@absolutejs/auth 0.45.7 → 0.45.9

package/dist/index.js

@@ -151,7 +151,7 @@ var init_crypto = __esm(() => {
   textDecoder = new TextDecoder;
 });
 
-// node_modules/citra/dist/index.js
+// ../../home/alexkahn/abs/auth/node_modules/citra/dist/index.js
 var BASE64_BLOCK_SIZE = 4;
 var NUM_GENERATOR_BYTES = 32;
 var anilistProfileQuery = `query {
@@ -3834,9 +3834,7 @@ var credentialsLogin = ({
     });
   }
   if (requireEmailVerification && !credential.emailVerified) {
-    return status("Forbidden", {
-      status: "email_not_verified"
-    });
+    return status("Forbidden", { status: "email_not_verified" });
   }
   if (await isMfaRequired?.(user, mfaContext)) {
     const compatibilityLayer = await createSessionCompatibilityLayer({
@@ -3868,10 +3866,7 @@ var credentialsLogin = ({
     user
   });
   await onCredentialsLoginSuccess?.({ user, userSessionId });
-  return status("OK", {
-    passwordCompromised,
-    status: "authenticated"
-  });
+  return status("OK", { passwordCompromised, status: "authenticated" });
 }), {
   body: t6.Object({ email: t6.String(), password: t6.String() }),
   cookie: t6.Cookie({ user_session_id: userSessionIdTypebox })
@@ -4007,9 +4002,7 @@ var credentialsRegister = ({
     user: created
   });
   if (requireEmailVerification) {
-    return status("Created", {
-      status: "verification_required"
-    });
+    return status("Created", { status: "verification_required" });
   }
   const userSessionId = await promoteToSession({
     authSessionStore,
@@ -4019,10 +4012,7 @@ var credentialsRegister = ({
     sessionDurationMs,
     user: created
   });
-  await onCredentialsLoginSuccess?.({
-    user: created,
-    userSessionId
-  });
+  await onCredentialsLoginSuccess?.({ user: created, userSessionId });
   return status("Created", { status: "authenticated" });
 }), {
   body: t8.Object({ email: t8.String(), password: t8.String() }, { additionalProperties: true }),
@@ -5359,9 +5349,7 @@ var buildIssuerMetadata = ({
       display: configuration.display,
       format: configuration.format,
       order: configuration.order,
-      proof_types_supported: {
-        jwt: { proof_signing_alg_values_supported: ["ES256"] }
-      },
+      proof_types_supported: { jwt: { proof_signing_alg_values_supported: ["ES256"] } },
       vct: configuration.vct
     }
   ])),
@@ -5654,12 +5642,7 @@ var deliverLogoutToOne = async ({
   userId
 }) => {
   try {
-    await postLogoutToken({
-      endpointUrl,
-      fetchImpl,
-      logoutToken,
-      timeoutMs
-    });
+    await postLogoutToken({ endpointUrl, fetchImpl, logoutToken, timeoutMs });
   } catch (error) {
     const delivery = {
       attempts: 1,
@@ -5988,9 +5971,7 @@ var registerClient = async ({
       status: 400
     };
   }
-  const decision = await onClientRegistration?.({
-    metadata
-  }) ?? { allow: true };
+  const decision = await onClientRegistration?.({ metadata }) ?? { allow: true };
   if (!decision.allow) {
     return {
       body: {
@@ -6036,9 +6017,7 @@ var updateRegisteredClient = async ({
   });
   if (!authed)
     return { body: { error: "invalid_token" }, status: 401 };
-  const decision = await onClientRegistration?.({
-    metadata
-  }) ?? { allow: true };
+  const decision = await onClientRegistration?.({ metadata }) ?? { allow: true };
   if (!decision.allow) {
     return {
       body: {
@@ -6503,12 +6482,7 @@ var oidcProviderRoutes = (config) => {
       url.searchParams.set("state", query.state);
     return redirectTo(url.toString());
   };
-  return new Elysia15().use(sessionStore()).get(authorizeRoute, async ({
-    cookie: { user_session_id },
-    query,
-    request,
-    store
-  }) => {
+  return new Elysia15().use(sessionStore()).get(authorizeRoute, async ({ cookie: { user_session_id }, query, request, store }) => {
     let effectiveQuery = query;
     if (query.request_uri !== undefined && config.pushedAuthorizationRequestStore !== undefined && query.client_id !== undefined) {
       const pushed = await consumePushedRequest({
@@ -6559,10 +6533,7 @@ var oidcProviderRoutes = (config) => {
       return jsonResponse({ error: "unsupported_response_mode" }, HTTP_BAD_REQUEST2);
     }
     const errorRedirect = (error) => {
-      const params2 = {
-        error,
-        iss: issuer
-      };
+      const params2 = { error, iss: issuer };
       if (state !== undefined)
         params2.state = state;
       return respondToClient(redirectUri, responseMode, params2);
@@ -6946,7 +6917,11 @@ var oidcProviderRoutes = (config) => {
     cookie: t12.Cookie({
       user_session_id: t12.Optional(userSessionIdTypebox)
     })
-  }).get(endSessionRoute, async ({ cookie: { user_session_id }, query, store }) => handleEndSession({
+  }).get(endSessionRoute, async ({
+    cookie: { user_session_id },
+    query,
+    store
+  }) => handleEndSession({
     cookie: user_session_id,
     inMemorySession: store.session,
     query
@@ -6960,7 +6935,11 @@ var oidcProviderRoutes = (config) => {
       post_logout_redirect_uri: t12.Optional(t12.String()),
       state: t12.Optional(t12.String())
     })
-  }).post(endSessionRoute, async ({ body, cookie: { user_session_id }, store }) => handleEndSession({
+  }).post(endSessionRoute, async ({
+    body,
+    cookie: { user_session_id },
+    store
+  }) => handleEndSession({
     cookie: user_session_id,
     inMemorySession: store.session,
     query: body
@@ -10005,7 +9984,8 @@ var samlSsoRoutes = ({
     }
     const metadata = await samlAdapter.getServiceProviderMetadata({
       acsUrl: acsUrlFor(request.url, organizationId),
-      connection
+      connection,
+      sloUrl: sloUrlFor(request.url, organizationId)
     });
     return new Response(metadata, {
       headers: { "content-type": "application/xml" }
@@ -10045,7 +10025,7 @@ var samlSsoRoutes = ({
   }).get(sloRoute, async ({
     cookie: { user_session_id },
     params: { organizationId },
-    query: { RelayState, SAMLRequest, SAMLResponse },
+    query: { RelayState, SAMLRequest, SAMLResponse, SigAlg, Signature },
     redirect,
     request,
     status,
@@ -10056,11 +10036,15 @@ var samlSsoRoutes = ({
       return status("Not Found", "No SAML connection is configured for this organization");
     }
     const sloUrl = sloUrlFor(request.url, organizationId);
+    const signedQueryString = new URL(request.url).search.replace(/^\?/, "");
     if (isNonEmptyString(SAMLResponse)) {
       const responseSettled = await settle(samlAdapter.validateLogoutResponse?.({
         connection,
         relayState: RelayState,
         samlResponse: SAMLResponse,
+        signature: Signature,
+        signatureAlgorithm: SigAlg,
+        signedQueryString,
         sloUrl
       }) ?? Promise.resolve());
       if (!("error" in responseSettled)) {
@@ -10083,6 +10067,9 @@ var samlSsoRoutes = ({
       connection,
       relayState: RelayState,
       samlRequest: SAMLRequest,
+      signature: Signature,
+      signatureAlgorithm: SigAlg,
+      signedQueryString,
       sloUrl
     }));
     if ("error" in requestSettled) {
@@ -10118,7 +10105,9 @@ var samlSsoRoutes = ({
     query: t29.Object({
       RelayState: t29.Optional(t29.String()),
       SAMLRequest: t29.Optional(t29.String()),
-      SAMLResponse: t29.Optional(t29.String())
+      SAMLResponse: t29.Optional(t29.String()),
+      SigAlg: t29.Optional(t29.String()),
+      Signature: t29.Optional(t29.String())
     })
   });
 };
@@ -10622,7 +10611,7 @@ var createInMemoryVaultStore = () => {
     }
   };
 };
-// node_modules/drizzle-orm/entity.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/entity.js
 var entityKind = Symbol.for("drizzle:entityKind");
 var hasOwnEntityKind = Symbol.for("drizzle:hasOwnEntityKind");
 function is(value, type) {
@@ -10647,7 +10636,7 @@ function is(value, type) {
   return false;
 }
 
-// node_modules/drizzle-orm/column.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/column.js
 class Column {
   constructor(table, config) {
     this.table = table;
@@ -10697,7 +10686,7 @@ class Column {
   }
 }
 
-// node_modules/drizzle-orm/column-builder.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/column-builder.js
 class ColumnBuilder {
   static [entityKind] = "ColumnBuilder";
   config;
@@ -10753,10 +10742,10 @@ class ColumnBuilder {
   }
 }
 
-// node_modules/drizzle-orm/table.utils.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/table.utils.js
 var TableName = Symbol.for("drizzle:Name");
 
-// node_modules/drizzle-orm/pg-core/foreign-keys.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/foreign-keys.js
 class ForeignKeyBuilder {
   static [entityKind] = "PgForeignKeyBuilder";
   reference;
@@ -10810,12 +10799,12 @@ class ForeignKey {
   }
 }
 
-// node_modules/drizzle-orm/tracing-utils.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/tracing-utils.js
 function iife(fn, ...args) {
   return fn(...args);
 }
 
-// node_modules/drizzle-orm/pg-core/unique-constraint.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/unique-constraint.js
 function uniqueKeyName(table, columns) {
   return `${table[TableName]}_${columns.join("_")}_unique`;
 }
@@ -10852,7 +10841,7 @@ class UniqueConstraint {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/utils/array.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/utils/array.js
 function parsePgArrayValue(arrayString, startFrom, inQuotes) {
   for (let i = startFrom;i < arrayString.length; i++) {
     const char = arrayString[i];
@@ -10928,7 +10917,7 @@ function makePgArray(array) {
   }).join(",")}}`;
 }
 
-// node_modules/drizzle-orm/pg-core/columns/common.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/common.js
 class PgColumnBuilder extends ColumnBuilder {
   foreignKeyConfigs = [];
   static [entityKind] = "PgColumnBuilder";
@@ -11061,7 +11050,7 @@ class PgArray extends PgColumn {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/columns/enum.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/enum.js
 var isPgEnumSym = Symbol.for("drizzle:isPgEnum");
 function isPgEnum(obj) {
   return !!obj && typeof obj === "function" && isPgEnumSym in obj && obj[isPgEnumSym] === true;
@@ -11079,7 +11068,7 @@ class PgEnumColumn extends PgColumn {
   }
 }
 
-// node_modules/drizzle-orm/subquery.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/subquery.js
 class Subquery {
   static [entityKind] = "Subquery";
   constructor(sql, selection, alias, isWith = false) {
@@ -11097,10 +11086,10 @@ class WithSubquery extends Subquery {
   static [entityKind] = "WithSubquery";
 }
 
-// node_modules/drizzle-orm/version.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/version.js
 var version = "0.41.0";
 
-// node_modules/drizzle-orm/tracing.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/tracing.js
 var otel;
 var rawTracer;
 var tracer = {
@@ -11127,10 +11116,10 @@ var tracer = {
   }
 };
 
-// node_modules/drizzle-orm/view-common.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/view-common.js
 var ViewBaseConfig = Symbol.for("drizzle:ViewBaseConfig");
 
-// node_modules/drizzle-orm/table.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/table.js
 var Schema = Symbol.for("drizzle:Schema");
 var Columns = Symbol.for("drizzle:Columns");
 var ExtraConfigColumns = Symbol.for("drizzle:ExtraConfigColumns");
@@ -11174,7 +11163,7 @@ function getTableUniqueName(table) {
   return `${table[Schema] ?? "public"}.${table[TableName]}`;
 }
 
-// node_modules/drizzle-orm/sql/sql.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/sql/sql.js
 function isSQLWrapper(value) {
   return value !== null && value !== undefined && typeof value.getSQL === "function";
 }
@@ -11547,7 +11536,7 @@ Subquery.prototype.getSQL = function() {
   return new SQL([this]);
 };
 
-// node_modules/drizzle-orm/alias.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/alias.js
 class ColumnAliasProxyHandler {
   constructor(table) {
     this.table = table;
@@ -11626,7 +11615,7 @@ function mapColumnsInSQLToAlias(query, alias) {
   }));
 }
 
-// node_modules/drizzle-orm/errors.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/errors.js
 class DrizzleError extends Error {
   static [entityKind] = "DrizzleError";
   constructor({ message, cause }) {
@@ -11636,7 +11625,7 @@ class DrizzleError extends Error {
   }
 }
 
-// node_modules/drizzle-orm/sql/expressions/conditions.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/sql/expressions/conditions.js
 function bindIfParam(value, column) {
   if (isDriverValueEncoder(column) && !isSQLWrapper(value) && !is(value, Param) && !is(value, Placeholder) && !is(value, Column) && !is(value, Table) && !is(value, View)) {
     return new Param(value, column);
@@ -11741,7 +11730,7 @@ function notIlike(column, value) {
   return sql`${column} not ilike ${value}`;
 }
 
-// node_modules/drizzle-orm/sql/expressions/select.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/sql/expressions/select.js
 function asc(column) {
   return sql`${column} asc`;
 }
@@ -11749,7 +11738,7 @@ function desc(column) {
   return sql`${column} desc`;
 }
 
-// node_modules/drizzle-orm/logger.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/logger.js
 class ConsoleLogWriter {
   static [entityKind] = "ConsoleLogWriter";
   write(message) {
@@ -11781,7 +11770,7 @@ class NoopLogger {
   logQuery() {}
 }
 
-// node_modules/drizzle-orm/query-promise.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/query-promise.js
 class QueryPromise {
   static [entityKind] = "QueryPromise";
   [Symbol.toStringTag] = "QueryPromise";
@@ -11802,7 +11791,7 @@ class QueryPromise {
   }
 }
 
-// node_modules/drizzle-orm/utils.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/utils.js
 function mapResultRow(columns, row, joinsNotNullableMap) {
   const nullifyMap = {};
   const result = columns.reduce((result2, { path, field }, columnIndex) => {
@@ -11953,7 +11942,7 @@ function isConfig(data) {
   return false;
 }
 
-// node_modules/drizzle-orm/pg-core/columns/int.common.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/int.common.js
 class PgIntColumnBaseBuilder extends PgColumnBuilder {
   static [entityKind] = "PgIntColumnBaseBuilder";
   generatedAlwaysAsIdentity(sequence) {
@@ -11992,7 +11981,7 @@ class PgIntColumnBaseBuilder extends PgColumnBuilder {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/columns/bigint.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/bigint.js
 class PgBigInt53Builder extends PgIntColumnBaseBuilder {
   static [entityKind] = "PgBigInt53Builder";
   constructor(name) {
@@ -12043,7 +12032,7 @@ function bigint(a, b) {
   return new PgBigInt64Builder(name);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/bigserial.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/bigserial.js
 class PgBigSerial53Builder extends PgColumnBuilder {
   static [entityKind] = "PgBigSerial53Builder";
   constructor(name) {
@@ -12097,7 +12086,7 @@ function bigserial(a, b) {
   return new PgBigSerial64Builder(name);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/boolean.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/boolean.js
 class PgBooleanBuilder extends PgColumnBuilder {
   static [entityKind] = "PgBooleanBuilder";
   constructor(name) {
@@ -12118,7 +12107,7 @@ function boolean(name) {
   return new PgBooleanBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/char.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/char.js
 class PgCharBuilder extends PgColumnBuilder {
   static [entityKind] = "PgCharBuilder";
   constructor(name, config) {
@@ -12144,7 +12133,7 @@ function char(a, b = {}) {
   return new PgCharBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/cidr.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/cidr.js
 class PgCidrBuilder extends PgColumnBuilder {
   static [entityKind] = "PgCidrBuilder";
   constructor(name) {
@@ -12165,7 +12154,7 @@ function cidr(name) {
   return new PgCidrBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/custom.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/custom.js
 class PgCustomColumnBuilder extends PgColumnBuilder {
   static [entityKind] = "PgCustomColumnBuilder";
   constructor(name, fieldConfig, customTypeParams) {
@@ -12206,7 +12195,7 @@ function customType(customTypeParams) {
   };
 }
 
-// node_modules/drizzle-orm/pg-core/columns/date.common.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/date.common.js
 class PgDateColumnBaseBuilder extends PgColumnBuilder {
   static [entityKind] = "PgDateColumnBaseBuilder";
   defaultNow() {
@@ -12214,7 +12203,7 @@ class PgDateColumnBaseBuilder extends PgColumnBuilder {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/columns/date.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/date.js
 class PgDateBuilder extends PgDateColumnBaseBuilder {
   static [entityKind] = "PgDateBuilder";
   constructor(name) {
@@ -12262,7 +12251,7 @@ function date(a, b) {
   return new PgDateStringBuilder(name);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/double-precision.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/double-precision.js
 class PgDoublePrecisionBuilder extends PgColumnBuilder {
   static [entityKind] = "PgDoublePrecisionBuilder";
   constructor(name) {
@@ -12289,7 +12278,7 @@ function doublePrecision(name) {
   return new PgDoublePrecisionBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/inet.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/inet.js
 class PgInetBuilder extends PgColumnBuilder {
   static [entityKind] = "PgInetBuilder";
   constructor(name) {
@@ -12310,7 +12299,7 @@ function inet(name) {
   return new PgInetBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/integer.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/integer.js
 class PgIntegerBuilder extends PgIntColumnBaseBuilder {
   static [entityKind] = "PgIntegerBuilder";
   constructor(name) {
@@ -12337,7 +12326,7 @@ function integer(name) {
   return new PgIntegerBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/interval.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/interval.js
 class PgIntervalBuilder extends PgColumnBuilder {
   static [entityKind] = "PgIntervalBuilder";
   constructor(name, intervalConfig) {
@@ -12364,7 +12353,7 @@ function interval(a, b = {}) {
   return new PgIntervalBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/json.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/json.js
 class PgJsonBuilder extends PgColumnBuilder {
   static [entityKind] = "PgJsonBuilder";
   constructor(name) {
@@ -12401,7 +12390,7 @@ function json(name) {
   return new PgJsonBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/jsonb.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/jsonb.js
 class PgJsonbBuilder extends PgColumnBuilder {
   static [entityKind] = "PgJsonbBuilder";
   constructor(name) {
@@ -12438,7 +12427,7 @@ function jsonb(name) {
   return new PgJsonbBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/line.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/line.js
 class PgLineBuilder extends PgColumnBuilder {
   static [entityKind] = "PgLineBuilder";
   constructor(name) {
@@ -12494,7 +12483,7 @@ function line(a, b) {
   return new PgLineABCBuilder(name);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/macaddr.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/macaddr.js
 class PgMacaddrBuilder extends PgColumnBuilder {
   static [entityKind] = "PgMacaddrBuilder";
   constructor(name) {
@@ -12515,7 +12504,7 @@ function macaddr(name) {
   return new PgMacaddrBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/macaddr8.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/macaddr8.js
 class PgMacaddr8Builder extends PgColumnBuilder {
   static [entityKind] = "PgMacaddr8Builder";
   constructor(name) {
@@ -12536,7 +12525,7 @@ function macaddr8(name) {
   return new PgMacaddr8Builder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/numeric.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/numeric.js
 class PgNumericBuilder extends PgColumnBuilder {
   static [entityKind] = "PgNumericBuilder";
   constructor(name, precision, scale) {
@@ -12651,7 +12640,7 @@ function numeric(a, b) {
   return mode === "number" ? new PgNumericNumberBuilder(name, config?.precision, config?.scale) : mode === "bigint" ? new PgNumericBigIntBuilder(name, config?.precision, config?.scale) : new PgNumericBuilder(name, config?.precision, config?.scale);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/point.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/point.js
 class PgPointTupleBuilder extends PgColumnBuilder {
   static [entityKind] = "PgPointTupleBuilder";
   constructor(name) {
@@ -12713,7 +12702,7 @@ function point(a, b) {
   return new PgPointObjectBuilder(name);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/postgis_extension/utils.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/postgis_extension/utils.js
 function hexToBytes(hex) {
   const bytes = [];
   for (let c = 0;c < hex.length; c += 2) {
@@ -12752,7 +12741,7 @@ function parseEWKB(hex) {
   throw new Error("Unsupported geometry type");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/postgis_extension/geometry.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/postgis_extension/geometry.js
 class PgGeometryBuilder extends PgColumnBuilder {
   static [entityKind] = "PgGeometryBuilder";
   constructor(name) {
@@ -12807,7 +12796,7 @@ function geometry(a, b) {
   return new PgGeometryObjectBuilder(name);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/real.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/real.js
 class PgRealBuilder extends PgColumnBuilder {
   static [entityKind] = "PgRealBuilder";
   constructor(name, length) {
@@ -12838,7 +12827,7 @@ function real(name) {
   return new PgRealBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/serial.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/serial.js
 class PgSerialBuilder extends PgColumnBuilder {
   static [entityKind] = "PgSerialBuilder";
   constructor(name) {
@@ -12861,7 +12850,7 @@ function serial(name) {
   return new PgSerialBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/smallint.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/smallint.js
 class PgSmallIntBuilder extends PgIntColumnBaseBuilder {
   static [entityKind] = "PgSmallIntBuilder";
   constructor(name) {
@@ -12888,7 +12877,7 @@ function smallint(name) {
   return new PgSmallIntBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/smallserial.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/smallserial.js
 class PgSmallSerialBuilder extends PgColumnBuilder {
   static [entityKind] = "PgSmallSerialBuilder";
   constructor(name) {
@@ -12911,7 +12900,7 @@ function smallserial(name) {
   return new PgSmallSerialBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/text.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/text.js
 class PgTextBuilder extends PgColumnBuilder {
   static [entityKind] = "PgTextBuilder";
   constructor(name, config) {
@@ -12935,7 +12924,7 @@ function text(a, b = {}) {
   return new PgTextBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/time.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/time.js
 class PgTimeBuilder extends PgDateColumnBaseBuilder {
   constructor(name, withTimezone, precision) {
     super(name, "string", "PgTime");
@@ -12969,7 +12958,7 @@ function time(a, b = {}) {
   return new PgTimeBuilder(name, config.withTimezone ?? false, config.precision);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/timestamp.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/timestamp.js
 class PgTimestampBuilder extends PgDateColumnBaseBuilder {
   static [entityKind] = "PgTimestampBuilder";
   constructor(name, withTimezone, precision) {
@@ -13037,7 +13026,7 @@ function timestamp(a, b = {}) {
   return new PgTimestampBuilder(name, config?.withTimezone ?? false, config?.precision);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/uuid.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/uuid.js
 class PgUUIDBuilder extends PgColumnBuilder {
   static [entityKind] = "PgUUIDBuilder";
   constructor(name) {
@@ -13061,7 +13050,7 @@ function uuid(name) {
   return new PgUUIDBuilder(name ?? "");
 }
 
-// node_modules/drizzle-orm/pg-core/columns/varchar.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/varchar.js
 class PgVarcharBuilder extends PgColumnBuilder {
   static [entityKind] = "PgVarcharBuilder";
   constructor(name, config) {
@@ -13087,7 +13076,7 @@ function varchar(a, b = {}) {
   return new PgVarcharBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/vector_extension/bit.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/vector_extension/bit.js
 class PgBinaryVectorBuilder extends PgColumnBuilder {
   static [entityKind] = "PgBinaryVectorBuilder";
   constructor(name, config) {
@@ -13111,7 +13100,7 @@ function bit(a, b) {
   return new PgBinaryVectorBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/vector_extension/halfvec.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/vector_extension/halfvec.js
 class PgHalfVectorBuilder extends PgColumnBuilder {
   static [entityKind] = "PgHalfVectorBuilder";
   constructor(name, config) {
@@ -13141,7 +13130,7 @@ function halfvec(a, b) {
   return new PgHalfVectorBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/vector_extension/sparsevec.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/vector_extension/sparsevec.js
 class PgSparseVectorBuilder extends PgColumnBuilder {
   static [entityKind] = "PgSparseVectorBuilder";
   constructor(name, config) {
@@ -13165,7 +13154,7 @@ function sparsevec(a, b) {
   return new PgSparseVectorBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/vector_extension/vector.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/vector_extension/vector.js
 class PgVectorBuilder extends PgColumnBuilder {
   static [entityKind] = "PgVectorBuilder";
   constructor(name, config) {
@@ -13195,7 +13184,7 @@ function vector(a, b) {
   return new PgVectorBuilder(name, config);
 }
 
-// node_modules/drizzle-orm/pg-core/columns/all.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/columns/all.js
 function getPgColumnBuilders() {
   return {
     bigint,
@@ -13233,7 +13222,7 @@ function getPgColumnBuilders() {
   };
 }
 
-// node_modules/drizzle-orm/pg-core/table.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/table.js
 var InlineForeignKeys = Symbol.for("drizzle:PgInlineForeignKeys");
 var EnableRLS = Symbol.for("drizzle:EnableRLS");
 
@@ -13281,7 +13270,7 @@ var pgTable = (name, columns, extraConfig) => {
   return pgTableWithSchema(name, columns, extraConfig, undefined);
 };
 
-// node_modules/drizzle-orm/pg-core/primary-keys.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/primary-keys.js
 function primaryKey(...config) {
   if (config[0].columns) {
     return new PrimaryKeyBuilder(config[0].columns, config[0].name);
@@ -13316,7 +13305,7 @@ class PrimaryKey {
   }
 }
 
-// node_modules/drizzle-orm/relations.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/relations.js
 class Relation {
   constructor(sourceTable, referencedTable, relationName) {
     this.sourceTable = sourceTable;
@@ -13536,7 +13525,7 @@ function mapRelationalRow(tablesConfig, tableConfig, row, buildQueryResultSelect
   return result;
 }
 
-// node_modules/drizzle-orm/pg-core/checks.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/checks.js
 class CheckBuilder {
   constructor(name, value) {
     this.name = name;
@@ -13560,7 +13549,7 @@ class Check {
   value;
 }
 
-// node_modules/drizzle-orm/selection-proxy.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/selection-proxy.js
 class SelectionProxyHandler {
   static [entityKind] = "SelectionProxyHandler";
   config;
@@ -13612,7 +13601,7 @@ class SelectionProxyHandler {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/delete.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/delete.js
 class PgDeleteBase extends QueryPromise {
   constructor(table, session, dialect, withList) {
     super();
@@ -13668,7 +13657,7 @@ class PgDeleteBase extends QueryPromise {
   }
 }
 
-// node_modules/drizzle-orm/casing.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/casing.js
 function toSnakeCase(input) {
   const words = input.replace(/['\u2019]/g, "").match(/[\da-z]+|[A-Z]+(?![a-z])|[A-Z][\da-z]+/g) ?? [];
   return words.map((word) => word.toLowerCase()).join("_");
@@ -13721,12 +13710,12 @@ class CasingCache {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/view-base.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/view-base.js
 class PgViewBase extends View {
   static [entityKind] = "PgViewBase";
 }
 
-// node_modules/drizzle-orm/pg-core/dialect.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/dialect.js
 class PgDialect {
   static [entityKind] = "PgDialect";
   casing;
@@ -14283,7 +14272,7 @@ class PgDialect {
   }
 }
 
-// node_modules/drizzle-orm/query-builders/query-builder.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/query-builders/query-builder.js
 class TypedQueryBuilder {
   static [entityKind] = "TypedQueryBuilder";
   getSelectedFields() {
@@ -14291,7 +14280,7 @@ class TypedQueryBuilder {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/select.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/select.js
 class PgSelectBuilder {
   static [entityKind] = "PgSelectBuilder";
   fields;
@@ -14580,7 +14569,7 @@ var intersectAll = createSetOperator("intersect", true);
 var except = createSetOperator("except", false);
 var exceptAll = createSetOperator("except", true);
 
-// node_modules/drizzle-orm/pg-core/query-builders/query-builder.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/query-builder.js
 class QueryBuilder {
   static [entityKind] = "PgQueryBuilder";
   dialect;
@@ -14658,7 +14647,7 @@ class QueryBuilder {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/insert.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/insert.js
 class PgInsertBuilder {
   constructor(table, session, dialect, withList, overridingSystemValue_) {
     this.table = table;
@@ -14777,7 +14766,7 @@ class PgInsertBase extends QueryPromise {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/refresh-materialized-view.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/refresh-materialized-view.js
 class PgRefreshMaterializedView extends QueryPromise {
   constructor(view, session, dialect) {
     super();
@@ -14828,7 +14817,7 @@ class PgRefreshMaterializedView extends QueryPromise {
   };
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/update.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/update.js
 class PgUpdateBuilder {
   constructor(table, session, dialect, withList) {
     this.table = table;
@@ -14978,7 +14967,7 @@ class PgUpdateBase extends QueryPromise {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/count.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/count.js
 class PgCountBuilder extends SQL {
   constructor(params) {
     super(PgCountBuilder.buildEmbeddedCount(params.source, params.filters).queryChunks);
@@ -15019,7 +15008,7 @@ class PgCountBuilder extends SQL {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/query.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/query.js
 class RelationalQueryBuilder {
   constructor(fullSchema, schema, tableNamesMap, table, tableConfig, dialect, session) {
     this.fullSchema = fullSchema;
@@ -15102,7 +15091,7 @@ class PgRelationalQuery extends QueryPromise {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/query-builders/raw.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/query-builders/raw.js
 class PgRaw extends QueryPromise {
   constructor(execute, sql2, query, mapBatchResult) {
     super();
@@ -15129,7 +15118,7 @@ class PgRaw extends QueryPromise {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/db.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/db.js
 class PgDatabase {
   constructor(dialect, session, schema) {
     this.dialect = dialect;
@@ -15253,7 +15242,7 @@ class PgDatabase {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/indexes.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/indexes.js
 class IndexBuilder {
   static [entityKind] = "PgIndexBuilder";
   config;
@@ -15291,7 +15280,7 @@ class Index {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/policies.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/policies.js
 class PgPolicy {
   constructor(name, config) {
     this.name = name;
@@ -15316,7 +15305,7 @@ class PgPolicy {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/session.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/session.js
 class PgPreparedQuery {
   constructor(query) {
     this.query = query;
@@ -15358,7 +15347,7 @@ class PgSession {
   }
 }
 
-// node_modules/drizzle-orm/pg-core/utils.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/pg-core/utils.js
 function getTableConfig(table) {
   const columns = Object.values(table[Table.Symbol.Columns]);
   const indexes = [];
@@ -15404,7 +15393,7 @@ function getTableConfig(table) {
   };
 }
 
-// node_modules/@neondatabase/serverless/index.mjs
+// ../../home/alexkahn/abs/auth/node_modules/@neondatabase/serverless/index.mjs
 var vo = Object.create;
 var Te = Object.defineProperty;
 var xo = Object.getOwnPropertyDescriptor;
@@ -20264,7 +20253,7 @@ buffer/index.js:
    *)
 */
 
-// node_modules/drizzle-orm/neon-http/session.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/neon-http/session.js
 var rawQueryConfig = {
   arrayMode: false,
   fullResults: true
@@ -20377,7 +20366,7 @@ class NeonHttpSession extends PgSession {
   }
 }
 
-// node_modules/drizzle-orm/neon-http/driver.js
+// ../../home/alexkahn/abs/auth/node_modules/drizzle-orm/neon-http/driver.js
 class NeonHttpDriver {
   constructor(client, dialect, options = {}) {
     this.client = client;
@@ -22492,11 +22481,7 @@ var vciRoutes = ({
   const credentialRoute = `${vciRoute}/credential`;
   const nonceRoute = `${vciRoute}/nonce`;
   const vciSigningKey = vciConfig.signingKey ?? signingKey;
-  return new Elysia35().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({
-    config: vciConfig,
-    issuer: issuerUrl,
-    vciRoute
-  }))).post(credentialRoute, async ({ body, headers }) => {
+  return new Elysia35().get("/.well-known/openid-credential-issuer", () => Response.json(buildIssuerMetadata({ config: vciConfig, issuer: issuerUrl, vciRoute }))).post(credentialRoute, async ({ body, headers }) => {
     const accessToken = extractBearer(headers.authorization);
     if (accessToken === undefined) {
       return errorBody("invalid_token", HTTP_UNAUTHORIZED3);
@@ -22535,10 +22520,7 @@ var vciRoutes = ({
       nonceHash: await hashToken2(nonce)
     });
     const msPerSecond = 1000;
-    return Response.json({
-      c_nonce: nonce,
-      c_nonce_expires_in: Math.floor(ttlMs / msPerSecond)
-    }, { status: HTTP_OK3 });
+    return Response.json({ c_nonce: nonce, c_nonce_expires_in: Math.floor(ttlMs / msPerSecond) }, { status: HTTP_OK3 });
   });
 };
 // src/vc/statusList.ts
@@ -22635,10 +22617,7 @@ var verifyStatusListJwt = async ({
     return;
   }
   const bits = await decompress(lst);
-  return {
-    bits,
-    sub: typeof payload.sub === "string" ? payload.sub : undefined
-  };
+  return { bits, sub: typeof payload.sub === "string" ? payload.sub : undefined };
 };
 // src/vc/statusListRoutes.ts
 import { Elysia as Elysia36, t as t32 } from "elysia";
@@ -22922,10 +22901,7 @@ var vpRoutes = ({
       return errorBody2("unknown_request", HTTP_NOT_FOUND2);
     }
     const rebuilt = await createPresentationRequest({
-      config: {
-        ...vpConfig,
-        requestStore: passthroughStore(stored)
-      },
+      config: { ...vpConfig, requestStore: passthroughStore(stored) },
       input: {
         clientId: stored.clientId,
         requestedClaims: stored.requestedClaims,
@@ -22935,9 +22911,7 @@ var vpRoutes = ({
       getRequestUri: () => `${issuerUrl}${vpRoute}/request/${id}`
     });
     return new Response(rebuilt.requestObject, {
-      headers: {
-        "content-type": "application/oauth-authz-req+jwt"
-      },
+      headers: { "content-type": "application/oauth-authz-req+jwt" },
       status: HTTP_OK5
     });
   }, { params: t33.Object({ id: t33.String() }) }).post(responseRoute, async ({ body }) => {
@@ -23457,11 +23431,7 @@ var createInMemoryDeviceAuthorizationStore = () => {
       const record = byDeviceCode.get(deviceCodeHash);
       if (!record)
         return;
-      byDeviceCode.set(deviceCodeHash, {
-        ...record,
-        status,
-        userSub
-      });
+      byDeviceCode.set(deviceCodeHash, { ...record, status, userSub });
     }
   };
 };
@@ -23612,9 +23582,7 @@ var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations",
     length: ID_LENGTH8
   }).primaryKey(),
   expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
-  interval_seconds: bigint("interval_seconds", {
-    mode: "number"
-  }).notNull(),
+  interval_seconds: bigint("interval_seconds", { mode: "number" }).notNull(),
   scopes: text("scopes").array().notNull(),
   status: varchar("status", { length: 16 }).notNull(),
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
@@ -23829,9 +23797,7 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
 });
 var createPostgresInitialAccessTokenStore = (db) => ({
   consumeToken: async (tokenHash) => {
-    const deleted = await db.delete(oauthInitialAccessTokensTable).where(eq(oauthInitialAccessTokensTable.token_hash, tokenHash)).returning({
-      token_hash: oauthInitialAccessTokensTable.token_hash
-    });
+    const deleted = await db.delete(oauthInitialAccessTokensTable).where(eq(oauthInitialAccessTokensTable.token_hash, tokenHash)).returning({ token_hash: oauthInitialAccessTokensTable.token_hash });
     return deleted.length > 0;
   }
 });
@@ -24509,10 +24475,7 @@ var parseBoolean = (raw) => {
     return false;
   return;
 };
-var createRedisFgaCache = (redis, {
-  keyPrefix = DEFAULT_PREFIX2,
-  ttlMs = DEFAULT_TTL_MS
-} = {}) => ({
+var createRedisFgaCache = (redis, { keyPrefix = DEFAULT_PREFIX2, ttlMs = DEFAULT_TTL_MS } = {}) => ({
   clear: async () => {
     const enumerate = redis.keys;
     if (enumerate === undefined)
@@ -25462,6 +25425,152 @@ var samlIdpRoutes = ({
     ssoUrl: ssoUrlFor(request.url)
   })));
 };
+// src/sso/nodeSamlAdapter.ts
+var STANDARD_PROFILE_KEYS = new Set([
+  "ID",
+  "getAssertion",
+  "getAssertionXml",
+  "getSamlResponseXml",
+  "issuer",
+  "mainAttributes",
+  "nameID",
+  "nameIDFormat",
+  "sessionIndex",
+  "spNameQualifier"
+]);
+var DEFAULT_NAMEID_FORMAT = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+var siblingEndpoints = (urls) => {
+  const acsUrl = urls.acsUrl ?? urls.sloUrl?.replace(/\/slo(\?|$)/, "/acs$1");
+  const sloUrl = urls.sloUrl ?? urls.acsUrl?.replace(/\/acs(\?|$)/, "/slo$1");
+  return { acsUrl, sloUrl };
+};
+var createNodeSamlAdapter = async (options = {}) => {
+  const { SAML } = await import("@node-saml/node-saml");
+  const { signatureAlgorithm = "sha256", spCertificate, spPrivateKey } = options;
+  const canSign = spPrivateKey !== undefined;
+  const build = (connection, urls) => {
+    const { acsUrl, sloUrl } = siblingEndpoints(urls);
+    const baseUrl = acsUrl ?? sloUrl;
+    if (baseUrl === undefined) {
+      throw new Error("node-saml adapter requires an acsUrl or sloUrl to build a SAML client");
+    }
+    const spEntityId = new URL(baseUrl).origin;
+    return new SAML({
+      audience: spEntityId,
+      callbackUrl: acsUrl ?? baseUrl,
+      entryPoint: connection.config.idpSsoUrl,
+      idpCert: connection.config.idpX509Cert,
+      issuer: spEntityId,
+      logoutUrl: connection.config.idpSloUrl,
+      wantAssertionsSigned: true,
+      ...canSign ? {
+        logoutCallbackUrl: sloUrl ?? baseUrl,
+        privateKey: spPrivateKey,
+        signatureAlgorithm
+      } : {}
+    });
+  };
+  const adapter = {
+    createAuthorizationUrl: ({ acsUrl, connection, relayState }) => build(connection, { acsUrl }).getAuthorizeUrlAsync(relayState ?? "", undefined, {}),
+    getServiceProviderMetadata: ({ acsUrl, connection, sloUrl }) => build(connection, { acsUrl, sloUrl }).generateServiceProviderMetadata(null, spCertificate ?? null),
+    validateAssertion: async ({ acsUrl, connection, samlResponse }) => {
+      const { profile: profile2 } = await build(connection, {
+        acsUrl
+      }).validatePostResponseAsync({ SAMLResponse: samlResponse });
+      if (!profile2) {
+        throw new Error("SAML response contained no assertion profile");
+      }
+      const attributes = {};
+      for (const [key, value] of Object.entries(profile2)) {
+        if (!STANDARD_PROFILE_KEYS.has(key))
+          attributes[key] = value;
+      }
+      const email = profile2.email ?? (profile2.nameID.includes("@") ? profile2.nameID : undefined);
+      const result = {
+        attributes,
+        email,
+        nameId: profile2.nameID,
+        sessionIndex: profile2.sessionIndex
+      };
+      return result;
+    }
+  };
+  if (!canSign)
+    return adapter;
+  return {
+    ...adapter,
+    createLogoutRequestUrl: ({
+      connection,
+      nameId,
+      relayState,
+      sessionIndex,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      return saml.getLogoutUrlAsync({
+        issuer: new URL(sloUrl).origin,
+        nameID: nameId,
+        nameIDFormat: DEFAULT_NAMEID_FORMAT,
+        sessionIndex
+      }, relayState ?? "", {});
+    },
+    createLogoutResponseUrl: ({
+      connection,
+      inResponseTo,
+      nameId,
+      relayState,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      return saml.getLogoutResponseUrlAsync({
+        ID: inResponseTo,
+        issuer: new URL(sloUrl).origin,
+        nameID: nameId ?? "",
+        nameIDFormat: DEFAULT_NAMEID_FORMAT
+      }, relayState ?? "", {}, true);
+    },
+    validateLogoutRequest: async ({
+      connection,
+      relayState,
+      samlRequest,
+      signature,
+      signatureAlgorithm: sigAlg,
+      signedQueryString,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      const { profile: profile2 } = await saml.validateRedirectAsync({
+        RelayState: relayState,
+        SAMLRequest: samlRequest,
+        SigAlg: sigAlg,
+        Signature: signature
+      }, signedQueryString ?? "");
+      return {
+        nameId: profile2?.nameID,
+        relayState,
+        requestId: profile2?.ID,
+        sessionIndex: profile2?.sessionIndex
+      };
+    },
+    validateLogoutResponse: async ({
+      connection,
+      relayState,
+      samlResponse,
+      signature,
+      signatureAlgorithm: sigAlg,
+      signedQueryString,
+      sloUrl
+    }) => {
+      const saml = build(connection, { sloUrl });
+      await saml.validateRedirectAsync({
+        RelayState: relayState,
+        SAMLResponse: samlResponse,
+        SigAlg: sigAlg,
+        Signature: signature
+      }, signedQueryString ?? "");
+    }
+  };
+};
 // src/sso/inMemorySamlServiceProviderStore.ts
 var createInMemorySamlServiceProviderStore = () => {
   const providers2 = new Map;
@@ -26225,6 +26334,7 @@ export {
   createPostgresAccessTokenStore,
   createOrganization,
   createOAuthLinkedProviderCredentialResolver,
+  createNodeSamlAdapter,
   createNeonWebhookDeliveryStore,
   createNeonWebAuthnCredentialStore,
   createNeonWarrantStore,
@@ -26382,5 +26492,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=936F4FF1936BF20064756E2164756E21
+//# debugId=0D29D094A31EE10964756E2164756E21
 //# sourceMappingURL=index.js.map