {
     body: t15.Object({
-      assertion: t15.Optional(t15.String()),
+      acr_values: t15.Optional(t15.String()),
       audience: t15.Optional(t15.String()),
-      auth_req_id: t15.Optional(t15.String()),
-      claim_token: t15.Optional(t15.String()),
+      claims: t15.Optional(t15.String()),
       client_assertion: t15.Optional(t15.String()),
       client_assertion_type: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      code: t15.Optional(t15.String()),
-      code_verifier: t15.Optional(t15.String()),
-      device_code: t15.Optional(t15.String()),
-      grant_type: t15.Optional(t15.String()),
-      "pre-authorized_code": t15.Optional(t15.String()),
+      code_challenge: t15.Optional(t15.String()),
+      code_challenge_method: t15.Optional(t15.String()),
+      nonce: t15.Optional(t15.String()),
       redirect_uri: t15.Optional(t15.String()),
-      refresh_token: t15.Optional(t15.String()),
       resource: t15.Optional(t15.String()),
+      response_type: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String()),
-      subject_token: t15.Optional(t15.String()),
-      subject_token_type: t15.Optional(t15.String())
+      state: t15.Optional(t15.String())
+    }),
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
     })
-  }).post(parRoute, async ({ body, headers, request }) => {
+  }, async ({ body, headers, request }) => {
     if (config.pushedAuthorizationRequestStore === undefined) {
       return oauthError2(HTTP_NOT_IMPLEMENTED, "unsupported_response_type");
     }
@@ -10045,28 +10071,17 @@ var oidcProviderRoutes = (config) => {
       ttlMs: config.pushedAuthorizationRequestTtlMs
     });
     return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
-  }, {
+  }).post(introspectRoute, {
     body: t15.Object({
-      acr_values: t15.Optional(t15.String()),
-      audience: t15.Optional(t15.String()),
-      claims: t15.Optional(t15.String()),
-      client_assertion: t15.Optional(t15.String()),
-      client_assertion_type: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      code_challenge: t15.Optional(t15.String()),
-      code_challenge_method: t15.Optional(t15.String()),
-      nonce: t15.Optional(t15.String()),
-      redirect_uri: t15.Optional(t15.String()),
-      resource: t15.Optional(t15.String()),
-      response_type: t15.Optional(t15.String()),
-      scope: t15.Optional(t15.String()),
-      state: t15.Optional(t15.String())
+      token: t15.String(),
+      token_type_hint: t15.Optional(t15.String())
     }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(introspectRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
@@ -10084,7 +10099,7 @@ var oidcProviderRoutes = (config) => {
       token: body.token
     });
     return jsonResponse(result, HTTP_OK3);
-  }, {
+  }).post(revokeRoute, {
     body: t15.Object({
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
@@ -10094,7 +10109,7 @@ var oidcProviderRoutes = (config) => {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(revokeRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
     const clientId = body.client_id ?? basic.clientId;
     const clientSecret = body.client_secret ?? basic.clientSecret;
@@ -10109,17 +10124,18 @@ var oidcProviderRoutes = (config) => {
       await revokeRefreshToken(config, body.token);
     }
     return new Response(null, { status: HTTP_OK3 });
-  }, {
+  }).post(backchannelAuthorizationRoute, {
     body: t15.Object({
+      binding_message: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      token: t15.String(),
-      token_type_hint: t15.Optional(t15.String())
+      login_hint: t15.Optional(t15.String()),
+      scope: t15.Optional(t15.String())
     }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(backchannelAuthorizationRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     if (config.backchannelAuthStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
@@ -10152,18 +10168,16 @@ var oidcProviderRoutes = (config) => {
       expires_in: result.expires_in,
       interval: result.interval
     }, HTTP_OK3);
-  }, {
+  }).post(deviceAuthorizationRoute, {
     body: t15.Object({
-      binding_message: t15.Optional(t15.String()),
       client_id: t15.Optional(t15.String()),
       client_secret: t15.Optional(t15.String()),
-      login_hint: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String())
     }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(deviceAuthorizationRoute, async ({ body, headers }) => {
+  }, async ({ body, headers }) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
@@ -10185,16 +10199,15 @@ var oidcProviderRoutes = (config) => {
       requestedScopes: requested
     });
     return jsonResponse(response, HTTP_OK3);
-  }, {
+  }).post(deviceApproveRoute, {
     body: t15.Object({
-      client_id: t15.Optional(t15.String()),
-      client_secret: t15.Optional(t15.String()),
-      scope: t15.Optional(t15.String())
+      action: t15.Optional(t15.Union([t15.Literal("approve"), t15.Literal("deny")])),
+      user_code: t15.String()
     }),
-    headers: t15.Object({
-      authorization: t15.Optional(t15.String())
+    cookie: t15.Cookie({
+      user_session_id: t15.Optional(userSessionIdTypebox)
     })
-  }).post(deviceApproveRoute, async ({ body, cookie: { user_session_id }, store }) => {
+  }, async ({ body, cookie: { user_session_id }, store }) => {
     if (config.deviceAuthorizationStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST3, "unsupported_grant_type");
     }
@@ -10217,19 +10230,7 @@ var oidcProviderRoutes = (config) => {
     if (!result.ok)
       return oauthError2(HTTP_BAD_REQUEST3, result.error);
     return jsonResponse({ ok: true }, HTTP_OK3);
-  }, {
-    body: t15.Object({
-      action: t15.Optional(t15.Union([t15.Literal("approve"), t15.Literal("deny")])),
-      user_code: t15.String()
-    }),
-    cookie: t15.Cookie({
-      user_session_id: t15.Optional(userSessionIdTypebox)
-    })
-  }).get(endSessionRoute, async ({ cookie: { user_session_id }, query, store }) => handleEndSession({
-    cookie: user_session_id,
-    inMemorySession: store.session,
-    query
-  }), {
+  }).get(endSessionRoute, {
     cookie: t15.Cookie({
       user_session_id: t15.Optional(userSessionIdTypebox)
     }),
@@ -10239,11 +10240,11 @@ var oidcProviderRoutes = (config) => {
       post_logout_redirect_uri: t15.Optional(t15.String()),
       state: t15.Optional(t15.String())
     })
-  }).post(endSessionRoute, async ({ body, cookie: { user_session_id }, store }) => handleEndSession({
+  }, async ({ cookie: { user_session_id }, query, store }) => handleEndSession({
     cookie: user_session_id,
     inMemorySession: store.session,
-    query: body
-  }), {
+    query
+  })).post(endSessionRoute, {
     body: t15.Object({
       client_id: t15.Optional(t15.String()),
       id_token_hint: t15.Optional(t15.String()),
@@ -10253,7 +10254,25 @@ var oidcProviderRoutes = (config) => {
     cookie: t15.Cookie({
       user_session_id: t15.Optional(userSessionIdTypebox)
     })
-  }).post(registrationRoute, async ({ body, headers }) => {
+  }, async ({ body, cookie: { user_session_id }, store }) => handleEndSession({
+    cookie: user_session_id,
+    inMemorySession: store.session,
+    query: body
+  })).post(registrationRoute, {
+    body: t15.Object({
+      backchannel_logout_uri: t15.Optional(t15.String()),
+      client_name: t15.Optional(t15.String()),
+      grant_types: t15.Optional(t15.Array(t15.String())),
+      jwks: t15.Optional(t15.Any()),
+      jwks_uri: t15.Optional(t15.String()),
+      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
+      redirect_uris: t15.Optional(t15.Array(t15.String())),
+      scope: t15.Optional(t15.String())
+    }),
+    headers: t15.Object({
+      authorization: t15.Optional(t15.String())
+    })
+  }, async ({ body, headers }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -10269,21 +10288,12 @@ var oidcProviderRoutes = (config) => {
       registrationTokenStore: config.clientRegistrationTokenStore
     });
     return jsonResponse(result.body, result.ok ? HTTP_OK3 : result.status);
-  }, {
-    body: t15.Object({
-      backchannel_logout_uri: t15.Optional(t15.String()),
-      client_name: t15.Optional(t15.String()),
-      grant_types: t15.Optional(t15.Array(t15.String())),
-      jwks: t15.Optional(t15.Any()),
-      jwks_uri: t15.Optional(t15.String()),
-      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
-      redirect_uris: t15.Optional(t15.Array(t15.String())),
-      scope: t15.Optional(t15.String())
-    }),
+  }).get(`${registrationRoute}/:clientId`, {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
-    })
-  }).get(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+    }),
+    params: t15.Object({ clientId: t15.String() })
+  }, async ({ headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -10294,12 +10304,22 @@ var oidcProviderRoutes = (config) => {
       registrationTokenStore: config.clientRegistrationTokenStore
     });
     return jsonResponse(result.body, result.status);
-  }, {
+  }).put(`${registrationRoute}/:clientId`, {
+    body: t15.Object({
+      backchannel_logout_uri: t15.Optional(t15.String()),
+      client_name: t15.Optional(t15.String()),
+      grant_types: t15.Optional(t15.Array(t15.String())),
+      jwks: t15.Optional(t15.Any()),
+      jwks_uri: t15.Optional(t15.String()),
+      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
+      redirect_uris: t15.Optional(t15.Array(t15.String())),
+      scope: t15.Optional(t15.String())
+    }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     }),
     params: t15.Object({ clientId: t15.String() })
-  }).put(`${registrationRoute}/:clientId`, async ({ body, headers, params: { clientId } }) => {
+  }, async ({ body, headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -10312,22 +10332,12 @@ var oidcProviderRoutes = (config) => {
       registrationTokenStore: config.clientRegistrationTokenStore
     });
     return jsonResponse(result.body, result.status);
-  }, {
-    body: t15.Object({
-      backchannel_logout_uri: t15.Optional(t15.String()),
-      client_name: t15.Optional(t15.String()),
-      grant_types: t15.Optional(t15.Array(t15.String())),
-      jwks: t15.Optional(t15.Any()),
-      jwks_uri: t15.Optional(t15.String()),
-      post_logout_redirect_uris: t15.Optional(t15.Array(t15.String())),
-      redirect_uris: t15.Optional(t15.Array(t15.String())),
-      scope: t15.Optional(t15.String())
-    }),
+  }).delete(`${registrationRoute}/:clientId`, {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     }),
     params: t15.Object({ clientId: t15.String() })
-  }).delete(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+  }, async ({ headers, params: { clientId } }) => {
     if (config.clientRegistrationTokenStore === undefined) {
       return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
     }
@@ -10341,12 +10351,11 @@ var oidcProviderRoutes = (config) => {
       return new Response(null, { status: HTTP_NO_CONTENT });
     }
     return jsonResponse(result.body, result.status);
-  }, {
+  }).get(userinfoRoute, {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
-    }),
-    params: t15.Object({ clientId: t15.String() })
-  }).get(userinfoRoute, async ({ headers }) => {
+    })
+  }, async ({ headers }) => {
     const token = readUserInfoBearer(headers.authorization);
     const result = await fetchUserInfo({ config, token });
     if (!result.ok) {
@@ -10359,11 +10368,14 @@ var oidcProviderRoutes = (config) => {
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
-  }, {
+  }).post(userinfoRoute, {
+    body: t15.Object({
+      access_token: t15.Optional(t15.String())
+    }),
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).post(userinfoRoute, async ({ headers, body }) => {
+  }, async ({ headers, body }) => {
     const token = readUserInfoBearer(headers.authorization) ?? body.access_token;
     const result = await fetchUserInfo({ config, token });
     if (!result.ok) {
@@ -10376,13 +10388,6 @@ var oidcProviderRoutes = (config) => {
       });
     }
     return jsonResponse(result.body, HTTP_OK3);
-  }, {
-    body: t15.Object({
-      access_token: t15.Optional(t15.String())
-    }),
-    headers: t15.Object({
-      authorization: t15.Optional(t15.String())
-    })
   }).get(jwksRoute, () => ({
     keys: signingVerificationKeys(signingKey, config.previousSigningKeys).map(toPublicJwk)
   })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
@@ -10521,7 +10526,7 @@ var organizationRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia23().use(sessionStore()).get(organizationsRoute, async ({
+  return new Elysia23().use(sessionStore()).get(organizationsRoute, { cookie }, async ({
     cookie: { user_session_id },
     status,
     store: { session }
@@ -10535,7 +10540,13 @@ var organizationRoutes = ({
       userId: getUserId(user)
     });
     return status("OK", { organizations });
-  }, { cookie }).post(organizationsRoute, async ({
+  }).post(organizationsRoute, {
+    body: t16.Object({
+      metadata: t16.Optional(t16.Record(t16.String(), t16.Unknown())),
+      name: t16.String()
+    }),
+    cookie
+  }, async ({
     body: { metadata, name },
     cookie: { user_session_id },
     status,
@@ -10567,13 +10578,14 @@ var organizationRoutes = ({
       ownerUserId
     });
     return status("OK", { organization });
-  }, {
+  }).post(`${organizationsRoute}/:organizationId/invitations`, {
     body: t16.Object({
-      metadata: t16.Optional(t16.Record(t16.String(), t16.Unknown())),
-      name: t16.String()
+      email: t16.String(),
+      roles: t16.Optional(t16.Array(t16.String()))
     }),
-    cookie
-  }).post(`${organizationsRoute}/:organizationId/invitations`, async ({
+    cookie,
+    params: t16.Object({ organizationId: t16.String() })
+  }, async ({
     body: { email, roles },
     cookie: { user_session_id },
     params: { organizationId },
@@ -10613,14 +10625,7 @@ var organizationRoutes = ({
       invitationId: invitation.invitationId,
       token
     });
-  }, {
-    body: t16.Object({
-      email: t16.String(),
-      roles: t16.Optional(t16.Array(t16.String()))
-    }),
-    cookie,
-    params: t16.Object({ organizationId: t16.String() })
-  }).get(`${organizationsRoute}/:organizationId/invitations`, async ({
+  }).get(`${organizationsRoute}/:organizationId/invitations`, { cookie, params: t16.Object({ organizationId: t16.String() }) }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -10643,7 +10648,13 @@ var organizationRoutes = ({
         state: invitation.state
       }))
     });
-  }, { cookie, params: t16.Object({ organizationId: t16.String() }) }).delete(`${organizationsRoute}/:organizationId/invitations/:invitationId`, async ({
+  }).delete(`${organizationsRoute}/:organizationId/invitations/:invitationId`, {
+    cookie,
+    params: t16.Object({
+      invitationId: t16.String(),
+      organizationId: t16.String()
+    })
+  }, async ({
     cookie: { user_session_id },
     params: { invitationId, organizationId },
     status,
@@ -10665,13 +10676,7 @@ var organizationRoutes = ({
       state: "revoked"
     });
     return status("OK", { revoked: invitationId });
-  }, {
-    cookie,
-    params: t16.Object({
-      invitationId: t16.String(),
-      organizationId: t16.String()
-    })
-  }).post(`${organizationsRoute}/invitations/accept`, async ({
+  }).post(`${organizationsRoute}/invitations/accept`, { body: t16.Object({ token: t16.String() }), cookie }, async ({
     body: { token },
     cookie: { user_session_id },
     status,
@@ -10704,7 +10709,7 @@ var organizationRoutes = ({
       organizationId: membership.organizationId,
       roles: membership.roles
     });
-  }, { body: t16.Object({ token: t16.String() }), cookie }).get(`${organizationsRoute}/:organizationId/members`, async ({
+  }).get(`${organizationsRoute}/:organizationId/members`, { cookie, params: t16.Object({ organizationId: t16.String() }) }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -10720,7 +10725,13 @@ var organizationRoutes = ({
     }
     const members = await organizationStore.listMembershipsByOrganization(organizationId);
     return status("OK", { members });
-  }, { cookie, params: t16.Object({ organizationId: t16.String() }) }).delete(`${organizationsRoute}/:organizationId/members/:userId`, async ({
+  }).delete(`${organizationsRoute}/:organizationId/members/:userId`, {
+    cookie,
+    params: t16.Object({
+      organizationId: t16.String(),
+      userId: t16.String()
+    })
+  }, async ({
     cookie: { user_session_id },
     params: { organizationId, userId },
     status,
@@ -10742,12 +10753,6 @@ var organizationRoutes = ({
     });
     await onMembershipRemoved?.({ organizationId, userId });
     return status("OK", { removed: userId });
-  }, {
-    cookie,
-    params: t16.Object({
-      organizationId: t16.String(),
-      userId: t16.String()
-    })
   });
 };
 
@@ -10814,7 +10819,7 @@ var passwordlessRoutes = ({
     await onPasswordlessLogin?.({ user, userSessionId });
     return userSessionId;
   };
-  const magicLink = onSendMagicLink ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, async ({ body: { email }, status }) => {
+  const magicLink = onSendMagicLink ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/magic-link`, { body: t17.Object({ email: t17.String() }) }, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const token = generateSecureToken();
     const expiresAt = Date.now() + magicLinkTokenDurationMs;
@@ -10829,7 +10834,7 @@ var passwordlessRoutes = ({
       token
     });
     return status("OK", { status: "magic_link_sent" });
-  }, { body: t17.Object({ email: t17.String() }) }).post(`${passwordlessRoute}/magic-link/verify`, async ({
+  }).post(`${passwordlessRoute}/magic-link/verify`, { body: t17.Object({ token: t17.String() }), cookie }, async ({
     body: { token },
     cookie: { user_session_id },
     status,
@@ -10844,8 +10849,8 @@ var passwordlessRoutes = ({
       return status("Unauthorized", "No account for this email");
     }
     return status("OK", { status: "authenticated" });
-  }, { body: t17.Object({ token: t17.String() }), cookie }) : new Elysia24;
-  const otp = onSendOtp ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/otp`, async ({ body: { email }, status }) => {
+  }) : new Elysia24;
+  const otp = onSendOtp ? new Elysia24().use(sessionStore()).post(`${passwordlessRoute}/otp`, { body: t17.Object({ email: t17.String() }) }, async ({ body: { email }, status }) => {
     const normalizedEmail = email.trim().toLowerCase();
     const code = generateOtpCode(otpLength);
     const expiresAt = Date.now() + otpDurationMs;
@@ -10860,7 +10865,13 @@ var passwordlessRoutes = ({
       expiresAt
     });
     return status("OK", { status: "otp_sent" });
-  }, { body: t17.Object({ email: t17.String() }) }).post(`${passwordlessRoute}/otp/verify`, async ({
+  }).post(`${passwordlessRoute}/otp/verify`, {
+    body: t17.Object({
+      code: t17.String(),
+      email: t17.String()
+    }),
+    cookie
+  }, async ({
     body: { code, email },
     cookie: { user_session_id },
     status,
@@ -10876,12 +10887,6 @@ var passwordlessRoutes = ({
       return status("Unauthorized", "No account for this email");
     }
     return status("OK", { status: "authenticated" });
-  }, {
-    body: t17.Object({
-      code: t17.String(),
-      email: t17.String()
-    }),
-    cookie
   }) : new Elysia24;
   return new Elysia24().use(magicLink).use(otp);
 };
@@ -11005,7 +11010,14 @@ var portalRoutes = ({
       } : undefined,
       scim: capabilities.includes("scim") ? { baseUrl: `${origin}${scimRoute}` } : undefined
     });
-  }).put(`${portalRoute}/connection/saml`, async ({ body, headers, status }) => {
+  }).put(`${portalRoute}/connection/saml`, {
+    body: t18.Object({
+      idpEntityId: t18.String(),
+      idpSloUrl: t18.Optional(t18.String()),
+      idpSsoUrl: t18.String(),
+      idpX509Cert: t18.String()
+    })
+  }, async ({ body, headers, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
       return status("Unauthorized", "Invalid or expired setup link");
@@ -11044,14 +11056,15 @@ var portalRoutes = ({
       type: "saml"
     });
     return status("OK", { configured: true, type: "saml" });
-  }, {
+  }).put(`${portalRoute}/connection/oidc`, {
     body: t18.Object({
-      idpEntityId: t18.String(),
-      idpSloUrl: t18.Optional(t18.String()),
-      idpSsoUrl: t18.String(),
-      idpX509Cert: t18.String()
+      clientId: t18.String(),
+      clientSecret: t18.String(),
+      issuer: t18.String(),
+      redirectUri: t18.Optional(t18.String()),
+      scopes: t18.Optional(t18.Array(t18.String()))
     })
-  }).put(`${portalRoute}/connection/oidc`, async ({ body, headers, request, status }) => {
+  }, async ({ body, headers, request, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
       return status("Unauthorized", "Invalid or expired setup link");
@@ -11092,14 +11105,6 @@ var portalRoutes = ({
       type: "oidc"
     });
     return status("OK", { configured: true, type: "oidc" });
-  }, {
-    body: t18.Object({
-      clientId: t18.String(),
-      clientSecret: t18.String(),
-      issuer: t18.String(),
-      redirectUri: t18.Optional(t18.String()),
-      scopes: t18.Optional(t18.Array(t18.String()))
-    })
   }).post(`${portalRoute}/scim/token`, async ({ headers, request, status }) => {
     const session = await loadSession(headers.authorization);
     if (!session) {
@@ -11180,7 +11185,7 @@ var roleRoutes = ({
     }
     return membership?.status === "active";
   };
-  return new Elysia26().use(sessionStore()).get(`${rolesRoute}/:organizationId`, async ({
+  return new Elysia26().use(sessionStore()).get(`${rolesRoute}/:organizationId`, { cookie, params: t19.Object({ organizationId: t19.String() }) }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     status,
@@ -11198,7 +11203,14 @@ var roleRoutes = ({
       roleStore.listRoles()
     ]);
     return status("OK", { roles: [...scoped, ...global2] });
-  }, { cookie, params: t19.Object({ organizationId: t19.String() }) }).put(`${rolesRoute}/:organizationId/members/:userId`, async ({
+  }).put(`${rolesRoute}/:organizationId/members/:userId`, {
+    body: t19.Object({ roles: t19.Array(t19.String()) }),
+    cookie,
+    params: t19.Object({
+      organizationId: t19.String(),
+      userId: t19.String()
+    })
+  }, async ({
     body: { roles },
     cookie: { user_session_id },
     params: { organizationId, userId },
@@ -11230,13 +11242,6 @@ var roleRoutes = ({
     });
     await onRolesAssigned?.({ organizationId, roles, userId });
     return status("OK", { roles: updated.roles });
-  }, {
-    body: t19.Object({ roles: t19.Array(t19.String()) }),
-    cookie,
-    params: t19.Object({
-      organizationId: t19.String(),
-      userId: t19.String()
-    })
   });
 };
 
@@ -11428,7 +11433,20 @@ var authorize = ({
   onAuthorizeError
 }) => {
   const secure = resolveCookieSecure(cookieSecure);
-  return new Elysia27().get(authorizeRoute, async ({
+  return new Elysia27().get(authorizeRoute, {
+    cookie: t20.Cookie({
+      auth_client: authClientOption,
+      auth_intent: authIntentOption,
+      auth_provider: t20.Optional(authProviderOption)
+    }),
+    params: t20.Object({
+      provider: authProviderOption
+    }),
+    query: t20.Object({
+      client: authClientOption,
+      intent: authIntentOption
+    })
+  }, async ({
     status,
     redirect,
     cookie: {
@@ -11544,19 +11562,6 @@ var authorize = ({
       });
       return status("Internal Server Error", "Failed to create authorization URL");
     }
-  }, {
-    cookie: t20.Cookie({
-      auth_client: authClientOption,
-      auth_intent: authIntentOption,
-      auth_provider: t20.Optional(authProviderOption)
-    }),
-    params: t20.Object({
-      provider: authProviderOption
-    }),
-    query: t20.Object({
-      client: authClientOption,
-      intent: authIntentOption
-    })
   });
 };
 
@@ -11584,7 +11589,17 @@ var callback = ({
   onLinkIdentityConflict,
   onLinkConnector,
   onCallbackError
-}) => new Elysia28().use(sessionStore()).get(callbackRoute, async ({
+}) => new Elysia28().use(sessionStore()).get(callbackRoute, {
+  cookie: t21.Cookie({
+    auth_client: authClientOption,
+    auth_intent: authIntentOption,
+    auth_provider: t21.Optional(authProviderOption),
+    code_verifier: t21.Optional(t21.String()),
+    origin_url: t21.Optional(t21.String()),
+    state: t21.Optional(t21.String()),
+    user_session_id: t21.Optional(userSessionIdTypebox)
+  })
+}, async ({
   status,
   redirect,
   store: { session, unregisteredSession },
@@ -11718,17 +11733,7 @@ var callback = ({
     return response;
   }
   return redirect(originUrl);
-}), {
-  cookie: t21.Cookie({
-    auth_client: authClientOption,
-    auth_intent: authIntentOption,
-    auth_provider: t21.Optional(authProviderOption),
-    code_verifier: t21.Optional(t21.String()),
-    origin_url: t21.Optional(t21.String()),
-    state: t21.Optional(t21.String()),
-    user_session_id: t21.Optional(userSessionIdTypebox)
-  })
-});
+}));
 
 // src/routes/profile.ts
 import { Elysia as Elysia29, t as t22 } from "elysia";
@@ -11738,7 +11743,13 @@ var profile = ({
   profileRoute = "/oauth2/profile",
   onProfileSuccess,
   onProfileError
-}) => new Elysia29().use(sessionStore()).get(profileRoute, async ({
+}) => new Elysia29().use(sessionStore()).get(profileRoute, {
+  cookie: t22.Cookie({
+    auth_client: authClientOption,
+    auth_provider: authProviderOption,
+    user_session_id: userSessionIdTypebox
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -11791,12 +11802,6 @@ var profile = ({
     });
     return err instanceof Error ? status("Internal Server Error", `${err.message} - ${err.stack ?? ""}`) : status("Internal Server Error", `Failed to validate authorization code: Unknown status: ${err}`);
   }
-}, {
-  cookie: t22.Cookie({
-    auth_client: authClientOption,
-    auth_provider: authProviderOption,
-    user_session_id: userSessionIdTypebox
-  })
 });
 
 // src/routes/refresh.ts
@@ -11809,7 +11814,13 @@ var refresh = ({
   onRefreshSuccess,
   onRefreshError,
   sessionDurationMs = MILLISECONDS_IN_A_DAY
-}) => new Elysia30().use(sessionStore()).post(refreshRoute, async ({
+}) => new Elysia30().use(sessionStore()).post(refreshRoute, {
+  cookie: t23.Cookie({
+    auth_client: authClientOption,
+    auth_provider: authProviderOption,
+    user_session_id: userSessionIdTypebox
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -11874,12 +11885,6 @@ var refresh = ({
     });
     return status("Internal Server Error", "Failed to refresh token");
   }
-}, {
-  cookie: t23.Cookie({
-    auth_client: authClientOption,
-    auth_provider: authProviderOption,
-    user_session_id: userSessionIdTypebox
-  })
 });
 
 // src/routes/revoke.ts
@@ -11890,7 +11895,13 @@ var revoke = ({
   revokeRoute = "/oauth2/revocation",
   onRevocationSuccess,
   onRevocationError
-}) => new Elysia31().use(sessionStore()).post(revokeRoute, async ({
+}) => new Elysia31().use(sessionStore()).post(revokeRoute, {
+  cookie: t24.Cookie({
+    auth_client: authClientOption,
+    auth_provider: authProviderOption,
+    user_session_id: userSessionIdTypebox
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider, auth_client }
@@ -11956,12 +11967,6 @@ var revoke = ({
     });
     return status("Internal Server Error", "Failed to revoke token");
   }
-}, {
-  cookie: t24.Cookie({
-    auth_client: authClientOption,
-    auth_provider: authProviderOption,
-    user_session_id: userSessionIdTypebox
-  })
 });
 
 // src/routes/sessions.ts
@@ -11970,7 +11975,7 @@ var sessionRoutes = ({
   authSessionStore,
   getUserId,
   sessionsRoute = "/auth/sessions"
-}) => new Elysia32().use(sessionStore()).get(sessionsRoute, async ({
+}) => new Elysia32().use(sessionStore()).get(sessionsRoute, { cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
   cookie: { user_session_id },
   status,
   store: { session }
@@ -11998,7 +12003,10 @@ var sessionRoutes = ({
     id: entry.id
   }));
   return status("OK", { sessions: list });
-}, { cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }) }).delete(`${sessionsRoute}/:id`, async ({
+}).delete(`${sessionsRoute}/:id`, {
+  cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }),
+  params: t25.Object({ id: t25.String() })
+}, async ({
   cookie: { user_session_id },
   params: { id },
   status,
@@ -12024,9 +12032,6 @@ var sessionRoutes = ({
   }
   await authSessionStore.removeSession(id);
   return status("OK", { revoked: id });
-}, {
-  cookie: t25.Cookie({ user_session_id: userSessionIdTypebox }),
-  params: t25.Object({ id: t25.String() })
 });
 
 // src/routes/signout.ts
@@ -12060,7 +12065,12 @@ var signout = ({
   authSessionStore,
   signoutRoute = "/oauth2/signout",
   onSignOut
-}) => new Elysia33().use(sessionStore()).delete(signoutRoute, async ({
+}) => new Elysia33().use(sessionStore()).delete(signoutRoute, {
+  cookie: t26.Cookie({
+    auth_provider: t26.Optional(authProviderOption),
+    user_session_id: t26.Optional(t26.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"))
+  })
+}, async ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider }
@@ -12099,12 +12109,7 @@ var signout = ({
   user_session_id.remove();
   auth_provider?.remove();
   return new Response(null, { status: 204 });
-}), {
-  cookie: t26.Cookie({
-    auth_provider: t26.Optional(authProviderOption),
-    user_session_id: t26.Optional(t26.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"))
-  })
-});
+}));
 
 // src/routes/userStatus.ts
 import { Elysia as Elysia34, t as t27 } from "elysia";
@@ -12112,7 +12117,11 @@ var userStatus = ({
   authSessionStore,
   statusRoute = "/oauth2/status",
   onStatus
-}) => new Elysia34().use(sessionStore()).get(statusRoute, async ({ status, cookie: { user_session_id }, store: { session } }) => {
+}) => new Elysia34().use(sessionStore()).get(statusRoute, { cookie: t27.Cookie({ user_session_id: userSessionIdTypebox }) }, async ({
+  status,
+  cookie: { user_session_id },
+  store: { session }
+}) => {
   const { user, impersonator, error } = await getStatusFromSource({
     authSessionStore,
     session,
@@ -12127,7 +12136,7 @@ var userStatus = ({
     return err instanceof Error ? status("Internal Server Error", `Error: ${err.message} - ${err.stack ?? ""}`) : status("Internal Server Error", `Unknown Error: ${String(err)}`);
   }
   return { impersonator, user };
-}, { cookie: t27.Cookie({ user_session_id: userSessionIdTypebox }) });
+});
 
 // src/scim/routes.ts
 import { Elysia as Elysia35, t as t28 } from "elysia";
@@ -12603,7 +12612,7 @@ var scimRoutes = ({
   const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
   const usersEndpoint = `${scimRoute}/Users`;
   const groupsEndpoint = `${scimRoute}/Groups`;
-  return new Elysia35().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
+  return new Elysia35().parse(({ contentType, request }) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12618,7 +12627,7 @@ var scimRoutes = ({
     }
     const user = await onScimUserCreate({ input, organizationId });
     return scimJson(toUserResource(user, userLocation(request.url, user.id), customAttributes), SCIM_CREATED);
-  }).get(usersRoute, async ({ headers, query, request }) => {
+  }).get(usersRoute, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12628,7 +12637,7 @@ var scimRoutes = ({
     });
     const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id), customAttributes));
     return scimJson(listResponse(resources), SCIM_OK);
-  }, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }).get(userRoute, async ({ headers, params: { id }, request }) => {
+  }).get(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12637,7 +12646,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
     return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).put(userRoute, async ({ body, headers, params: { id }, request }) => {
+  }).put(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12654,7 +12663,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
     return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).patch(userRoute, async ({ body, headers, params: { id }, request }) => {
+  }).patch(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12671,13 +12680,13 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
     return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).delete(userRoute, async ({ headers, params: { id } }) => {
+  }).delete(userRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
     await onScimUserDeactivate({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
-  }, { params: t28.Object({ id: t28.String() }) }).post(groupsRoute, async ({ body, headers, request }) => {
+  }).post(groupsRoute, async ({ body, headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12692,7 +12701,7 @@ var scimRoutes = ({
       organizationId
     });
     return scimJson(toGroupResource(group, groupLocation(request.url, group.id)), SCIM_CREATED);
-  }).get(groupsRoute, async ({ headers, query, request }) => {
+  }).get(groupsRoute, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12704,7 +12713,7 @@ var scimRoutes = ({
     });
     const resources = groups.map((group) => toGroupResource(group, groupLocation(request.url, group.id)));
     return scimJson(listResponse(resources), SCIM_OK);
-  }, { query: t28.Object({ filter: t28.Optional(t28.String()) }) }).get(groupRoute, async ({ headers, params: { id }, request }) => {
+  }).get(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12715,7 +12724,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Group not found");
     }
     return scimJson(toGroupResource(group, groupLocation(request.url, id)), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).put(groupRoute, async ({ body, headers, params: { id }, request }) => {
+  }).put(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12734,7 +12743,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Group not found");
     }
     return scimJson(toGroupResource(group, groupLocation(request.url, id)), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).patch(groupRoute, async ({ body, headers, params: { id }, request }) => {
+  }).patch(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12754,7 +12763,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Group not found");
     }
     return scimJson(toGroupResource(group, groupLocation(request.url, id)), SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).delete(groupRoute, async ({ headers, params: { id } }) => {
+  }).delete(groupRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12762,12 +12771,12 @@ var scimRoutes = ({
       return notImplemented();
     await onScimGroupDelete({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
-  }, { params: t28.Object({ id: t28.String() }) }).get(schemasRoute, async ({ headers, request }) => {
+  }).get(schemasRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
     return scimJson(schemaList(schemasLocation(request.url), extensionSchemas), SCIM_OK);
-  }).get(schemaRoute, async ({ headers, params: { id }, request }) => {
+  }).get(schemaRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12776,12 +12785,12 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "Schema not found");
     }
     return scimJson(schema, SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) }).get(resourceTypesRoute, async ({ headers, request }) => {
+  }).get(resourceTypesRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
     return scimJson(resourceTypeList(resourceTypesLocation(request.url), usersEndpoint, groupsEndpoint, extensionSchemas), SCIM_OK);
-  }).get(resourceTypeRoute, async ({ headers, params: { id }, request }) => {
+  }).get(resourceTypeRoute, { params: t28.Object({ id: t28.String() }) }, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
@@ -12790,7 +12799,7 @@ var scimRoutes = ({
       return scimError(SCIM_NOT_FOUND, "ResourceType not found");
     }
     return scimJson(resourceType, SCIM_OK);
-  }, { params: t28.Object({ id: t28.String() }) });
+  });
 };
 
 // src/session/cleanup.ts
@@ -12803,17 +12812,19 @@ var sessionCleanup = ({
   onSessionCleanup
 }) => {
   let intervalId = null;
-  return new Elysia36({ name: "sessionCleanup" }).use(sessionStore()).onStart(({ store: { session, unregisteredSession } }) => {
+  const sessionState = {};
+  const unregisteredSessionState = {};
+  return new Elysia36({ name: "sessionCleanup" }).use(sessionStore(sessionState, unregisteredSessionState)).setup(() => {
     intervalId = setInterval(async () => {
       await performCleanup({
         authSessionStore,
         maxSessions,
         onSessionCleanup,
-        session,
-        unregisteredSession
+        session: sessionState,
+        unregisteredSession: unregisteredSessionState
       });
     }, cleanupIntervalMs);
-  }).onStop(() => {
+  }).cleanup(() => {
     if (intervalId) {
       clearInterval(intervalId);
       intervalId = null;
@@ -13049,7 +13060,7 @@ var ssoDiscoveryRoute = ({
   ssoRoute = DEFAULT_SSO_ROUTE
 }) => {
   const discoveryRoute = `${ssoRoute}/authorize`;
-  return new Elysia37().get(discoveryRoute, async ({ query: { email }, redirect, status }) => {
+  return new Elysia37().get(discoveryRoute, { query: t29.Object({ email: t29.Optional(t29.String()) }) }, async ({ query: { email }, redirect, status }) => {
     if (!isNonEmptyString(email)) {
       return status("Bad Request", 'An "email" query parameter is required');
     }
@@ -13066,7 +13077,7 @@ var ssoDiscoveryRoute = ({
       return status("Not Found", "No SSO connection is configured for this organization");
     }
     return redirect(`${ssoRoute}/${connection.type}/${organizationId}/authorize`);
-  }, { query: t29.Object({ email: t29.Optional(t29.String()) }) });
+  });
 };
 
 // src/sso/oidcRoutes.ts
@@ -13110,7 +13121,10 @@ var oidcSsoRoutes = ({
   const ssoCookieOptions = makeSsoCookieOptions(resolveCookieSecure(cookieSecure));
   const authorizeRoute = `${ssoRoute}/oidc/:organizationId/authorize`;
   const callbackRoute = `${ssoRoute}/oidc/:organizationId/callback`;
-  return new Elysia38().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia38().use(sessionStore()).get(authorizeRoute, {
+    cookie: ssoCookieSchema,
+    params: t30.Object({ organizationId: t30.String() })
+  }, async ({
     cookie: {
       sso_nonce,
       sso_organization,
@@ -13148,10 +13162,14 @@ var oidcSsoRoutes = ({
       state
     });
     return redirect(authorizationUrl.toString());
-  }, {
+  }).get(callbackRoute, {
     cookie: ssoCookieSchema,
-    params: t30.Object({ organizationId: t30.String() })
-  }).get(callbackRoute, async ({
+    params: t30.Object({ organizationId: t30.String() }),
+    query: t30.Object({
+      code: t30.Optional(t30.String()),
+      state: t30.Optional(t30.String())
+    })
+  }, async ({
     cookie: {
       sso_nonce,
       sso_organization,
@@ -13225,13 +13243,6 @@ var oidcSsoRoutes = ({
       await onSsoCallbackError?.({ error, organizationId });
       return status("Internal Server Error", "OIDC sign-in failed");
     }
-  }, {
-    cookie: ssoCookieSchema,
-    params: t30.Object({ organizationId: t30.String() }),
-    query: t30.Object({
-      code: t30.Optional(t30.String()),
-      state: t30.Optional(t30.String())
-    })
   });
 };
 
@@ -13281,7 +13292,7 @@ var samlSsoRoutes = ({
     const target = authSessionStore ? compatibilityLayer.session : inMemorySession;
     return target[userSessionId]?.samlLogout;
   };
-  return new Elysia39().use(sessionStore()).get(authorizeRoute, async ({
+  return new Elysia39().use(sessionStore()).get(authorizeRoute, { params: t31.Object({ organizationId: t31.String() }) }, async ({
     headers,
     params: { organizationId },
     redirect,
@@ -13298,7 +13309,16 @@ var samlSsoRoutes = ({
       relayState: refererPath(headers["referer"])
     });
     return redirect(url);
-  }, { params: t31.Object({ organizationId: t31.String() }) }).post(acsRoute, async ({
+  }).post(acsRoute, {
+    body: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLResponse: t31.String()
+    }),
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    params: t31.Object({ organizationId: t31.String() })
+  }, async ({
     body,
     cookie: { user_session_id },
     params: { organizationId },
@@ -13351,16 +13371,7 @@ var samlSsoRoutes = ({
       await onSsoCallbackError?.({ error, organizationId });
       return status("Internal Server Error", "SAML sign-in failed");
     }
-  }, {
-    body: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLResponse: t31.String()
-    }),
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    }),
-    params: t31.Object({ organizationId: t31.String() })
-  }).get(metadataRoute, async ({ params: { organizationId }, request, status }) => {
+  }).get(metadataRoute, { params: t31.Object({ organizationId: t31.String() }) }, async ({ params: { organizationId }, request, status }) => {
     const connection = await ssoConnectionStore.getConnectionByOrganization(organizationId, "saml");
     if (connection === undefined || connection.type !== "saml") {
       return status("Not Found", "No SAML connection is configured for this organization");
@@ -13373,7 +13384,12 @@ var samlSsoRoutes = ({
     return new Response(metadata, {
       headers: { "content-type": "application/xml" }
     });
-  }, { params: t31.Object({ organizationId: t31.String() }) }).get(logoutRoute, async ({
+  }).get(logoutRoute, {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    params: t31.Object({ organizationId: t31.String() })
+  }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     redirect,
@@ -13400,12 +13416,19 @@ var samlSsoRoutes = ({
       return redirect(url);
     }
     return redirect(idpSloUrl ?? "/");
-  }, {
+  }).get(sloRoute, {
     cookie: t31.Cookie({
       user_session_id: t31.Optional(userSessionIdTypebox)
     }),
-    params: t31.Object({ organizationId: t31.String() })
-  }).get(sloRoute, async ({
+    params: t31.Object({ organizationId: t31.String() }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String()),
+      SAMLResponse: t31.Optional(t31.String()),
+      SigAlg: t31.Optional(t31.String()),
+      Signature: t31.Optional(t31.String())
+    })
+  }, async ({
     cookie: { user_session_id },
     params: { organizationId },
     query: {
@@ -13486,18 +13509,6 @@ var samlSsoRoutes = ({
       return redirect(url);
     }
     return redirect(toSafeLocalPath(info.relayState ?? RelayState));
-  }, {
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    }),
-    params: t31.Object({ organizationId: t31.String() }),
-    query: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLRequest: t31.Optional(t31.String()),
-      SAMLResponse: t31.Optional(t31.String()),
-      SigAlg: t31.Optional(t31.String()),
-      Signature: t31.Optional(t31.String())
-    })
   });
 };
 
@@ -13545,7 +13556,7 @@ var webauthnRoutes = ({
     secure,
     value: challenge
   });
-  return new Elysia40().use(sessionStore()).post(`${webauthnRoute}/register/options`, async ({
+  return new Elysia40().use(sessionStore()).post(`${webauthnRoute}/register/options`, { cookie: challengeCookie }, async ({
     cookie: { user_session_id, webauthn_challenge },
     status,
     store: { session }
@@ -13574,7 +13585,10 @@ var webauthnRoutes = ({
     });
     setChallenge(webauthn_challenge, challenge);
     return status("OK", options);
-  }, { cookie: challengeCookie }).post(`${webauthnRoute}/register/verify`, async ({
+  }).post(`${webauthnRoute}/register/verify`, {
+    body: t32.Object({}, { additionalProperties: true }),
+    cookie: challengeCookie
+  }, async ({
     body,
     cookie: { user_session_id, webauthn_challenge },
     status,
@@ -13622,17 +13636,17 @@ var webauthnRoutes = ({
       credentialId: result.credential.credentialId,
       verified: true
     });
-  }, {
-    body: t32.Object({}, { additionalProperties: true }),
-    cookie: challengeCookie
-  }).post(`${webauthnRoute}/authenticate/options`, async ({ cookie: { webauthn_challenge }, status }) => {
+  }).post(`${webauthnRoute}/authenticate/options`, { cookie: challengeCookie }, async ({ cookie: { webauthn_challenge }, status }) => {
     const { challenge, options } = await webauthnAdapter.createAuthenticationOptions({
       allowCredentials: [],
       rpId
     });
     setChallenge(webauthn_challenge, challenge);
     return status("OK", options);
-  }, { cookie: challengeCookie }).post(`${webauthnRoute}/authenticate/verify`, async ({
+  }).post(`${webauthnRoute}/authenticate/verify`, {
+    body: t32.Object({ id: t32.String() }, { additionalProperties: true }),
+    cookie: challengeCookie
+  }, async ({
     body,
     cookie: { user_session_id, webauthn_challenge },
     status,
@@ -13686,9 +13700,6 @@ var webauthnRoutes = ({
     });
     await onWebAuthnAuthenticated?.({ user, userSessionId });
     return status("OK", { status: "authenticated" });
-  }, {
-    body: t32.Object({ id: t32.String() }, { additionalProperties: true }),
-    cookie: challengeCookie
   });
 };
 
@@ -32568,7 +32579,7 @@ var createNeonLinkedProviderGrantStore = (db) => ({
         owner_ref: grant.ownerRef,
         provider_family: grant.providerFamily,
         provider_subject: grant.providerSubject,
-        refresh_token_ciphertext: grant.refreshTokenCiphertext ?? null,
+        refresh_token_ciphertext: sql`coalesce(excluded.refresh_token_ciphertext, ${linkedProviderGrantsTable.refresh_token_ciphertext})`,
         status: grant.status,
         token_type: grant.tokenType ?? null,
         updated_at: new Date(grant.updatedAt)
@@ -32627,7 +32638,11 @@ var createInMemoryLinkedProviderStores = (input = {}) => {
       [...bindings.entries()].filter(([, binding]) => binding.grantId === id).forEach(([bindingId2]) => bindings.delete(bindingId2));
     },
     saveGrant: async (grant) => {
-      grants.set(grant.id, cloneGrant(grant));
+      const existing = grants.get(grant.id);
+      grants.set(grant.id, cloneGrant({
+        ...grant,
+        refreshTokenCiphertext: grant.refreshTokenCiphertext ?? existing?.refreshTokenCiphertext
+      }));
     }
   };
   const bindingStore = {
@@ -32653,14 +32668,17 @@ var requireAuthPlugin = ({
 } = {}) => new Elysia41({
   name: "@absolutejs/auth/require-auth",
   seed: pluginDependencySeed(authSessionStore)
-}).use(sessionStore()).guard({ cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }) }).resolve(async ({ store: { session }, cookie: { user_session_id } }) => {
+}).use(sessionStore()).guard({
+  cookie: t33.Cookie({ user_session_id: userSessionIdTypebox }),
+  schema: "merge"
+}).derive(async ({ store: { session }, cookie: { user_session_id } }) => {
   const { user } = await getStatusFromSource({
     authSessionStore,
     session,
     user_session_id
   });
   return { user: user ?? null };
-}).onBeforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
+}).beforeHandle(({ user, status }) => user === null ? status("Unauthorized", "User is not authenticated") : undefined).as("global");
 // src/session/impersonation.ts
 init_constants();
 var DEFAULT_IMPERSONATION_TTL_MS = MILLISECONDS_IN_AN_HOUR;
@@ -34112,7 +34130,15 @@ var vciRoutes = ({
     config: vciConfig,
     issuer: issuerUrl,
     vciRoute
-  }))).post(credentialRoute, async ({ body, headers }) => {
+  }))).post(credentialRoute, {
+    body: t34.Object({
+      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
+      proof: t34.Optional(t34.Object({
+        jwt: t34.String(),
+        proof_type: t34.Literal("jwt")
+      }))
+    })
+  }, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
       return errorBody("invalid_token", HTTP_UNAUTHORIZED5);
@@ -34130,14 +34156,6 @@ var vciRoutes = ({
     if (!result.ok)
       return errorBody(result.error, HTTP_BAD_REQUEST4);
     return Response.json({ credential: result.credential, format: result.format }, { status: HTTP_OK4 });
-  }, {
-    body: t34.Object({
-      format: t34.Optional(t34.Union([t34.Literal("vc+sd-jwt")])),
-      proof: t34.Optional(t34.Object({
-        jwt: t34.String(),
-        proof_type: t34.Literal("jwt")
-      }))
-    })
   }).post(nonceRoute, async () => {
     if (vciConfig.credentialNonceStore === undefined) {
       return errorBody("not_supported", HTTP_BAD_REQUEST4);
@@ -34269,7 +34287,7 @@ var statusListRoutes = ({
   ttlSeconds
 }) => {
   const listRoute = `${statusRoute}/:listId`;
-  return new Elysia43().get(listRoute, async ({ params: { listId } }) => {
+  return new Elysia43().get(listRoute, { params: t35.Object({ listId: t35.String() }) }, async ({ params: { listId } }) => {
     const bits = await getStatusList(listId);
     if (bits === undefined) {
       return new Response("Not found", { status: HTTP_NOT_FOUND });
@@ -34285,7 +34303,7 @@ var statusListRoutes = ({
       headers: { "content-type": STATUS_LIST_SUB_TYP },
       status: HTTP_OK5
     });
-  }, { params: t35.Object({ listId: t35.String() }) });
+  });
 };
 // src/vc/openid4vp.ts
 init_crypto();
@@ -34509,7 +34527,13 @@ var vpRoutes = ({
   const authorizeRoute = `${vpRoute}/authorize`;
   const requestRoute = `${vpRoute}/request/:id`;
   const responseRoute = `${vpRoute}/response`;
-  return new Elysia44().post(authorizeRoute, async ({ body }) => {
+  return new Elysia44().post(authorizeRoute, {
+    body: t36.Object({
+      client_id: t36.Optional(t36.String()),
+      requested_claims: t36.Array(t36.String()),
+      state: t36.Optional(t36.String())
+    })
+  }, async ({ body }) => {
     const input = {
       clientId: body.client_id ?? defaultClientId,
       requestedClaims: body.requested_claims,
@@ -34526,13 +34550,7 @@ var vpRoutes = ({
       request_uri: result.requestUri,
       requestId: result.request.requestId
     }, { status: HTTP_OK6 });
-  }, {
-    body: t36.Object({
-      client_id: t36.Optional(t36.String()),
-      requested_claims: t36.Array(t36.String()),
-      state: t36.Optional(t36.String())
-    })
-  }).get(requestRoute, async ({ params: { id } }) => {
+  }).get(requestRoute, { params: t36.Object({ id: t36.String() }) }, async ({ params: { id } }) => {
     const stored = await vpConfig.requestStore.getRequest(id);
     if (stored === undefined) {
       return errorBody2("unknown_request", HTTP_NOT_FOUND2);
@@ -34556,7 +34574,13 @@ var vpRoutes = ({
       },
       status: HTTP_OK6
     });
-  }, { params: t36.Object({ id: t36.String() }) }).post(responseRoute, async ({ body }) => {
+  }).post(responseRoute, {
+    body: t36.Object({
+      presentation_submission: t36.Optional(t36.Unknown()),
+      state: t36.Optional(t36.String()),
+      vp_token: t36.String()
+    })
+  }, async ({ body }) => {
     const requestId = body.state;
     if (requestId === undefined) {
       return errorBody2("missing_state", HTTP_BAD_REQUEST5);
@@ -34576,12 +34600,6 @@ var vpRoutes = ({
       protected_claims: result.verified.protectedClaims,
       verified: true
     }, { status: HTTP_OK6 });
-  }, {
-    body: t36.Object({
-      presentation_submission: t36.Optional(t36.Unknown()),
-      state: t36.Optional(t36.String()),
-      vp_token: t36.String()
-    })
   });
 };
 var passthroughStore = (request) => ({
@@ -38056,13 +38074,7 @@ var samlIdpRoutes = ({
       user: userSession.user
     });
   };
-  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
-    binding: "POST",
-    body,
-    inMemorySession: store.session,
-    request,
-    userSessionIdValue: user_session_id.value
-  }), {
+  return new Elysia45().use(sessionStore()).post(ssoIdpRoute, {
     body: t37.Object({
       RelayState: t37.Optional(t37.String()),
       SAMLRequest: t37.Optional(t37.String())
@@ -38070,13 +38082,13 @@ var samlIdpRoutes = ({
     cookie: t37.Cookie({
       user_session_id: t37.Optional(userSessionIdTypebox)
     })
-  }).get(ssoIdpRoute, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
-    binding: "Redirect",
-    body: query,
+  }, async ({ body, cookie: { user_session_id }, request, store }) => handleSpInitiated({
+    binding: "POST",
+    body,
     inMemorySession: store.session,
     request,
     userSessionIdValue: user_session_id.value
-  }), {
+  })).get(ssoIdpRoute, {
     cookie: t37.Cookie({
       user_session_id: t37.Optional(userSessionIdTypebox)
     }),
@@ -38086,7 +38098,21 @@ var samlIdpRoutes = ({
       SigAlg: t37.Optional(t37.String()),
       Signature: t37.Optional(t37.String())
     })
-  }).get(idpInitiateRoute, async ({
+  }, async ({ cookie: { user_session_id }, query, request, store }) => handleSpInitiated({
+    binding: "Redirect",
+    body: query,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  })).get(idpInitiateRoute, {
+    cookie: t37.Cookie({
+      user_session_id: t37.Optional(userSessionIdTypebox)
+    }),
+    query: t37.Object({
+      RelayState: t37.Optional(t37.String()),
+      sp: t37.Optional(t37.String())
+    })
+  }, async ({
     cookie: { user_session_id },
     query: { sp: serviceProviderEntityId, RelayState: relayState },
     request,
@@ -38119,14 +38145,6 @@ var samlIdpRoutes = ({
       serviceProviderEntityId: serviceProvider.entityId,
       user: userSession.user
     });
-  }, {
-    cookie: t37.Cookie({
-      user_session_id: t37.Optional(userSessionIdTypebox)
-    }),
-    query: t37.Object({
-      RelayState: t37.Optional(t37.String()),
-      sp: t37.Optional(t37.String())
-    })
   }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
     entityId: idpEntityId,
     ssoUrl: ssoUrlFor(request.url)
@@ -38631,10 +38649,7 @@ var buildAuthApplications = async (configuration) => {
       profileRoute
     })
   ]);
-  const featureRoutes = new Elysia46({
-    name: "@absolutejs/auth/feature-routes",
-    seed: pluginSeed
-  }).use([
+  const identityFeatureRoutes = new Elysia46().use([
     auditedCredentials ? credentialRoutes({
       ...auditedCredentials,
       authSessionStore,
@@ -38664,7 +38679,9 @@ var buildAuthApplications = async (configuration) => {
       authSessionStore,
       cookieSecure: resolvedCookieSecure,
       samlAdapter: sso.samlAdapter
-    }) : new Elysia46,
+    }) : new Elysia46
+  ]);
+  const organizationFeatureRoutes = new Elysia46().use([
     sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
       getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
       ssoConnectionStore: sso.ssoConnectionStore,
@@ -38685,7 +38702,9 @@ var buildAuthApplications = async (configuration) => {
       ...roles,
       authSessionStore,
       emit: auditEmit
-    }) : new Elysia46,
+    }) : new Elysia46
+  ]);
+  const extendedFeatureRoutes = new Elysia46().use([
     portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia46,
     webauthn ? webauthnRoutes({
       ...webauthn,
@@ -38701,6 +38720,14 @@ var buildAuthApplications = async (configuration) => {
     createConfiguredAuthHtmxRoutes({ authSessionStore, config: htmx }),
     agentAuthRoutes(resolvedAgentAuth)
   ]);
+  const featureRoutes = new Elysia46({
+    name: "@absolutejs/auth/feature-routes",
+    seed: pluginSeed
+  }).use([
+    identityFeatureRoutes,
+    organizationFeatureRoutes,
+    extendedFeatureRoutes
+  ]);
   const authContext = createAuthContext({
     agentAuth: resolvedAgentAuth,
     authorization,
@@ -38898,5 +38925,5 @@ export {
   VerificationProviderError
 };
 
-//# debugId=5901150ECA00DB6964756E2164756E21
+//# debugId=E426F833E493795E64756E2164756E21
 //# sourceMappingURL=server.js.map