saml-test-server 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,2170 @@
+import { createServer } from "node:https";
+import { homedir, hostname } from "node:os";
+import { serve } from "@hono/node-server";
+import { jsxs, Fragment, jsx } from "hono/jsx/jsx-runtime";
+import { randomBytes, randomInt, X509Certificate, createHash, createVerify, createSign } from "node:crypto";
+import { XMLSerializer, DOMParser } from "@xmldom/xmldom";
+import { Hono } from "hono";
+import { logger } from "hono/logger";
+import pc from "picocolors";
+import xmlFormat from "xml-formatter";
+import { getSignedCookie, deleteCookie, setSignedCookie } from "hono/cookie";
+import { name } from "xml-name-validator";
+import * as xmlenc from "xml-encryption";
+import { SignedXml } from "xml-crypto";
+import xpath from "xpath";
+import { inflateRaw, deflateRaw } from "node:zlib";
+import { promisify } from "node:util";
+import qs from "node:querystring";
+import { raw } from "hono/html";
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, isAbsolute } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+const UNDEFINED_VALUE = "None";
+const CERT_OPTIONS = [
+  "cert",
+  "key",
+  "encryptionCert",
+  "encryptionPublicKey",
+  "httpsPrivateKey",
+  "httpsCert"
+];
+const LOG_LEVELS = ["silent", "error", "info"];
+function isLogLevel(value) {
+  return LOG_LEVELS.includes(value);
+}
+function createLogger(level = "info") {
+  const noop = () => {
+  };
+  return {
+    log: level === "info" ? (...args) => console.log(...args) : noop,
+    error: level === "silent" ? noop : (...args) => console.error(...args)
+  };
+}
+function indentLines(text, indent) {
+  const pad = " ".repeat(indent);
+  return text.replace(/(^|\n)/g, `$1${pad}`);
+}
+function prettyPrintXml(xml, indent = 0) {
+  const pretty = xmlFormat(xml, { indentation: "  ", collapseContent: true }).replace(
+    /<(\/)?((?:[\w]+)(?::))?([\w]+)(.*?)>/g,
+    (_m, slash = "", prefix = "", name2, rest) => `<${pc.green(`${slash}${prefix}${pc.bold(name2)}`)}${rest}>`
+  ).replace(/ ([\w:]+)="(.+?)"/g, (_m, attr, value) => ` ${pc.white(attr)}=${pc.cyan(`"${value}"`)}`);
+  return indent ? indentLines(pretty, indent) : pretty;
+}
+function formatOptionValue(key, value) {
+  if (typeof value === "string" && !CERT_OPTIONS.includes(key)) {
+    return value;
+  }
+  if (CERT_OPTIONS.includes(key) && value) {
+    return value.toString().replace(/-----.+?-----|\n/g, "").substring(0, 80) + pc.white("…");
+  }
+  if (!value && value !== false) {
+    return UNDEFINED_VALUE;
+  }
+  if (typeof value === "function") {
+    return `${value}`.split("\n")[0].slice(0, -2);
+  }
+  return JSON.stringify(value);
+}
+function describeRecord(record, indent, format = formatOptionValue) {
+  return Object.entries(record).map(([key, value]) => `${" ".repeat(indent)}${key}: ${pc.cyan(format(key, value))}`).join("\n");
+}
+function configBanner(options) {
+  const v = (value) => pc.cyan(value === false ? "false" : String(value || UNDEFINED_VALUE));
+  return [
+    `Listener Port:`,
+    `  ${pc.cyan(`${options.host}:${options.port}`)}`,
+    `HTTPS Enabled:`,
+    `  ${pc.cyan(String(options.https))}`,
+    ``,
+    pc.bold(`[${pc.yellow("Identity Provider")}]`),
+    ``,
+    `Issuer URI:`,
+    `  ${v(options.issuer)}`,
+    `Sign Response Message:`,
+    `  ${v(options.signResponse)}`,
+    `Encrypt Assertion:`,
+    `  ${v(options.encryptAssertion)}`,
+    `Authentication Context Class Reference:`,
+    `  ${v(options.authnContextClassRef)}`,
+    `Authentication Context Declaration:`,
+    `  ${v(options.authnContextDecl)}`,
+    `Default RelayState:`,
+    `  ${v(options.relayState)}`,
+    ``,
+    pc.bold(`[${pc.yellow("Service Provider")}]`),
+    ``,
+    `Issuer URI:`,
+    `  ${v(options.serviceProviderId)}`,
+    `Audience URI:`,
+    `  ${v(options.audience)}`,
+    `ACS URL:`,
+    `  ${v(options.acsUrl)}`,
+    `SLO URL:`,
+    `  ${v(options.sloUrl)}`,
+    `Trust ACS URL in Request:`,
+    `  ${pc.cyan(String(!options.disableRequestAcsUrl))}`,
+    ``
+  ].join("\n");
+}
+function listeningBanner(baseUrl, sloEnabled) {
+  const lines = [
+    `IdP Metadata URL:`,
+    `  ${pc.cyan(`${baseUrl}/metadata`)}`,
+    ``,
+    `SSO Bindings:`,
+    `  urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`,
+    `    => ${pc.cyan(`${baseUrl}/saml/sso`)}`,
+    `  urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect`,
+    `    => ${pc.cyan(`${baseUrl}/saml/sso`)}`
+  ];
+  if (sloEnabled) {
+    lines.push(
+      ``,
+      `SLO Bindings:`,
+      `  urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`,
+      `    => ${pc.cyan(`${baseUrl}/saml/slo`)}`,
+      `  urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect`,
+      `    => ${pc.cyan(`${baseUrl}/saml/slo`)}`
+    );
+  }
+  lines.push(``, `IdP server ready at`, `  ${pc.cyan(baseUrl)}`);
+  return lines.join("\n");
+}
+function createDefaultConfig() {
+  return {
+    user: {
+      userName: "saml.jackson@example.com",
+      nameIdFormat: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+      firstName: "Saml",
+      lastName: "Jackson",
+      displayName: "saml jackson",
+      email: "saml.jackson@example.com",
+      mobilePhone: "+1-415-555-5141",
+      groups: "Simple IdP Users, West Coast Users, Cloud Users"
+    },
+    metadata: [
+      {
+        id: "firstName",
+        optional: false,
+        displayName: "First Name",
+        description: "The given name of the user",
+        multiValue: false
+      },
+      {
+        id: "lastName",
+        optional: false,
+        displayName: "Last Name",
+        description: "The surname of the user",
+        multiValue: false
+      },
+      {
+        id: "displayName",
+        optional: true,
+        displayName: "Display Name",
+        description: "The display name of the user",
+        multiValue: false
+      },
+      {
+        id: "email",
+        optional: false,
+        displayName: "E-Mail Address",
+        description: "The e-mail address of the user",
+        multiValue: false
+      },
+      {
+        id: "mobilePhone",
+        optional: true,
+        displayName: "Mobile Phone",
+        description: "The mobile phone of the user",
+        multiValue: false
+      },
+      {
+        id: "groups",
+        optional: true,
+        displayName: "Groups",
+        description: "Group memberships of the user",
+        multiValue: true
+      },
+      {
+        id: "userType",
+        optional: true,
+        displayName: "User Type",
+        description: "The type of user",
+        options: ["Admin", "Editor", "Commenter"]
+      }
+    ]
+  };
+}
+const PACKAGE_ROOT = fileURLToPath(new URL("..", import.meta.url));
+const DEFAULT_CERT_PATH = resolve(PACKAGE_ROOT, "assets/idp-public-cert.pem");
+const DEFAULT_KEY_PATH = resolve(PACKAGE_ROOT, "assets/idp-private-key.pem");
+const DEFAULT_CONFIG_FILE = "saml-idp/config.js";
+const KEY_CERT_HELP_TEXT = `To generate a key/cert pair for the IdP, run the following command:
+
+  openssl req -x509 -new -newkey rsa:2048 -nodes \\
+    -subj '/C=US/ST=California/L=San Francisco/O=JankyCo/CN=Test Identity Provider' \\
+    -keyout idp-private-key.pem \\
+    -out idp-public-cert.pem -days 7300`;
+const CRYPT_TYPES = {
+  certificate: /-----BEGIN CERTIFICATE-----[^-]*-----END CERTIFICATE-----/,
+  // PKCS#1 (RSA PRIVATE KEY) and PKCS#8 (PRIVATE KEY)
+  "private key": /-----BEGIN (?:RSA )?PRIVATE KEY-----[^-]*-----END (?:RSA )?PRIVATE KEY-----/,
+  "public key": /-----BEGIN (?:RSA )?PUBLIC KEY-----[^-]*-----END (?:RSA )?PUBLIC KEY-----/
+};
+class OptionsError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OptionsError";
+  }
+}
+function matchesCertType(value, type) {
+  return CRYPT_TYPES[type].test(value);
+}
+function resolveFilePath(filePath) {
+  if (filePath.startsWith("saml-idp/")) {
+    const resolved = resolve(PACKAGE_ROOT, filePath.replace(/^saml-idp\//, ""));
+    return existsSync(resolved) ? resolved : void 0;
+  }
+  if (isAbsolute(filePath) && existsSync(filePath)) return filePath;
+  if (filePath.startsWith("~/")) {
+    const expanded = resolve(process.env.HOME ?? homedir(), filePath.slice(2));
+    return existsSync(expanded) ? expanded : void 0;
+  }
+  return [process.cwd(), PACKAGE_ROOT].map((base) => resolve(base, filePath)).find((candidate) => existsSync(candidate));
+}
+function coerceCertFile(value, type, description, helpText) {
+  const asString = value.toString();
+  if (matchesCertType(asString, type)) {
+    return asString;
+  }
+  const filePath = resolveFilePath(asString);
+  if (filePath) {
+    const content = readFileSync(filePath, "utf8");
+    if (matchesCertType(content, type)) return content;
+    throw new OptionsError(`Invalid ${description}: "${filePath}" does not contain a valid ${type}`);
+  }
+  throw new OptionsError(
+    `Invalid / missing ${description} - not a valid crypt key/cert or file path` + (helpText ? "\n" + helpText : "")
+  );
+}
+async function loadConfigFile(configFile) {
+  if (configFile === DEFAULT_CONFIG_FILE) return {};
+  const filePath = resolveFilePath(configFile);
+  if (!filePath) {
+    throw new OptionsError(`SAML attribute config file path "${configFile}" is not a valid path.`);
+  }
+  try {
+    if (filePath.endsWith(".json")) {
+      return JSON.parse(readFileSync(filePath, "utf8"));
+    }
+    const mod = await import(
+      /* @vite-ignore */
+      pathToFileURL(filePath).href
+    );
+    return mod.default?.user || mod.default?.metadata ? mod.default : mod;
+  } catch (error) {
+    throw new OptionsError(
+      `Encountered an exception while loading SAML attribute config file "${filePath}".
+${error}`
+    );
+  }
+}
+function coerceAuthnContextDecl(value) {
+  if (value.trimStart().startsWith("<")) return value;
+  const filePath = resolveFilePath(value);
+  if (!filePath) {
+    throw new OptionsError(`Authentication Context Declaration file "${value}" was not found.`);
+  }
+  return readFileSync(filePath, "utf8");
+}
+async function resolveOptions(options) {
+  if (!options.acsUrl) throw new OptionsError("Missing required option: acsUrl");
+  if (!options.audience) throw new OptionsError("Missing required option: audience");
+  const encryptAssertion = options.encryptAssertion ?? false;
+  if (encryptAssertion && options.encryptionCert === void 0) {
+    throw new OptionsError("encryptionCert argument is required for assertion encryption");
+  }
+  const logLevel = options.logLevel ?? (options.silent ? "silent" : process.env.SAML_IDP_LOG_LEVEL ?? "info");
+  if (!isLogLevel(logLevel)) {
+    throw new OptionsError(`Invalid logLevel "${logLevel}", expected one of: ${LOG_LEVELS.join(", ")}`);
+  }
+  const https = options.https ?? false;
+  if (https && (options.httpsPrivateKey === void 0 || options.httpsCert === void 0)) {
+    throw new OptionsError("httpsPrivateKey and httpsCert arguments are required to enable HTTPS");
+  }
+  const fileConfig = options.config ? {} : await loadConfigFile(options.configFile ?? DEFAULT_CONFIG_FILE);
+  const inlineConfig = options.config ?? fileConfig;
+  const defaults = createDefaultConfig();
+  const config = {
+    // the user is merged with the defaults so that a partial profile still has a NameID
+    user: { ...defaults.user, ...inlineConfig.user ?? {} },
+    metadata: inlineConfig.metadata ?? defaults.metadata
+  };
+  return {
+    host: options.host ?? "localhost",
+    port: options.port ?? 7e3,
+    cert: coerceCertFile(
+      options.cert ?? DEFAULT_CERT_PATH,
+      "certificate",
+      "IdP Signature PublicKey Certificate",
+      KEY_CERT_HELP_TEXT
+    ),
+    key: coerceCertFile(
+      options.key ?? DEFAULT_KEY_PATH,
+      "private key",
+      "IdP Signature PrivateKey Certificate",
+      KEY_CERT_HELP_TEXT
+    ),
+    issuer: options.issuer ?? "urn:example:idp",
+    acsUrl: options.acsUrl,
+    sloUrl: options.sloUrl,
+    audience: options.audience,
+    serviceProviderId: options.serviceProviderId || options.audience,
+    relayState: options.relayState,
+    disableRequestAcsUrl: options.disableRequestAcsUrl ?? false,
+    encryptAssertion,
+    encryptionCert: options.encryptionCert !== void 0 ? coerceCertFile(options.encryptionCert, "certificate", "Encryption cert") : void 0,
+    encryptionPublicKey: options.encryptionPublicKey !== void 0 ? coerceCertFile(options.encryptionPublicKey, "public key", "Encryption public key") : void 0,
+    httpsPrivateKey: options.httpsPrivateKey !== void 0 ? coerceCertFile(options.httpsPrivateKey, "private key", "Web Server TLS/SSL Private Key") : void 0,
+    httpsCert: options.httpsCert !== void 0 ? coerceCertFile(options.httpsCert, "certificate", "Web Server TLS/SSL Certificate") : void 0,
+    https,
+    signResponse: options.signResponse ?? true,
+    rollSession: options.rollSession ?? false,
+    authnContextClassRef: options.authnContextClassRef ?? "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
+    authnContextDecl: options.authnContextDecl ? coerceAuthnContextDecl(options.authnContextDecl) : void 0,
+    logLevel,
+    config
+  };
+}
+function createSimpleProfileMapper(getMetadata) {
+  return {
+    get metadata() {
+      return getMetadata();
+    },
+    getClaims(user) {
+      const claims = {};
+      for (const entry of getMetadata()) {
+        const value = user[entry.id];
+        claims[entry.id] = entry.multiValue ? (value ?? "").split(",").map((v) => v.trim()).filter((v) => v !== "") : value;
+      }
+      return Object.keys(claims).length ? claims : void 0;
+    },
+    getNameIdentifier(user) {
+      return {
+        nameIdentifier: user.userName,
+        nameIdentifierFormat: user.nameIdFormat,
+        nameIdentifierNameQualifier: user.nameIdNameQualifier || void 0,
+        nameIdentifierSPNameQualifier: user.nameIdSPNameQualifier || void 0,
+        nameIdentifierSPProvidedID: user.nameIdSPProvidedID || void 0
+      };
+    }
+  };
+}
+const SESSION_COOKIE = "idp_sid";
+const MAX_AGE_SECONDS = 60 * 60;
+class Session {
+  constructor(id, store) {
+    this.store = store;
+    this.id = id;
+  }
+  store;
+  id;
+  /** Arbitrary per-session data. */
+  data = {};
+  destroyed = false;
+  /** Destroys the session. The cookie is cleared at the end of the request. */
+  destroy() {
+    this.destroyed = true;
+    this.store.delete(this.id);
+  }
+  /** Replaces the session id (and drops the data), like express-session's `regenerate()`. */
+  regenerate() {
+    this.store.delete(this.id);
+    this.id = randomBytes(24).toString("hex");
+    this.data = {};
+    this.destroyed = false;
+    this.store.set(this);
+  }
+}
+class SessionStore {
+  entries = /* @__PURE__ */ new Map();
+  create() {
+    const session = new Session(randomBytes(24).toString("hex"), this);
+    this.set(session);
+    return session;
+  }
+  get(id) {
+    const entry = this.entries.get(id);
+    if (!entry) return void 0;
+    if (entry.expires < Date.now()) {
+      this.entries.delete(id);
+      return void 0;
+    }
+    return entry.session;
+  }
+  set(session) {
+    this.entries.set(session.id, { session, expires: Date.now() + MAX_AGE_SECONDS * 1e3 });
+  }
+  delete(id) {
+    this.entries.delete(id);
+  }
+  clear() {
+    this.entries.clear();
+  }
+}
+function sessionMiddleware(store, secret) {
+  return async (c, next) => {
+    const cookieId = await getSignedCookie(c, secret, SESSION_COOKIE);
+    const session = (cookieId ? store.get(cookieId) : void 0) ?? store.create();
+    c.set("session", session);
+    await next();
+    if (session.destroyed) {
+      deleteCookie(c, SESSION_COOKIE, { path: "/" });
+      return;
+    }
+    store.set(session);
+    await setSignedCookie(c, SESSION_COOKIE, session.id, secret, {
+      path: "/",
+      httpOnly: true,
+      sameSite: "Lax",
+      maxAge: MAX_AGE_SECONDS
+    });
+  };
+}
+function getSessionIndex(session) {
+  let hash = 0;
+  for (let i = 0; i < session.id.length; i++) {
+    hash = (hash << 5) - hash + session.id.charCodeAt(i);
+    hash = hash & hash;
+  }
+  return Math.abs(hash).toString();
+}
+function createLogoutStore(session) {
+  const bag = () => session.data._logoutState ??= {};
+  return {
+    save(state) {
+      const handle = randomBytes(16).toString("hex");
+      bag()[handle] = state;
+      return handle;
+    },
+    load(handle, options) {
+      if (!handle) return void 0;
+      const state = bag()[handle];
+      if (state && options?.destroy) delete bag()[handle];
+      return state;
+    },
+    update(handle, state) {
+      bag()[handle] = state;
+    }
+  };
+}
+const IDP_PATHS = {
+  SSO: "/saml/sso",
+  SLO: "/saml/slo",
+  METADATA: "/metadata",
+  SIGN_IN: "/signin",
+  SIGN_OUT: "/signout",
+  SETTINGS: "/settings"
+};
+function initialSettings(options) {
+  return {
+    issuer: options.issuer,
+    serviceProviderId: options.serviceProviderId,
+    cert: options.cert,
+    key: options.key,
+    audience: options.audience,
+    recipient: options.acsUrl,
+    destination: options.acsUrl,
+    acsUrl: options.acsUrl,
+    sloUrl: options.sloUrl,
+    RelayState: options.relayState,
+    allowRequestAcsUrl: !options.disableRequestAcsUrl,
+    digestAlgorithm: "sha256",
+    signatureAlgorithm: "rsa-sha256",
+    signResponse: options.signResponse,
+    encryptAssertion: options.encryptAssertion,
+    encryptionCert: options.encryptionCert,
+    encryptionPublicKey: options.encryptionPublicKey,
+    encryptionAlgorithm: "http://www.w3.org/2001/04/xmlenc#aes256-cbc",
+    keyEncryptionAlgorithm: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p",
+    lifetimeInSeconds: 3600,
+    authnContextClassRef: options.authnContextClassRef,
+    authnContextDecl: options.authnContextDecl,
+    includeAttributeNameFormat: true
+  };
+}
+function createState(options) {
+  const snapshot = () => ({
+    settings: initialSettings(options),
+    user: structuredClone(options.config.user),
+    metadata: structuredClone(options.config.metadata)
+  });
+  const state = {
+    ...snapshot(),
+    reset() {
+      Object.assign(state, snapshot());
+    }
+  };
+  return state;
+}
+function pemToCert(pem) {
+  const cert = /-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/.exec(pem.toString());
+  if (cert) {
+    return cert[1].replace(/[\r\n]/g, "");
+  }
+  return null;
+}
+const UID_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function uid(len) {
+  let out = "";
+  for (let i = 0; i < len; i++) {
+    out += UID_CHARS[randomInt(0, UID_CHARS.length)];
+  }
+  return out;
+}
+function removeWhitespace(xml) {
+  return xml.replace(/\r\n/g, "").replace(/\n/g, "").replace(/>(\s*)</g, "><").trim();
+}
+function fixPemFormatting(pem) {
+  const entries = pem.toString().matchAll(/([-]{5}[^-\r\n]+[-]{5})([^-]*)([-]{5}[^-\r\n]+[-]{5})/g);
+  let fixed = "";
+  for (const parts of entries) {
+    fixed += `${parts[1]}
+${parts[2].replace(/[\r\n]/g, "")}
+${parts[3]}
+`;
+  }
+  if (fixed.length === 0) {
+    return pem;
+  }
+  return Buffer.from(fixed);
+}
+function formatInstant(date) {
+  return date.toISOString();
+}
+function escapeXml(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+const DEFAULT_ENCRYPTION_ALGORITHM = "http://www.w3.org/2001/04/xmlenc#aes256-cbc";
+const DEFAULT_KEY_ENCRYPTION_ALGORITHM = "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p";
+function derivePublicKey(cert) {
+  return new X509Certificate(cert).publicKey.export({ type: "spki", format: "pem" }).toString();
+}
+function encryptOnce(xml, options) {
+  return new Promise((resolve2, reject) => {
+    xmlenc.encrypt(xml, options, (err, encrypted) => err ? reject(err) : resolve2(encrypted));
+  });
+}
+async function encryptXml(xml, options) {
+  const encryptOptions = {
+    rsa_pub: options.encryptionPublicKey ?? derivePublicKey(options.encryptionCert),
+    pem: options.encryptionCert,
+    encryptionAlgorithm: options.encryptionAlgorithm ?? DEFAULT_ENCRYPTION_ALGORITHM,
+    keyEncryptionAlgorithm: options.keyEncryptionAlgorithm ?? DEFAULT_KEY_ENCRYPTION_ALGORITHM
+  };
+  try {
+    return removeWhitespace(await encryptOnce(xml, encryptOptions));
+  } catch {
+    const retried = await encryptOnce(xml, {
+      ...encryptOptions,
+      rsa_pub: fixPemFormatting(encryptOptions.rsa_pub),
+      pem: fixPemFormatting(encryptOptions.pem)
+    });
+    return removeWhitespace(retried);
+  }
+}
+const SIGNATURE_ALGORITHMS = {
+  "rsa-sha256": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+  "rsa-sha1": "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
+};
+const DIGEST_ALGORITHMS = {
+  sha256: "http://www.w3.org/2001/04/xmlenc#sha256",
+  sha1: "http://www.w3.org/2000/09/xmldsig#sha1"
+};
+const ENVELOPED_SIGNATURE = "http://www.w3.org/2000/09/xmldsig#enveloped-signature";
+const EXC_C14N = "http://www.w3.org/2001/10/xml-exc-c14n#";
+function signXml$1(xml, options) {
+  if (!options.key) throw new Error("Expect a private key in pem format");
+  if (!options.cert) throw new Error("Expect a public key cert in pem format");
+  const cert = pemToCert(options.cert);
+  if (!cert) throw new Error("Expect a public key cert in pem format");
+  const sign2 = (key) => {
+    const sig = new SignedXml({
+      privateKey: key,
+      signatureAlgorithm: SIGNATURE_ALGORITHMS[options.signatureAlgorithm ?? "rsa-sha256"],
+      canonicalizationAlgorithm: EXC_C14N,
+      idAttribute: options.signatureIdAttribute,
+      getKeyInfoContent: ({ prefix } = {}) => {
+        const p = prefix ? `${prefix}:` : "";
+        return `<${p}X509Data><${p}X509Certificate>${cert}</${p}X509Certificate></${p}X509Data>`;
+      }
+    });
+    sig.addReference({
+      xpath: options.xpathToSign,
+      transforms: [ENVELOPED_SIGNATURE, EXC_C14N],
+      digestAlgorithm: DIGEST_ALGORITHMS[options.digestAlgorithm ?? "sha256"]
+    });
+    sig.computeSignature(xml, {
+      location: { reference: options.xpathToNodeBeforeSignature, action: "after" },
+      prefix: options.signatureNamespacePrefix ?? ""
+    });
+    return sig.getSignedXml();
+  };
+  try {
+    return sign2(options.key);
+  } catch {
+    return sign2(fixPemFormatting(options.key));
+  }
+}
+function unsigned(xml) {
+  return removeWhitespace(xml);
+}
+const SAML_ASSERTION_NS = "urn:oasis:names:tc:SAML:2.0:assertion";
+const ASSERTION_TEMPLATE = `<saml:Assertion xmlns:saml="${SAML_ASSERTION_NS}" Version="2.0" ID="" IssueInstant="">
+  <saml:Issuer></saml:Issuer>
+  <saml:Subject>
+    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
+    <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+      <saml:SubjectConfirmationData />
+    </saml:SubjectConfirmation>
+  </saml:Subject>
+  <saml:Conditions />
+  <saml:AuthnStatement AuthnInstant="">
+    <saml:AuthnContext>
+      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
+    </saml:AuthnContext>
+  </saml:AuthnStatement>
+</saml:Assertion>`;
+function getAttributeType(value) {
+  switch (typeof value) {
+    case "string":
+      return "xs:string";
+    case "boolean":
+      return "xs:boolean";
+    case "number":
+      return "xs:double";
+    default:
+      return "xs:anyType";
+  }
+}
+const URI_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\S+$/;
+function getNameFormat(name$1) {
+  if (URI_RE.test(name$1)) {
+    return "urn:oasis:names:tc:SAML:2.0:attrname-format:uri";
+  }
+  if (name(name$1)) {
+    return "urn:oasis:names:tc:SAML:2.0:attrname-format:basic";
+  }
+  return "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified";
+}
+function buildAssertionDocument(options) {
+  const doc = new DOMParser().parseFromString(ASSERTION_TEMPLATE, "text/xml");
+  const root = doc.documentElement;
+  root.setAttribute("ID", `_${options.uid || uid(32)}`);
+  if (options.issuer) {
+    root.getElementsByTagName("saml:Issuer")[0].textContent = options.issuer;
+  }
+  const now = /* @__PURE__ */ new Date();
+  root.setAttribute("IssueInstant", formatInstant(now));
+  const conditions = root.getElementsByTagName("saml:Conditions")[0];
+  const confirmationData = root.getElementsByTagName("saml:SubjectConfirmationData")[0];
+  if (options.lifetimeInSeconds) {
+    const notOnOrAfter = formatInstant(new Date(now.getTime() + options.lifetimeInSeconds * 1e3));
+    conditions.setAttribute("NotBefore", formatInstant(now));
+    conditions.setAttribute("NotOnOrAfter", notOnOrAfter);
+    confirmationData.setAttribute("NotOnOrAfter", notOnOrAfter);
+  }
+  if (options.audiences) {
+    const audienceRestriction = doc.createElementNS(SAML_ASSERTION_NS, "saml:AudienceRestriction");
+    const audiences = Array.isArray(options.audiences) ? options.audiences : [options.audiences];
+    for (const audience of audiences) {
+      const element = doc.createElementNS(SAML_ASSERTION_NS, "saml:Audience");
+      element.textContent = audience;
+      audienceRestriction.appendChild(element);
+    }
+    conditions.appendChild(audienceRestriction);
+  }
+  if (options.recipient) confirmationData.setAttribute("Recipient", options.recipient);
+  if (options.inResponseTo) confirmationData.setAttribute("InResponseTo", options.inResponseTo);
+  const typedAttributes = options.typedAttributes ?? true;
+  const includeAttributeNameFormat = options.includeAttributeNameFormat ?? true;
+  if (options.attributes) {
+    const statement = doc.createElementNS(SAML_ASSERTION_NS, "saml:AttributeStatement");
+    statement.setAttribute("xmlns:xs", "http://www.w3.org/2001/XMLSchema");
+    statement.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance");
+    root.appendChild(statement);
+    for (const [prop, raw2] of Object.entries(options.attributes)) {
+      if (typeof raw2 === "undefined") continue;
+      const attributeElement = doc.createElementNS(SAML_ASSERTION_NS, "saml:Attribute");
+      attributeElement.setAttribute("Name", prop);
+      if (includeAttributeNameFormat) {
+        attributeElement.setAttribute("NameFormat", getNameFormat(prop));
+      }
+      const values = (Array.isArray(raw2) ? raw2 : [raw2]).filter((v) => typeof v !== "undefined");
+      for (const value of values) {
+        const valueElement = doc.createElementNS(SAML_ASSERTION_NS, "saml:AttributeValue");
+        valueElement.setAttribute("xsi:type", typedAttributes ? getAttributeType(value) : "xs:anyType");
+        valueElement.textContent = String(value);
+        attributeElement.appendChild(valueElement);
+      }
+      if (values.length > 0) {
+        statement.appendChild(attributeElement);
+      }
+    }
+  }
+  const authnStatement = root.getElementsByTagName("saml:AuthnStatement")[0];
+  authnStatement.setAttribute("AuthnInstant", formatInstant(now));
+  if (options.sessionIndex) {
+    authnStatement.setAttribute("SessionIndex", options.sessionIndex);
+  }
+  const nameID = root.getElementsByTagNameNS(SAML_ASSERTION_NS, "NameID")[0];
+  if (options.nameIdentifier) nameID.textContent = options.nameIdentifier;
+  if (options.nameIdentifierFormat) nameID.setAttribute("Format", options.nameIdentifierFormat);
+  if (options.nameIdentifierNameQualifier) {
+    nameID.setAttribute("NameQualifier", options.nameIdentifierNameQualifier);
+  }
+  if (options.nameIdentifierSPNameQualifier) {
+    nameID.setAttribute("SPNameQualifier", options.nameIdentifierSPNameQualifier);
+  }
+  if (options.nameIdentifierSPProvidedID) {
+    nameID.setAttribute("SPProvidedID", options.nameIdentifierSPProvidedID);
+  }
+  if (options.authnContextClassRef) {
+    root.getElementsByTagName("saml:AuthnContextClassRef")[0].textContent = options.authnContextClassRef;
+  }
+  if (typeof options.transformAssertion === "function") {
+    options.transformAssertion(doc);
+  }
+  return doc;
+}
+async function createAssertion(options) {
+  const doc = buildAssertionDocument(options);
+  const xml = removeWhitespace(new XMLSerializer().serializeToString(doc));
+  const signed = options.signAssertion === false ? unsigned(xml) : signXml$1(xml, {
+    key: options.key,
+    cert: options.cert,
+    signatureAlgorithm: options.signatureAlgorithm,
+    digestAlgorithm: options.digestAlgorithm,
+    signatureNamespacePrefix: options.signatureNamespacePrefix,
+    xpathToNodeBeforeSignature: "//*[local-name(.)='Issuer']",
+    xpathToSign: "//*[local-name(.)='Assertion']",
+    signatureIdAttribute: "ID"
+  });
+  if (!options.encryptionCert) {
+    return signed;
+  }
+  const encryptOptions = {
+    encryptionCert: options.encryptionCert,
+    encryptionPublicKey: options.encryptionPublicKey,
+    encryptionAlgorithm: options.encryptionAlgorithm,
+    keyEncryptionAlgorithm: options.keyEncryptionAlgorithm
+  };
+  const encrypted = await encryptXml(signed, encryptOptions);
+  return removeWhitespace(
+    `<saml:EncryptedAssertion xmlns:saml="${SAML_ASSERTION_NS}">${encrypted}</saml:EncryptedAssertion>`
+  );
+}
+const BINDINGS = {
+  HTTP_REDIRECT: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+};
+const STATUS = {
+  SUCCESS: "urn:oasis:names:tc:SAML:2.0:status:Success",
+  PARTIAL_LOGOUT: "urn:oasis:names:tc:SAML:2.0:status:PartialLogout"
+};
+const ELEMENTS = {
+  LOGOUT_REQUEST: {
+    PROP: "SAMLRequest",
+    SIGNATURE_VALIDATION_PATH: "//*[local-name(.)='LogoutRequest']/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
+    SIGNATURE_LOCATION_PATH: "//*[local-name(.)='LogoutRequest' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:protocol']",
+    ISSUER_PATH: "//*[local-name(.)='Issuer' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:assertion']/text()",
+    SESSION_INDEX_PATH: "//*[local-name(.)='SessionIndex' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:protocol']/text()",
+    NAME_ID: "//*[local-name(.)='NameID' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:assertion']/text()"
+  },
+  LOGOUT_RESPONSE: {
+    PROP: "SAMLResponse",
+    SIGNATURE_VALIDATION_PATH: "//*[local-name(.)='LogoutResponse']/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
+    SIGNATURE_LOCATION_PATH: "//*[local-name(.)='LogoutResponse' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:protocol']"
+  },
+  RESPONSE: {
+    PROP: "SAMLResponse",
+    SIGNATURE_LOCATION_PATH: "//*[local-name(.)='Response' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:protocol']"
+  },
+  AUTHN_REQUEST: {
+    PROP: "SAMLRequest",
+    SIGNATURE_VALIDATION_PATH: "//*[local-name(.)='AuthnRequest']/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
+    AUTHN_CONTEXT_CLASS_REF_PATH: "//*[local-name(.)='AuthnContextClassRef']/text()"
+  }
+};
+const ALGORITHMS = {
+  SIGNATURE: {
+    "rsa-sha256": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+    "rsa-sha1": "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
+  }
+};
+function removeHeaders(cert) {
+  const pem = /-----BEGIN (\w*)-----([^-]*)-----END (\w*)-----/g.exec(cert.toString());
+  if (pem && pem.length > 0) {
+    return pem[2].replace(/[\r\n]/g, "");
+  }
+  return null;
+}
+function calculateThumbprint(base64Cert) {
+  return createHash("sha1").update(Buffer.from(base64Cert.replace(/\s/g, ""), "base64")).digest("hex").toUpperCase();
+}
+const fm = {
+  nameIdentifier: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
+  email: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+  name: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+  givenname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+  surname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
+};
+const DONT_REMAP = ["emails", "displayName", "name", "id", "_json"];
+const passportProfileMapper = {
+  metadata: [
+    { id: fm.email, optional: true, displayName: "E-Mail Address", description: "The e-mail address of the user" },
+    { id: fm.givenname, optional: true, displayName: "Given Name", description: "The given name of the user" },
+    { id: fm.name, optional: true, displayName: "Name", description: "The unique name of the user" },
+    { id: fm.surname, optional: true, displayName: "Surname", description: "The surname of the user" },
+    { id: fm.nameIdentifier, optional: true, displayName: "Name ID", description: "The SAML name identifier of the user" }
+  ],
+  getClaims(pu) {
+    const claims = {};
+    claims[fm.nameIdentifier] = pu.id;
+    claims[fm.email] = pu.emails?.[0]?.value;
+    claims[fm.name] = pu.displayName;
+    claims[fm.givenname] = pu.name?.givenName;
+    claims[fm.surname] = pu.name?.familyName;
+    for (const key of Object.keys(pu)) {
+      if (!DONT_REMAP.includes(key)) {
+        claims["http://schemas.passportjs.com/" + key] = pu[key];
+      }
+    }
+    return claims;
+  },
+  getNameIdentifier(pu) {
+    const claims = this.getClaims(pu) ?? {};
+    return {
+      nameIdentifier: claims[fm.nameIdentifier] || claims[fm.name] || claims[fm.email]
+    };
+  }
+};
+function parseXml(xml) {
+  return new DOMParser({
+    onError: (level, msg) => {
+      if (level === "fatalError") throw new Error(msg);
+    }
+  }).parseFromString(xml, "text/xml");
+}
+function selectNodes(expression, node) {
+  const result = xpath.select(expression, node);
+  return Array.isArray(result) ? result : [];
+}
+const DEFAULT_SIG_ALG = "rsa-sha256";
+const DEFAULT_DIGEST_ALG = "sha256";
+const DSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+function getSigAlg(options) {
+  return ALGORITHMS.SIGNATURE[options.signatureAlgorithm ?? DEFAULT_SIG_ALG];
+}
+function signXml(options, xml) {
+  return signXml$1(xml, {
+    key: options.key,
+    cert: options.cert,
+    signatureAlgorithm: options.signatureAlgorithm ?? DEFAULT_SIG_ALG,
+    digestAlgorithm: options.digestAlgorithm ?? DEFAULT_DIGEST_ALG,
+    xpathToSign: options.reference ?? ELEMENTS.LOGOUT_REQUEST.SIGNATURE_LOCATION_PATH,
+    xpathToNodeBeforeSignature: "//*[local-name(.)='Issuer']",
+    signatureIdAttribute: "ID"
+  });
+}
+function certToPEM(cert) {
+  const value = cert.toString();
+  if (/-----BEGIN CERTIFICATE-----/.test(value)) {
+    return value;
+  }
+  const body = value.replace(/\s/g, "").match(/.{1,64}/g)?.join("\n") ?? "";
+  return `-----BEGIN CERTIFICATE-----
+${body}
+-----END CERTIFICATE-----
+`;
+}
+function validateXmlEmbeddedSignature(xml, xmlString, options) {
+  const signature = selectNodes(
+    "/*/*[local-name(.)='Signature' and namespace-uri(.)='" + DSIG_NS + "']",
+    xml
+  )[0];
+  if (!signature) {
+    return ["Signature is missing"];
+  }
+  const thumbprints = options.thumbprints ? Array.isArray(options.thumbprints) ? options.thumbprints : [options.thumbprints] : [];
+  let calculatedThumbprint = "";
+  const sig = new SignedXml({
+    publicCert: options.signingCert ? certToPEM(options.signingCert) : void 0,
+    getCertFromKeyInfo: (keyInfo) => {
+      if (thumbprints.length === 0 || !keyInfo) return null;
+      const certNode = selectNodes(".//*[local-name(.)='X509Certificate']", keyInfo)[0];
+      const base64 = certNode?.textContent?.replace(/\s/g, "");
+      if (!base64) return null;
+      calculatedThumbprint = calculateThumbprint(base64);
+      return certToPEM(base64);
+    }
+  });
+  if (!options.signingCert && thumbprints.length === 0) {
+    return ["options.signingCert or options.thumbprints must be specified to validate the signature"];
+  }
+  try {
+    sig.loadSignature(signature);
+    if (!sig.checkSignature(xmlString)) {
+      return sig.getSignedReferences().length === 0 ? ["Invalid signature"] : ["Invalid signature reference"];
+    }
+  } catch (e) {
+    return [e instanceof Error ? e.message : String(e)];
+  }
+  if (thumbprints.length > 0 && !options.signingCert) {
+    const valid = thumbprints.some((t) => calculatedThumbprint === t.replace(/:/g, "").toUpperCase());
+    if (!valid) {
+      return [
+        `Invalid thumbprint (configured: ${thumbprints.join(", ").toUpperCase()}. calculated: ${calculatedThumbprint})`
+      ];
+    }
+  }
+  return [];
+}
+function sign(options, content) {
+  const signer = createSign((options.signatureAlgorithm ?? DEFAULT_SIG_ALG).toUpperCase());
+  signer.update(content);
+  return signer.sign(options.key, "base64");
+}
+function isValidContentAndSignature(content, signature, options) {
+  const verifier = createVerify(options.signatureAlgorithm.split("#")[1].toUpperCase());
+  verifier.update(content);
+  return verifier.verify(certToPEM(options.signingCert), signature, "base64");
+}
+function samlResponse(data) {
+  return `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="${escapeXml(data.id)}"` + (data.inResponseTo ? ` InResponseTo="${escapeXml(data.inResponseTo)}"` : "") + ` Version="2.0" IssueInstant="${escapeXml(data.instant)}"` + (data.destination ? ` Destination="${escapeXml(data.destination)}"` : "") + `><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">${escapeXml(data.issuer)}</saml:Issuer><samlp:Status><samlp:StatusCode Value="${escapeXml(data.samlStatusCode)}"/>` + (data.samlStatusMessage ? `<samlp:StatusMessage Value="${escapeXml(data.samlStatusMessage)}"/>` : "") + `</samlp:Status>` + (data.assertion ?? "") + `</samlp:Response>`;
+}
+function logoutResponse(data) {
+  return `<samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="${escapeXml(data.id)}"` + (data.inResponseTo ? ` InResponseTo="${escapeXml(data.inResponseTo)}"` : "") + ` Version="2.0" IssueInstant="${escapeXml(data.instant)}"` + (data.destination ? ` Destination="${escapeXml(data.destination)}"` : "") + `><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">${escapeXml(data.issuer)}</saml:Issuer><samlp:Status><samlp:StatusCode Value="${escapeXml(data.samlStatusCode)}"/>` + (data.samlStatusMessage ? `<samlp:StatusMessage>${escapeXml(data.samlStatusMessage)}</samlp:StatusMessage>` : "") + `</samlp:Status></samlp:LogoutResponse>`;
+}
+function logoutRequest(data) {
+  const nameId = data.NameID;
+  return `<samlp:LogoutRequest ID="_${escapeXml(data.ID)}" Version="2.0" IssueInstant="${escapeXml(data.IssueInstant)}"` + (data.Destination ? ` Destination="${escapeXml(data.Destination)}"` : "") + ` Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">${escapeXml(data.Issuer)}</Issuer><NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion"` + (nameId.NameQualifier ? ` NameQualifier="${escapeXml(nameId.NameQualifier)}"` : "") + (nameId.SPNameQualifier ? ` SPNameQualifier="${escapeXml(nameId.SPNameQualifier)}"` : "") + (nameId.Format ? ` Format="${escapeXml(nameId.Format)}"` : "") + (nameId.SPProvidedID ? ` SPProvidedID="${escapeXml(nameId.SPProvidedID)}"` : "") + `>${escapeXml(nameId.value)}</NameID>` + (data.SessionIndex ? `<samlp:SessionIndex>${escapeXml(data.SessionIndex)}</samlp:SessionIndex>` : "") + `</samlp:LogoutRequest>`;
+}
+function metadata(data) {
+  const lines = [
+    `<EntityDescriptor entityID="${escapeXml(data.issuer)}" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">`,
+    `  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">`,
+    `    <KeyDescriptor use="signing">`,
+    `      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">`,
+    `        <X509Data>`,
+    `          <X509Certificate>${escapeXml(data.pem)}</X509Certificate>`,
+    `        </X509Data>`,
+    `      </KeyInfo>`,
+    `    </KeyDescriptor>`
+  ];
+  if (data.logoutEndpoints.redirect) {
+    lines.push(
+      `    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${escapeXml(data.logoutEndpoints.redirect)}"/>`
+    );
+  }
+  if (data.logoutEndpoints.post) {
+    lines.push(
+      `    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${escapeXml(data.logoutEndpoints.post)}"/>`
+    );
+  }
+  lines.push(
+    `    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>`,
+    `    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>`,
+    `    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>`,
+    `    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${escapeXml(data.redirectEndpoint)}"/>`,
+    `    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${escapeXml(data.postEndpoint)}"/>`
+  );
+  for (const ct of data.claimTypes) {
+    lines.push(
+      `    <Attribute Name="${escapeXml(ct.id)}" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="${escapeXml(ct.displayName)}" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>`
+    );
+  }
+  lines.push(`  </IDPSSODescriptor>`, `</EntityDescriptor>`);
+  return lines.join("\n");
+}
+const inflateRawAsync$1 = promisify(inflateRaw);
+const SIGNATURE_ALGORITHM_NAMES = {
+  "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256": "rsa-sha256",
+  "http://www.w3.org/2000/09/xmldsig#rsa-sha1": "rsa-sha1"
+};
+function generateUniqueID() {
+  return randomBytes(10).toString("hex");
+}
+function formatXmlDateTime(date) {
+  return date.toISOString();
+}
+function generateInstant() {
+  return formatXmlDateTime(/* @__PURE__ */ new Date());
+}
+function appendQueryString(initialUrl, query) {
+  const parsed = new URL(initialUrl);
+  for (const [key, value] of Object.entries(query)) {
+    parsed.searchParams.set(key, value);
+  }
+  return parsed.toString();
+}
+function isXmlBuffer(input) {
+  return input[0] === 60;
+}
+async function parseSamlRequest(input, samlRequest, type, options = {}) {
+  if (!samlRequest) return void 0;
+  const raw2 = Buffer.from(samlRequest, "base64");
+  let xmlString;
+  if (isXmlBuffer(raw2)) {
+    xmlString = raw2.toString();
+  } else {
+    xmlString = (await inflateRawAsync$1(raw2)).toString();
+  }
+  let xml;
+  try {
+    xml = parseXml(xmlString);
+  } catch (e) {
+    throw new Error(e instanceof Error ? e.message : String(e));
+  }
+  if (!xml || !xml.documentElement) {
+    throw new Error("Invalid SAML Request");
+  }
+  const credentials = await configureSigningCredentials(xml, type, options);
+  if (!credentials) return xml;
+  validateSignature(input, type, xml, xmlString, {
+    signingCert: credentials.cert,
+    thumbprints: credentials.thumbprints,
+    deflate: !!input.query.Signature,
+    relayState: options.relayState,
+    signaturePath: options.signaturePath
+  });
+  return xml;
+}
+async function configureSigningCredentials(xml, type, options) {
+  if (options.signingCert || options.thumbprints && options.thumbprints.length > 0) {
+    return { cert: options.signingCert, thumbprints: options.thumbprints };
+  }
+  if (!options.getCredentials) return void 0;
+  const descriptor = ELEMENTS[type];
+  const issuer = descriptor.ISSUER_PATH ? selectNodes(descriptor.ISSUER_PATH, xml)[0]?.textContent ?? void 0 : void 0;
+  let sessionIndices;
+  if (descriptor.SESSION_INDEX_PATH) {
+    const nodes = selectNodes(descriptor.SESSION_INDEX_PATH, xml);
+    if (nodes.length > 0) sessionIndices = nodes.map((n) => n.textContent ?? "");
+  }
+  let nameId;
+  if (descriptor.NAME_ID) {
+    nameId = selectNodes(descriptor.NAME_ID, xml)[0]?.textContent ?? void 0;
+  }
+  if (!issuer && !(sessionIndices && sessionIndices.length) && !nameId) {
+    return void 0;
+  }
+  let credentials;
+  try {
+    credentials = await options.getCredentials(issuer, sessionIndices, nameId);
+  } catch {
+    return void 0;
+  }
+  if (!credentials) return void 0;
+  return credentials;
+}
+function validateSignature(input, elementType, xml, xmlString, options) {
+  const descriptor = ELEMENTS[elementType];
+  const prop = descriptor.PROP;
+  const isRequestSigned = !options.deflate ? selectNodes(options.signaturePath ?? descriptor.SIGNATURE_VALIDATION_PATH, xml).length > 0 : !!input.query.Signature;
+  if (isRequestSigned) {
+    if (input.body[prop] || !options.deflate) {
+      const errors = validateXmlEmbeddedSignature(xml, xmlString, options);
+      if (errors.length > 0) {
+        throw new Error("Signature check errors: " + errors.join("; "));
+      }
+    } else {
+      const signedContent = {
+        [prop]: input.query[prop],
+        RelayState: input.query.RelayState || options.relayState,
+        SigAlg: input.query.SigAlg
+      };
+      if (!signedContent.RelayState) {
+        delete signedContent.RelayState;
+      }
+      if (!signedContent.SigAlg) {
+        throw new Error("Signature Algorithm is missing");
+      }
+      if (!SIGNATURE_ALGORITHM_NAMES[signedContent.SigAlg]) {
+        throw new Error(
+          "Invalid signature algorithm. Supported algorithms are http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 and http://www.w3.org/2000/09/xmldsig#rsa-sha1"
+        );
+      }
+      if (!options.signingCert) {
+        throw new Error("options.signingCert must be specified to validate a detached signature");
+      }
+      const valid = isValidContentAndSignature(
+        qs.stringify(signedContent),
+        input.query.Signature,
+        { signingCert: options.signingCert, signatureAlgorithm: signedContent.SigAlg }
+      );
+      if (!valid) {
+        throw new Error(
+          "Signature check errors: The signature provided (" + input.query.Signature + ") does not match the one calculated"
+        );
+      }
+    }
+  } else if (options.signingCert) {
+    throw new Error(prop + " message MUST be signed when using an asynchronous binding (POST or Redirect)");
+  }
+}
+const ISSUER_XPATH = "//*[local-name(.)='Issuer' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:assertion']/text()";
+class SamlpError extends Error {
+  status;
+  context;
+  constructor(message, status = 500, context) {
+    super(message);
+    this.name = "SamlpError";
+    this.status = status;
+    this.context = context;
+  }
+}
+function buildSamlResponse(options) {
+  let response = samlResponse({
+    id: "_" + generateUniqueID(),
+    instant: generateInstant(),
+    destination: options.destination || options.audience,
+    inResponseTo: options.inResponseTo,
+    issuer: options.issuer,
+    samlStatusCode: options.samlStatusCode ?? STATUS.SUCCESS,
+    samlStatusMessage: options.samlStatusMessage,
+    assertion: options.samlAssertion || ""
+  });
+  if (options.signResponse) {
+    response = signXml(
+      {
+        key: options.key,
+        cert: options.cert,
+        signatureAlgorithm: options.signatureAlgorithm,
+        digestAlgorithm: options.digestAlgorithm,
+        reference: ELEMENTS.RESPONSE.SIGNATURE_LOCATION_PATH
+      },
+      response
+    );
+  }
+  return response;
+}
+function nameIdentifierNotFoundErrorMessage(options) {
+  const probes = Array.isArray(options.nameIdentifierProbes) ? options.nameIdentifierProbes.join(", ") : "";
+  return "No attribute was found to generate the nameIdentifier. We tried with: " + probes;
+}
+async function createSamlResponse(samlConfig, user) {
+  const options = {
+    ...samlConfig,
+    profileMapper: samlConfig.profileMapper ?? passportProfileMapper,
+    signAssertion: typeof samlConfig.signAssertion !== "boolean" || samlConfig.signAssertion,
+    signatureNamespacePrefix: typeof samlConfig.signatureNamespacePrefix === "string" ? samlConfig.signatureNamespacePrefix : ""
+  };
+  const mapper = options.profileMapper;
+  const claims = mapper.getClaims(user);
+  const ni = mapper.getNameIdentifier(user);
+  if (!ni || !ni.nameIdentifier) {
+    throw new SamlpError(nameIdentifierNotFoundErrorMessage(options), 500, { user });
+  }
+  const samlAssertion = await createAssertion({
+    signatureAlgorithm: options.signatureAlgorithm,
+    digestAlgorithm: options.digestAlgorithm,
+    signAssertion: options.signAssertion,
+    cert: options.cert,
+    key: options.key,
+    issuer: options.issuer,
+    lifetimeInSeconds: options.lifetimeInSeconds || 3600,
+    audiences: options.audience,
+    attributes: claims || void 0,
+    nameIdentifier: ni.nameIdentifier,
+    nameIdentifierFormat: ni.nameIdentifierFormat || options.nameIdentifierFormat,
+    nameIdentifierNameQualifier: ni.nameIdentifierNameQualifier,
+    nameIdentifierSPNameQualifier: ni.nameIdentifierSPNameQualifier,
+    nameIdentifierSPProvidedID: ni.nameIdentifierSPProvidedID,
+    recipient: options.recipient,
+    inResponseTo: options.inResponseTo,
+    authnContextClassRef: options.authnContextClassRef,
+    encryptionPublicKey: options.encryptionPublicKey,
+    encryptionCert: options.encryptionCert,
+    encryptionAlgorithm: options.encryptionAlgorithm,
+    keyEncryptionAlgorithm: options.keyEncryptionAlgorithm,
+    sessionIndex: options.sessionIndex,
+    typedAttributes: options.typedAttributes,
+    includeAttributeNameFormat: options.includeAttributeNameFormat,
+    signatureNamespacePrefix: options.signatureNamespacePrefix,
+    transformAssertion: options.transformAssertion
+  });
+  return buildSamlResponse({
+    ...options,
+    samlAssertion,
+    samlStatusCode: options.samlStatusCode || STATUS.SUCCESS
+  });
+}
+async function authenticate(input, options, user) {
+  const opts = {
+    ...options,
+    signatureAlgorithm: options.signatureAlgorithm || "rsa-sha256",
+    digestAlgorithm: options.digestAlgorithm || "sha256"
+  };
+  if (typeof opts.getPostURL !== "function") {
+    throw new Error("getPostURL is required");
+  }
+  const samlRequest = input.query.SAMLRequest || input.body.SAMLRequest;
+  const samlRequestDom = await parseSamlRequest(input, samlRequest, "AUTHN_REQUEST", {
+    ...opts,
+    relayState: opts.RelayState || input.query.RelayState
+  });
+  let audience = opts.audience;
+  if (samlRequestDom) {
+    if (!audience) {
+      audience = selectNodes(ISSUER_XPATH, samlRequestDom)[0]?.textContent ?? void 0;
+    }
+    const id = samlRequestDom.documentElement?.getAttribute("ID");
+    if (id) opts.inResponseTo = opts.inResponseTo || id;
+  }
+  const postUrl = await opts.getPostURL(audience, samlRequestDom);
+  if (!postUrl) throw new SamlpError("Unable to determine the Assertion Consumer Service URL", 401);
+  if (!user) throw new SamlpError("Unauthorized", 401);
+  opts.audience = audience;
+  opts.postUrl = postUrl;
+  const xml = await createSamlResponse(opts, user);
+  return {
+    url: postUrl,
+    field: "SAMLResponse",
+    value: Buffer.from(xml).toString("base64"),
+    relayState: opts.RelayState || input.query.RelayState || input.body.RelayState || "",
+    xml,
+    options: opts
+  };
+}
+async function parseRequest(input, options = {}) {
+  const samlRequest = input.query.SAMLRequest || input.body.SAMLRequest;
+  if (!samlRequest) return void 0;
+  const dom = await parseSamlRequest(input, samlRequest, "AUTHN_REQUEST", options);
+  if (!dom) return void 0;
+  const data = {};
+  const root = dom.documentElement;
+  const issuer = selectNodes(ISSUER_XPATH, dom);
+  if (issuer.length > 0) data.issuer = issuer[0].textContent ?? void 0;
+  const subject = selectNodes(
+    "//*[local-name(.)='Subject' and namespace-uri(.)='urn:oasis:names:tc:SAML:2.0:assertion']/*[local-name(.)='NameID']",
+    dom
+  );
+  if (subject.length > 0) data.subject = subject[0].textContent ?? void 0;
+  const acs = root.getAttribute("AssertionConsumerServiceURL");
+  if (acs) data.assertionConsumerServiceURL = acs;
+  const destination = root.getAttribute("Destination");
+  if (destination) data.destination = destination;
+  const forceAuthn = root.getAttribute("ForceAuthn");
+  if (forceAuthn) data.forceAuthn = forceAuthn;
+  const id = root.getAttribute("ID");
+  if (id) data.id = id;
+  const classRefs = selectNodes(ELEMENTS.AUTHN_REQUEST.AUTHN_CONTEXT_CLASS_REF_PATH, dom);
+  if (classRefs.length === 1) {
+    data.requestedAuthnContext = { authnContextClassRef: classRefs[0].textContent ?? "" };
+  }
+  return data;
+}
+function matchingIndex(issuer, sessionIndex, nameId) {
+  return (session) => {
+    if (session.serviceProviderId && issuer && session.serviceProviderId !== issuer) {
+      return false;
+    }
+    const hasMatchingSessionIndex = Array.isArray(sessionIndex) ? sessionIndex.some((si) => si === session.sessionIndex) : sessionIndex === session.sessionIndex;
+    return hasMatchingSessionIndex && session.nameId === nameId;
+  };
+}
+class SessionParticipants {
+  participants;
+  constructor(sessions = []) {
+    this.participants = sessions;
+  }
+  /** Finds a participant by issuer (optional), session index and NameID. */
+  get(issuer, sessionIndices, nameId) {
+    return this.participants.find(matchingIndex(issuer, sessionIndices, nameId));
+  }
+  hasElements() {
+    return this.participants.length > 0;
+  }
+  /** Returns the first participant without removing it. */
+  getFirst() {
+    return this.participants[0];
+  }
+  /** Removes and returns the matching participant (if any). */
+  remove(issuer, sessionIndex, nameId) {
+    if (this.participants.length === 0 || !issuer) return null;
+    const index = this.participants.findIndex(matchingIndex(issuer, sessionIndex, nameId));
+    if (index === -1) return null;
+    return this.participants.splice(index, 1)[0];
+  }
+}
+const whitespace = /^\s+$/;
+function removeEmptyNodes(node) {
+  for (let i = 0; i < node.childNodes.length; i++) {
+    const current = node.childNodes[i];
+    if (current.nodeType === 3 && whitespace.test(current.nodeValue ?? "")) {
+      node.removeChild(current);
+      i--;
+    } else if (current.nodeType === 1) {
+      removeEmptyNodes(current);
+    }
+  }
+}
+function trimXml(xml) {
+  const dom = new DOMParser().parseFromString(xml, "text/xml");
+  removeEmptyNodes(dom);
+  return new XMLSerializer().serializeToString(dom);
+}
+const deflateRawAsync = promisify(deflateRaw);
+const inflateRawAsync = promisify(inflateRaw);
+async function parseIncomingLogoutRequest(input, samlRequest, options) {
+  const type = "LOGOUT_REQUEST";
+  const dom = await parseSamlRequest(input, samlRequest, type, options);
+  const descriptor = ELEMENTS[type];
+  const data = {};
+  const issuer = selectNodes(descriptor.ISSUER_PATH, dom);
+  if (issuer.length > 0) data.issuer = issuer[0].textContent ?? void 0;
+  const sessionIndexNodes = selectNodes("//*[local-name(.)='SessionIndex']/text()", dom);
+  if (sessionIndexNodes.length > 0) data.sessionIndices = sessionIndexNodes.map((n) => n.textContent ?? "");
+  const nameId = selectNodes("//*[local-name(.)='NameID']", dom);
+  if (nameId.length > 0) {
+    data.nameId = nameId[0].textContent ?? void 0;
+    data.nameIdFormat = nameId[0].getAttribute("Format") ?? void 0;
+  }
+  const root = dom.documentElement;
+  const destination = root.getAttribute("Destination");
+  if (destination) data.destination = destination;
+  const id = root.getAttribute("ID");
+  if (id) data.id = id;
+  const signature = selectNodes(descriptor.SIGNATURE_VALIDATION_PATH, dom);
+  if (signature.length > 0) data.signature = signature[0].textContent ?? void 0;
+  return data;
+}
+async function prepareAndSendToken(elementType, token, options, ctx) {
+  const type = ELEMENTS[elementType].PROP;
+  const params = { [type]: "", RelayState: ctx.relayState || "" };
+  const send = () => {
+    if (options.protocolBinding !== BINDINGS.HTTP_REDIRECT) {
+      return {
+        type: "post",
+        url: ctx.destination,
+        field: type,
+        value: params[type],
+        relayState: params.RelayState ?? ""
+      };
+    }
+    try {
+      return { type: "redirect", url: appendQueryString(ctx.destination, params) };
+    } catch {
+      throw new Error("The logout URL may be missing or misconfigured");
+    }
+  };
+  const canonical = trimXml(token);
+  const signingOptions = {
+    key: options.key,
+    cert: options.cert,
+    signatureAlgorithm: options.signatureAlgorithm,
+    digestAlgorithm: options.digestAlgorithm,
+    reference: ctx.reference
+  };
+  if (options.protocolBinding !== BINDINGS.HTTP_REDIRECT || !options.deflate) {
+    params[type] = Buffer.from(signXml(signingOptions, canonical)).toString("base64");
+    return send();
+  }
+  params[type] = (await deflateRawAsync(Buffer.from(canonical))).toString("base64");
+  if (params.RelayState === "") delete params.RelayState;
+  params.SigAlg = getSigAlg(options);
+  params.Signature = sign(options, qs.stringify(params));
+  return send();
+}
+async function prepareAndSendLogoutRequest(options, transactionId) {
+  const { sessionParticipants } = options;
+  if (!sessionParticipants.hasElements()) {
+    return finalize(options, transactionId);
+  }
+  const participant = sessionParticipants.getFirst();
+  const relayState = options.store.save({
+    transactionId,
+    sessionIndex: participant.sessionIndex,
+    issuer: participant.serviceProviderId,
+    nameId: participant.nameId
+  });
+  const logoutRequest$1 = logoutRequest({
+    ID: generateUniqueID(),
+    IssueInstant: generateInstant(),
+    Issuer: options.issuer,
+    // IdP identifier
+    NameID: { value: participant.nameId, Format: participant.nameIdFormat },
+    SessionIndex: participant.sessionIndex,
+    Destination: participant.serviceProviderLogoutURL
+  });
+  return prepareAndSendToken("LOGOUT_REQUEST", logoutRequest$1, options, {
+    destination: participant.serviceProviderLogoutURL,
+    relayState
+  });
+}
+async function finalize(options, transactionId) {
+  const transaction = options.store.load(transactionId, { destroy: true });
+  let isPartialLogout = !!transaction && transaction.global_status === "failed";
+  try {
+    await options.clearIdPSession?.();
+  } catch {
+    isPartialLogout = true;
+  }
+  if (!transaction || !transaction.parsedRequest) {
+    return { type: "done" };
+  }
+  const data = transaction.parsedRequest;
+  const destination = data.serviceProviderLogoutURL || options.destination;
+  const logoutResponse$1 = logoutResponse({
+    id: "_" + generateUniqueID(),
+    instant: generateInstant(),
+    inResponseTo: data.id,
+    destination,
+    issuer: options.issuer,
+    samlStatusCode: isPartialLogout ? STATUS.PARTIAL_LOGOUT : STATUS.SUCCESS,
+    samlStatusMessage: options.samlStatusMessage
+  });
+  return prepareAndSendToken("LOGOUT_RESPONSE", logoutResponse$1, options, {
+    destination,
+    // We stored the relay state of the initial request
+    relayState: transaction.relayState,
+    reference: ELEMENTS.LOGOUT_RESPONSE.SIGNATURE_LOCATION_PATH
+  });
+}
+async function validateSamlResponse(input, options, cert) {
+  const samlResponse2 = input.query.SAMLResponse || input.body.SAMLResponse;
+  const raw2 = Buffer.from(samlResponse2, "base64");
+  const xmlString = input.body.SAMLResponse || !options.deflate ? raw2.toString() : (await inflateRawAsync(raw2)).toString();
+  const xml = parseXml(xmlString);
+  const PROTOCOL_NS = "urn:oasis:names:tc:SAML:2.0:protocol";
+  const parsed = {};
+  const statusCodes = xml.getElementsByTagNameNS(PROTOCOL_NS, "StatusCode");
+  if (statusCodes[0]) {
+    parsed.status = statusCodes[0].getAttribute("Value") ?? void 0;
+    if (statusCodes[1]) parsed.subCode = statusCodes[1].getAttribute("Value") ?? void 0;
+  }
+  const message = xml.getElementsByTagNameNS(PROTOCOL_NS, "StatusMessage")[0];
+  if (message) parsed.message = message.textContent ?? void 0;
+  const detail = xml.getElementsByTagNameNS(PROTOCOL_NS, "StatusDetail")[0];
+  if (detail) parsed.detail = detail.textContent ?? void 0;
+  const issuer = xml.getElementsByTagNameNS("urn:oasis:names:tc:SAML:2.0:assertion", "Issuer")[0];
+  if (issuer) parsed.issuer = issuer.textContent ?? void 0;
+  if (cert) {
+    validateSignature(input, "LOGOUT_RESPONSE", xml, xmlString, {
+      signingCert: cert,
+      deflate: options.deflate
+    });
+  }
+  return parsed;
+}
+async function logout(input, options) {
+  const relayStateParam = input.query.RelayState || input.body.RelayState;
+  const samlRequest = input.query.SAMLRequest || input.body.SAMLRequest;
+  if (samlRequest) {
+    const requestData = await parseIncomingLogoutRequest(input, samlRequest, {
+      getCredentials: (issuer, sessionIndices, nameId) => {
+        const session2 = options.sessionParticipants.get(issuer, sessionIndices, nameId);
+        if (!session2) throw new Error("Invalid Session Participant");
+        if (!session2.cert) return void 0;
+        return { cert: session2.cert, thumbprints: session2.thumbprint };
+      }
+    });
+    if (!requestData.issuer) {
+      throw new SamlpError("SAML Request with no issuer. Issuer is a mandatory element.", 400);
+    }
+    const session = options.sessionParticipants.get(
+      requestData.issuer,
+      requestData.sessionIndices,
+      requestData.nameId
+    );
+    if (!session && !options.destination) {
+      throw new SamlpError("Invalid Session Participant", 400);
+    }
+    const transactionId2 = options.store.save({
+      parsedRequest: {
+        id: requestData.id,
+        serviceProviderLogoutURL: session?.serviceProviderLogoutURL || options.destination
+      },
+      relayState: relayStateParam
+    });
+    options.sessionParticipants.remove(session?.serviceProviderId, session?.sessionIndex, session?.nameId);
+    return prepareAndSendLogoutRequest(options, transactionId2);
+  }
+  if (input.query.SAMLResponse || input.body.SAMLResponse) {
+    const state = options.store.load(relayStateParam, { destroy: true });
+    if (!state) throw new SamlpError("Invalid RelayState", 400);
+    const participant = options.sessionParticipants.get(state.issuer, [state.sessionIndex], state.nameId);
+    if (!participant) throw new SamlpError("Invalid Session Participant", 400);
+    const logoutResponse2 = await validateSamlResponse(input, options, participant.cert);
+    const transactionId2 = state.transactionId;
+    if (logoutResponse2.status !== STATUS.SUCCESS) {
+      const globalState = options.store.load(transactionId2) ?? {};
+      globalState.global_status = "failed";
+      options.store.update(transactionId2, globalState);
+    }
+    options.sessionParticipants.remove(state.issuer, state.sessionIndex, state.nameId);
+    return prepareAndSendLogoutRequest(options, transactionId2);
+  }
+  const transactionId = options.store.save({});
+  return prepareAndSendLogoutRequest(options, transactionId);
+}
+function buildMetadata(options, origin) {
+  if (!options.issuer) throw new Error("options.issuer is required");
+  if (!options.cert) throw new Error("options.cert is required");
+  const pem = removeHeaders(options.cert);
+  if (!pem) throw new Error("options.cert must be a PEM certificate");
+  const logoutPaths = options.logoutEndpointPaths ?? { redirect: "/logout" };
+  const logoutEndpoints = {};
+  if (logoutPaths.redirect) logoutEndpoints.redirect = origin + logoutPaths.redirect;
+  if (logoutPaths.post) logoutEndpoints.post = origin + logoutPaths.post;
+  return metadata({
+    claimTypes: (options.profileMapper ?? passportProfileMapper).metadata,
+    pem,
+    issuer: options.issuer,
+    redirectEndpoint: origin + (options.redirectEndpointPath ?? ""),
+    postEndpoint: origin + (options.postEndpointPath ?? ""),
+    logoutEndpoints
+  }).replace(/\n(?:\s*\n)+/g, "\n");
+}
+const AutoPostForm = ({ url, field, value, relayState }) => /* @__PURE__ */ jsxs(Fragment, { children: [
+  raw("<!DOCTYPE html>"),
+  /* @__PURE__ */ jsxs("html", { children: [
+    /* @__PURE__ */ jsx("head", { children: /* @__PURE__ */ jsx("title", { children: "Keep Calm and Single Sign-On!" }) }),
+    /* @__PURE__ */ jsxs("body", { children: [
+      /* @__PURE__ */ jsxs("form", { method: "post", name: "hiddenform", action: url, children: [
+        /* @__PURE__ */ jsx("input", { type: "hidden", name: field, value }),
+        /* @__PURE__ */ jsx("input", { type: "hidden", name: "RelayState", value: relayState ?? "" }),
+        /* @__PURE__ */ jsxs("noscript", { children: [
+          /* @__PURE__ */ jsx("p", { children: "JavaScript is disabled. Click Submit to continue." }),
+          /* @__PURE__ */ jsx("input", { type: "submit", value: "Submit" })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx("script", { children: raw("window.setTimeout(function(){document.forms[0].submit();}, 0);") })
+    ] })
+  ] })
+] });
+const STYLES = `
+  :root { color-scheme: light; }
+  * { box-sizing: border-box; }
+  body { margin: 0; font-family: "Lato", "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 14px; color: #2c3e50; background: #f5f7f9; }
+  nav { background: #2d3f50; color: #ecf0f1; display: flex; align-items: center; justify-content: space-between; padding: 12px 24px; }
+  nav a { color: #ecf0f1; text-decoration: none; margin-left: 20px; }
+  nav a.brand { margin-left: 0; font-size: 16px; font-weight: 600; }
+  main { max-width: 820px; margin: 24px auto; padding: 0 16px; }
+  .panel { background: #fff; border: 1px solid #d9e0e6; border-radius: 4px; margin-bottom: 20px; }
+  .panel > h3, .panel > summary { margin: 0; padding: 10px 16px; font-size: 15px; font-weight: 600; background: #eef2f5; border-bottom: 1px solid #d9e0e6; cursor: default; }
+  .panel.primary > h3, .panel.primary > summary { background: #2d3f50; color: #ecf0f1; }
+  .panel > summary { cursor: pointer; }
+  .panel-body { padding: 16px; }
+  .row { display: flex; align-items: flex-start; margin-bottom: 12px; gap: 12px; }
+  .row > label, .row > .label { flex: 0 0 200px; padding-top: 7px; font-weight: 600; }
+  .row > .field { flex: 1; min-width: 0; }
+  .static { padding-top: 7px; overflow-wrap: anywhere; }
+  input, select { width: 100%; padding: 6px 10px; border: 1px solid #c3ccd4; border-radius: 4px; font: inherit; }
+  .hint { color: #7b8a97; font-size: 12px; margin: 4px 0 0; }
+  .actions { display: flex; justify-content: flex-end; gap: 10px; }
+  .btn { display: inline-block; padding: 7px 16px; border: 1px solid #c3ccd4; border-radius: 4px; background: #fff; color: #2c3e50; font: inherit; text-decoration: none; cursor: pointer; }
+  .btn.primary { background: #2d3f50; border-color: #2d3f50; color: #fff; }
+  pre { white-space: pre-wrap; word-break: break-word; }
+`;
+const Layout = ({ issuer, children }) => /* @__PURE__ */ jsxs(Fragment, { children: [
+  raw("<!DOCTYPE html>"),
+  /* @__PURE__ */ jsxs("html", { lang: "en", children: [
+    /* @__PURE__ */ jsxs("head", { children: [
+      /* @__PURE__ */ jsx("meta", { charset: "utf-8" }),
+      /* @__PURE__ */ jsx("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }),
+      /* @__PURE__ */ jsx("title", { children: "Simple Identity Provider" }),
+      /* @__PURE__ */ jsx("style", { children: raw(STYLES) })
+    ] }),
+    /* @__PURE__ */ jsxs("body", { children: [
+      /* @__PURE__ */ jsxs("nav", { children: [
+        /* @__PURE__ */ jsxs("a", { class: "brand", href: IDP_PATHS.METADATA, children: [
+          "Simple SAML Identity Provider",
+          issuer ? ` (${issuer})` : ""
+        ] }),
+        /* @__PURE__ */ jsxs("div", { children: [
+          /* @__PURE__ */ jsx("a", { href: IDP_PATHS.METADATA, children: "IdP Metadata" }),
+          /* @__PURE__ */ jsx("a", { href: IDP_PATHS.SIGN_OUT, children: "New Session" }),
+          /* @__PURE__ */ jsx("a", { href: IDP_PATHS.SETTINGS, children: "Settings" })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx("main", { children })
+    ] })
+  ] })
+] });
+const ErrorPage = ({ message, status, stack, issuer }) => /* @__PURE__ */ jsx(Layout, { issuer, children: /* @__PURE__ */ jsxs("div", { id: "container", children: [
+  /* @__PURE__ */ jsx("h1", { children: message }),
+  status ? /* @__PURE__ */ jsx("h2", { children: status }) : null,
+  stack ? /* @__PURE__ */ jsx("pre", { children: stack }) : null,
+  /* @__PURE__ */ jsx("div", { class: "actions", children: /* @__PURE__ */ jsx("form", { action: "/", method: "get", children: /* @__PURE__ */ jsx("button", { id: "btn-return", class: "btn primary", type: "submit", children: "Restart" }) }) })
+] }) });
+const AUTHN_CONTEXT_CLASSES = [
+  "InternetProtocol",
+  "InternetProtocolPassword",
+  "Kerberos",
+  "MobileOneFactorUnregistered",
+  "MobileTwoFactorUnregistered",
+  "MobileOneFactorContract",
+  "MobileTwoFactorContract",
+  "Password",
+  "PasswordProtectedTransport",
+  "PreviousSession",
+  "X509",
+  "PGP",
+  "SPKI",
+  "XMLDSig",
+  "Smartcard",
+  "SmartcardPKI",
+  "SoftwarePKI",
+  "Telephony",
+  "NomadTelephony",
+  "PersonalTelephony",
+  "AuthenticatedTelephony",
+  "SecureRemotePassword",
+  "TLSClient",
+  "TimeSyncToken",
+  "unspecified"
+].map((name2) => ({ value: `urn:oasis:names:tc:SAML:2.0:ac:classes:${name2}`, label: name2 }));
+const Row = ({ id, label, children }) => /* @__PURE__ */ jsxs("div", { class: "row", children: [
+  /* @__PURE__ */ jsx("label", { for: id, children: label }),
+  /* @__PURE__ */ jsx("div", { class: "field", children })
+] });
+const Select = ({ id, name: name2, selected, options }) => /* @__PURE__ */ jsx("select", { id, name: name2 ?? id, children: options.map((o) => /* @__PURE__ */ jsx("option", { value: o.value, selected: o.value === String(selected), children: o.label })) });
+const YES_NO = [
+  { value: "true", label: "Yes" },
+  { value: "false", label: "No" }
+];
+const SettingsPage = ({ idp }) => /* @__PURE__ */ jsx(Layout, { issuer: idp.issuer, children: /* @__PURE__ */ jsxs("form", { id: "settings", method: "post", children: [
+  /* @__PURE__ */ jsxs("div", { class: "panel", children: [
+    /* @__PURE__ */ jsx("h3", { children: "Identity Provider Settings" }),
+    /* @__PURE__ */ jsxs("div", { class: "panel-body", children: [
+      /* @__PURE__ */ jsx(Row, { id: "issuer", label: "Issuer", children: /* @__PURE__ */ jsx("input", { id: "issuer", name: "issuer", type: "text", required: true, value: idp.issuer }) }),
+      /* @__PURE__ */ jsx(Row, { id: "signatureAlgorithm", label: "Signature Algorithm", children: /* @__PURE__ */ jsx(
+        Select,
+        {
+          id: "signatureAlgorithm",
+          selected: idp.signatureAlgorithm,
+          options: [
+            { value: "rsa-sha1", label: "RSA-SHA1" },
+            { value: "rsa-sha256", label: "RSA-SHA256" }
+          ]
+        }
+      ) }),
+      /* @__PURE__ */ jsx(Row, { id: "digestAlgorithm", label: "Digest Algorithm", children: /* @__PURE__ */ jsx(
+        Select,
+        {
+          id: "digestAlgorithm",
+          selected: idp.digestAlgorithm,
+          options: [
+            { value: "sha1", label: "SHA1" },
+            { value: "sha256", label: "SHA256" }
+          ]
+        }
+      ) }),
+      /* @__PURE__ */ jsx(Row, { id: "signResponse", label: "Sign Response", children: /* @__PURE__ */ jsx(Select, { id: "signResponse", selected: idp.signResponse, options: YES_NO }) }),
+      /* @__PURE__ */ jsx(Row, { id: "lifetimeInSeconds", label: "Assertion Lifetime Seconds", children: /* @__PURE__ */ jsx("input", { id: "lifetimeInSeconds", name: "lifetimeInSeconds", type: "number", required: true, value: idp.lifetimeInSeconds }) }),
+      /* @__PURE__ */ jsx(Row, { id: "authnContextClassRef", label: "Authentication Context Class", children: /* @__PURE__ */ jsx(
+        Select,
+        {
+          id: "authnContextClassRef",
+          selected: idp.authnContextClassRef,
+          options: AUTHN_CONTEXT_CLASSES
+        }
+      ) }),
+      /* @__PURE__ */ jsx(Row, { id: "allowRequestAcsUrl", label: "Allow Dynamic Assertion Consumer Service URL", children: /* @__PURE__ */ jsx(Select, { id: "allowRequestAcsUrl", selected: idp.allowRequestAcsUrl, options: YES_NO }) })
+    ] })
+  ] }),
+  /* @__PURE__ */ jsxs("div", { class: "panel", children: [
+    /* @__PURE__ */ jsx("h3", { children: "Service Provider Settings" }),
+    /* @__PURE__ */ jsxs("div", { class: "panel-body", children: [
+      /* @__PURE__ */ jsx(Row, { id: "serviceProviderId", label: "Issuer URI", children: /* @__PURE__ */ jsx("input", { id: "serviceProviderId", name: "serviceProviderId", type: "text", required: true, value: idp.serviceProviderId }) }),
+      /* @__PURE__ */ jsx(Row, { id: "sloUrl", label: "Single Logout URL", children: /* @__PURE__ */ jsx("input", { id: "sloUrl", name: "sloUrl", type: "url", value: idp.sloUrl ?? "" }) }),
+      /* @__PURE__ */ jsx(Row, { id: "acsUrl", label: "Assertion Consumer Service URL", children: /* @__PURE__ */ jsx("input", { id: "acsUrl", name: "acsUrl", type: "url", required: true, value: idp.acsUrl }) }),
+      /* @__PURE__ */ jsx(Row, { id: "destination", label: "Destination", children: /* @__PURE__ */ jsx("input", { id: "destination", name: "destination", type: "url", required: true, value: idp.destination }) }),
+      /* @__PURE__ */ jsx(Row, { id: "recipient", label: "Recipient", children: /* @__PURE__ */ jsx("input", { id: "recipient", name: "recipient", type: "url", required: true, value: idp.recipient }) }),
+      /* @__PURE__ */ jsx(Row, { id: "audience", label: "Audience", children: /* @__PURE__ */ jsx("input", { id: "audience", name: "audience", type: "text", required: true, value: idp.audience }) }),
+      /* @__PURE__ */ jsx(Row, { id: "relayState", label: "Default Relay State", children: /* @__PURE__ */ jsx("input", { id: "relayState", name: "RelayState", type: "text", value: idp.RelayState ?? "" }) })
+    ] })
+  ] }),
+  /* @__PURE__ */ jsxs("div", { class: "actions", children: [
+    /* @__PURE__ */ jsx("a", { href: "/", class: "btn", children: "Cancel" }),
+    /* @__PURE__ */ jsx("button", { type: "submit", class: "btn primary", children: "Save" })
+  ] })
+] }) });
+const NAME_ID_FORMATS = [
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos"
+];
+const StaticRow = ({ id, label, value }) => /* @__PURE__ */ jsxs("div", { class: "row", children: [
+  /* @__PURE__ */ jsx("span", { class: "label", children: label }),
+  /* @__PURE__ */ jsx("div", { class: "field", children: /* @__PURE__ */ jsx("p", { class: "static", id, children: String(value) }) })
+] });
+const AuthnRequestPanel = ({ authnRequest }) => /* @__PURE__ */ jsxs("details", { class: "panel primary", id: "authn-request", children: [
+  /* @__PURE__ */ jsx("summary", { children: "SAML Authentication Request" }),
+  /* @__PURE__ */ jsxs("div", { class: "panel-body", children: [
+    /* @__PURE__ */ jsx(StaticRow, { id: "requestId", label: "Request ID", value: authnRequest.id }),
+    /* @__PURE__ */ jsx(StaticRow, { id: "issuer", label: "Issuer", value: authnRequest.issuer }),
+    authnRequest.destination ? /* @__PURE__ */ jsx(StaticRow, { id: "destination", label: "Destination", value: authnRequest.destination }) : null,
+    authnRequest.acsUrl ? /* @__PURE__ */ jsx(StaticRow, { id: "acsUrl", label: "ACS URL", value: authnRequest.acsUrl }) : null,
+    authnRequest.forceAuthn ? /* @__PURE__ */ jsx(StaticRow, { id: "forceAuthn", label: "ForceAuthn", value: authnRequest.forceAuthn }) : null,
+    authnRequest.relayState ? /* @__PURE__ */ jsx(StaticRow, { id: "relayState", label: "Relay State", value: authnRequest.relayState }) : null
+  ] })
+] });
+const AttributeField = ({ entry, value }) => /* @__PURE__ */ jsxs("div", { class: "row", children: [
+  /* @__PURE__ */ jsx("label", { for: entry.id, children: entry.displayName }),
+  /* @__PURE__ */ jsxs("div", { class: "field", children: [
+    entry.options ? /* @__PURE__ */ jsx("select", { id: entry.id, name: entry.id, children: entry.options.map((option) => /* @__PURE__ */ jsx("option", { value: option, selected: option === value, children: option })) }) : /* @__PURE__ */ jsx("input", { id: entry.id, name: entry.id, type: "text", placeholder: "Attribute value", value: value ?? "" }),
+    entry.multiValue ? /* @__PURE__ */ jsx("p", { class: "hint", children: "Multiple values are separated by commas" }) : null
+  ] })
+] });
+const UserPage = ({ user, sessionIndex, metadata: metadata2, authnRequest, idp }) => /* @__PURE__ */ jsxs(Layout, { issuer: idp.issuer, children: [
+  authnRequest?.id ? /* @__PURE__ */ jsx(AuthnRequestPanel, { authnRequest }) : null,
+  /* @__PURE__ */ jsxs("form", { action: IDP_PATHS.SIGN_IN, method: "post", children: [
+    /* @__PURE__ */ jsxs("div", { class: "panel primary", children: [
+      /* @__PURE__ */ jsx("h3", { children: "SAML Assertion" }),
+      /* @__PURE__ */ jsxs("div", { class: "panel-body", children: [
+        /* @__PURE__ */ jsxs("div", { class: "row", children: [
+          /* @__PURE__ */ jsx("label", { for: "userName", children: "Subject NameID" }),
+          /* @__PURE__ */ jsx("div", { class: "field", children: /* @__PURE__ */ jsx("input", { id: "userName", name: "userName", placeholder: "user@example.com", required: true, value: user.userName }) })
+        ] }),
+        /* @__PURE__ */ jsxs("details", { children: [
+          /* @__PURE__ */ jsx("summary", { children: "More Options" }),
+          /* @__PURE__ */ jsxs("div", { class: "row", children: [
+            /* @__PURE__ */ jsx("label", { for: "nameIdFormat", children: "Name ID Format" }),
+            /* @__PURE__ */ jsx("div", { class: "field", children: /* @__PURE__ */ jsx("select", { id: "nameIdFormat", name: "nameIdFormat", children: NAME_ID_FORMATS.map((format) => /* @__PURE__ */ jsx("option", { value: format, selected: format === user.nameIdFormat, children: format })) }) })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { class: "row", children: [
+            /* @__PURE__ */ jsx("label", { for: "nameIdNameQualifier", children: "Name Qualifier" }),
+            /* @__PURE__ */ jsx("div", { class: "field", children: /* @__PURE__ */ jsx("input", { id: "nameIdNameQualifier", name: "nameIdNameQualifier", type: "text", value: user.nameIdNameQualifier ?? "" }) })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { class: "row", children: [
+            /* @__PURE__ */ jsx("label", { for: "nameIdSPNameQualifier", children: "Service Provider Name Qualifier" }),
+            /* @__PURE__ */ jsx("div", { class: "field", children: /* @__PURE__ */ jsx("input", { id: "nameIdSPNameQualifier", name: "nameIdSPNameQualifier", type: "text", value: user.nameIdSPNameQualifier ?? "" }) })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { class: "row", children: [
+            /* @__PURE__ */ jsx("label", { for: "nameIdSPProvidedID", children: "Service Provider Provided ID" }),
+            /* @__PURE__ */ jsx("div", { class: "field", children: /* @__PURE__ */ jsx("input", { id: "nameIdSPProvidedID", name: "nameIdSPProvidedID", type: "text", value: user.nameIdSPProvidedID ?? "" }) })
+          ] })
+        ] })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs("details", { class: "panel", children: [
+      /* @__PURE__ */ jsx("summary", { children: "Authentication Statement" }),
+      /* @__PURE__ */ jsxs("div", { class: "panel-body", children: [
+        /* @__PURE__ */ jsx(StaticRow, { id: "sessionIndex", label: "Session Index", value: sessionIndex }),
+        /* @__PURE__ */ jsx(StaticRow, { id: "authnContextClassRef", label: "Authentication Context Class", value: idp.authnContextClassRef })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs("div", { class: "panel", children: [
+      /* @__PURE__ */ jsx("h3", { children: "Attribute Statements" }),
+      /* @__PURE__ */ jsx("div", { class: "panel-body", children: metadata2.map((entry) => /* @__PURE__ */ jsx(AttributeField, { entry, value: user[entry.id] })) })
+    ] }),
+    authnRequest?.id ? /* @__PURE__ */ jsx(
+      "input",
+      {
+        name: "_authnRequest",
+        type: "hidden",
+        value: Buffer.from(JSON.stringify(authnRequest)).toString("base64")
+      }
+    ) : null,
+    /* @__PURE__ */ jsxs("div", { class: "actions", children: [
+      /* @__PURE__ */ jsx("a", { id: "btn-sign-out", class: "btn", href: IDP_PATHS.SIGN_OUT, children: "Sign out" }),
+      /* @__PURE__ */ jsx("button", { id: "btn-sign-in", class: "btn primary", type: "submit", children: "Sign in" })
+    ] })
+  ] })
+] });
+const SSO_PATHS = ["/", "/idp", IDP_PATHS.SSO];
+const UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+async function readInput(c) {
+  const query = c.req.query();
+  const body = {};
+  if (c.req.method === "POST") {
+    const contentType = c.req.header("content-type") ?? "";
+    if (/application\/x-www-form-urlencoded|multipart\/form-data/.test(contentType)) {
+      const parsed = await c.req.parseBody();
+      for (const [key, value] of Object.entries(parsed)) {
+        if (typeof value === "string") body[key] = value;
+      }
+    }
+  }
+  return { query, body };
+}
+function errorPage(c, state, message, status = 500, error) {
+  const stack = error instanceof Error ? error.stack : void 0;
+  return c.html(
+    /* @__PURE__ */ jsx(ErrorPage, { message, status, stack, issuer: state.settings.issuer }),
+    status
+  );
+}
+function postFormResponse(c, form) {
+  return c.html(/* @__PURE__ */ jsx(AutoPostForm, { url: form.url, field: form.field, value: form.value, relayState: form.relayState }));
+}
+function toBoolean(value) {
+  return ["true", "yes", "1", "on"].includes(value.toLowerCase());
+}
+const SETTINGS_FIELDS = {
+  issuer: "string",
+  signatureAlgorithm: "string",
+  digestAlgorithm: "string",
+  signResponse: "boolean",
+  lifetimeInSeconds: "number",
+  authnContextClassRef: "string",
+  allowRequestAcsUrl: "boolean",
+  serviceProviderId: "string",
+  sloUrl: "optional",
+  acsUrl: "string",
+  destination: "string",
+  recipient: "string",
+  audience: "string",
+  RelayState: "optional"
+};
+function applySettings(settings, body) {
+  for (const [key, kind] of Object.entries(SETTINGS_FIELDS)) {
+    const value = body[key];
+    if (value === void 0) continue;
+    const target = settings;
+    switch (kind) {
+      case "boolean":
+        target[key] = toBoolean(value);
+        break;
+      case "number": {
+        const parsed = Number.parseInt(value, 10);
+        if (!Number.isNaN(parsed)) target[key] = parsed;
+        break;
+      }
+      case "optional":
+        target[key] = value === "" ? void 0 : value;
+        break;
+      default:
+        target[key] = value;
+    }
+  }
+}
+function authnContextDeclTransformer(decl, logger2) {
+  if (!decl) return void 0;
+  return (assertionDom) => {
+    let declDoc;
+    try {
+      declDoc = new DOMParser().parseFromString(decl, "text/xml");
+    } catch (err) {
+      logger2.log("Unable to parse Authentication Context Declaration XML", err);
+      return;
+    }
+    if (!declDoc?.documentElement) return;
+    const declEl = assertionDom.createElementNS("urn:oasis:names:tc:SAML:2.0:assertion", "saml:AuthnContextDecl");
+    declEl.appendChild(assertionDom.importNode(declDoc.documentElement, true));
+    assertionDom.getElementsByTagName("saml:AuthnContext")[0].appendChild(declEl);
+  };
+}
+function requestOrigin(c) {
+  const url = new URL(c.req.url);
+  const proto = c.req.header("x-forwarded-proto")?.split(",")[0].trim() ?? url.protocol.replace(":", "");
+  const host = c.req.header("x-forwarded-host") ?? c.req.header("host") ?? url.host;
+  return `${proto}://${host}`;
+}
+function createApp({ state, logger: logger$1 = createLogger("info"), rollSession = false }) {
+  const app = new Hono();
+  const fail = (c, st, message, status = 500, error) => {
+    if (status >= 500) logger$1.error(error instanceof Error ? error.stack ?? message : message);
+    return errorPage(c, st, message, status, error);
+  };
+  const sessions = new SessionStore();
+  const profileMapper = createSimpleProfileMapper(() => state.metadata);
+  const logoutCredentials = (c) => {
+    const settings = state.settings;
+    const session = c.get("session");
+    return {
+      participant: {
+        serviceProviderId: settings.serviceProviderId,
+        sessionIndex: getSessionIndex(session),
+        nameId: state.user.userName,
+        nameIdFormat: state.user.nameIdFormat,
+        serviceProviderLogoutURL: settings.sloUrl
+      },
+      session
+    };
+  };
+  app.use(
+    "*",
+    logger((message, ...rest) => logger$1.log(message, ...rest))
+  );
+  app.use("*", sessionMiddleware(sessions, randomBytes(32).toString("hex")));
+  app.use("*", async (c, next) => {
+    if (rollSession && SSO_PATHS.includes(c.req.path) && ["GET", "POST"].includes(c.req.method)) {
+      c.get("session").regenerate();
+    }
+    await next();
+  });
+  const showUser = (c, authnRequest) => {
+    const session = c.get("session");
+    return c.html(
+      /* @__PURE__ */ jsx(
+        UserPage,
+        {
+          user: state.user,
+          sessionIndex: getSessionIndex(session),
+          metadata: state.metadata,
+          authnRequest,
+          idp: state.settings
+        }
+      )
+    );
+  };
+  const parseSamlRequest2 = async (c) => {
+    const input = await readInput(c);
+    let data;
+    try {
+      data = await parseRequest(input);
+    } catch (err) {
+      return fail(c, state, "SAML AuthnRequest Parse Error: " + err.message, 400, err);
+    }
+    let authnRequest;
+    if (data) {
+      authnRequest = {
+        relayState: input.query.RelayState || input.body.RelayState,
+        id: data.id,
+        issuer: data.issuer,
+        destination: data.destination,
+        acsUrl: data.assertionConsumerServiceURL,
+        forceAuthn: data.forceAuthn === "true"
+      };
+      logger$1.log("Received AuthnRequest => \n", authnRequest);
+    }
+    return showUser(c, authnRequest);
+  };
+  app.on(["GET", "POST"], SSO_PATHS, parseSamlRequest2);
+  const handleLogout = async (c) => {
+    const settings = state.settings;
+    if (!settings.sloUrl) {
+      return fail(c, state, "SAML Single Logout Service URL not defined for Service Provider", 400);
+    }
+    const { participant, session } = logoutCredentials(c);
+    logger$1.log("Processing SAML SLO request for participant => \n", participant);
+    const input = await readInput(c);
+    let result;
+    try {
+      result = await logout(input, {
+        issuer: settings.issuer,
+        cert: settings.cert,
+        key: settings.key,
+        digestAlgorithm: settings.digestAlgorithm,
+        signatureAlgorithm: settings.signatureAlgorithm,
+        sessionParticipants: new SessionParticipants([participant]),
+        store: createLogoutStore(session),
+        clearIdPSession: () => {
+          logger$1.log("Destroying session " + session.id + " for participant", participant);
+          session.destroy();
+        }
+      });
+    } catch (err) {
+      const status = err instanceof SamlpError ? err.status : 500;
+      return fail(c, state, err.message, status, err);
+    }
+    switch (result.type) {
+      case "post":
+        return postFormResponse(c, result);
+      case "redirect":
+        return c.redirect(result.url);
+      default:
+        return c.text("OK", 200);
+    }
+  };
+  app.get(IDP_PATHS.SLO, handleLogout);
+  app.post(IDP_PATHS.SLO, handleLogout);
+  app.post(IDP_PATHS.SIGN_IN, async (c) => {
+    const settings = state.settings;
+    const session = c.get("session");
+    const input = await readInput(c);
+    const authOptions = {
+      ...settings,
+      profileMapper,
+      postEndpointPath: IDP_PATHS.SSO,
+      redirectEndpointPath: IDP_PATHS.SSO,
+      getPostURL: () => settings.acsUrl,
+      transformAssertion: authnContextDeclTransformer(settings.authnContextDecl, logger$1)
+    };
+    let authnRequest;
+    for (const [key, value] of Object.entries(input.body)) {
+      if (value === void 0) continue;
+      if (key === "_authnRequest") {
+        try {
+          authnRequest = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+        } catch {
+          return fail(c, state, "Invalid _authnRequest", 400);
+        }
+        if (!authnRequest) continue;
+        authOptions.inResponseTo = authnRequest.id;
+        if (settings.allowRequestAcsUrl && authnRequest.acsUrl) {
+          authOptions.acsUrl = authnRequest.acsUrl;
+          authOptions.recipient = authnRequest.acsUrl;
+          authOptions.destination = authnRequest.acsUrl;
+          authOptions.forceAuthn = authnRequest.forceAuthn;
+          authOptions.getPostURL = () => authnRequest.acsUrl;
+        }
+        if (authnRequest.relayState) {
+          authOptions.RelayState = authnRequest.relayState;
+        }
+      } else if (!UNSAFE_KEYS.has(key)) {
+        state.user[key] = value;
+      }
+    }
+    if (!authOptions.encryptAssertion) {
+      delete authOptions.encryptionCert;
+      delete authOptions.encryptionPublicKey;
+    }
+    authOptions.sessionIndex = getSessionIndex(session);
+    logger$1.log(
+      [
+        "Generating SAML Response using =>",
+        "  User =>",
+        describeRecord(state.user, 4, (_k, v) => String(v)),
+        "  SAMLP Options =>",
+        describeRecord(authOptions, 4),
+        ""
+      ].join("\n")
+    );
+    try {
+      const result = await authenticate({ query: {}, body: {} }, authOptions, state.user);
+      logger$1.log(
+        [
+          `Sending SAML Response to ${result.url} =>`,
+          `  RelayState =>`,
+          `    ${result.relayState || "None"}`,
+          `  SAMLResponse =>`,
+          prettyPrintXml(result.xml, 4),
+          ""
+        ].join("\n")
+      );
+      return postFormResponse(c, result);
+    } catch (err) {
+      const status = err instanceof SamlpError ? err.status : 500;
+      return fail(c, state, err.message, status, err);
+    }
+  });
+  app.get(IDP_PATHS.METADATA, (c) => {
+    const settings = state.settings;
+    const xml = buildMetadata(
+      {
+        issuer: settings.issuer,
+        cert: settings.cert,
+        profileMapper,
+        postEndpointPath: IDP_PATHS.SSO,
+        redirectEndpointPath: IDP_PATHS.SSO,
+        logoutEndpointPaths: settings.sloUrl ? { redirect: IDP_PATHS.SLO, post: IDP_PATHS.SLO } : {}
+      },
+      requestOrigin(c)
+    );
+    return c.body(xml, 200, { "Content-Type": "application/xml" });
+  });
+  app.post(IDP_PATHS.METADATA, async (c) => {
+    const { body } = await readInput(c);
+    if (body.attributeName && body.displayName) {
+      const attribute = {
+        id: body.attributeName,
+        optional: true,
+        displayName: body.displayName,
+        description: body.description || "",
+        multiValue: body.valueType === "multi"
+      };
+      const index = state.metadata.findIndex((entry) => entry.id === attribute.id);
+      if (index === -1) state.metadata.push(attribute);
+      else state.metadata[index] = attribute;
+      logger$1.log("Updated SAML Attribute Metadata => \n", state.metadata);
+      return c.body(null, 200);
+    }
+    return c.body(null, 400);
+  });
+  app.get(IDP_PATHS.SIGN_OUT, (c) => {
+    const settings = state.settings;
+    if (settings.sloUrl) {
+      logger$1.log(
+        `Initiating SAML SLO request for user: ${state.user.userName} with sessionIndex: ${getSessionIndex(c.get("session"))}`
+      );
+      return c.redirect(IDP_PATHS.SLO);
+    }
+    logger$1.log("SAML SLO is not enabled for SP, destroying IDP session");
+    c.get("session").destroy();
+    return c.redirect(c.req.header("referer") || "/");
+  });
+  app.get(IDP_PATHS.SETTINGS, (c) => c.html(/* @__PURE__ */ jsx(SettingsPage, { idp: state.settings })));
+  app.post(IDP_PATHS.SETTINGS, async (c) => {
+    const { body } = await readInput(c);
+    applySettings(state.settings, body);
+    logger$1.log("Updated IdP Configuration => \n", {
+      ...state.settings,
+      cert: formatOptionValue("cert", state.settings.cert),
+      key: formatOptionValue("key", state.settings.key)
+    });
+    return c.redirect("/");
+  });
+  app.notFound((c) => {
+    const err = new Error("Route Not Found");
+    return fail(c, state, err.message, 404, err);
+  });
+  app.onError((err, c) => {
+    const status = err.status ?? 500;
+    return fail(c, state, err.message, status, err);
+  });
+  return app;
+}
+const WILDCARD_ADDRESSES = ["0.0.0.0", "::"];
+async function createIdp(input) {
+  const options = await resolveOptions(input);
+  const logger2 = createLogger(options.logLevel);
+  const state = createState(options);
+  const app = createApp({ state, logger: logger2, rollSession: options.rollSession });
+  return { app, state, options, logger: logger2 };
+}
+async function runServer(input) {
+  const idp = await createIdp(input);
+  const { app, options, logger: logger2 } = idp;
+  logger2.log(configBanner(options));
+  logger2.log(`Starting IdP server on port ${pc.cyan(`${options.host}:${options.port}`)}...
+`);
+  const server = await new Promise((resolve2, reject) => {
+    const instance = serve(
+      {
+        fetch: app.fetch,
+        port: options.port,
+        hostname: options.host,
+        ...options.https ? {
+          createServer,
+          serverOptions: { key: options.httpsPrivateKey, cert: options.httpsCert }
+        } : {}
+      },
+      () => resolve2(instance)
+    );
+    instance.once("error", reject);
+  });
+  const { address, port } = server.address();
+  const scheme = options.https ? "https" : "http";
+  const bannerHost = WILDCARD_ADDRESSES.includes(address) ? hostname() : "localhost";
+  const url = `${scheme}://localhost:${port}`;
+  logger2.log(listeningBanner(`${scheme}://${bannerHost}:${port}`, !!options.sloUrl));
+  return {
+    ...idp,
+    url,
+    metadataUrl: `${url}/metadata`,
+    server,
+    close: () => new Promise((resolve2, reject) => {
+      server.close((err) => err ? reject(err) : resolve2());
+      server.closeAllConnections();
+    })
+  };
+}
+export {
+  IDP_PATHS,
+  LOG_LEVELS as L,
+  OptionsError,
+  createDefaultConfig,
+  createIdp,
+  runServer
+};
+//# sourceMappingURL=index.js.map