@absolutejs/auth 0.30.0-beta.5 → 0.30.0

package/dist/index.d.ts

@@ -15143,8 +15143,11 @@ export { createInMemoryWarrantStore, warrantKey } from './fga/inMemoryStores';
 export { createNeonWarrantStore, createPostgresWarrantStore, warrantsTable } from './fga/postgresStores';
 export { ssoDiscoveryRoute } from './sso/discoveryRoute';
 export { oidcSsoRoutes } from './sso/oidcRoutes';
+export { samlIdpRoutes } from './sso/samlIdpRoutes';
 export { samlSsoRoutes } from './sso/samlRoutes';
+export { createInMemorySamlServiceProviderStore } from './sso/inMemorySamlServiceProviderStore';
 export { createInMemorySsoConnectionStore } from './sso/inMemorySsoConnectionStore';
+export { createNeonSamlServiceProviderStore, createPostgresSamlServiceProviderStore, samlServiceProvidersTable } from './sso/postgresSamlServiceProviderStore';
 export { createNeonSsoConnectionStore, createPostgresSsoConnectionStore, ssoConnectionsTable } from './sso/postgresSsoConnectionStore';
 export * from './webauthn/adapter';
 export * from './webauthn/config';

package/dist/index.js

@@ -2520,7 +2520,7 @@ var createOAuth2Client = async (providerName, config) => {
 };
 
 // src/index.ts
-import { Elysia as Elysia35 } from "elysia";
+import { Elysia as Elysia36 } from "elysia";
 
 // src/apikeys/routes.ts
 import { Elysia, t } from "elysia";
@@ -22390,6 +22390,220 @@ var createPostgresWarrantStore = (db) => ({
     }).onConflictDoNothing({ target: warrantsTable.id });
   }
 });
+// src/sso/samlIdpRoutes.ts
+import { Elysia as Elysia35, t as t31 } from "elysia";
+var HTTP_BAD_REQUEST3 = 400;
+var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_FOUND2 = 302;
+var HTTP_OK3 = 200;
+var xmlResponse = (body) => new Response(body, {
+  headers: { "content-type": "application/samlmetadata+xml" },
+  status: HTTP_OK3
+});
+var htmlResponse = (body) => new Response(body, {
+  headers: { "content-type": "text/html; charset=utf-8" },
+  status: HTTP_OK3
+});
+var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
+var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
+  headers: { "content-type": "application/json" },
+  status
+});
+var samlIdpRoutes = ({
+  authSessionStore,
+  getNameId,
+  getSamlAttributes,
+  idpAdapter,
+  idpEntityId,
+  loginUrl,
+  samlServiceProviderStore,
+  ssoRoute = DEFAULT_SSO_ROUTE
+}) => {
+  const ssoIdpRoute = `${ssoRoute}/saml/idp/sso`;
+  const idpInitiateRoute = `${ssoRoute}/saml/idp/sso/initiate`;
+  const idpMetadataRoute = `${ssoRoute}/saml/idp/metadata`;
+  const ssoUrlFor = (requestUrl) => `${new URL(requestUrl).origin}${ssoIdpRoute}`;
+  const renderResponse = async ({
+    acsUrl,
+    inResponseTo,
+    relayState,
+    serviceProviderEntityId,
+    user
+  }) => {
+    const samlResponse = await idpAdapter.createSamlResponse({
+      acsUrl,
+      attributes: getSamlAttributes?.(user),
+      audience: serviceProviderEntityId,
+      idpEntityId,
+      inResponseTo,
+      nameId: getNameId(user),
+      sessionIndex: crypto.randomUUID()
+    });
+    const html2 = idpAdapter.buildAutoPostForm({
+      acsUrl,
+      relayState,
+      samlResponse
+    });
+    return htmlResponse(html2);
+  };
+  const handleSpInitiated = async ({
+    binding,
+    body,
+    inMemorySession,
+    request,
+    userSessionIdValue
+  }) => {
+    if (body.SAMLRequest === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "missing_saml_request");
+    }
+    let firstPass;
+    try {
+      firstPass = await idpAdapter.parseAuthnRequest({
+        binding,
+        samlRequest: body.SAMLRequest
+      });
+    } catch {
+      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+    }
+    const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
+    if (serviceProvider === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+    }
+    let parsed;
+    try {
+      parsed = await idpAdapter.parseAuthnRequest({
+        binding,
+        samlRequest: body.SAMLRequest,
+        serviceProvider,
+        signature: body.Signature,
+        signatureAlgorithm: body.SigAlg,
+        signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
+      });
+    } catch {
+      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+    }
+    const userSession = await loadSessionFromSource({
+      authSessionStore,
+      session: inMemorySession,
+      userSessionId: userSessionIdValue
+    });
+    if (userSession === undefined || parsed.forceAuthn === true) {
+      if (loginUrl === undefined) {
+        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+      }
+      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+    }
+    return renderResponse({
+      acsUrl: parsed.acsUrl ?? serviceProvider.acsUrl,
+      inResponseTo: parsed.id,
+      relayState: parsed.relayState ?? body.RelayState,
+      serviceProviderEntityId: serviceProvider.entityId,
+      user: userSession.user
+    });
+  };
+  return new Elysia35().use(sessionStore()).post(ssoIdpRoute, async ({
+    body,
+    cookie: { user_session_id },
+    request,
+    store
+  }) => handleSpInitiated({
+    binding: "POST",
+    body,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  }), {
+    body: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String())
+    }),
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    })
+  }).get(ssoIdpRoute, async ({
+    cookie: { user_session_id },
+    query,
+    request,
+    store
+  }) => handleSpInitiated({
+    binding: "Redirect",
+    body: query,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  }), {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String()),
+      SigAlg: t31.Optional(t31.String()),
+      Signature: t31.Optional(t31.String())
+    })
+  }).get(idpInitiateRoute, async ({
+    cookie: { user_session_id },
+    query: { sp: serviceProviderEntityId, RelayState: relayState },
+    request,
+    store
+  }) => {
+    if (serviceProviderEntityId === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "missing_sp");
+    }
+    const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
+    if (serviceProvider === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+    }
+    const userSession = authSessionStore === undefined ? await loadSessionFromSource({
+      session: store.session,
+      userSessionId: user_session_id.value
+    }) : await loadSessionFromSource({
+      authSessionStore,
+      session: store.session,
+      userSessionId: user_session_id.value
+    });
+    if (userSession === undefined) {
+      if (loginUrl === undefined) {
+        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+      }
+      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+    }
+    return renderResponse({
+      acsUrl: serviceProvider.acsUrl,
+      relayState,
+      serviceProviderEntityId: serviceProvider.entityId,
+      user: userSession.user
+    });
+  }, {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      sp: t31.Optional(t31.String())
+    })
+  }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
+    entityId: idpEntityId,
+    ssoUrl: ssoUrlFor(request.url)
+  })));
+};
+// src/sso/inMemorySamlServiceProviderStore.ts
+var createInMemorySamlServiceProviderStore = () => {
+  const providers2 = new Map;
+  return {
+    deleteServiceProvider: async (entityId) => {
+      providers2.delete(entityId);
+    },
+    findServiceProvider: async (entityId) => {
+      const found = providers2.get(entityId);
+      return found ? { ...found } : undefined;
+    },
+    listServiceProviders: async () => Array.from(providers2.values()).map((serviceProvider) => ({ ...serviceProvider })),
+    saveServiceProvider: async (serviceProvider) => {
+      providers2.set(serviceProvider.entityId, { ...serviceProvider });
+    }
+  };
+};
 // src/sso/inMemorySsoConnectionStore.ts
 var cloneConnection = (value) => value.type === "oidc" ? {
   ...value,
@@ -22415,16 +22629,63 @@ var createInMemorySsoConnectionStore = () => {
     }
   };
 };
-// src/sso/postgresSsoConnectionStore.ts
+// src/sso/postgresSamlServiceProviderStore.ts
 var ID_LENGTH10 = 255;
+var URL_LENGTH2 = 2048;
+var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
+  acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
+  name_id_format: varchar("name_id_format", { length: ID_LENGTH10 }),
+  signing_cert: text("signing_cert"),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
+});
+var toServiceProvider = (row) => ({
+  acsUrl: row.acs_url,
+  createdAt: row.created_at_ms,
+  entityId: row.entity_id,
+  nameIdFormat: row.name_id_format ?? undefined,
+  signingCert: row.signing_cert ?? undefined,
+  updatedAt: row.updated_at_ms
+});
+var toValues2 = (serviceProvider) => ({
+  acs_url: serviceProvider.acsUrl,
+  created_at_ms: serviceProvider.createdAt,
+  entity_id: serviceProvider.entityId,
+  name_id_format: serviceProvider.nameIdFormat ?? null,
+  signing_cert: serviceProvider.signingCert ?? null,
+  updated_at_ms: serviceProvider.updatedAt
+});
+var createNeonSamlServiceProviderStore = (databaseUrl) => createPostgresSamlServiceProviderStore(createNeonDatabase(databaseUrl));
+var createPostgresSamlServiceProviderStore = (db) => ({
+  deleteServiceProvider: async (entityId) => {
+    await db.delete(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId));
+  },
+  findServiceProvider: async (entityId) => {
+    const [row] = await db.select().from(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId)).limit(1);
+    return row === undefined ? undefined : toServiceProvider(row);
+  },
+  listServiceProviders: async () => {
+    const rows = await db.select().from(samlServiceProvidersTable);
+    return rows.map(toServiceProvider);
+  },
+  saveServiceProvider: async (serviceProvider) => {
+    await db.insert(samlServiceProvidersTable).values(toValues2(serviceProvider)).onConflictDoUpdate({
+      set: toValues2(serviceProvider),
+      target: samlServiceProvidersTable.entity_id
+    });
+  }
+});
+// src/sso/postgresSsoConnectionStore.ts
+var ID_LENGTH11 = 255;
 var TYPE_LENGTH2 = 16;
 var ssoConnectionsTable = pgTable("auth_sso_connections", {
   config: jsonb("config").$type().notNull(),
-  connection_id: varchar("connection_id", { length: ID_LENGTH10 }).primaryKey(),
+  connection_id: varchar("connection_id", { length: ID_LENGTH11 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   enabled: boolean("enabled").notNull().default(true),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH10
+    length: ID_LENGTH11
   }).notNull(),
   type: varchar("type", { length: TYPE_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -22491,7 +22752,7 @@ var toConnection = (row) => {
   };
   return connection;
 };
-var toValues2 = (connection) => ({
+var toValues3 = (connection) => ({
   config: connection.config,
   connection_id: connection.connectionId,
   created_at_ms: connection.createdAt,
@@ -22521,7 +22782,7 @@ var createPostgresSsoConnectionStore = (db) => ({
     });
   },
   saveConnection: async (connection) => {
-    const values = toValues2(connection);
+    const values = toValues3(connection);
     await db.insert(ssoConnectionsTable).values(values).onConflictDoUpdate({
       set: values,
       target: ssoConnectionsTable.connection_id
@@ -22550,18 +22811,18 @@ var createInMemoryWebAuthnCredentialStore = () => {
   };
 };
 // src/webauthn/postgresWebAuthnCredentialStore.ts
-var ID_LENGTH11 = 255;
+var ID_LENGTH12 = 255;
 var DEVICE_TYPE_LENGTH = 32;
 var webauthnCredentialsTable = pgTable("auth_webauthn_credentials", {
   backed_up: boolean("backed_up"),
   counter: bigint("counter", { mode: "number" }).notNull().default(0),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  credential_id: varchar("credential_id", { length: ID_LENGTH11 }).primaryKey(),
+  credential_id: varchar("credential_id", { length: ID_LENGTH12 }).primaryKey(),
   device_type: varchar("device_type", { length: DEVICE_TYPE_LENGTH }),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   public_key: text("public_key").notNull(),
   transports: jsonb("transports").$type(),
-  user_id: varchar("user_id", { length: ID_LENGTH11 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH12 }).notNull()
 });
 var toCredential = (row) => ({
   backedUp: row.backed_up ?? undefined,
@@ -22574,7 +22835,7 @@ var toCredential = (row) => ({
   transports: row.transports ?? undefined,
   userId: row.user_id
 });
-var toValues3 = (credential) => ({
+var toValues4 = (credential) => ({
   backed_up: credential.backedUp ?? null,
   counter: credential.counter,
   created_at_ms: credential.createdAt,
@@ -22599,7 +22860,7 @@ var createPostgresWebAuthnCredentialStore = (db) => ({
     await db.delete(webauthnCredentialsTable).where(eq(webauthnCredentialsTable.credential_id, credentialId));
   },
   saveCredential: async (credential) => {
-    const values = toValues3(credential);
+    const values = toValues4(credential);
     await db.insert(webauthnCredentialsTable).values(values).onConflictDoUpdate({
       set: values,
       target: webauthnCredentialsTable.credential_id
@@ -22654,41 +22915,41 @@ var createInMemoryOrganizationStore = () => {
   };
 };
 // src/organizations/postgresOrganizationStore.ts
-var ID_LENGTH12 = 255;
+var ID_LENGTH13 = 255;
 var NAME_LENGTH = 255;
 var STATE_LENGTH = 16;
 var organizationInvitationsTable = pgTable("auth_organization_invitations", {
   accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  email: varchar("email", { length: ID_LENGTH12 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH13 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   invitation_id: varchar("invitation_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).primaryKey(),
-  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH12 }),
+  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH13 }),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
-  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).notNull().unique()
 });
 var organizationMembershipsTable = pgTable("auth_organization_memberships", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).notNull(),
   roles: jsonb("roles").$type().notNull().default([]),
   status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH12 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH13 }).notNull()
 }, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
 var organizationsTable = pgTable("auth_organizations", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   metadata: jsonb("metadata").$type(),
   name: varchar("name", { length: NAME_LENGTH }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH12
+    length: ID_LENGTH13
   }).primaryKey(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
@@ -22862,12 +23123,12 @@ var createInMemoryRoleStore = () => {
   };
 };
 // src/roles/postgresRoleStore.ts
-var ID_LENGTH13 = 255;
+var ID_LENGTH14 = 255;
 var SLUG_LENGTH = 128;
 var GLOBAL_SCOPE = "";
 var rolesTable = pgTable("auth_roles", {
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", { length: ID_LENGTH13 }).notNull().default(GLOBAL_SCOPE),
+  organization_id: varchar("organization_id", { length: ID_LENGTH14 }).notNull().default(GLOBAL_SCOPE),
   permissions: jsonb("permissions").$type().notNull().default([]),
   slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -22922,11 +23183,11 @@ var createInMemoryPasswordlessTokenStore = () => {
   };
 };
 // src/passwordless/postgresPasswordlessTokenStore.ts
-var ID_LENGTH14 = 255;
+var ID_LENGTH15 = 255;
 var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
-  email: varchar("email", { length: ID_LENGTH14 }).notNull(),
+  email: varchar("email", { length: ID_LENGTH15 }).notNull(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH14 }).primaryKey()
+  token_hash: varchar("token_hash", { length: ID_LENGTH15 }).primaryKey()
 });
 var toToken3 = (row) => ({
   email: row.email,
@@ -22966,14 +23227,14 @@ var createInMemoryWebhookDeliveryStore = () => {
   };
 };
 // src/webhooks/postgresStore.ts
-var ID_LENGTH15 = 255;
-var URL_LENGTH2 = 2048;
+var ID_LENGTH16 = 255;
+var URL_LENGTH3 = 2048;
 var DEFAULT_LIST_LIMIT4 = 100;
 var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH2 }).notNull(),
-  envelope_id: varchar("envelope_id", { length: ID_LENGTH15 }).primaryKey(),
+  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
+  envelope_id: varchar("envelope_id", { length: ID_LENGTH16 }).primaryKey(),
   envelope_json: jsonb("envelope_json").$type().notNull(),
   last_error: text("last_error"),
   last_status: bigint("last_status", { mode: "number" })
@@ -23028,19 +23289,19 @@ var createInMemorySetupSessionStore = () => {
   };
 };
 // src/portal/postgresSetupSessionStore.ts
-var ID_LENGTH16 = 255;
+var ID_LENGTH17 = 255;
 var setupSessionsTable = pgTable("auth_setup_sessions", {
   capabilities: jsonb("capabilities").$type().notNull().default([]),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  created_by: varchar("created_by", { length: ID_LENGTH16 }),
+  created_by: varchar("created_by", { length: ID_LENGTH17 }),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH16
+    length: ID_LENGTH17
   }).notNull(),
   setup_session_id: varchar("setup_session_id", {
-    length: ID_LENGTH16
+    length: ID_LENGTH17
   }).primaryKey(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH16 }).notNull().unique()
+  token_hash: varchar("token_hash", { length: ID_LENGTH17 }).notNull().unique()
 });
 var toSession = (row) => ({
   capabilities: row.capabilities,
@@ -23146,7 +23407,7 @@ var auth = async ({
   const auditedOnCallbackSuccess = auditEmit ? composeCallbackAudit(onCallbackSuccess, auditEmit) : onCallbackSuccess;
   const auditedOnRevocationSuccess = auditEmit ? composeRevocationAudit(onRevocationSuccess, auditEmit) : onRevocationSuccess;
   const auditedOnSignOut = auditEmit ? composeSignOutAudit(onSignOut, auditEmit) : onSignOut;
-  return new Elysia35().use(sessionCleanup({
+  return new Elysia36().use(sessionCleanup({
     authSessionStore,
     cleanupIntervalMs,
     maxSessions,
@@ -23192,42 +23453,42 @@ var auth = async ({
     ...auditedCredentials,
     authSessionStore,
     lockoutGuard
-  }) : new Elysia35).use(auditedMfa ? mfaRoutes({ ...auditedMfa, authSessionStore }) : new Elysia35).use(passwordless ? passwordlessRoutes({
+  }) : new Elysia36).use(auditedMfa ? mfaRoutes({ ...auditedMfa, authSessionStore }) : new Elysia36).use(passwordless ? passwordlessRoutes({
     ...passwordless,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia35).use(sso ? oidcSsoRoutes({ ...sso, authSessionStore }) : new Elysia35).use(sso && sso.samlAdapter ? samlSsoRoutes({
+  }) : new Elysia36).use(sessions ? sessionRoutes({ ...sessions, authSessionStore }) : new Elysia36).use(sso ? oidcSsoRoutes({ ...sso, authSessionStore }) : new Elysia36).use(sso && sso.samlAdapter ? samlSsoRoutes({
     ...sso,
     authSessionStore,
     samlAdapter: sso.samlAdapter
-  }) : new Elysia35).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
+  }) : new Elysia36).use(sso && sso.getOrganizationByEmailDomain ? ssoDiscoveryRoute({
     getOrganizationByEmailDomain: sso.getOrganizationByEmailDomain,
     ssoConnectionStore: sso.ssoConnectionStore,
     ssoRoute: sso.ssoRoute
-  }) : new Elysia35).use(scim ? scimRoutes(scim) : new Elysia35).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia35).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia35).use(organizations ? organizationRoutes({
+  }) : new Elysia36).use(scim ? scimRoutes(scim) : new Elysia36).use(apikeys ? apiKeysRoutes(apikeys) : new Elysia36).use(oidc ? oidcProviderRoutes({ ...oidc, authSessionStore }) : new Elysia36).use(organizations ? organizationRoutes({
     ...organizations,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(roles ? roleRoutes({
+  }) : new Elysia36).use(roles ? roleRoutes({
     ...roles,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia35).use(webauthn ? webauthnRoutes({
+  }) : new Elysia36).use(portal ? portalRoutes({ ...portal, emit: auditEmit }) : new Elysia36).use(webauthn ? webauthnRoutes({
     ...webauthn,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(compliance ? complianceRoutes({
+  }) : new Elysia36).use(compliance ? complianceRoutes({
     ...compliance,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
+  }) : new Elysia36).use(protectRoutePlugin({ authSessionStore })).use(stepUpPlugin({ authSessionStore })).use(authorization ? protectPermissionPlugin({
     ...authorization,
     authSessionStore,
     emit: auditEmit
-  }) : new Elysia35).use(htmx ? createAuthHtmxRoutes({
+  }) : new Elysia36).use(htmx ? createAuthHtmxRoutes({
     ...htmx,
     authSessionStore
-  }) : new Elysia35);
+  }) : new Elysia36);
 };
 export {
   writeWarrant,
@@ -23279,6 +23540,8 @@ export {
   scimTokensTable,
   scimRoutes,
   samlSsoRoutes,
+  samlServiceProvidersTable,
+  samlIdpRoutes,
   rotateVaultKey,
   rotateMfaEncryptionKey,
   rolesTable,
@@ -23434,6 +23697,7 @@ export {
   createPostgresSsoConnectionStore,
   createPostgresSetupSessionStore,
   createPostgresScimTokenStore,
+  createPostgresSamlServiceProviderStore,
   createPostgresRoleStore,
   createPostgresPushedAuthorizationRequestStore,
   createPostgresPasswordlessTokenStore,
@@ -23464,6 +23728,7 @@ export {
   createNeonSsoConnectionStore,
   createNeonSetupSessionStore,
   createNeonScimTokenStore,
+  createNeonSamlServiceProviderStore,
   createNeonRoleStore,
   createNeonPushedAuthorizationRequestStore,
   createNeonPasswordlessTokenStore,
@@ -23500,6 +23765,7 @@ export {
   createInMemorySsoConnectionStore,
   createInMemorySetupSessionStore,
   createInMemoryScimTokenStore,
+  createInMemorySamlServiceProviderStore,
   createInMemoryRoleStore,
   createInMemoryPushedAuthorizationRequestStore,
   createInMemoryPasswordlessTokenStore,
@@ -23590,5 +23856,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=36AE5503DAE3C8E864756E2164756E21
+//# debugId=B31AA1D09BAE440964756E2164756E21
 //# sourceMappingURL=index.js.map