import { __commonJS, __require } from "../../../../_virtual/rolldown_runtime.mjs";
import { require_utility } from "./utility.mjs";
import { require_urn } from "./urn.mjs";
import { require_xpath } from "../../../xpath/xpath.mjs";
import { require_lib } from "../../../@xmldom/xmldom/lib/index.mjs";
import { require_api } from "./api.mjs";
import { require_camelcase } from "../../../camelcase/index.mjs";
import { require_NodeRSA } from "../../../node-rsa/src/NodeRSA.mjs";
import { require_lib as require_lib$1 } from "../../../xml-crypto/lib/index.mjs";
import { require_lib as require_lib$2 } from "../../../@authenio/xml-encryption/lib/index.mjs";
import { require_xml_escape } from "../../../xml-escape/index.mjs";

//#region ../../node_modules/samlify/build/src/libsaml.js
var require_libsaml = /* @__PURE__ */ __commonJS({ "../../node_modules/samlify/build/src/libsaml.js": ((exports) => {
	/**
	* @file SamlLib.js
	* @author tngan
	* @desc  A simple library including some common functions
	*/
	var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
		if (k2 === void 0) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) desc = {
			enumerable: true,
			get: function() {
				return m[k];
			}
		};
		Object.defineProperty(o, k2, desc);
	}) : (function(o, m, k, k2) {
		if (k2 === void 0) k2 = k;
		o[k2] = m[k];
	}));
	var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
		Object.defineProperty(o, "default", {
			enumerable: true,
			value: v
		});
	}) : function(o, v) {
		o["default"] = v;
	});
	var __importStar = exports && exports.__importStar || function(mod) {
		if (mod && mod.__esModule) return mod;
		var result = {};
		if (mod != null) {
			for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
		}
		__setModuleDefault(result, mod);
		return result;
	};
	var __awaiter = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
		function adopt(value) {
			return value instanceof P ? value : new P(function(resolve) {
				resolve(value);
			});
		}
		return new (P || (P = Promise))(function(resolve, reject) {
			function fulfilled(value) {
				try {
					step(generator.next(value));
				} catch (e) {
					reject(e);
				}
			}
			function rejected(value) {
				try {
					step(generator["throw"](value));
				} catch (e) {
					reject(e);
				}
			}
			function step(result) {
				result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
			}
			step((generator = generator.apply(thisArg, _arguments || [])).next());
		});
	};
	var __generator = exports && exports.__generator || function(thisArg, body) {
		var _ = {
			label: 0,
			sent: function() {
				if (t[0] & 1) throw t[1];
				return t[1];
			},
			trys: [],
			ops: []
		}, f, y, t, g;
		return g = {
			next: verb(0),
			"throw": verb(1),
			"return": verb(2)
		}, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
			return this;
		}), g;
		function verb(n) {
			return function(v) {
				return step([n, v]);
			};
		}
		function step(op) {
			if (f) throw new TypeError("Generator is already executing.");
			while (_) try {
				if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
				if (y = 0, t) op = [op[0] & 2, t.value];
				switch (op[0]) {
					case 0:
					case 1:
						t = op;
						break;
					case 4:
						_.label++;
						return {
							value: op[1],
							done: false
						};
					case 5:
						_.label++;
						y = op[1];
						op = [0];
						continue;
					case 7:
						op = _.ops.pop();
						_.trys.pop();
						continue;
					default:
						if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
							_ = 0;
							continue;
						}
						if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
							_.label = op[1];
							break;
						}
						if (op[0] === 6 && _.label < t[1]) {
							_.label = t[1];
							t = op;
							break;
						}
						if (t && _.label < t[2]) {
							_.label = t[2];
							_.ops.push(op);
							break;
						}
						if (t[2]) _.ops.pop();
						_.trys.pop();
						continue;
				}
				op = body.call(thisArg, _);
			} catch (e) {
				op = [6, e];
				y = 0;
			} finally {
				f = t = 0;
			}
			if (op[0] & 5) throw op[1];
			return {
				value: op[0] ? op[1] : void 0,
				done: true
			};
		}
	};
	var __values = exports && exports.__values || function(o) {
		var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
		if (m) return m.call(o);
		if (o && typeof o.length === "number") return { next: function() {
			if (o && i >= o.length) o = void 0;
			return {
				value: o && o[i++],
				done: !o
			};
		} };
		throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
	};
	var __importDefault = exports && exports.__importDefault || function(mod) {
		return mod && mod.__esModule ? mod : { "default": mod };
	};
	Object.defineProperty(exports, "__esModule", { value: true });
	var utility_1 = __importStar(require_utility());
	var urn_1 = require_urn();
	var xpath_1 = require_xpath();
	var node_rsa_1 = __importDefault(require_NodeRSA());
	var xml_crypto_1 = require_lib$1();
	var xmlenc = __importStar(require_lib$2());
	var camelcase_1 = __importDefault(require_camelcase());
	var api_1 = require_api();
	var xml_escape_1 = __importDefault(require_xml_escape());
	var fs = __importStar(__require("fs"));
	var xmldom_1 = require_lib();
	var signatureAlgorithms = urn_1.algorithms.signature;
	var digestAlgorithms = urn_1.algorithms.digest;
	var certUse = urn_1.wording.certUse;
	var urlParams = urn_1.wording.urlParams;
	var libSaml = function() {
		/**
		* @desc helper function to get back the query param for redirect binding for SLO/SSO
		* @type {string}
		*/
		function getQueryParamByType(type) {
			if ([urlParams.logoutRequest, urlParams.samlRequest].indexOf(type) !== -1) return "SAMLRequest";
			if ([urlParams.logoutResponse, urlParams.samlResponse].indexOf(type) !== -1) return "SAMLResponse";
			throw new Error("ERR_UNDEFINED_QUERY_PARAMS");
		}
		/**
		*
		*/
		var nrsaAliasMapping = {
			"http://www.w3.org/2000/09/xmldsig#rsa-sha1": "pkcs1-sha1",
			"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256": "pkcs1-sha256",
			"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512": "pkcs1-sha512"
		};
		/**
		* @desc Default login request template
		* @type {LoginRequestTemplate}
		*/
		var defaultLoginRequestTemplate = { context: "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{ID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\" Destination=\"{Destination}\" ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" AssertionConsumerServiceURL=\"{AssertionConsumerServiceURL}\"><saml:Issuer>{Issuer}</saml:Issuer><samlp:NameIDPolicy Format=\"{NameIDFormat}\" AllowCreate=\"{AllowCreate}\"/></samlp:AuthnRequest>" };
		/**
		* @desc Default logout request template
		* @type {LogoutRequestTemplate}
		*/
		var defaultLogoutRequestTemplate = { context: "<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{ID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\" Destination=\"{Destination}\"><saml:Issuer>{Issuer}</saml:Issuer><saml:NameID Format=\"{NameIDFormat}\">{NameID}</saml:NameID></samlp:LogoutRequest>" };
		/**
		* @desc Default AttributeStatement template
		* @type {AttributeStatementTemplate}
		*/
		var defaultAttributeStatementTemplate = { context: "<saml:AttributeStatement>{Attributes}</saml:AttributeStatement>" };
		/**
		* @desc Default Attribute template
		* @type {AttributeTemplate}
		*/
		var defaultAttributeTemplate = { context: "<saml:Attribute Name=\"{Name}\" NameFormat=\"{NameFormat}\"><saml:AttributeValue xmlns:xs=\"{ValueXmlnsXs}\" xmlns:xsi=\"{ValueXmlnsXsi}\" xsi:type=\"{ValueXsiType}\">{Value}</saml:AttributeValue></saml:Attribute>" };
		/**
		* @desc Default login response template
		* @type {LoginResponseTemplate}
		*/
		var defaultLoginResponseTemplate = {
			context: "<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{ID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\" Destination=\"{Destination}\" InResponseTo=\"{InResponseTo}\"><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value=\"{StatusCode}\"/></samlp:Status><saml:Assertion xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xs=\"http://www.w3.org/2001/XMLSchema\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{AssertionID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\"><saml:Issuer>{Issuer}</saml:Issuer><saml:Subject><saml:NameID Format=\"{NameIDFormat}\">{NameID}</saml:NameID><saml:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><saml:SubjectConfirmationData NotOnOrAfter=\"{SubjectConfirmationDataNotOnOrAfter}\" Recipient=\"{SubjectRecipient}\" InResponseTo=\"{InResponseTo}\"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore=\"{ConditionsNotBefore}\" NotOnOrAfter=\"{ConditionsNotOnOrAfter}\"><saml:AudienceRestriction><saml:Audience>{Audience}</saml:Audience></saml:AudienceRestriction></saml:Conditions>{AuthnStatement}{AttributeStatement}</saml:Assertion></samlp:Response>",
			attributes: [],
			additionalTemplates: {
				"attributeStatementTemplate": defaultAttributeStatementTemplate,
				"attributeTemplate": defaultAttributeTemplate
			}
		};
		/**
		* @desc Default logout response template
		* @type {LogoutResponseTemplate}
		*/
		var defaultLogoutResponseTemplate = { context: "<samlp:LogoutResponse xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"{ID}\" Version=\"2.0\" IssueInstant=\"{IssueInstant}\" Destination=\"{Destination}\" InResponseTo=\"{InResponseTo}\"><saml:Issuer>{Issuer}</saml:Issuer><samlp:Status><samlp:StatusCode Value=\"{StatusCode}\"/></samlp:Status></samlp:LogoutResponse>" };
		/**
		* @private
		* @desc Get the signing scheme alias by signature algorithms, used by the node-rsa module
		* @param {string} sigAlg    signature algorithm
		* @return {string/null} signing algorithm short-hand for the module node-rsa
		*/
		function getSigningScheme(sigAlg) {
			if (sigAlg) {
				var algAlias = nrsaAliasMapping[sigAlg];
				if (!(algAlias === void 0)) return algAlias;
			}
			return nrsaAliasMapping[signatureAlgorithms.RSA_SHA1];
		}
		/**
		* @private
		* @desc Get the digest algorithms by signature algorithms
		* @param {string} sigAlg    signature algorithm
		* @return {string/undefined} digest algorithm
		*/
		function getDigestMethod(sigAlg) {
			return digestAlgorithms[sigAlg];
		}
		/**
		* @public
		* @desc Create XPath
		* @param  {string/object} local     parameters to create XPath
		* @param  {boolean} isExtractAll    define whether returns whole content according to the XPath
		* @return {string} xpath
		*/
		function createXPath(local, isExtractAll) {
			if ((0, utility_1.isString)(local)) return isExtractAll === true ? "//*[local-name(.)='" + local + "']/text()" : "//*[local-name(.)='" + local + "']";
			return "//*[local-name(.)='" + local.name + "']/@" + local.attr;
		}
		/**
		* @private
		* @desc Tag normalization
		* @param {string} prefix     prefix of the tag
		* @param {content} content   normalize it to capitalized camel case
		* @return {string}
		*/
		function tagging(prefix, content) {
			var camelContent = (0, camelcase_1.default)(content, { locale: "en-us" });
			return prefix + camelContent.charAt(0).toUpperCase() + camelContent.slice(1);
		}
		function escapeTag(replacement) {
			return function(_match, quote) {
				var text = replacement === null || replacement === void 0 ? "" : String(replacement);
				return quote ? "".concat(quote).concat((0, xml_escape_1.default)(text)) : text;
			};
		}
		return {
			createXPath,
			getQueryParamByType,
			defaultLoginRequestTemplate,
			defaultLoginResponseTemplate,
			defaultAttributeStatementTemplate,
			defaultAttributeTemplate,
			defaultLogoutRequestTemplate,
			defaultLogoutResponseTemplate,
			replaceTagsByValue: function(rawXML, tagValues) {
				Object.keys(tagValues).forEach(function(t) {
					rawXML = rawXML.replace(new RegExp("(\"?)\\{".concat(t, "\\}"), "g"), escapeTag(tagValues[t]));
				});
				return rawXML;
			},
			attributeStatementBuilder: function(attributes, attributeTemplate, attributeStatementTemplate) {
				if (attributeTemplate === void 0) attributeTemplate = defaultAttributeTemplate;
				if (attributeStatementTemplate === void 0) attributeStatementTemplate = defaultAttributeStatementTemplate;
				var attr = attributes.map(function(_a) {
					var name = _a.name, nameFormat = _a.nameFormat, valueTag = _a.valueTag, valueXsiType = _a.valueXsiType, valueXmlnsXs = _a.valueXmlnsXs, valueXmlnsXsi = _a.valueXmlnsXsi;
					var defaultValueXmlnsXs = "http://www.w3.org/2001/XMLSchema";
					var defaultValueXmlnsXsi = "http://www.w3.org/2001/XMLSchema-instance";
					var attributeLine = attributeTemplate.context;
					attributeLine = attributeLine.replace("{Name}", name);
					attributeLine = attributeLine.replace("{NameFormat}", nameFormat);
					attributeLine = attributeLine.replace("{ValueXmlnsXs}", valueXmlnsXs ? valueXmlnsXs : defaultValueXmlnsXs);
					attributeLine = attributeLine.replace("{ValueXmlnsXsi}", valueXmlnsXsi ? valueXmlnsXsi : defaultValueXmlnsXsi);
					attributeLine = attributeLine.replace("{ValueXsiType}", valueXsiType);
					attributeLine = attributeLine.replace("{Value}", "{".concat(tagging("attr", valueTag), "}"));
					return attributeLine;
				}).join("");
				return attributeStatementTemplate.context.replace("{Attributes}", attr);
			},
			constructSAMLSignature: function(opts) {
				var rawSamlMessage = opts.rawSamlMessage, referenceTagXPath = opts.referenceTagXPath, privateKey = opts.privateKey, privateKeyPass = opts.privateKeyPass, _a = opts.signatureAlgorithm, signatureAlgorithm = _a === void 0 ? signatureAlgorithms.RSA_SHA256 : _a, _b = opts.transformationAlgorithms, transformationAlgorithms = _b === void 0 ? ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", "http://www.w3.org/2001/10/xml-exc-c14n#"] : _b, signingCert = opts.signingCert, signatureConfig = opts.signatureConfig, _c = opts.isBase64Output, isBase64Output = _c === void 0 ? true : _c, _d = opts.isMessageSigned, isMessageSigned = _d === void 0 ? false : _d;
				var sig = new xml_crypto_1.SignedXml();
				var digestAlgorithm = getDigestMethod(signatureAlgorithm);
				if (referenceTagXPath) sig.addReference({
					xpath: referenceTagXPath,
					transforms: transformationAlgorithms,
					digestAlgorithm
				});
				if (isMessageSigned) sig.addReference({
					xpath: "/*",
					transforms: transformationAlgorithms,
					digestAlgorithm
				});
				sig.signatureAlgorithm = signatureAlgorithm;
				sig.publicCert = this.getKeyInfo(signingCert, signatureConfig).getKey();
				sig.getKeyInfoContent = this.getKeyInfo(signingCert, signatureConfig).getKeyInfo;
				sig.privateKey = utility_1.default.readPrivateKey(privateKey, privateKeyPass, true);
				sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
				if (signatureConfig) sig.computeSignature(rawSamlMessage, signatureConfig);
				else sig.computeSignature(rawSamlMessage);
				return isBase64Output !== false ? utility_1.default.base64Encode(sig.getSignedXml()) : sig.getSignedXml();
			},
			verifySignature: function(xml, opts) {
				var e_1, _a;
				var doc = (0, api_1.getContext)().dom.parseFromString(xml);
				var docParser = new xmldom_1.DOMParser();
				var messageSignatureXpath = "/*[contains(local-name(), 'Response') or contains(local-name(), 'Request')]/*[local-name(.)='Signature']";
				var assertionSignatureXpath = "/*[contains(local-name(), 'Response') or contains(local-name(), 'Request')]/*[local-name(.)='Assertion']/*[local-name(.)='Signature']";
				var wrappingElementsXPath = "/*[contains(local-name(), 'Response')]/*[local-name(.)='Assertion']/*[local-name(.)='Subject']/*[local-name(.)='SubjectConfirmation']/*[local-name(.)='SubjectConfirmationData']//*[local-name(.)='Assertion' or local-name(.)='Signature']";
				var selection = [];
				var messageSignatureNode = (0, xpath_1.select)(messageSignatureXpath, doc);
				var assertionSignatureNode = (0, xpath_1.select)(assertionSignatureXpath, doc);
				var wrappingElementNode = (0, xpath_1.select)(wrappingElementsXPath, doc);
				selection = selection.concat(messageSignatureNode);
				selection = selection.concat(assertionSignatureNode);
				if (wrappingElementNode.length !== 0) throw new Error("ERR_POTENTIAL_WRAPPING_ATTACK");
				if (selection.length === 0) return [false, null];
				var _loop_1 = function(signatureNode$1) {
					var sig = new xml_crypto_1.SignedXml();
					var verified = false;
					sig.signatureAlgorithm = opts.signatureAlgorithm;
					if (!opts.keyFile && !opts.metadata) throw new Error("ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS");
					if (opts.keyFile) sig.publicCert = fs.readFileSync(opts.keyFile);
					if (opts.metadata) {
						var certificateNode = (0, xpath_1.select)(".//*[local-name(.)='X509Certificate']", signatureNode$1);
						var metadataCert = opts.metadata.getX509Certificate(certUse.signing);
						if (Array.isArray(metadataCert)) metadataCert = (0, utility_1.flattenDeep)(metadataCert);
						else if (typeof metadataCert === "string") metadataCert = [metadataCert];
						metadataCert = metadataCert.map(utility_1.default.normalizeCerString);
						if (certificateNode.length === 0 && metadataCert.length === 0) throw new Error("NO_SELECTED_CERTIFICATE");
						if (certificateNode.length !== 0) {
							var x509CertificateData = certificateNode[0].firstChild.data;
							var x509Certificate_1 = utility_1.default.normalizeCerString(x509CertificateData);
							if (metadataCert.length >= 1 && !metadataCert.find(function(cert) {
								return cert.trim() === x509Certificate_1.trim();
							})) throw new Error("ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA");
							sig.publicCert = this_1.getKeyInfo(x509Certificate_1).getKey();
						} else sig.publicCert = this_1.getKeyInfo(metadataCert[0]).getKey();
					}
					sig.loadSignature(signatureNode$1);
					verified = sig.checkSignature(doc.toString());
					if (!verified) return "continue";
					if (!(sig.getSignedReferences().length >= 1)) throw new Error("NO_SIGNATURE_REFERENCES");
					var signedVerifiedXML = sig.getSignedReferences()[0];
					var rootNode = docParser.parseFromString(signedVerifiedXML, "text/xml").documentElement;
					if (rootNode.localName === "Response") {
						var assertions = (0, xpath_1.select)("./*[local-name()='Assertion']", rootNode);
						var encryptedAssertions = (0, xpath_1.select)("./*[local-name()='EncryptedAssertion']", rootNode);
						if (assertions.length === 1) return { value: [true, assertions[0].toString()] };
						else if (encryptedAssertions.length >= 1) return { value: [true, rootNode.toString()] };
						else return { value: [true, null] };
					} else if (rootNode.localName === "Assertion") return { value: [true, rootNode.toString()] };
					else return { value: [true, null] };
				};
				var this_1 = this;
				try {
					for (var selection_1 = __values(selection), selection_1_1 = selection_1.next(); !selection_1_1.done; selection_1_1 = selection_1.next()) {
						var signatureNode = selection_1_1.value;
						var state_1 = _loop_1(signatureNode);
						if (typeof state_1 === "object") return state_1.value;
					}
				} catch (e_1_1) {
					e_1 = { error: e_1_1 };
				} finally {
					try {
						if (selection_1_1 && !selection_1_1.done && (_a = selection_1.return)) _a.call(selection_1);
					} finally {
						if (e_1) throw e_1.error;
					}
				}
				return [false, null];
			},
			createKeySection: function(use, certString) {
				var _a, _b, _c;
				return _a = {}, _a["KeyDescriptor"] = [{ _attr: { use } }, (_b = {}, _b["ds:KeyInfo"] = [{ _attr: { "xmlns:ds": "http://www.w3.org/2000/09/xmldsig#" } }, (_c = {}, _c["ds:X509Data"] = [{ "ds:X509Certificate": utility_1.default.normalizeCerString(certString) }], _c)], _b)], _a;
			},
			constructMessageSignature: function(octetString, key, passphrase, isBase64, signingAlgorithm) {
				var signature = new node_rsa_1.default(utility_1.default.readPrivateKey(key, passphrase), void 0, { signingScheme: getSigningScheme(signingAlgorithm) }).sign(octetString);
				return isBase64 !== false ? signature.toString("base64") : signature;
			},
			verifyMessageSignature: function(metadata, octetString, signature, verifyAlgorithm) {
				var signCert = metadata.getX509Certificate(certUse.signing);
				var signingScheme = getSigningScheme(verifyAlgorithm);
				return new node_rsa_1.default(utility_1.default.getPublicKeyPemFromCertificate(signCert), "public", { signingScheme }).verify(Buffer.from(octetString), Buffer.from(signature));
			},
			getKeyInfo: function(x509Certificate, signatureConfig) {
				if (signatureConfig === void 0) signatureConfig = {};
				var prefix = signatureConfig.prefix ? "".concat(signatureConfig.prefix, ":") : "";
				return {
					getKeyInfo: function() {
						return "<".concat(prefix, "X509Data><").concat(prefix, "X509Certificate>").concat(x509Certificate, "</").concat(prefix, "X509Certificate></").concat(prefix, "X509Data>");
					},
					getKey: function() {
						return utility_1.default.getPublicKeyPemFromCertificate(x509Certificate).toString();
					}
				};
			},
			encryptAssertion: function(sourceEntity, targetEntity, xml) {
				return new Promise(function(resolve, reject) {
					if (!xml) return reject(/* @__PURE__ */ new Error("ERR_UNDEFINED_ASSERTION"));
					var sourceEntitySetting = sourceEntity.entitySetting;
					var targetEntityMetadata = targetEntity.entityMeta;
					var dom = (0, api_1.getContext)().dom;
					var doc = dom.parseFromString(xml);
					var assertions = (0, xpath_1.select)("//*[local-name(.)='Assertion']", doc);
					if (!Array.isArray(assertions) || assertions.length === 0) throw new Error("ERR_NO_ASSERTION");
					if (assertions.length > 1) throw new Error("ERR_MULTIPLE_ASSERTION");
					var rawAssertionNode = assertions[0];
					if (sourceEntitySetting.isAssertionEncrypted) {
						var publicKeyPem = utility_1.default.getPublicKeyPemFromCertificate(targetEntityMetadata.getX509Certificate(certUse.encrypt));
						xmlenc.encrypt(rawAssertionNode.toString(), {
							rsa_pub: Buffer.from(publicKeyPem),
							pem: Buffer.from("-----BEGIN CERTIFICATE-----".concat(targetEntityMetadata.getX509Certificate(certUse.encrypt), "-----END CERTIFICATE-----")),
							encryptionAlgorithm: sourceEntitySetting.dataEncryptionAlgorithm,
							keyEncryptionAlgorithm: sourceEntitySetting.keyEncryptionAlgorithm
						}, function(err, res) {
							if (err) {
								console.error(err);
								return reject(/* @__PURE__ */ new Error("ERR_EXCEPTION_OF_ASSERTION_ENCRYPTION"));
							}
							if (!res) return reject(/* @__PURE__ */ new Error("ERR_UNDEFINED_ENCRYPTED_ASSERTION"));
							var encAssertionPrefix = sourceEntitySetting.tagPrefix.encryptedAssertion;
							var encryptAssertionDoc = dom.parseFromString("<".concat(encAssertionPrefix, ":EncryptedAssertion xmlns:").concat(encAssertionPrefix, "=\"").concat(urn_1.namespace.names.assertion, "\">").concat(res, "</").concat(encAssertionPrefix, ":EncryptedAssertion>"));
							doc.documentElement.replaceChild(encryptAssertionDoc.documentElement, rawAssertionNode);
							return resolve(utility_1.default.base64Encode(doc.toString()));
						});
					} else return resolve(utility_1.default.base64Encode(xml));
				});
			},
			decryptAssertion: function(here, entireXML) {
				return new Promise(function(resolve, reject) {
					if (!entireXML) return reject(/* @__PURE__ */ new Error("ERR_UNDEFINED_ASSERTION"));
					var hereSetting = here.entitySetting;
					var dom = (0, api_1.getContext)().dom;
					var doc = dom.parseFromString(entireXML);
					var encryptedAssertions = (0, xpath_1.select)("/*[contains(local-name(), 'Response')]/*[local-name(.)='EncryptedAssertion']", doc);
					if (!Array.isArray(encryptedAssertions) || encryptedAssertions.length === 0) throw new Error("ERR_UNDEFINED_ENCRYPTED_ASSERTION");
					if (encryptedAssertions.length > 1) throw new Error("ERR_MULTIPLE_ASSERTION");
					var encAssertionNode = encryptedAssertions[0];
					return xmlenc.decrypt(encAssertionNode.toString(), { key: utility_1.default.readPrivateKey(hereSetting.encPrivateKey, hereSetting.encPrivateKeyPass) }, function(err, res) {
						if (err) {
							console.error(err);
							return reject(/* @__PURE__ */ new Error("ERR_EXCEPTION_OF_ASSERTION_DECRYPTION"));
						}
						if (!res) return reject(/* @__PURE__ */ new Error("ERR_UNDEFINED_ENCRYPTED_ASSERTION"));
						var rawAssertionDoc = dom.parseFromString(res);
						doc.documentElement.replaceChild(rawAssertionDoc.documentElement, encAssertionNode);
						return resolve([doc.toString(), res]);
					});
				});
			},
			isValidXml: function(input) {
				return __awaiter(this, void 0, void 0, function() {
					var validate, e_2;
					return __generator(this, function(_a) {
						switch (_a.label) {
							case 0:
								validate = (0, api_1.getContext)().validate;
								/**
								* user can write a validate function that always returns
								* a resolved promise and skip the validator even in
								* production, user will take the responsibility if
								* they intend to skip the validation
								*/
								if (!validate) return [2, Promise.reject("Your application is potentially vulnerable because no validation function found. Please read the documentation on how to setup the validator. (https://github.com/tngan/samlify#installation)")];
								_a.label = 1;
							case 1:
								_a.trys.push([
									1,
									3,
									,
									4
								]);
								return [4, validate(input)];
							case 2: return [2, _a.sent()];
							case 3:
								e_2 = _a.sent();
								throw e_2;
							case 4: return [2];
						}
					});
				});
			}
		};
	};
	exports.default = libSaml();
}) });

//#endregion
export default require_libsaml();

export { require_libsaml };
//# sourceMappingURL=libsaml.mjs.map