@absolutejs/auth 0.34.0 → 0.35.0

package/dist/index.js

@@ -1,4 +1,6 @@
 // @bun
+var __require = import.meta.require;
+
 // node_modules/citra/dist/index.js
 var BASE64_BLOCK_SIZE = 4;
 var NUM_GENERATOR_BYTES = 32;
@@ -3675,6 +3677,32 @@ var verifyCognitoSha256 = async (plainPassword, wrappedHash) => {
   return constantTimeEqualBytes(derived, expected);
 };
 
+// src/telemetry/tracing.ts
+var DEFAULT_SERVICE_NAME = "@absolutejs/auth";
+var noopWithSpan = (_name, _attributes, work) => work(undefined);
+var activeWithSpan = noopWithSpan;
+var initTracing = async (config) => {
+  const otel = await import("@opentelemetry/api");
+  const tracer = config.tracerProvider.getTracer(config.serviceName ?? DEFAULT_SERVICE_NAME);
+  activeWithSpan = async (name, attributes, work) => {
+    const span = tracer.startSpan(name, { attributes });
+    try {
+      const result = await otel.context.with(otel.trace.setSpan(otel.context.active(), span), () => work(span));
+      span.setStatus({ code: otel.SpanStatusCode.OK });
+      return result;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "unknown";
+      if (error instanceof Error)
+        span.recordException(error);
+      span.setStatus({ code: otel.SpanStatusCode.ERROR, message });
+      throw error;
+    } finally {
+      span.end();
+    }
+  };
+};
+var withSpan = (name, attributes, work) => activeWithSpan(name, attributes, work);
+
 // src/credentials/passwordPolicy.ts
 var DEFAULT_MIN_LENGTH = 12;
 var HEX_RADIX = 16;
@@ -3746,7 +3774,7 @@ var credentialsLogin = ({
   request,
   status,
   store: { session, unregisteredSession }
-}) => {
+}) => withSpan("auth.credentials.login", undefined, async (span) => {
   const headerBag = {};
   request.headers.forEach((value, key) => {
     headerBag[key] = value;
@@ -3817,7 +3845,7 @@ var credentialsLogin = ({
   });
   await onCredentialsLoginSuccess?.({ user, userSessionId });
   return status("OK", { passwordCompromised, status: "authenticated" });
-}, {
+}), {
   body: t6.Object({ email: t6.String(), password: t6.String() }),
   cookie: t6.Cookie({ user_session_id: userSessionIdTypebox })
 });
@@ -3900,7 +3928,7 @@ var credentialsRegister = ({
   cookie: { user_session_id },
   status,
   store: { session }
-}) => {
+}) => withSpan("auth.credentials.register", undefined, async () => {
   const normalizedEmail = email.trim().toLowerCase();
   if (!normalizedEmail.includes("@")) {
     return status("Bad Request", "A valid email is required");
@@ -3962,7 +3990,7 @@ var credentialsRegister = ({
   });
   await onCredentialsLoginSuccess?.({ user: created, userSessionId });
   return status("Created", { status: "authenticated" });
-}, {
+}), {
   body: t8.Object({ email: t8.String(), password: t8.String() }, { additionalProperties: true }),
   cookie: t8.Cookie({ user_session_id: userSessionIdTypebox })
 });
@@ -4237,7 +4265,7 @@ var mfaChallenge = ({
   cookie: { user_session_id },
   status,
   store: { session, unregisteredSession }
-}) => {
+}) => withSpan("auth.mfa.challenge", undefined, async () => {
   const compatibilityLayer = await createSessionCompatibilityLayer({
     authSessionStore,
     userSessionId: user_session_id.value
@@ -4288,7 +4316,7 @@ var mfaChallenge = ({
   await persistWhen(authSessionStore !== undefined, compatibilityLayer.persist);
   await onMfaChallengeSuccess?.({ user, userSessionId });
   return status("OK", { status: "authenticated" });
-}, {
+}), {
   body: t10.Object({ code: t10.String() }),
   cookie: t10.Cookie({ user_session_id: userSessionIdTypebox })
 });
@@ -7428,7 +7456,7 @@ var callback = ({
     auth_intent
   },
   query: { code, state: callback_state }
-}) => {
+}) => withSpan("auth.oauth.callback", { "auth.provider": auth_provider?.value }, async () => {
   if (stored_state === undefined || code_verifier === undefined || user_session_id === undefined || auth_client === undefined || auth_intent === undefined) {
     return status("Bad Request", "Cookies are missing");
   }
@@ -7539,7 +7567,7 @@ var callback = ({
     return response;
   }
   return redirect(originUrl);
-}, {
+}), {
   cookie: t18.Cookie({
     auth_client: authClientOption,
     auth_intent: authIntentOption,
@@ -7890,7 +7918,7 @@ var signout = ({
   status,
   store: { session },
   cookie: { user_session_id, auth_provider }
-}) => {
+}) => withSpan("auth.signout", { "auth.provider": auth_provider?.value }, async () => {
   if (user_session_id === undefined) {
     return status("Bad Request", "Cookies are missing");
   }
@@ -7924,7 +7952,7 @@ var signout = ({
   user_session_id.remove();
   auth_provider?.remove();
   return new Response(null, { status: 204 });
-}, {
+}), {
   cookie: t24.Cookie({
     auth_provider: t24.Optional(authProviderOption),
     user_session_id: t24.Optional(t24.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"))
@@ -9316,16 +9344,24 @@ var attemptOnce = async ({
   timeoutMs,
   timestamp
 }) => {
-  const response = await fetchImpl(endpoint.url, {
-    body: payload,
-    headers: {
-      "content-type": "application/json",
-      "webhook-id": envelope.id,
-      "webhook-signature": signature,
-      "webhook-timestamp": timestamp
-    },
-    method: "POST",
-    signal: AbortSignal.timeout(timeoutMs)
+  const response = await withSpan("auth.webhook.deliver", {
+    "auth.webhook.event": envelope.type,
+    "auth.webhook.url": endpoint.url,
+    "http.method": "POST"
+  }, async (span) => {
+    const result = await fetchImpl(endpoint.url, {
+      body: payload,
+      headers: {
+        "content-type": "application/json",
+        "webhook-id": envelope.id,
+        "webhook-signature": signature,
+        "webhook-timestamp": timestamp
+      },
+      method: "POST",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    span?.setAttribute("http.status_code", result.status);
+    return result;
   });
   if (!response.ok) {
     throw new Error(`Webhook delivery returned ${response.status}`);
@@ -9756,6 +9792,38 @@ function uniqueKeyName(table, columns) {
   return `${table[TableName]}_${columns.join("_")}_unique`;
 }
 
+class UniqueConstraintBuilder {
+  constructor(columns, name) {
+    this.name = name;
+    this.columns = columns;
+  }
+  static [entityKind] = "PgUniqueConstraintBuilder";
+  columns;
+  nullsNotDistinctConfig = false;
+  nullsNotDistinct() {
+    this.nullsNotDistinctConfig = true;
+    return this;
+  }
+  build(table) {
+    return new UniqueConstraint(table, this.columns, this.nullsNotDistinctConfig, this.name);
+  }
+}
+class UniqueConstraint {
+  constructor(table, columns, nullsNotDistinct, name) {
+    this.table = table;
+    this.columns = columns;
+    this.name = name ?? uniqueKeyName(this.table, this.columns.map((column) => column.name));
+    this.nullsNotDistinct = nullsNotDistinct;
+  }
+  static [entityKind] = "PgUniqueConstraint";
+  columns;
+  name;
+  nullsNotDistinct = false;
+  getName() {
+    return this.name;
+  }
+}
+
 // node_modules/drizzle-orm/pg-core/utils/array.js
 function parsePgArrayValue(arrayString, startFrom, inQuotes) {
   for (let i = startFrom;i < arrayString.length; i++) {
@@ -12440,6 +12508,30 @@ function mapRelationalRow(tablesConfig, tableConfig, row, buildQueryResultSelect
   return result;
 }
 
+// node_modules/drizzle-orm/pg-core/checks.js
+class CheckBuilder {
+  constructor(name, value) {
+    this.name = name;
+    this.value = value;
+  }
+  static [entityKind] = "PgCheckBuilder";
+  brand;
+  build(table) {
+    return new Check(table, this);
+  }
+}
+
+class Check {
+  constructor(table, builder) {
+    this.table = table;
+    this.name = builder.name;
+    this.value = builder.value;
+  }
+  static [entityKind] = "PgCheck";
+  name;
+  value;
+}
+
 // node_modules/drizzle-orm/selection-proxy.js
 class SelectionProxyHandler {
   static [entityKind] = "SelectionProxyHandler";
@@ -14133,6 +14225,69 @@ class PgDatabase {
   }
 }
 
+// node_modules/drizzle-orm/pg-core/indexes.js
+class IndexBuilder {
+  static [entityKind] = "PgIndexBuilder";
+  config;
+  constructor(columns, unique, only, name, method = "btree") {
+    this.config = {
+      name,
+      columns,
+      unique,
+      only,
+      method
+    };
+  }
+  concurrently() {
+    this.config.concurrently = true;
+    return this;
+  }
+  with(obj) {
+    this.config.with = obj;
+    return this;
+  }
+  where(condition) {
+    this.config.where = condition;
+    return this;
+  }
+  build(table) {
+    return new Index(this.config, table);
+  }
+}
+
+class Index {
+  static [entityKind] = "PgIndex";
+  config;
+  constructor(config, table) {
+    this.config = { ...config, table };
+  }
+}
+
+// node_modules/drizzle-orm/pg-core/policies.js
+class PgPolicy {
+  constructor(name, config) {
+    this.name = name;
+    if (config) {
+      this.as = config.as;
+      this.for = config.for;
+      this.to = config.to;
+      this.using = config.using;
+      this.withCheck = config.withCheck;
+    }
+  }
+  static [entityKind] = "PgPolicy";
+  as;
+  for;
+  to;
+  using;
+  withCheck;
+  _linkedTable;
+  link(table) {
+    this._linkedTable = table;
+    return this;
+  }
+}
+
 // node_modules/drizzle-orm/pg-core/session.js
 class PgPreparedQuery {
   constructor(query) {
@@ -14175,6 +14330,52 @@ class PgSession {
   }
 }
 
+// node_modules/drizzle-orm/pg-core/utils.js
+function getTableConfig(table) {
+  const columns = Object.values(table[Table.Symbol.Columns]);
+  const indexes = [];
+  const checks = [];
+  const primaryKeys = [];
+  const foreignKeys = Object.values(table[PgTable.Symbol.InlineForeignKeys]);
+  const uniqueConstraints = [];
+  const name = table[Table.Symbol.Name];
+  const schema = table[Table.Symbol.Schema];
+  const policies = [];
+  const enableRLS = table[PgTable.Symbol.EnableRLS];
+  const extraConfigBuilder = table[PgTable.Symbol.ExtraConfigBuilder];
+  if (extraConfigBuilder !== undefined) {
+    const extraConfig = extraConfigBuilder(table[Table.Symbol.ExtraConfigColumns]);
+    const extraValues = Array.isArray(extraConfig) ? extraConfig.flat(1) : Object.values(extraConfig);
+    for (const builder of extraValues) {
+      if (is(builder, IndexBuilder)) {
+        indexes.push(builder.build(table));
+      } else if (is(builder, CheckBuilder)) {
+        checks.push(builder.build(table));
+      } else if (is(builder, UniqueConstraintBuilder)) {
+        uniqueConstraints.push(builder.build(table));
+      } else if (is(builder, PrimaryKeyBuilder)) {
+        primaryKeys.push(builder.build(table));
+      } else if (is(builder, ForeignKeyBuilder)) {
+        foreignKeys.push(builder.build(table));
+      } else if (is(builder, PgPolicy)) {
+        policies.push(builder);
+      }
+    }
+  }
+  return {
+    columns,
+    indexes,
+    foreignKeys,
+    checks,
+    primaryKeys,
+    uniqueConstraints,
+    name,
+    schema,
+    policies,
+    enableRLS
+  };
+}
+
 // node_modules/@neondatabase/serverless/index.mjs
 var vo = Object.create;
 var Te = Object.defineProperty;
@@ -19015,6 +19216,7 @@ var Fn = class Fn2 extends mo.Pool {
   }
 };
 a(Fn, "NeonPool");
+var Ln = Fn;
 We();
 var kn = xe(ot());
 var export_DatabaseError = kn.DatabaseError;
@@ -22442,302 +22644,344 @@ var createPostgresWarrantStore = (db) => ({
     }).onConflictDoNothing({ target: warrantsTable.id });
   }
 });
-// src/sso/samlIdpRoutes.ts
-import { Elysia as Elysia35, t as t31 } from "elysia";
-var HTTP_BAD_REQUEST3 = 400;
-var HTTP_UNAUTHORIZED3 = 401;
-var HTTP_FOUND2 = 302;
-var HTTP_OK3 = 200;
-var xmlResponse = (body) => new Response(body, {
-  headers: { "content-type": "application/samlmetadata+xml" },
-  status: HTTP_OK3
+
+// src/organizations/postgresOrganizationStore.ts
+var ID_LENGTH10 = 255;
+var NAME_LENGTH = 255;
+var STATE_LENGTH = 16;
+var organizationInvitationsTable = pgTable("auth_organization_invitations", {
+  accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  email: varchar("email", { length: ID_LENGTH10 }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  invitation_id: varchar("invitation_id", {
+    length: ID_LENGTH10
+  }).primaryKey(),
+  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH10 }),
+  organization_id: varchar("organization_id", {
+    length: ID_LENGTH10
+  }).notNull(),
+  roles: jsonb("roles").$type().notNull().default([]),
+  state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
+  token_hash: varchar("token_hash", { length: ID_LENGTH10 }).notNull().unique()
 });
-var htmlResponse = (body) => new Response(body, {
-  headers: { "content-type": "text/html; charset=utf-8" },
-  status: HTTP_OK3
+var organizationMembershipsTable = pgTable("auth_organization_memberships", {
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  organization_id: varchar("organization_id", {
+    length: ID_LENGTH10
+  }).notNull(),
+  roles: jsonb("roles").$type().notNull().default([]),
+  status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
+  user_id: varchar("user_id", { length: ID_LENGTH10 }).notNull()
+}, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
+var organizationsTable = pgTable("auth_organizations", {
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  metadata: jsonb("metadata").$type(),
+  name: varchar("name", { length: NAME_LENGTH }).notNull(),
+  organization_id: varchar("organization_id", {
+    length: ID_LENGTH10
+  }).primaryKey(),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
 });
-var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
-var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
-  headers: { "content-type": "application/json" },
-  status
+var toOrganization = (row) => ({
+  createdAt: row.created_at_ms,
+  metadata: row.metadata ?? undefined,
+  name: row.name,
+  organizationId: row.organization_id,
+  updatedAt: row.updated_at_ms
 });
-var samlIdpRoutes = ({
-  authSessionStore,
-  getNameId,
-  getSamlAttributes,
-  idpAdapter,
-  idpEntityId,
-  loginUrl,
-  samlServiceProviderStore,
-  ssoRoute = DEFAULT_SSO_ROUTE
-}) => {
-  const ssoIdpRoute = `${ssoRoute}/saml/idp/sso`;
-  const idpInitiateRoute = `${ssoRoute}/saml/idp/sso/initiate`;
-  const idpMetadataRoute = `${ssoRoute}/saml/idp/metadata`;
-  const ssoUrlFor = (requestUrl) => `${new URL(requestUrl).origin}${ssoIdpRoute}`;
-  const renderResponse = async ({
-    acsUrl,
-    inResponseTo,
-    relayState,
-    serviceProviderEntityId,
-    user
-  }) => {
-    const samlResponse = await idpAdapter.createSamlResponse({
-      acsUrl,
-      attributes: getSamlAttributes?.(user),
-      audience: serviceProviderEntityId,
-      idpEntityId,
-      inResponseTo,
-      nameId: getNameId(user),
-      sessionIndex: crypto.randomUUID()
-    });
-    const html2 = idpAdapter.buildAutoPostForm({
-      acsUrl,
-      relayState,
-      samlResponse
+var toMembership = (row) => ({
+  createdAt: row.created_at_ms,
+  organizationId: row.organization_id,
+  roles: row.roles,
+  status: row.status,
+  updatedAt: row.updated_at_ms,
+  userId: row.user_id
+});
+var toInvitation = (row) => ({
+  acceptedAt: row.accepted_at_ms ?? undefined,
+  createdAt: row.created_at_ms,
+  email: row.email,
+  expiresAt: row.expires_at_ms,
+  invitationId: row.invitation_id,
+  inviterUserId: row.inviter_user_id ?? undefined,
+  organizationId: row.organization_id,
+  roles: row.roles,
+  state: row.state,
+  tokenHash: row.token_hash
+});
+var createNeonOrganizationStore = (databaseUrl) => createPostgresOrganizationStore(createNeonDatabase(databaseUrl));
+var createPostgresOrganizationStore = (db) => ({
+  deleteOrganization: async (organizationId) => {
+    await db.delete(organizationsTable).where(eq(organizationsTable.organization_id, organizationId));
+  },
+  getInvitation: async (invitationId) => {
+    const [row] = await db.select().from(organizationInvitationsTable).where(eq(organizationInvitationsTable.invitation_id, invitationId)).limit(1);
+    return row ? toInvitation(row) : undefined;
+  },
+  getInvitationByTokenHash: async (tokenHash) => {
+    const [row] = await db.select().from(organizationInvitationsTable).where(eq(organizationInvitationsTable.token_hash, tokenHash)).limit(1);
+    return row ? toInvitation(row) : undefined;
+  },
+  getMembership: async (organizationId, userId) => {
+    const [row] = await db.select().from(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationId), eq(organizationMembershipsTable.user_id, userId))).limit(1);
+    return row ? toMembership(row) : undefined;
+  },
+  getOrganization: async (organizationId) => {
+    const [row] = await db.select().from(organizationsTable).where(eq(organizationsTable.organization_id, organizationId)).limit(1);
+    return row ? toOrganization(row) : undefined;
+  },
+  listInvitationsByOrganization: async (organizationId) => {
+    const rows = await db.select().from(organizationInvitationsTable).where(eq(organizationInvitationsTable.organization_id, organizationId));
+    return rows.map(toInvitation);
+  },
+  listMembershipsByOrganization: async (organizationId) => {
+    const rows = await db.select().from(organizationMembershipsTable).where(eq(organizationMembershipsTable.organization_id, organizationId));
+    return rows.map(toMembership);
+  },
+  listMembershipsByUser: async (userId) => {
+    const rows = await db.select().from(organizationMembershipsTable).where(eq(organizationMembershipsTable.user_id, userId));
+    return rows.map(toMembership);
+  },
+  removeMembership: async (organizationId, userId) => {
+    await db.delete(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationId), eq(organizationMembershipsTable.user_id, userId)));
+  },
+  saveInvitation: async (invitation) => {
+    const values = {
+      accepted_at_ms: invitation.acceptedAt ?? null,
+      created_at_ms: invitation.createdAt,
+      email: invitation.email,
+      expires_at_ms: invitation.expiresAt,
+      invitation_id: invitation.invitationId,
+      inviter_user_id: invitation.inviterUserId ?? null,
+      organization_id: invitation.organizationId,
+      roles: invitation.roles,
+      state: invitation.state,
+      token_hash: invitation.tokenHash
+    };
+    await db.insert(organizationInvitationsTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: organizationInvitationsTable.invitation_id
     });
-    return htmlResponse(html2);
-  };
-  const handleSpInitiated = async ({
-    binding,
-    body,
-    inMemorySession,
-    request,
-    userSessionIdValue
-  }) => {
-    if (body.SAMLRequest === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "missing_saml_request");
-    }
-    let firstPass;
-    try {
-      firstPass = await idpAdapter.parseAuthnRequest({
-        binding,
-        samlRequest: body.SAMLRequest
-      });
-    } catch {
-      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
-    }
-    const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
-    if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
-    }
-    let parsed;
-    try {
-      parsed = await idpAdapter.parseAuthnRequest({
-        binding,
-        samlRequest: body.SAMLRequest,
-        serviceProvider,
-        signature: body.Signature,
-        signatureAlgorithm: body.SigAlg,
-        signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
-      });
-    } catch {
-      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
-    }
-    const userSession = await loadSessionFromSource({
-      authSessionStore,
-      session: inMemorySession,
-      userSessionId: userSessionIdValue
-    });
-    if (userSession === undefined || parsed.forceAuthn === true) {
-      if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
-      }
-      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
-    }
-    return renderResponse({
-      acsUrl: parsed.acsUrl ?? serviceProvider.acsUrl,
-      inResponseTo: parsed.id,
-      relayState: parsed.relayState ?? body.RelayState,
-      serviceProviderEntityId: serviceProvider.entityId,
-      user: userSession.user
-    });
-  };
-  return new Elysia35().use(sessionStore()).post(ssoIdpRoute, async ({
-    body,
-    cookie: { user_session_id },
-    request,
-    store
-  }) => handleSpInitiated({
-    binding: "POST",
-    body,
-    inMemorySession: store.session,
-    request,
-    userSessionIdValue: user_session_id.value
-  }), {
-    body: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLRequest: t31.Optional(t31.String())
-    }),
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    })
-  }).get(ssoIdpRoute, async ({
-    cookie: { user_session_id },
-    query,
-    request,
-    store
-  }) => handleSpInitiated({
-    binding: "Redirect",
-    body: query,
-    inMemorySession: store.session,
-    request,
-    userSessionIdValue: user_session_id.value
-  }), {
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    }),
-    query: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      SAMLRequest: t31.Optional(t31.String()),
-      SigAlg: t31.Optional(t31.String()),
-      Signature: t31.Optional(t31.String())
-    })
-  }).get(idpInitiateRoute, async ({
-    cookie: { user_session_id },
-    query: { sp: serviceProviderEntityId, RelayState: relayState },
-    request,
-    store
-  }) => {
-    if (serviceProviderEntityId === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "missing_sp");
-    }
-    const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
-    if (serviceProvider === undefined) {
-      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
-    }
-    const userSession = authSessionStore === undefined ? await loadSessionFromSource({
-      session: store.session,
-      userSessionId: user_session_id.value
-    }) : await loadSessionFromSource({
-      authSessionStore,
-      session: store.session,
-      userSessionId: user_session_id.value
-    });
-    if (userSession === undefined) {
-      if (loginUrl === undefined) {
-        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
-      }
-      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
-    }
-    return renderResponse({
-      acsUrl: serviceProvider.acsUrl,
-      relayState,
-      serviceProviderEntityId: serviceProvider.entityId,
-      user: userSession.user
-    });
-  }, {
-    cookie: t31.Cookie({
-      user_session_id: t31.Optional(userSessionIdTypebox)
-    }),
-    query: t31.Object({
-      RelayState: t31.Optional(t31.String()),
-      sp: t31.Optional(t31.String())
-    })
-  }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
-    entityId: idpEntityId,
-    ssoUrl: ssoUrlFor(request.url)
-  })));
-};
-// src/sso/inMemorySamlServiceProviderStore.ts
-var createInMemorySamlServiceProviderStore = () => {
-  const providers2 = new Map;
-  return {
-    deleteServiceProvider: async (entityId) => {
-      providers2.delete(entityId);
-    },
-    findServiceProvider: async (entityId) => {
-      const found = providers2.get(entityId);
-      return found ? { ...found } : undefined;
-    },
-    listServiceProviders: async () => Array.from(providers2.values()).map((serviceProvider) => ({ ...serviceProvider })),
-    saveServiceProvider: async (serviceProvider) => {
-      providers2.set(serviceProvider.entityId, { ...serviceProvider });
-    }
-  };
-};
-// src/sso/inMemorySsoConnectionStore.ts
-var cloneConnection = (value) => value.type === "oidc" ? {
-  ...value,
-  config: { ...value.config, scopes: [...value.config.scopes] }
-} : { ...value, config: { ...value.config } };
-var createInMemorySsoConnectionStore = () => {
-  const connections = new Map;
-  return {
-    deleteConnection: async (connectionId) => {
-      connections.delete(connectionId);
-    },
-    getConnection: async (connectionId) => {
-      const connection = connections.get(connectionId);
-      return connection ? cloneConnection(connection) : undefined;
-    },
-    getConnectionByOrganization: async (organizationId, type) => {
-      const match = Array.from(connections.values()).find((connection) => connection.organizationId === organizationId && connection.enabled && (type === undefined || connection.type === type));
-      return match ? cloneConnection(match) : undefined;
-    },
-    listConnectionsByOrganization: async (organizationId) => Array.from(connections.values()).filter((connection) => connection.organizationId === organizationId).sort((left, right) => right.updatedAt - left.updatedAt).map(cloneConnection),
-    saveConnection: async (connection) => {
-      connections.set(connection.connectionId, cloneConnection(connection));
-    }
-  };
-};
-// src/sso/postgresSamlServiceProviderStore.ts
-var ID_LENGTH10 = 255;
-var URL_LENGTH2 = 2048;
-var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
-  acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
-  name_id_format: varchar("name_id_format", { length: ID_LENGTH10 }),
-  signing_cert: text("signing_cert"),
-  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
-});
-var toServiceProvider = (row) => ({
-  acsUrl: row.acs_url,
-  createdAt: row.created_at_ms,
-  entityId: row.entity_id,
-  nameIdFormat: row.name_id_format ?? undefined,
-  signingCert: row.signing_cert ?? undefined,
-  updatedAt: row.updated_at_ms
-});
-var toValues2 = (serviceProvider) => ({
-  acs_url: serviceProvider.acsUrl,
-  created_at_ms: serviceProvider.createdAt,
-  entity_id: serviceProvider.entityId,
-  name_id_format: serviceProvider.nameIdFormat ?? null,
-  signing_cert: serviceProvider.signingCert ?? null,
-  updated_at_ms: serviceProvider.updatedAt
-});
-var createNeonSamlServiceProviderStore = (databaseUrl) => createPostgresSamlServiceProviderStore(createNeonDatabase(databaseUrl));
-var createPostgresSamlServiceProviderStore = (db) => ({
-  deleteServiceProvider: async (entityId) => {
-    await db.delete(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId));
-  },
-  findServiceProvider: async (entityId) => {
-    const [row] = await db.select().from(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId)).limit(1);
-    return row === undefined ? undefined : toServiceProvider(row);
   },
-  listServiceProviders: async () => {
-    const rows = await db.select().from(samlServiceProvidersTable);
-    return rows.map(toServiceProvider);
+  saveMembership: async (membership) => {
+    const values = {
+      created_at_ms: membership.createdAt,
+      organization_id: membership.organizationId,
+      roles: membership.roles,
+      status: membership.status,
+      updated_at_ms: membership.updatedAt,
+      user_id: membership.userId
+    };
+    await db.insert(organizationMembershipsTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: [
+        organizationMembershipsTable.organization_id,
+        organizationMembershipsTable.user_id
+      ]
+    });
   },
-  saveServiceProvider: async (serviceProvider) => {
-    await db.insert(samlServiceProvidersTable).values(toValues2(serviceProvider)).onConflictDoUpdate({
-      set: toValues2(serviceProvider),
-      target: samlServiceProvidersTable.entity_id
+  saveOrganization: async (organization) => {
+    const values = {
+      created_at_ms: organization.createdAt,
+      metadata: organization.metadata ?? null,
+      name: organization.name,
+      organization_id: organization.organizationId,
+      updated_at_ms: organization.updatedAt
+    };
+    await db.insert(organizationsTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: organizationsTable.organization_id
     });
   }
 });
-// src/sso/postgresSsoConnectionStore.ts
+
+// src/passwordless/postgresPasswordlessTokenStore.ts
 var ID_LENGTH11 = 255;
+var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
+  email: varchar("email", { length: ID_LENGTH11 }).notNull(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  token_hash: varchar("token_hash", { length: ID_LENGTH11 }).primaryKey()
+});
+var toToken3 = (row) => ({
+  email: row.email,
+  expiresAt: row.expires_at_ms,
+  tokenHash: row.token_hash
+});
+var createNeonPasswordlessTokenStore = (databaseUrl) => createPostgresPasswordlessTokenStore(createNeonDatabase(databaseUrl));
+var createPostgresPasswordlessTokenStore = (db) => ({
+  consumeToken: async (tokenHash) => {
+    const [row] = await db.delete(passwordlessTokensTable).where(eq(passwordlessTokensTable.token_hash, tokenHash)).returning();
+    return row ? toToken3(row) : undefined;
+  },
+  saveToken: async (token) => {
+    const values = {
+      email: token.email,
+      expires_at_ms: token.expiresAt,
+      token_hash: token.tokenHash
+    };
+    await db.insert(passwordlessTokensTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: passwordlessTokensTable.token_hash
+    });
+  }
+});
+
+// src/portal/postgresSetupSessionStore.ts
+var ID_LENGTH12 = 255;
+var setupSessionsTable = pgTable("auth_setup_sessions", {
+  capabilities: jsonb("capabilities").$type().notNull().default([]),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  created_by: varchar("created_by", { length: ID_LENGTH12 }),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  organization_id: varchar("organization_id", {
+    length: ID_LENGTH12
+  }).notNull(),
+  setup_session_id: varchar("setup_session_id", {
+    length: ID_LENGTH12
+  }).primaryKey(),
+  token_hash: varchar("token_hash", { length: ID_LENGTH12 }).notNull().unique()
+});
+var toSession = (row) => ({
+  capabilities: row.capabilities,
+  createdAt: row.created_at_ms,
+  createdBy: row.created_by ?? undefined,
+  expiresAt: row.expires_at_ms,
+  organizationId: row.organization_id,
+  setupSessionId: row.setup_session_id,
+  tokenHash: row.token_hash
+});
+var createNeonSetupSessionStore = (databaseUrl) => createPostgresSetupSessionStore(createNeonDatabase(databaseUrl));
+var createPostgresSetupSessionStore = (db) => ({
+  deleteSetupSession: async (setupSessionId) => {
+    await db.delete(setupSessionsTable).where(eq(setupSessionsTable.setup_session_id, setupSessionId));
+  },
+  getSetupSessionByTokenHash: async (tokenHash) => {
+    const [row] = await db.select().from(setupSessionsTable).where(eq(setupSessionsTable.token_hash, tokenHash)).limit(1);
+    return row ? toSession(row) : undefined;
+  },
+  saveSetupSession: async (session) => {
+    const values = {
+      capabilities: session.capabilities,
+      created_at_ms: session.createdAt,
+      created_by: session.createdBy ?? null,
+      expires_at_ms: session.expiresAt,
+      organization_id: session.organizationId,
+      setup_session_id: session.setupSessionId,
+      token_hash: session.tokenHash
+    };
+    await db.insert(setupSessionsTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: setupSessionsTable.setup_session_id
+    });
+  }
+});
+
+// src/roles/postgresRoleStore.ts
+var ID_LENGTH13 = 255;
+var SLUG_LENGTH = 128;
+var GLOBAL_SCOPE = "";
+var rolesTable = pgTable("auth_roles", {
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  organization_id: varchar("organization_id", { length: ID_LENGTH13 }).notNull().default(GLOBAL_SCOPE),
+  permissions: jsonb("permissions").$type().notNull().default([]),
+  slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
+}, (table) => [primaryKey({ columns: [table.organization_id, table.slug] })]);
+var toRole = (row) => ({
+  createdAt: row.created_at_ms,
+  organizationId: row.organization_id === GLOBAL_SCOPE ? undefined : row.organization_id,
+  permissions: row.permissions,
+  slug: row.slug,
+  updatedAt: row.updated_at_ms
+});
+var createNeonRoleStore = (databaseUrl) => createPostgresRoleStore(createNeonDatabase(databaseUrl));
+var createPostgresRoleStore = (db) => ({
+  deleteRole: async (slug, organizationId) => {
+    await db.delete(rolesTable).where(and(eq(rolesTable.organization_id, organizationId ?? GLOBAL_SCOPE), eq(rolesTable.slug, slug)));
+  },
+  getRole: async (slug, organizationId) => {
+    const [row] = await db.select().from(rolesTable).where(and(eq(rolesTable.organization_id, organizationId ?? GLOBAL_SCOPE), eq(rolesTable.slug, slug))).limit(1);
+    return row ? toRole(row) : undefined;
+  },
+  listRoles: async (organizationId) => {
+    const rows = await db.select().from(rolesTable).where(eq(rolesTable.organization_id, organizationId ?? GLOBAL_SCOPE));
+    return rows.map(toRole);
+  },
+  saveRole: async (role) => {
+    const values = {
+      created_at_ms: role.createdAt,
+      organization_id: role.organizationId ?? GLOBAL_SCOPE,
+      permissions: role.permissions,
+      slug: role.slug,
+      updated_at_ms: role.updatedAt
+    };
+    await db.insert(rolesTable).values(values).onConflictDoUpdate({
+      set: values,
+      target: [rolesTable.organization_id, rolesTable.slug]
+    });
+  }
+});
+
+// src/sso/postgresSamlServiceProviderStore.ts
+var ID_LENGTH14 = 255;
+var URL_LENGTH2 = 2048;
+var samlServiceProvidersTable = pgTable("auth_saml_service_providers", {
+  acs_url: varchar("acs_url", { length: URL_LENGTH2 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  entity_id: varchar("entity_id", { length: URL_LENGTH2 }).primaryKey(),
+  name_id_format: varchar("name_id_format", { length: ID_LENGTH14 }),
+  signing_cert: text("signing_cert"),
+  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
+});
+var toServiceProvider = (row) => ({
+  acsUrl: row.acs_url,
+  createdAt: row.created_at_ms,
+  entityId: row.entity_id,
+  nameIdFormat: row.name_id_format ?? undefined,
+  signingCert: row.signing_cert ?? undefined,
+  updatedAt: row.updated_at_ms
+});
+var toValues2 = (serviceProvider) => ({
+  acs_url: serviceProvider.acsUrl,
+  created_at_ms: serviceProvider.createdAt,
+  entity_id: serviceProvider.entityId,
+  name_id_format: serviceProvider.nameIdFormat ?? null,
+  signing_cert: serviceProvider.signingCert ?? null,
+  updated_at_ms: serviceProvider.updatedAt
+});
+var createNeonSamlServiceProviderStore = (databaseUrl) => createPostgresSamlServiceProviderStore(createNeonDatabase(databaseUrl));
+var createPostgresSamlServiceProviderStore = (db) => ({
+  deleteServiceProvider: async (entityId) => {
+    await db.delete(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId));
+  },
+  findServiceProvider: async (entityId) => {
+    const [row] = await db.select().from(samlServiceProvidersTable).where(eq(samlServiceProvidersTable.entity_id, entityId)).limit(1);
+    return row === undefined ? undefined : toServiceProvider(row);
+  },
+  listServiceProviders: async () => {
+    const rows = await db.select().from(samlServiceProvidersTable);
+    return rows.map(toServiceProvider);
+  },
+  saveServiceProvider: async (serviceProvider) => {
+    await db.insert(samlServiceProvidersTable).values(toValues2(serviceProvider)).onConflictDoUpdate({
+      set: toValues2(serviceProvider),
+      target: samlServiceProvidersTable.entity_id
+    });
+  }
+});
+
+// src/sso/postgresSsoConnectionStore.ts
+var ID_LENGTH15 = 255;
 var TYPE_LENGTH2 = 16;
 var ssoConnectionsTable = pgTable("auth_sso_connections", {
   config: jsonb("config").$type().notNull(),
-  connection_id: varchar("connection_id", { length: ID_LENGTH11 }).primaryKey(),
+  connection_id: varchar("connection_id", { length: ID_LENGTH15 }).primaryKey(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
   enabled: boolean("enabled").notNull().default(true),
   organization_id: varchar("organization_id", {
-    length: ID_LENGTH11
+    length: ID_LENGTH15
   }).notNull(),
   type: varchar("type", { length: TYPE_LENGTH2 }).$type().notNull(),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
@@ -22841,40 +23085,20 @@ var createPostgresSsoConnectionStore = (db) => ({
     });
   }
 });
-// src/webauthn/inMemoryWebAuthnCredentialStore.ts
-var cloneCredential2 = (value) => ({
-  ...value,
-  transports: value.transports ? [...value.transports] : undefined
-});
-var createInMemoryWebAuthnCredentialStore = () => {
-  const credentials = new Map;
-  return {
-    getCredential: async (credentialId) => {
-      const credential = credentials.get(credentialId);
-      return credential ? cloneCredential2(credential) : undefined;
-    },
-    listCredentialsByUser: async (userId) => [...credentials.values()].filter((credential) => credential.userId === userId).map(cloneCredential2),
-    removeCredential: async (credentialId) => {
-      credentials.delete(credentialId);
-    },
-    saveCredential: async (credential) => {
-      credentials.set(credential.credentialId, cloneCredential2(credential));
-    }
-  };
-};
+
 // src/webauthn/postgresWebAuthnCredentialStore.ts
-var ID_LENGTH12 = 255;
+var ID_LENGTH16 = 255;
 var DEVICE_TYPE_LENGTH = 32;
 var webauthnCredentialsTable = pgTable("auth_webauthn_credentials", {
   backed_up: boolean("backed_up"),
   counter: bigint("counter", { mode: "number" }).notNull().default(0),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  credential_id: varchar("credential_id", { length: ID_LENGTH12 }).primaryKey(),
+  credential_id: varchar("credential_id", { length: ID_LENGTH16 }).primaryKey(),
   device_type: varchar("device_type", { length: DEVICE_TYPE_LENGTH }),
   last_used_at_ms: bigint("last_used_at_ms", { mode: "number" }),
   public_key: text("public_key").notNull(),
   transports: jsonb("transports").$type(),
-  user_id: varchar("user_id", { length: ID_LENGTH12 }).notNull()
+  user_id: varchar("user_id", { length: ID_LENGTH16 }).notNull()
 });
 var toCredential = (row) => ({
   backedUp: row.backed_up ?? undefined,
@@ -22919,204 +23143,514 @@ var createPostgresWebAuthnCredentialStore = (db) => ({
     });
   }
 });
-// src/organizations/inMemoryOrganizationStore.ts
-var membershipKey = (organizationId, userId) => `${organizationId}\x00${userId}`;
-var cloneMembership = (value) => ({ ...value, roles: [...value.roles] });
-var cloneInvitation = (value) => ({ ...value, roles: [...value.roles] });
-var createInMemoryOrganizationStore = () => {
-  const organizations = new Map;
-  const memberships = new Map;
-  const invitations = new Map;
-  return {
-    deleteOrganization: async (organizationId) => {
-      organizations.delete(organizationId);
-    },
-    getInvitation: async (invitationId) => {
-      const invitation = invitations.get(invitationId);
-      return invitation ? cloneInvitation(invitation) : undefined;
-    },
-    getInvitationByTokenHash: async (tokenHash) => {
-      const invitation = [...invitations.values()].find((entry) => entry.tokenHash === tokenHash);
-      return invitation ? cloneInvitation(invitation) : undefined;
-    },
-    getMembership: async (organizationId, userId) => {
-      const membership = memberships.get(membershipKey(organizationId, userId));
-      return membership ? cloneMembership(membership) : undefined;
-    },
-    getOrganization: async (organizationId) => {
-      const organization = organizations.get(organizationId);
-      return organization ? { ...organization } : undefined;
-    },
-    listInvitationsByOrganization: async (organizationId) => [...invitations.values()].filter((entry) => entry.organizationId === organizationId).map(cloneInvitation),
-    listMembershipsByOrganization: async (organizationId) => [...memberships.values()].filter((entry) => entry.organizationId === organizationId).map(cloneMembership),
-    listMembershipsByUser: async (userId) => [...memberships.values()].filter((entry) => entry.userId === userId).map(cloneMembership),
-    removeMembership: async (organizationId, userId) => {
-      memberships.delete(membershipKey(organizationId, userId));
-    },
-    saveInvitation: async (invitation) => {
-      invitations.set(invitation.invitationId, cloneInvitation(invitation));
-    },
-    saveMembership: async (membership) => {
-      memberships.set(membershipKey(membership.organizationId, membership.userId), cloneMembership(membership));
-    },
-    saveOrganization: async (organization) => {
-      organizations.set(organization.organizationId, {
-        ...organization
-      });
-    }
-  };
-};
-// src/organizations/postgresOrganizationStore.ts
-var ID_LENGTH13 = 255;
-var NAME_LENGTH = 255;
-var STATE_LENGTH = 16;
-var organizationInvitationsTable = pgTable("auth_organization_invitations", {
-  accepted_at_ms: bigint("accepted_at_ms", { mode: "number" }),
+
+// src/webhooks/postgresStore.ts
+var ID_LENGTH17 = 255;
+var URL_LENGTH3 = 2048;
+var DEFAULT_LIST_LIMIT3 = 100;
+var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
+  attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  email: varchar("email", { length: ID_LENGTH13 }).notNull(),
-  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  invitation_id: varchar("invitation_id", {
-    length: ID_LENGTH13
-  }).primaryKey(),
-  inviter_user_id: varchar("inviter_user_id", { length: ID_LENGTH13 }),
-  organization_id: varchar("organization_id", {
-    length: ID_LENGTH13
-  }).notNull(),
-  roles: jsonb("roles").$type().notNull().default([]),
-  state: varchar("state", { length: STATE_LENGTH }).$type().notNull().default("pending"),
-  token_hash: varchar("token_hash", { length: ID_LENGTH13 }).notNull().unique()
-});
-var organizationMembershipsTable = pgTable("auth_organization_memberships", {
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", {
-    length: ID_LENGTH13
-  }).notNull(),
-  roles: jsonb("roles").$type().notNull().default([]),
-  status: varchar("status", { length: STATE_LENGTH }).$type().notNull().default("active"),
-  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
-  user_id: varchar("user_id", { length: ID_LENGTH13 }).notNull()
-}, (table) => [primaryKey({ columns: [table.organization_id, table.user_id] })]);
-var organizationsTable = pgTable("auth_organizations", {
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  metadata: jsonb("metadata").$type(),
-  name: varchar("name", { length: NAME_LENGTH }).notNull(),
-  organization_id: varchar("organization_id", {
-    length: ID_LENGTH13
-  }).primaryKey(),
-  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
-});
-var toOrganization = (row) => ({
-  createdAt: row.created_at_ms,
-  metadata: row.metadata ?? undefined,
-  name: row.name,
-  organizationId: row.organization_id,
-  updatedAt: row.updated_at_ms
-});
-var toMembership = (row) => ({
-  createdAt: row.created_at_ms,
-  organizationId: row.organization_id,
-  roles: row.roles,
-  status: row.status,
-  updatedAt: row.updated_at_ms,
-  userId: row.user_id
+  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
+  envelope_id: varchar("envelope_id", { length: ID_LENGTH17 }).primaryKey(),
+  envelope_json: jsonb("envelope_json").$type().notNull(),
+  last_error: text("last_error"),
+  last_status: bigint("last_status", { mode: "number" })
 });
-var toInvitation = (row) => ({
-  acceptedAt: row.accepted_at_ms ?? undefined,
+var toDelivery = (row) => ({
+  attempts: row.attempts,
   createdAt: row.created_at_ms,
-  email: row.email,
-  expiresAt: row.expires_at_ms,
-  invitationId: row.invitation_id,
-  inviterUserId: row.inviter_user_id ?? undefined,
-  organizationId: row.organization_id,
-  roles: row.roles,
-  state: row.state,
-  tokenHash: row.token_hash
+  endpointUrl: row.endpoint_url,
+  envelope: row.envelope_json,
+  lastError: row.last_error ?? undefined,
+  lastStatus: row.last_status ?? undefined
 });
-var createNeonOrganizationStore = (databaseUrl) => createPostgresOrganizationStore(createNeonDatabase(databaseUrl));
-var createPostgresOrganizationStore = (db) => ({
-  deleteOrganization: async (organizationId) => {
-    await db.delete(organizationsTable).where(eq(organizationsTable.organization_id, organizationId));
-  },
-  getInvitation: async (invitationId) => {
-    const [row] = await db.select().from(organizationInvitationsTable).where(eq(organizationInvitationsTable.invitation_id, invitationId)).limit(1);
-    return row ? toInvitation(row) : undefined;
-  },
-  getInvitationByTokenHash: async (tokenHash) => {
-    const [row] = await db.select().from(organizationInvitationsTable).where(eq(organizationInvitationsTable.token_hash, tokenHash)).limit(1);
-    return row ? toInvitation(row) : undefined;
-  },
-  getMembership: async (organizationId, userId) => {
-    const [row] = await db.select().from(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationId), eq(organizationMembershipsTable.user_id, userId))).limit(1);
-    return row ? toMembership(row) : undefined;
-  },
-  getOrganization: async (organizationId) => {
-    const [row] = await db.select().from(organizationsTable).where(eq(organizationsTable.organization_id, organizationId)).limit(1);
-    return row ? toOrganization(row) : undefined;
-  },
-  listInvitationsByOrganization: async (organizationId) => {
-    const rows = await db.select().from(organizationInvitationsTable).where(eq(organizationInvitationsTable.organization_id, organizationId));
-    return rows.map(toInvitation);
-  },
-  listMembershipsByOrganization: async (organizationId) => {
-    const rows = await db.select().from(organizationMembershipsTable).where(eq(organizationMembershipsTable.organization_id, organizationId));
-    return rows.map(toMembership);
-  },
-  listMembershipsByUser: async (userId) => {
-    const rows = await db.select().from(organizationMembershipsTable).where(eq(organizationMembershipsTable.user_id, userId));
-    return rows.map(toMembership);
-  },
-  removeMembership: async (organizationId, userId) => {
-    await db.delete(organizationMembershipsTable).where(and(eq(organizationMembershipsTable.organization_id, organizationId), eq(organizationMembershipsTable.user_id, userId)));
+var createNeonWebhookDeliveryStore = (databaseUrl) => createPostgresWebhookDeliveryStore(createNeonDatabase(databaseUrl));
+var createPostgresWebhookDeliveryStore = (db) => ({
+  listFailed: async (limit = DEFAULT_LIST_LIMIT3) => {
+    const rows = await db.select().from(webhookDeliveriesTable).orderBy(desc(webhookDeliveriesTable.created_at_ms)).limit(limit);
+    return rows.map(toDelivery);
   },
-  saveInvitation: async (invitation) => {
-    const values = {
-      accepted_at_ms: invitation.acceptedAt ?? null,
-      created_at_ms: invitation.createdAt,
-      email: invitation.email,
-      expires_at_ms: invitation.expiresAt,
-      invitation_id: invitation.invitationId,
-      inviter_user_id: invitation.inviterUserId ?? null,
-      organization_id: invitation.organizationId,
-      roles: invitation.roles,
-      state: invitation.state,
-      token_hash: invitation.tokenHash
-    };
-    await db.insert(organizationInvitationsTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: organizationInvitationsTable.invitation_id
+  recordFailure: async (delivery) => {
+    await db.insert(webhookDeliveriesTable).values({
+      attempts: delivery.attempts,
+      created_at_ms: delivery.createdAt,
+      endpoint_url: delivery.endpointUrl,
+      envelope_id: delivery.envelope.id,
+      envelope_json: delivery.envelope,
+      last_error: delivery.lastError ?? null,
+      last_status: delivery.lastStatus ?? null
     });
   },
-  saveMembership: async (membership) => {
-    const values = {
-      created_at_ms: membership.createdAt,
-      organization_id: membership.organizationId,
-      roles: membership.roles,
-      status: membership.status,
-      updated_at_ms: membership.updatedAt,
-      user_id: membership.userId
-    };
-    await db.insert(organizationMembershipsTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: [
-        organizationMembershipsTable.organization_id,
-        organizationMembershipsTable.user_id
-      ]
+  removeFailure: async (envelopeId) => {
+    await db.delete(webhookDeliveriesTable).where(eq(webhookDeliveriesTable.envelope_id, envelopeId));
+  }
+});
+
+// src/migrations/generate.ts
+var renderChunk = (chunk) => {
+  if (chunk === null || typeof chunk !== "object")
+    return String(chunk);
+  const value = Reflect.get(chunk, "value");
+  if (Array.isArray(value))
+    return value.map((part) => String(part)).join("");
+  return "";
+};
+var formatSqlTemplate = (value) => value.queryChunks.map(renderChunk).join("");
+var formatDefault = (value) => {
+  if (value === null || value === undefined)
+    return "NULL";
+  if (is(value, SQL))
+    return formatSqlTemplate(value);
+  if (typeof value === "string")
+    return `'${value.replace(/'/gu, "''")}'`;
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number")
+    return String(value);
+  if (Array.isArray(value) || typeof value === "object") {
+    return `'${JSON.stringify(value)}'::jsonb`;
+  }
+  return String(value);
+};
+var columnSql = (column) => {
+  const parts = [`"${column.name}"`, column.getSQLType()];
+  if (column.primary)
+    parts.push("PRIMARY KEY");
+  if (column.notNull && !column.primary)
+    parts.push("NOT NULL");
+  if (column.hasDefault && column.default !== undefined) {
+    parts.push(`DEFAULT ${formatDefault(column.default)}`);
+  }
+  if (column.isUnique)
+    parts.push("UNIQUE");
+  return parts.join(" ");
+};
+var compositePkLine = (compositePk) => `PRIMARY KEY (${compositePk.map((column) => `"${column.name}"`).join(", ")})`;
+var tableToCreateSql = (table) => {
+  const cfg = getTableConfig(table);
+  const columnLines = cfg.columns.map(columnSql);
+  const singlePk = cfg.columns.find((column) => column.primary);
+  const compositePk = cfg.primaryKeys[0]?.columns ?? [];
+  const lines = singlePk === undefined && compositePk.length > 0 ? [...columnLines, compositePkLine(compositePk)] : columnLines;
+  const body = lines.map((line2) => `	${line2}`).join(`,
+`);
+  return `CREATE TABLE IF NOT EXISTS "${cfg.name}" (
+${body}
+);`;
+};
+var tablesToInitSql = (tables) => tables.map(tableToCreateSql).join(`
+
+`);
+
+// src/migrations/runner.ts
+var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
+	"id" text PRIMARY KEY,
+	"applied_at_ms" bigint NOT NULL
+);`;
+var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
+var allBlockNames = () => Object.keys(blockMigrations);
+var applyOne = async (pool, id, sql2, log) => {
+  await pool.query(sql2);
+  await pool.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
+  log(`apply  ${id}`);
+};
+var runOne = async (pool, id, sql2, applied, result, log) => {
+  if (applied.has(id)) {
+    result.skipped.push(id);
+    log(`skip   ${id}`);
+    return;
+  }
+  await applyOne(pool, id, sql2, log);
+  result.applied.push(id);
+};
+var runMigrations = async ({
+  blocks,
+  databaseUrl,
+  log = console.log
+}) => {
+  const pool = new Ln({ connectionString: databaseUrl });
+  const result = { applied: [], skipped: [] };
+  try {
+    await pool.query(JOURNAL_DDL);
+    const journal = await pool.query(`SELECT "id" FROM "auth_migrations"`);
+    const applied = new Set(journal.rows.filter(isJournalRow).map((row) => row.id));
+    const selected = blocks ?? allBlockNames();
+    const flat = selected.flatMap((block) => blockMigrations[block].migrations.map((migration) => ({
+      id: `${block}/${migration.id}`,
+      sql: migration.sql
+    })));
+    await flat.reduce(async (prior, item) => {
+      await prior;
+      return runOne(pool, item.id, item.sql, applied, result, log);
+    }, Promise.resolve());
+  } finally {
+    await pool.end();
+  }
+  return result;
+};
+
+// src/migrations/index.ts
+var initMigration = (block, tables) => ({
+  block,
+  migrations: [{ id: "0001_init", sql: tablesToInitSql(tables) }]
+});
+var blockMigrations = {
+  adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
+  apikeys: initMigration("apikeys", [
+    accessTokensTable,
+    apiClientsTable,
+    apiKeysTable
+  ]),
+  audit: initMigration("audit", [auditEventsTable]),
+  credentials: initMigration("credentials", [
+    credentialsTable,
+    credentialResetTokensTable,
+    credentialVerificationTokensTable
+  ]),
+  fga: initMigration("fga", [warrantsTable]),
+  linkedProviders: initMigration("linkedProviders", [
+    linkedProviderBindingsTable,
+    linkedProviderGrantsTable
+  ]),
+  lockout: initMigration("lockout", [lockoutsTable]),
+  mfa: initMigration("mfa", [mfaEnrollmentsTable]),
+  oidc: initMigration("oidc", [
+    oauthClientAssertionJtisTable,
+    oauthClientRegistrationTokensTable,
+    oauthClientsTable,
+    oauthCodesTable,
+    oauthDeviceAuthorizationsTable,
+    oauthInitialAccessTokensTable,
+    oauthLogoutDeliveriesTable,
+    oauthPushedAuthorizationRequestsTable,
+    oauthRefreshTokensTable
+  ]),
+  organizations: initMigration("organizations", [
+    organizationsTable,
+    organizationMembershipsTable,
+    organizationInvitationsTable
+  ]),
+  passwordless: initMigration("passwordless", [passwordlessTokensTable]),
+  portal: initMigration("portal", [setupSessionsTable]),
+  roles: initMigration("roles", [rolesTable]),
+  scim: initMigration("scim", [scimTokensTable]),
+  sessions: initMigration("sessions", [
+    authSessionsTable,
+    authUnregisteredSessionsTable
+  ]),
+  sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
+  vault: initMigration("vault", [vaultEntriesTable]),
+  webauthn: initMigration("webauthn", [webauthnCredentialsTable]),
+  webhooks: initMigration("webhooks", [webhookDeliveriesTable])
+};
+// src/sso/samlIdpRoutes.ts
+import { Elysia as Elysia35, t as t31 } from "elysia";
+var HTTP_BAD_REQUEST3 = 400;
+var HTTP_UNAUTHORIZED3 = 401;
+var HTTP_FOUND2 = 302;
+var HTTP_OK3 = 200;
+var xmlResponse = (body) => new Response(body, {
+  headers: { "content-type": "application/samlmetadata+xml" },
+  status: HTTP_OK3
+});
+var htmlResponse = (body) => new Response(body, {
+  headers: { "content-type": "text/html; charset=utf-8" },
+  status: HTTP_OK3
+});
+var redirectTo2 = (url) => new Response(null, { headers: { location: url }, status: HTTP_FOUND2 });
+var errorJson = (status, error) => new Response(JSON.stringify({ error }), {
+  headers: { "content-type": "application/json" },
+  status
+});
+var samlIdpRoutes = ({
+  authSessionStore,
+  getNameId,
+  getSamlAttributes,
+  idpAdapter,
+  idpEntityId,
+  loginUrl,
+  samlServiceProviderStore,
+  ssoRoute = DEFAULT_SSO_ROUTE
+}) => {
+  const ssoIdpRoute = `${ssoRoute}/saml/idp/sso`;
+  const idpInitiateRoute = `${ssoRoute}/saml/idp/sso/initiate`;
+  const idpMetadataRoute = `${ssoRoute}/saml/idp/metadata`;
+  const ssoUrlFor = (requestUrl) => `${new URL(requestUrl).origin}${ssoIdpRoute}`;
+  const renderResponse = async ({
+    acsUrl,
+    inResponseTo,
+    relayState,
+    serviceProviderEntityId,
+    user
+  }) => {
+    const samlResponse = await idpAdapter.createSamlResponse({
+      acsUrl,
+      attributes: getSamlAttributes?.(user),
+      audience: serviceProviderEntityId,
+      idpEntityId,
+      inResponseTo,
+      nameId: getNameId(user),
+      sessionIndex: crypto.randomUUID()
     });
-  },
-  saveOrganization: async (organization) => {
-    const values = {
-      created_at_ms: organization.createdAt,
-      metadata: organization.metadata ?? null,
-      name: organization.name,
-      organization_id: organization.organizationId,
-      updated_at_ms: organization.updatedAt
-    };
-    await db.insert(organizationsTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: organizationsTable.organization_id
+    const html2 = idpAdapter.buildAutoPostForm({
+      acsUrl,
+      relayState,
+      samlResponse
     });
-  }
+    return htmlResponse(html2);
+  };
+  const handleSpInitiated = async ({
+    binding,
+    body,
+    inMemorySession,
+    request,
+    userSessionIdValue
+  }) => {
+    if (body.SAMLRequest === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "missing_saml_request");
+    }
+    let firstPass;
+    try {
+      firstPass = await idpAdapter.parseAuthnRequest({
+        binding,
+        samlRequest: body.SAMLRequest
+      });
+    } catch {
+      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+    }
+    const serviceProvider = await samlServiceProviderStore.findServiceProvider(firstPass.issuer);
+    if (serviceProvider === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+    }
+    let parsed;
+    try {
+      parsed = await idpAdapter.parseAuthnRequest({
+        binding,
+        samlRequest: body.SAMLRequest,
+        serviceProvider,
+        signature: body.Signature,
+        signatureAlgorithm: body.SigAlg,
+        signedQueryString: binding === "Redirect" ? new URL(request.url).search.slice(1) : undefined
+      });
+    } catch {
+      return errorJson(HTTP_BAD_REQUEST3, "invalid_authn_request");
+    }
+    const userSession = await loadSessionFromSource({
+      authSessionStore,
+      session: inMemorySession,
+      userSessionId: userSessionIdValue
+    });
+    if (userSession === undefined || parsed.forceAuthn === true) {
+      if (loginUrl === undefined) {
+        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+      }
+      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+    }
+    return renderResponse({
+      acsUrl: parsed.acsUrl ?? serviceProvider.acsUrl,
+      inResponseTo: parsed.id,
+      relayState: parsed.relayState ?? body.RelayState,
+      serviceProviderEntityId: serviceProvider.entityId,
+      user: userSession.user
+    });
+  };
+  return new Elysia35().use(sessionStore()).post(ssoIdpRoute, async ({
+    body,
+    cookie: { user_session_id },
+    request,
+    store
+  }) => handleSpInitiated({
+    binding: "POST",
+    body,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  }), {
+    body: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String())
+    }),
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    })
+  }).get(ssoIdpRoute, async ({
+    cookie: { user_session_id },
+    query,
+    request,
+    store
+  }) => handleSpInitiated({
+    binding: "Redirect",
+    body: query,
+    inMemorySession: store.session,
+    request,
+    userSessionIdValue: user_session_id.value
+  }), {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      SAMLRequest: t31.Optional(t31.String()),
+      SigAlg: t31.Optional(t31.String()),
+      Signature: t31.Optional(t31.String())
+    })
+  }).get(idpInitiateRoute, async ({
+    cookie: { user_session_id },
+    query: { sp: serviceProviderEntityId, RelayState: relayState },
+    request,
+    store
+  }) => {
+    if (serviceProviderEntityId === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "missing_sp");
+    }
+    const serviceProvider = await samlServiceProviderStore.findServiceProvider(serviceProviderEntityId);
+    if (serviceProvider === undefined) {
+      return errorJson(HTTP_BAD_REQUEST3, "unknown_service_provider");
+    }
+    const userSession = authSessionStore === undefined ? await loadSessionFromSource({
+      session: store.session,
+      userSessionId: user_session_id.value
+    }) : await loadSessionFromSource({
+      authSessionStore,
+      session: store.session,
+      userSessionId: user_session_id.value
+    });
+    if (userSession === undefined) {
+      if (loginUrl === undefined) {
+        return errorJson(HTTP_UNAUTHORIZED3, "login_required");
+      }
+      return redirectTo2(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
+    }
+    return renderResponse({
+      acsUrl: serviceProvider.acsUrl,
+      relayState,
+      serviceProviderEntityId: serviceProvider.entityId,
+      user: userSession.user
+    });
+  }, {
+    cookie: t31.Cookie({
+      user_session_id: t31.Optional(userSessionIdTypebox)
+    }),
+    query: t31.Object({
+      RelayState: t31.Optional(t31.String()),
+      sp: t31.Optional(t31.String())
+    })
+  }).get(idpMetadataRoute, async ({ request }) => xmlResponse(await idpAdapter.getIdpMetadata({
+    entityId: idpEntityId,
+    ssoUrl: ssoUrlFor(request.url)
+  })));
+};
+// src/sso/inMemorySamlServiceProviderStore.ts
+var createInMemorySamlServiceProviderStore = () => {
+  const providers2 = new Map;
+  return {
+    deleteServiceProvider: async (entityId) => {
+      providers2.delete(entityId);
+    },
+    findServiceProvider: async (entityId) => {
+      const found = providers2.get(entityId);
+      return found ? { ...found } : undefined;
+    },
+    listServiceProviders: async () => Array.from(providers2.values()).map((serviceProvider) => ({ ...serviceProvider })),
+    saveServiceProvider: async (serviceProvider) => {
+      providers2.set(serviceProvider.entityId, { ...serviceProvider });
+    }
+  };
+};
+// src/sso/inMemorySsoConnectionStore.ts
+var cloneConnection = (value) => value.type === "oidc" ? {
+  ...value,
+  config: { ...value.config, scopes: [...value.config.scopes] }
+} : { ...value, config: { ...value.config } };
+var createInMemorySsoConnectionStore = () => {
+  const connections = new Map;
+  return {
+    deleteConnection: async (connectionId) => {
+      connections.delete(connectionId);
+    },
+    getConnection: async (connectionId) => {
+      const connection = connections.get(connectionId);
+      return connection ? cloneConnection(connection) : undefined;
+    },
+    getConnectionByOrganization: async (organizationId, type) => {
+      const match = Array.from(connections.values()).find((connection) => connection.organizationId === organizationId && connection.enabled && (type === undefined || connection.type === type));
+      return match ? cloneConnection(match) : undefined;
+    },
+    listConnectionsByOrganization: async (organizationId) => Array.from(connections.values()).filter((connection) => connection.organizationId === organizationId).sort((left, right) => right.updatedAt - left.updatedAt).map(cloneConnection),
+    saveConnection: async (connection) => {
+      connections.set(connection.connectionId, cloneConnection(connection));
+    }
+  };
+};
+// src/webauthn/inMemoryWebAuthnCredentialStore.ts
+var cloneCredential2 = (value) => ({
+  ...value,
+  transports: value.transports ? [...value.transports] : undefined
 });
+var createInMemoryWebAuthnCredentialStore = () => {
+  const credentials = new Map;
+  return {
+    getCredential: async (credentialId) => {
+      const credential = credentials.get(credentialId);
+      return credential ? cloneCredential2(credential) : undefined;
+    },
+    listCredentialsByUser: async (userId) => [...credentials.values()].filter((credential) => credential.userId === userId).map(cloneCredential2),
+    removeCredential: async (credentialId) => {
+      credentials.delete(credentialId);
+    },
+    saveCredential: async (credential) => {
+      credentials.set(credential.credentialId, cloneCredential2(credential));
+    }
+  };
+};
+// src/organizations/inMemoryOrganizationStore.ts
+var membershipKey = (organizationId, userId) => `${organizationId}\x00${userId}`;
+var cloneMembership = (value) => ({ ...value, roles: [...value.roles] });
+var cloneInvitation = (value) => ({ ...value, roles: [...value.roles] });
+var createInMemoryOrganizationStore = () => {
+  const organizations = new Map;
+  const memberships = new Map;
+  const invitations = new Map;
+  return {
+    deleteOrganization: async (organizationId) => {
+      organizations.delete(organizationId);
+    },
+    getInvitation: async (invitationId) => {
+      const invitation = invitations.get(invitationId);
+      return invitation ? cloneInvitation(invitation) : undefined;
+    },
+    getInvitationByTokenHash: async (tokenHash) => {
+      const invitation = [...invitations.values()].find((entry) => entry.tokenHash === tokenHash);
+      return invitation ? cloneInvitation(invitation) : undefined;
+    },
+    getMembership: async (organizationId, userId) => {
+      const membership = memberships.get(membershipKey(organizationId, userId));
+      return membership ? cloneMembership(membership) : undefined;
+    },
+    getOrganization: async (organizationId) => {
+      const organization = organizations.get(organizationId);
+      return organization ? { ...organization } : undefined;
+    },
+    listInvitationsByOrganization: async (organizationId) => [...invitations.values()].filter((entry) => entry.organizationId === organizationId).map(cloneInvitation),
+    listMembershipsByOrganization: async (organizationId) => [...memberships.values()].filter((entry) => entry.organizationId === organizationId).map(cloneMembership),
+    listMembershipsByUser: async (userId) => [...memberships.values()].filter((entry) => entry.userId === userId).map(cloneMembership),
+    removeMembership: async (organizationId, userId) => {
+      memberships.delete(membershipKey(organizationId, userId));
+    },
+    saveInvitation: async (invitation) => {
+      invitations.set(invitation.invitationId, cloneInvitation(invitation));
+    },
+    saveMembership: async (membership) => {
+      memberships.set(membershipKey(membership.organizationId, membership.userId), cloneMembership(membership));
+    },
+    saveOrganization: async (organization) => {
+      organizations.set(organization.organizationId, {
+        ...organization
+      });
+    }
+  };
+};
 // src/roles/resolver.ts
 var WILDCARD = "*";
 var createMembershipPermissionResolver = ({
@@ -23174,51 +23708,6 @@ var createInMemoryRoleStore = () => {
     }
   };
 };
-// src/roles/postgresRoleStore.ts
-var ID_LENGTH14 = 255;
-var SLUG_LENGTH = 128;
-var GLOBAL_SCOPE = "";
-var rolesTable = pgTable("auth_roles", {
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", { length: ID_LENGTH14 }).notNull().default(GLOBAL_SCOPE),
-  permissions: jsonb("permissions").$type().notNull().default([]),
-  slug: varchar("slug", { length: SLUG_LENGTH }).notNull(),
-  updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull()
-}, (table) => [primaryKey({ columns: [table.organization_id, table.slug] })]);
-var toRole = (row) => ({
-  createdAt: row.created_at_ms,
-  organizationId: row.organization_id === GLOBAL_SCOPE ? undefined : row.organization_id,
-  permissions: row.permissions,
-  slug: row.slug,
-  updatedAt: row.updated_at_ms
-});
-var createNeonRoleStore = (databaseUrl) => createPostgresRoleStore(createNeonDatabase(databaseUrl));
-var createPostgresRoleStore = (db) => ({
-  deleteRole: async (slug, organizationId) => {
-    await db.delete(rolesTable).where(and(eq(rolesTable.organization_id, organizationId ?? GLOBAL_SCOPE), eq(rolesTable.slug, slug)));
-  },
-  getRole: async (slug, organizationId) => {
-    const [row] = await db.select().from(rolesTable).where(and(eq(rolesTable.organization_id, organizationId ?? GLOBAL_SCOPE), eq(rolesTable.slug, slug))).limit(1);
-    return row ? toRole(row) : undefined;
-  },
-  listRoles: async (organizationId) => {
-    const rows = await db.select().from(rolesTable).where(eq(rolesTable.organization_id, organizationId ?? GLOBAL_SCOPE));
-    return rows.map(toRole);
-  },
-  saveRole: async (role) => {
-    const values = {
-      created_at_ms: role.createdAt,
-      organization_id: role.organizationId ?? GLOBAL_SCOPE,
-      permissions: role.permissions,
-      slug: role.slug,
-      updated_at_ms: role.updatedAt
-    };
-    await db.insert(rolesTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: [rolesTable.organization_id, rolesTable.slug]
-    });
-  }
-});
 // src/passwordless/inMemoryPasswordlessTokenStore.ts
 var createInMemoryPasswordlessTokenStore = () => {
   const tokens = new Map;
@@ -23234,42 +23723,12 @@ var createInMemoryPasswordlessTokenStore = () => {
     }
   };
 };
-// src/passwordless/postgresPasswordlessTokenStore.ts
-var ID_LENGTH15 = 255;
-var passwordlessTokensTable = pgTable("auth_passwordless_tokens", {
-  email: varchar("email", { length: ID_LENGTH15 }).notNull(),
-  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH15 }).primaryKey()
-});
-var toToken3 = (row) => ({
-  email: row.email,
-  expiresAt: row.expires_at_ms,
-  tokenHash: row.token_hash
-});
-var createNeonPasswordlessTokenStore = (databaseUrl) => createPostgresPasswordlessTokenStore(createNeonDatabase(databaseUrl));
-var createPostgresPasswordlessTokenStore = (db) => ({
-  consumeToken: async (tokenHash) => {
-    const [row] = await db.delete(passwordlessTokensTable).where(eq(passwordlessTokensTable.token_hash, tokenHash)).returning();
-    return row ? toToken3(row) : undefined;
-  },
-  saveToken: async (token) => {
-    const values = {
-      email: token.email,
-      expires_at_ms: token.expiresAt,
-      token_hash: token.tokenHash
-    };
-    await db.insert(passwordlessTokensTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: passwordlessTokensTable.token_hash
-    });
-  }
-});
 // src/webhooks/inMemoryStore.ts
-var DEFAULT_LIST_LIMIT3 = 100;
+var DEFAULT_LIST_LIMIT4 = 100;
 var createInMemoryWebhookDeliveryStore = () => {
   const failures = new Map;
   return {
-    listFailed: async (limit = DEFAULT_LIST_LIMIT3) => Array.from(failures.values()).sort((left, right) => right.createdAt - left.createdAt).slice(0, limit),
+    listFailed: async (limit = DEFAULT_LIST_LIMIT4) => Array.from(failures.values()).sort((left, right) => right.createdAt - left.createdAt).slice(0, limit),
     recordFailure: async (delivery) => {
       failures.set(delivery.envelope.id, delivery);
     },
@@ -23278,48 +23737,6 @@ var createInMemoryWebhookDeliveryStore = () => {
     }
   };
 };
-// src/webhooks/postgresStore.ts
-var ID_LENGTH16 = 255;
-var URL_LENGTH3 = 2048;
-var DEFAULT_LIST_LIMIT4 = 100;
-var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
-  attempts: bigint("attempts", { mode: "number" }).notNull(),
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH3 }).notNull(),
-  envelope_id: varchar("envelope_id", { length: ID_LENGTH16 }).primaryKey(),
-  envelope_json: jsonb("envelope_json").$type().notNull(),
-  last_error: text("last_error"),
-  last_status: bigint("last_status", { mode: "number" })
-});
-var toDelivery = (row) => ({
-  attempts: row.attempts,
-  createdAt: row.created_at_ms,
-  endpointUrl: row.endpoint_url,
-  envelope: row.envelope_json,
-  lastError: row.last_error ?? undefined,
-  lastStatus: row.last_status ?? undefined
-});
-var createNeonWebhookDeliveryStore = (databaseUrl) => createPostgresWebhookDeliveryStore(createNeonDatabase(databaseUrl));
-var createPostgresWebhookDeliveryStore = (db) => ({
-  listFailed: async (limit = DEFAULT_LIST_LIMIT4) => {
-    const rows = await db.select().from(webhookDeliveriesTable).orderBy(desc(webhookDeliveriesTable.created_at_ms)).limit(limit);
-    return rows.map(toDelivery);
-  },
-  recordFailure: async (delivery) => {
-    await db.insert(webhookDeliveriesTable).values({
-      attempts: delivery.attempts,
-      created_at_ms: delivery.createdAt,
-      endpoint_url: delivery.endpointUrl,
-      envelope_id: delivery.envelope.id,
-      envelope_json: delivery.envelope,
-      last_error: delivery.lastError ?? null,
-      last_status: delivery.lastStatus ?? null
-    });
-  },
-  removeFailure: async (envelopeId) => {
-    await db.delete(webhookDeliveriesTable).where(eq(webhookDeliveriesTable.envelope_id, envelopeId));
-  }
-});
 // src/portal/inMemorySetupSessionStore.ts
 var cloneSession = (value) => ({
   ...value,
@@ -23340,55 +23757,6 @@ var createInMemorySetupSessionStore = () => {
     }
   };
 };
-// src/portal/postgresSetupSessionStore.ts
-var ID_LENGTH17 = 255;
-var setupSessionsTable = pgTable("auth_setup_sessions", {
-  capabilities: jsonb("capabilities").$type().notNull().default([]),
-  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  created_by: varchar("created_by", { length: ID_LENGTH17 }),
-  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  organization_id: varchar("organization_id", {
-    length: ID_LENGTH17
-  }).notNull(),
-  setup_session_id: varchar("setup_session_id", {
-    length: ID_LENGTH17
-  }).primaryKey(),
-  token_hash: varchar("token_hash", { length: ID_LENGTH17 }).notNull().unique()
-});
-var toSession = (row) => ({
-  capabilities: row.capabilities,
-  createdAt: row.created_at_ms,
-  createdBy: row.created_by ?? undefined,
-  expiresAt: row.expires_at_ms,
-  organizationId: row.organization_id,
-  setupSessionId: row.setup_session_id,
-  tokenHash: row.token_hash
-});
-var createNeonSetupSessionStore = (databaseUrl) => createPostgresSetupSessionStore(createNeonDatabase(databaseUrl));
-var createPostgresSetupSessionStore = (db) => ({
-  deleteSetupSession: async (setupSessionId) => {
-    await db.delete(setupSessionsTable).where(eq(setupSessionsTable.setup_session_id, setupSessionId));
-  },
-  getSetupSessionByTokenHash: async (tokenHash) => {
-    const [row] = await db.select().from(setupSessionsTable).where(eq(setupSessionsTable.token_hash, tokenHash)).limit(1);
-    return row ? toSession(row) : undefined;
-  },
-  saveSetupSession: async (session) => {
-    const values = {
-      capabilities: session.capabilities,
-      created_at_ms: session.createdAt,
-      created_by: session.createdBy ?? null,
-      expires_at_ms: session.expiresAt,
-      organization_id: session.organizationId,
-      setup_session_id: session.setupSessionId,
-      token_hash: session.tokenHash
-    };
-    await db.insert(setupSessionsTable).values(values).onConflictDoUpdate({
-      set: values,
-      target: setupSessionsTable.setup_session_id
-    });
-  }
-});
 
 // src/index.ts
 var auth = async ({
@@ -23423,6 +23791,7 @@ var auth = async ({
   webauthn,
   webhooks,
   htmx,
+  tracing,
   resolveAuthIntent,
   onAuthorizeSuccess,
   onAuthorizeError,
@@ -23441,6 +23810,8 @@ var auth = async ({
   onRevocationError,
   onSessionCleanup
 }) => {
+  if (tracing !== undefined)
+    await initTracing(tracing);
   const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client);
   const resolvedCookieSecure = resolveCookieSecure(cookieSecure);
   const webhookDispatch = webhooks ? createWebhookDispatcher(webhooks) : undefined;
@@ -23559,6 +23930,7 @@ var auth = async ({
 };
 export {
   writeWarrant,
+  withSpan,
   webhookDeliveriesTable,
   webauthnRoutes,
   webauthnCredentialsTable,
@@ -23609,6 +23981,7 @@ export {
   samlSsoRoutes,
   samlServiceProvidersTable,
   samlIdpRoutes,
+  runMigrations,
   rotateVaultKey,
   rotateMfaEncryptionKey,
   rolesTable,
@@ -23698,6 +24071,7 @@ export {
   inviteToOrganization,
   introspectToken,
   instantiateUserSession,
+  initTracing,
   importUsers,
   importUser,
   hashToken,
@@ -23875,6 +24249,7 @@ export {
   complianceRoutes,
   check,
   buildClientProviders,
+  blockMigrations,
   base32Encode,
   base32Decode,
   authProviderOption,
@@ -23925,5 +24300,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=0F54EE0288E37B6464756E2164756E21
+//# debugId=E33462A0DBAD894164756E2164756E21
 //# sourceMappingURL=index.js.map