@enterprisestandard/core 0.0.14 → 0.0.15-beta.20260407.1

package/dist/index.d.ts

@@ -1754,8 +1754,8 @@ interface SessionStore<TExtended = object> {
 	delete(sid: string): Promise<void>;
 }
 type SSOConfig<
-	TSessionData = {},
-	TUserData = {}
+	TSessionData = Record<string, never>,
+	TUserData = Record<string, never>
 > = {
 	authority?: string;
 	tokenUrl?: string;
@@ -1838,8 +1838,8 @@ type SSOValidators = {
 	tokenResponse: StandardSchemaV16<unknown, TokenResponse>;
 };
 type SSO<
-	TSessionData = {},
-	TUserData = {}
+	TSessionData = Record<string, never>,
+	TUserData = Record<string, never>
 > = SSOConfig<TSessionData, TUserData> & {
 	getUser: (request: Request) => Promise<User2 | undefined>;
 	getRequiredUser: (request: Request) => Promise<User2>;

package/dist/index.js

@@ -1 +1 @@
-import{I as B,a as D0,b as T0,c as $0,d as f0,e as x0,f as A0,g as Q0,h as X0,i as Z0,j as G0,k as R0,l as Y0,m as c0,n as y0,o as z0,p as B0,q as H0,t as N0,u as W0,v as C0,w as M0,x as _0}from"./shared/core-kk9hdwwp.js";var k="0.0.14";var V=["sessionStore","userStore","groupStore","tokenStore","magicLinkStore"];function C(L){if(L===null||typeof L!=="object")return L;let T={};for(let[J,D]of Object.entries(L)){if(V.includes(J)||J==="validators"||J==="setStores")continue;T[J]=D!==null&&typeof D==="object"&&!Array.isArray(D)&&Object.getPrototypeOf(D)===Object.prototype?C(D):D}return T}function E(L){return C(L)}function z(L,T,J,D){let $=T.length,A=D??L,f=A>0?Math.floor(J/A)+1:1,x=A>0?Math.ceil(L/A):0;return{total:L,count:$,items:T,size:A,page:f,pages:x}}class N extends Error{constructor(L,T){super(L,T);this.name="TenantRequestError",Object.setPrototypeOf(this,N.prototype)}}class c extends Error{userId;tenantIds;constructor(L,T,J){super(`Multiple tenants found for user id "${L}"`,J);this.name="MultipleTenantsForUserError",this.userId=L,this.tenantIds=T,Object.setPrototypeOf(this,c.prototype)}}var H=Number.POSITIVE_INFINITY;class M{tenants=new Map;tenantEsMap=new Map;userTenantIds=new Map;ttl;userMode;createEs;findTenantByUserId;findTenantsByUserId;constructor(L){if(this.ttl=O(L.ttl),this.userMode=L.userMode,this.createEs=L.createEs,this.userMode==="singleTenantOnly"){this.findTenantByUserId=this.findSingleTenantByUserId.bind(this),this.findTenantsByUserId=void 0;return}this.findTenantByUserId=void 0,this.findTenantsByUserId=this.findMultipleTenantsByUserId.bind(this)}async get(L){return this.tenants.get(L)??null}async list(L){let T=Array.from(this.tenants.values()),J=Math.max(0,L?.start??0),D=L?.limit,$=L?.sort;if($?.length)T=[...T].sort((X,G)=>{for(let{field:Z,direction:q}of $){let F=X[Z],U=G[Z],y=j(F,U);if(y!==0)return q==="desc"?-y:y}return 0});let A=T.length,f=D!=null?J+D:void 0,x=T.slice(J,f);return z(A,x,J,D)}async upsert(L){let T=new Date,J=this.tenants.get(L.tenantId),D={...J??{},...L,companyId:L.companyId??J?.companyId??"",companyName:L.companyName??J?.companyName??"",environmentType:L.environmentType??J?.environmentType??"DEV",email:L.email??J?.email,webhookUrl:L.webhookUrl??J?.webhookUrl,callbackUrl:L.callbackUrl??J?.callbackUrl,tenantUrl:L.tenantUrl??J?.tenantUrl,status:L.status??J?.status??"completed",createdAt:L.createdAt??J?.createdAt??T,updatedAt:L.updatedAt??T};return this.tenants.set(D.tenantId,D),this.tenantEsMap.delete(D.tenantId),D}async delete(L){this.tenantEsMap.delete(L),this.tenants.delete(L)}async getEs(L){let T=await this.get(L);if(!T)throw Error(`Tenant "${L}" not found`);if(!this.createEs)throw Error("InMemoryTenantStore requires options.createEs to use getEs()");if(this.ttl===0)return this.createEs(B(T));let J=Date.now(),D=this.tenantEsMap.get(L);if(D&&D.expiresAt>J)return D.es;if(D)this.tenantEsMap.delete(L);let $=this.createEs(B(T));return this.tenantEsMap.set(L,{es:$,expiresAt:g(J,this.ttl)}),$}getCachedTenantIds(){if(this.ttl===0)return[];let L=Date.now();for(let[T,J]of this.tenantEsMap.entries())if(J.expiresAt<=L)this.tenantEsMap.delete(T);return Array.from(this.tenantEsMap.keys())}async registerUserTenantId(L,T){if(!L)return;let J=S(T);if(this.userMode==="singleTenantOnly"){this.userTenantIds.set(L,new Set([J]));return}let D=this.userTenantIds.get(L);if(D){D.add(J);return}this.userTenantIds.set(L,new Set([J]))}async findSingleTenantByUserId(L){let T=await this.resolveTenantsByUserId(L);if(T.length>1)throw new c(L,T.map((J)=>J.tenantId));return T[0]??null}async findMultipleTenantsByUserId(L){return this.resolveTenantsByUserId(L)}async resolveTenantsByUserId(L){let T=this.userTenantIds.get(L);if(!T||T.size===0)return[];let J=T.has(null),D=Array.from(T).filter((f)=>f!=null);if(D.length===0)return[];let $=await Promise.all(D.map(async(f)=>({tenantId:f,tenant:await this.get(f)}))),A=$.filter((f)=>f.tenant!=null).map((f)=>f.tenantId);if(A.length===0){if(J)this.userTenantIds.set(L,new Set([null]));else this.userTenantIds.delete(L);return[]}if(A.length!==D.length){let f=J?[null,...A]:A;this.userTenantIds.set(L,new Set(f))}return $.map((f)=>f.tenant).filter((f)=>f!=null)}}function j(L,T){let J=L===void 0||L===null,D=T===void 0||T===null;if(J&&D)return 0;if(J)return 1;if(D)return-1;if(L instanceof Date&&T instanceof Date)return L.getTime()-T.getTime();let $=String(L),A=String(T);return $.localeCompare(A)}function S(L){if(typeof L!=="string")return null;return L.trim()||null}function O(L){if(L===void 0)return H;if(L<=0)return L===0?0:H;return L}function g(L,T){if(!Number.isFinite(T))return H;return L+T}function I(L,T,J){return(async()=>{try{let D=await fetch(L,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(T)});if(!D.ok)J.error(`Failed to send webhook update: ${D.status} ${D.statusText}`)}catch(D){J.error("Failed to send webhook update:",D)}})()}async function P(L,T,J){return I(L,T,J)}var p={beforeTenantSegments:["ui"]},m={beforeTenantSegments:["api"]};function _(L){return{segments:W(L?.segments)}}function W(L){return(L??[]).map((T)=>T.trim()).filter(Boolean)}function h(L){let T=L.trim();if(!T)return"/";let J=T.replace(/\\/g,"/").replace(/\/+/g,"/");return J.startsWith("/")?J:`/${J}`}function K(L){return h(L).split("/").filter(Boolean)}function R(L){return{beforeTenantSegments:W(L?.beforeTenantSegments),afterTenantSegments:W(L?.afterTenantSegments)}}function b(L){if(!L||L.type===void 0||L.type==="path"){let J=L;return{type:"path",ui:R(J?.ui),api:R(J?.api)}}let T=L;return{...T,ui:_(T.ui),api:_(T.api)}}function o(L,T){let J=R(T),D=J.beforeTenantSegments??[],$=J.afterTenantSegments??[],A=K(L),f=D.length+1+$.length;if(A.length<f)return null;for(let Z=0;Z<D.length;Z++)if(A[Z]!==D[Z])return null;let x=D.length,X=A[x];if(!X)return null;for(let Z=0;Z<$.length;Z++)if(A[x+1+Z]!==$[Z])return null;let G=A.slice(x+1+$.length);return{tenantId:decodeURIComponent(X),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function n(L,T="/",J){let D=R(J),$=D.beforeTenantSegments??[],A=D.afterTenantSegments??[],f=K(T),x=[...$,encodeURIComponent(L),...A,...f];return x.length>0?`/${x.join("/")}`:"/"}function Q(L,T,J,D,$){if(L===void 0||L===null){if(J)D.push({message:`${T} is required`,path:$});return}if(typeof L!=="string"){D.push({message:`${T} must be a string`,path:$});return}return L}function Y(L,T,J,D){if(L===void 0||L===null)return;if(typeof L!=="boolean"){J.push({message:`${T} must be a boolean`,path:D});return}return L}function v(L,T,J){if(L===void 0||L===null)return;if(typeof L!=="object"||L===null){T.push({message:"name must be an object",path:J});return}let D=L,$={};return $.formatted=Q(D.formatted,"formatted",!1,T,[...J,"formatted"]),$.familyName=Q(D.familyName,"familyName",!1,T,[...J,"familyName"]),$.givenName=Q(D.givenName,"givenName",!1,T,[...J,"givenName"]),$.middleName=Q(D.middleName,"middleName",!1,T,[...J,"middleName"]),$.honorificPrefix=Q(D.honorificPrefix,"honorificPrefix",!1,T,[...J,"honorificPrefix"]),$.honorificSuffix=Q(D.honorificSuffix,"honorificSuffix",!1,T,[...J,"honorificSuffix"]),$}function d(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"emails must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"email must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function r(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"phoneNumbers must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"phoneNumber must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function l(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"addresses must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"address must be an object",path:f});continue}let x=A;D.push({formatted:Q(x.formatted,"formatted",!1,T,[...f,"formatted"]),streetAddress:Q(x.streetAddress,"streetAddress",!1,T,[...f,"streetAddress"]),locality:Q(x.locality,"locality",!1,T,[...f,"locality"]),region:Q(x.region,"region",!1,T,[...f,"region"]),postalCode:Q(x.postalCode,"postalCode",!1,T,[...f,"postalCode"]),country:Q(x.country,"country",!1,T,[...f,"country"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function t(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"groups must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"group must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,$ref:Q(x.$ref,"$ref",!1,T,[...f,"$ref"]),display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"])})}return D.length>0?D:void 0}function i(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"roles must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"role must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function u(L,T,J){if(L===void 0||L===null)return;if(typeof L!=="object"||L===null){T.push({message:"Enterprise User extension must be an object",path:J});return}let D=L,$={};if($.employeeNumber=Q(D.employeeNumber,"employeeNumber",!1,T,[...J,"employeeNumber"]),$.costCenter=Q(D.costCenter,"costCenter",!1,T,[...J,"costCenter"]),$.organization=Q(D.organization,"organization",!1,T,[...J,"organization"]),$.division=Q(D.division,"division",!1,T,[...J,"division"]),$.department=Q(D.department,"department",!1,T,[...J,"department"]),D.manager!==void 0&&D.manager!==null)if(typeof D.manager!=="object"||D.manager===null)T.push({message:"manager must be an object",path:[...J,"manager"]});else{let A=D.manager;$.manager={value:Q(A.value,"value",!1,T,[...J,"manager","value"]),$ref:Q(A.$ref,"$ref",!1,T,[...J,"manager","$ref"]),displayName:Q(A.displayName,"displayName",!1,T,[...J,"manager","displayName"])}}return $}function a(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={},A=Q(J.userName,"userName",!0,D,["userName"]);if(!A)return{issues:D};$.userName=A,$.id=Q(J.id,"id",!1,D,["id"]),$.externalId=Q(J.externalId,"externalId",!1,D,["externalId"]),$.displayName=Q(J.displayName,"displayName",!1,D,["displayName"]),$.nickName=Q(J.nickName,"nickName",!1,D,["nickName"]),$.profileUrl=Q(J.profileUrl,"profileUrl",!1,D,["profileUrl"]),$.title=Q(J.title,"title",!1,D,["title"]),$.userType=Q(J.userType,"userType",!1,D,["userType"]),$.preferredLanguage=Q(J.preferredLanguage,"preferredLanguage",!1,D,["preferredLanguage"]),$.locale=Q(J.locale,"locale",!1,D,["locale"]),$.timezone=Q(J.timezone,"timezone",!1,D,["timezone"]),$.password=Q(J.password,"password",!1,D,["password"]),$.active=Y(J.active,"active",D,["active"]),$.name=v(J.name,D,["name"]),$.emails=d(J.emails,D,["emails"]),$.phoneNumbers=r(J.phoneNumbers,D,["phoneNumbers"]),$.addresses=l(J.addresses,D,["addresses"]),$.groups=t(J.groups,D,["groups"]),$.roles=i(J.roles,D,["roles"]);let f="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(J[f]!==void 0)$[f]=u(J[f],D,[f]);if(J.schemas!==void 0)if(Array.isArray(J.schemas))$.schemas=J.schemas.filter((x)=>typeof x==="string");else D.push({message:"schemas must be an array",path:["schemas"]});if(J.meta!==void 0)if(typeof J.meta==="object"&&J.meta!==null){let x=J.meta;$.meta={resourceType:typeof x.resourceType==="string"?x.resourceType:void 0,created:typeof x.created==="string"?x.created:void 0,lastModified:typeof x.lastModified==="string"?x.lastModified:void 0,location:typeof x.location==="string"?x.location:void 0,version:typeof x.version==="string"?x.version:void 0}}else D.push({message:"meta must be an object",path:["meta"]});if(D.length>0)return{issues:D};return{value:$}}}}}function e(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"members must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"member must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X){let G=Q(x.type,"type",!1,T,[...f,"type"]);D.push({value:X,$ref:Q(x.$ref,"$ref",!1,T,[...f,"$ref"]),display:Q(x.display,"display",!1,T,[...f,"display"]),type:G==="User"||G==="Group"?G:void 0})}}return D.length>0?D:void 0}function s(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={},A=Q(J.displayName,"displayName",!0,D,["displayName"]);if(!A)return{issues:D};if($.displayName=A,$.id=Q(J.id,"id",!1,D,["id"]),$.externalId=Q(J.externalId,"externalId",!1,D,["externalId"]),$.members=e(J.members,D,["members"]),J.schemas!==void 0)if(Array.isArray(J.schemas))$.schemas=J.schemas.filter((f)=>typeof f==="string");else D.push({message:"schemas must be an array",path:["schemas"]});if(J.meta!==void 0)if(typeof J.meta==="object"&&J.meta!==null){let f=J.meta;$.meta={resourceType:typeof f.resourceType==="string"?f.resourceType:void 0,created:typeof f.created==="string"?f.created:void 0,lastModified:typeof f.lastModified==="string"?f.lastModified:void 0,location:typeof f.location==="string"?f.location:void 0,version:typeof f.version==="string"?f.version:void 0}}else D.push({message:"meta must be an object",path:["meta"]});if(D.length>0)return{issues:D};return{value:$}}}}}function J0(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={...J},A=["iss","sub"];for(let X of A)if(X in J){if(typeof J[X]!=="string")D.push({message:`${X} must be a string`,path:[X]})}else D.push({message:`${X} is required`,path:[X]});if("aud"in J&&J.aud!==void 0){let X=J.aud;if(typeof X!=="string"&&!Array.isArray(X))D.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(X)&&!X.every((G)=>typeof G==="string"))D.push({message:"aud array must contain only strings",path:["aud"]})}let f=["jti","scope"];for(let X of f)if(X in J&&J[X]!==void 0){if(typeof J[X]!=="string")D.push({message:`${X} must be a string`,path:[X]})}let x=["exp","iat"];for(let X of x)if(X in J){if(typeof J[X]!=="number")D.push({message:`${X} must be a number`,path:[X]})}else D.push({message:`${X} is required`,path:[X]});if(D.length>0)return{issues:D};return{value:$}}}}}function L0(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={};if("access_token"in J)if(typeof J.access_token==="string")$.access_token=J.access_token;else D.push({message:"access_token must be a string",path:["access_token"]});else D.push({message:"access_token is required",path:["access_token"]});if("token_type"in J)if(typeof J.token_type==="string")$.token_type=J.token_type;else D.push({message:"token_type must be a string",path:["token_type"]});else D.push({message:"token_type is required",path:["token_type"]});if("scope"in J)if(typeof J.scope==="string"||J.scope===void 0)$.scope=J.scope;else D.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in J)if(typeof J.refresh_token==="string"||J.refresh_token===void 0)$.refresh_token=J.refresh_token;else D.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in J)if(typeof J.expires==="string"||J.expires===void 0)$.expires=J.expires;else D.push({message:"expires must be a string",path:["expires"]});if("expires_in"in J)if(typeof J.expires_in==="number"||J.expires_in===void 0)$.expires_in=J.expires_in;else D.push({message:"expires_in must be a number",path:["expires_in"]});if(D.length>0)return{issues:D};return{value:$}}}}}export{L0 as workloadTokenResponseSchema,f0 as withValidate,G0 as waitOn,k as version,A0 as validationFailureResponse,a as userSchema,T0 as tokenResponseSchema,X0 as stripJsonComments,y0 as silentLogger,W0 as setActiveSession,E as serializeESConfig,P as sendTenantWebhook,Z0 as parseJsonc,D0 as oidcCallbackSchema,b as normalizeTenantRoutingStrategy,R as normalizeTenantPathNamespace,x0 as must,Q0 as mergeConfig,o as matchTenantPath,M0 as listSsoClientIdsFromCookies,z as list,J0 as jwtAssertionClaimsSchema,z0 as infoLogger,$0 as idTokenClaimsSchema,s as groupResourceSchema,N0 as getActiveSession,_0 as findTenantFromStateParam,c0 as defaultLogger,Y0 as decodeUser,B0 as debugLogger,H0 as consoleLogger,C0 as clearActiveSession,R0 as claimsToUser,n as buildTenantPath,N as TenantRequestError,c as MultipleTenantsForUserError,M as InMemoryTenantStore,p as DEFAULT_TENANT_UI_NAMESPACE,m as DEFAULT_TENANT_API_NAMESPACE};
+import{I as B,a as D0,b as T0,c as $0,d as f0,e as x0,f as A0,g as Q0,h as X0,i as Z0,j as G0,k as R0,l as Y0,m as c0,n as y0,o as z0,p as B0,q as H0,t as N0,u as W0,v as C0,w as M0,x as _0}from"./shared/core-5zkmzncy.js";var k="0.0.15-beta.20260407.1";var V=["sessionStore","userStore","groupStore","tokenStore","magicLinkStore"];function C(L){if(L===null||typeof L!=="object")return L;let T={};for(let[J,D]of Object.entries(L)){if(V.includes(J)||J==="validators"||J==="setStores")continue;T[J]=D!==null&&typeof D==="object"&&!Array.isArray(D)&&Object.getPrototypeOf(D)===Object.prototype?C(D):D}return T}function E(L){return C(L)}function z(L,T,J,D){let $=T.length,A=D??L,f=A>0?Math.floor(J/A)+1:1,x=A>0?Math.ceil(L/A):0;return{total:L,count:$,items:T,size:A,page:f,pages:x}}class N extends Error{constructor(L,T){super(L,T);this.name="TenantRequestError",Object.setPrototypeOf(this,N.prototype)}}class c extends Error{userId;tenantIds;constructor(L,T,J){super(`Multiple tenants found for user id "${L}"`,J);this.name="MultipleTenantsForUserError",this.userId=L,this.tenantIds=T,Object.setPrototypeOf(this,c.prototype)}}var H=Number.POSITIVE_INFINITY;class M{tenants=new Map;tenantEsMap=new Map;userTenantIds=new Map;ttl;userMode;createEs;findTenantByUserId;findTenantsByUserId;constructor(L){if(this.ttl=O(L.ttl),this.userMode=L.userMode,this.createEs=L.createEs,this.userMode==="singleTenantOnly"){this.findTenantByUserId=this.findSingleTenantByUserId.bind(this),this.findTenantsByUserId=void 0;return}this.findTenantByUserId=void 0,this.findTenantsByUserId=this.findMultipleTenantsByUserId.bind(this)}async get(L){return this.tenants.get(L)??null}async list(L){let T=Array.from(this.tenants.values()),J=Math.max(0,L?.start??0),D=L?.limit,$=L?.sort;if($?.length)T=[...T].sort((X,G)=>{for(let{field:Z,direction:q}of $){let F=X[Z],U=G[Z],y=j(F,U);if(y!==0)return q==="desc"?-y:y}return 0});let A=T.length,f=D!=null?J+D:void 0,x=T.slice(J,f);return z(A,x,J,D)}async upsert(L){let T=new Date,J=this.tenants.get(L.tenantId),D={...J??{},...L,companyId:L.companyId??J?.companyId??"",companyName:L.companyName??J?.companyName??"",environmentType:L.environmentType??J?.environmentType??"DEV",email:L.email??J?.email,webhookUrl:L.webhookUrl??J?.webhookUrl,callbackUrl:L.callbackUrl??J?.callbackUrl,tenantUrl:L.tenantUrl??J?.tenantUrl,status:L.status??J?.status??"completed",createdAt:L.createdAt??J?.createdAt??T,updatedAt:L.updatedAt??T};return this.tenants.set(D.tenantId,D),this.tenantEsMap.delete(D.tenantId),D}async delete(L){this.tenantEsMap.delete(L),this.tenants.delete(L)}async getEs(L){let T=await this.get(L);if(!T)throw Error(`Tenant "${L}" not found`);if(!this.createEs)throw Error("InMemoryTenantStore requires options.createEs to use getEs()");if(this.ttl===0)return this.createEs(B(T));let J=Date.now(),D=this.tenantEsMap.get(L);if(D&&D.expiresAt>J)return D.es;if(D)this.tenantEsMap.delete(L);let $=this.createEs(B(T));return this.tenantEsMap.set(L,{es:$,expiresAt:g(J,this.ttl)}),$}getCachedTenantIds(){if(this.ttl===0)return[];let L=Date.now();for(let[T,J]of this.tenantEsMap.entries())if(J.expiresAt<=L)this.tenantEsMap.delete(T);return Array.from(this.tenantEsMap.keys())}async registerUserTenantId(L,T){if(!L)return;let J=S(T);if(this.userMode==="singleTenantOnly"){this.userTenantIds.set(L,new Set([J]));return}let D=this.userTenantIds.get(L);if(D){D.add(J);return}this.userTenantIds.set(L,new Set([J]))}async findSingleTenantByUserId(L){let T=await this.resolveTenantsByUserId(L);if(T.length>1)throw new c(L,T.map((J)=>J.tenantId));return T[0]??null}async findMultipleTenantsByUserId(L){return this.resolveTenantsByUserId(L)}async resolveTenantsByUserId(L){let T=this.userTenantIds.get(L);if(!T||T.size===0)return[];let J=T.has(null),D=Array.from(T).filter((f)=>f!=null);if(D.length===0)return[];let $=await Promise.all(D.map(async(f)=>({tenantId:f,tenant:await this.get(f)}))),A=$.filter((f)=>f.tenant!=null).map((f)=>f.tenantId);if(A.length===0){if(J)this.userTenantIds.set(L,new Set([null]));else this.userTenantIds.delete(L);return[]}if(A.length!==D.length){let f=J?[null,...A]:A;this.userTenantIds.set(L,new Set(f))}return $.map((f)=>f.tenant).filter((f)=>f!=null)}}function j(L,T){let J=L===void 0||L===null,D=T===void 0||T===null;if(J&&D)return 0;if(J)return 1;if(D)return-1;if(L instanceof Date&&T instanceof Date)return L.getTime()-T.getTime();let $=String(L),A=String(T);return $.localeCompare(A)}function S(L){if(typeof L!=="string")return null;return L.trim()||null}function O(L){if(L===void 0)return H;if(L<=0)return L===0?0:H;return L}function g(L,T){if(!Number.isFinite(T))return H;return L+T}function I(L,T,J){return(async()=>{try{let D=await fetch(L,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(T)});if(!D.ok)J.error(`Failed to send webhook update: ${D.status} ${D.statusText}`)}catch(D){J.error("Failed to send webhook update:",D)}})()}async function P(L,T,J){return I(L,T,J)}var p={beforeTenantSegments:["ui"]},m={beforeTenantSegments:["api"]};function _(L){return{segments:W(L?.segments)}}function W(L){return(L??[]).map((T)=>T.trim()).filter(Boolean)}function h(L){let T=L.trim();if(!T)return"/";let J=T.replace(/\\/g,"/").replace(/\/+/g,"/");return J.startsWith("/")?J:`/${J}`}function K(L){return h(L).split("/").filter(Boolean)}function R(L){return{beforeTenantSegments:W(L?.beforeTenantSegments),afterTenantSegments:W(L?.afterTenantSegments)}}function b(L){if(!L||L.type===void 0||L.type==="path"){let J=L;return{type:"path",ui:R(J?.ui),api:R(J?.api)}}let T=L;return{...T,ui:_(T.ui),api:_(T.api)}}function o(L,T){let J=R(T),D=J.beforeTenantSegments??[],$=J.afterTenantSegments??[],A=K(L),f=D.length+1+$.length;if(A.length<f)return null;for(let Z=0;Z<D.length;Z++)if(A[Z]!==D[Z])return null;let x=D.length,X=A[x];if(!X)return null;for(let Z=0;Z<$.length;Z++)if(A[x+1+Z]!==$[Z])return null;let G=A.slice(x+1+$.length);return{tenantId:decodeURIComponent(X),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function n(L,T="/",J){let D=R(J),$=D.beforeTenantSegments??[],A=D.afterTenantSegments??[],f=K(T),x=[...$,encodeURIComponent(L),...A,...f];return x.length>0?`/${x.join("/")}`:"/"}function Q(L,T,J,D,$){if(L===void 0||L===null){if(J)D.push({message:`${T} is required`,path:$});return}if(typeof L!=="string"){D.push({message:`${T} must be a string`,path:$});return}return L}function Y(L,T,J,D){if(L===void 0||L===null)return;if(typeof L!=="boolean"){J.push({message:`${T} must be a boolean`,path:D});return}return L}function v(L,T,J){if(L===void 0||L===null)return;if(typeof L!=="object"||L===null){T.push({message:"name must be an object",path:J});return}let D=L,$={};return $.formatted=Q(D.formatted,"formatted",!1,T,[...J,"formatted"]),$.familyName=Q(D.familyName,"familyName",!1,T,[...J,"familyName"]),$.givenName=Q(D.givenName,"givenName",!1,T,[...J,"givenName"]),$.middleName=Q(D.middleName,"middleName",!1,T,[...J,"middleName"]),$.honorificPrefix=Q(D.honorificPrefix,"honorificPrefix",!1,T,[...J,"honorificPrefix"]),$.honorificSuffix=Q(D.honorificSuffix,"honorificSuffix",!1,T,[...J,"honorificSuffix"]),$}function d(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"emails must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"email must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function r(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"phoneNumbers must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"phoneNumber must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function l(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"addresses must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"address must be an object",path:f});continue}let x=A;D.push({formatted:Q(x.formatted,"formatted",!1,T,[...f,"formatted"]),streetAddress:Q(x.streetAddress,"streetAddress",!1,T,[...f,"streetAddress"]),locality:Q(x.locality,"locality",!1,T,[...f,"locality"]),region:Q(x.region,"region",!1,T,[...f,"region"]),postalCode:Q(x.postalCode,"postalCode",!1,T,[...f,"postalCode"]),country:Q(x.country,"country",!1,T,[...f,"country"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function t(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"groups must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"group must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,$ref:Q(x.$ref,"$ref",!1,T,[...f,"$ref"]),display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"])})}return D.length>0?D:void 0}function i(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"roles must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"role must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X)D.push({value:X,display:Q(x.display,"display",!1,T,[...f,"display"]),type:Q(x.type,"type",!1,T,[...f,"type"]),primary:Y(x.primary,"primary",T,[...f,"primary"])})}return D.length>0?D:void 0}function u(L,T,J){if(L===void 0||L===null)return;if(typeof L!=="object"||L===null){T.push({message:"Enterprise User extension must be an object",path:J});return}let D=L,$={};if($.employeeNumber=Q(D.employeeNumber,"employeeNumber",!1,T,[...J,"employeeNumber"]),$.costCenter=Q(D.costCenter,"costCenter",!1,T,[...J,"costCenter"]),$.organization=Q(D.organization,"organization",!1,T,[...J,"organization"]),$.division=Q(D.division,"division",!1,T,[...J,"division"]),$.department=Q(D.department,"department",!1,T,[...J,"department"]),D.manager!==void 0&&D.manager!==null)if(typeof D.manager!=="object"||D.manager===null)T.push({message:"manager must be an object",path:[...J,"manager"]});else{let A=D.manager;$.manager={value:Q(A.value,"value",!1,T,[...J,"manager","value"]),$ref:Q(A.$ref,"$ref",!1,T,[...J,"manager","$ref"]),displayName:Q(A.displayName,"displayName",!1,T,[...J,"manager","displayName"])}}return $}function a(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={},A=Q(J.userName,"userName",!0,D,["userName"]);if(!A)return{issues:D};$.userName=A,$.id=Q(J.id,"id",!1,D,["id"]),$.externalId=Q(J.externalId,"externalId",!1,D,["externalId"]),$.displayName=Q(J.displayName,"displayName",!1,D,["displayName"]),$.nickName=Q(J.nickName,"nickName",!1,D,["nickName"]),$.profileUrl=Q(J.profileUrl,"profileUrl",!1,D,["profileUrl"]),$.title=Q(J.title,"title",!1,D,["title"]),$.userType=Q(J.userType,"userType",!1,D,["userType"]),$.preferredLanguage=Q(J.preferredLanguage,"preferredLanguage",!1,D,["preferredLanguage"]),$.locale=Q(J.locale,"locale",!1,D,["locale"]),$.timezone=Q(J.timezone,"timezone",!1,D,["timezone"]),$.password=Q(J.password,"password",!1,D,["password"]),$.active=Y(J.active,"active",D,["active"]),$.name=v(J.name,D,["name"]),$.emails=d(J.emails,D,["emails"]),$.phoneNumbers=r(J.phoneNumbers,D,["phoneNumbers"]),$.addresses=l(J.addresses,D,["addresses"]),$.groups=t(J.groups,D,["groups"]),$.roles=i(J.roles,D,["roles"]);let f="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(J[f]!==void 0)$[f]=u(J[f],D,[f]);if(J.schemas!==void 0)if(Array.isArray(J.schemas))$.schemas=J.schemas.filter((x)=>typeof x==="string");else D.push({message:"schemas must be an array",path:["schemas"]});if(J.meta!==void 0)if(typeof J.meta==="object"&&J.meta!==null){let x=J.meta;$.meta={resourceType:typeof x.resourceType==="string"?x.resourceType:void 0,created:typeof x.created==="string"?x.created:void 0,lastModified:typeof x.lastModified==="string"?x.lastModified:void 0,location:typeof x.location==="string"?x.location:void 0,version:typeof x.version==="string"?x.version:void 0}}else D.push({message:"meta must be an object",path:["meta"]});if(D.length>0)return{issues:D};return{value:$}}}}}function e(L,T,J){if(L===void 0||L===null)return;if(!Array.isArray(L)){T.push({message:"members must be an array",path:J});return}let D=[];for(let $=0;$<L.length;$++){let A=L[$],f=[...J,$];if(typeof A!=="object"||A===null){T.push({message:"member must be an object",path:f});continue}let x=A,X=Q(x.value,"value",!0,T,[...f,"value"]);if(X){let G=Q(x.type,"type",!1,T,[...f,"type"]);D.push({value:X,$ref:Q(x.$ref,"$ref",!1,T,[...f,"$ref"]),display:Q(x.display,"display",!1,T,[...f,"display"]),type:G==="User"||G==="Group"?G:void 0})}}return D.length>0?D:void 0}function s(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={},A=Q(J.displayName,"displayName",!0,D,["displayName"]);if(!A)return{issues:D};if($.displayName=A,$.id=Q(J.id,"id",!1,D,["id"]),$.externalId=Q(J.externalId,"externalId",!1,D,["externalId"]),$.members=e(J.members,D,["members"]),J.schemas!==void 0)if(Array.isArray(J.schemas))$.schemas=J.schemas.filter((f)=>typeof f==="string");else D.push({message:"schemas must be an array",path:["schemas"]});if(J.meta!==void 0)if(typeof J.meta==="object"&&J.meta!==null){let f=J.meta;$.meta={resourceType:typeof f.resourceType==="string"?f.resourceType:void 0,created:typeof f.created==="string"?f.created:void 0,lastModified:typeof f.lastModified==="string"?f.lastModified:void 0,location:typeof f.location==="string"?f.location:void 0,version:typeof f.version==="string"?f.version:void 0}}else D.push({message:"meta must be an object",path:["meta"]});if(D.length>0)return{issues:D};return{value:$}}}}}function J0(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={...J},A=["iss","sub"];for(let X of A)if(X in J){if(typeof J[X]!=="string")D.push({message:`${X} must be a string`,path:[X]})}else D.push({message:`${X} is required`,path:[X]});if("aud"in J&&J.aud!==void 0){let X=J.aud;if(typeof X!=="string"&&!Array.isArray(X))D.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(X)&&!X.every((G)=>typeof G==="string"))D.push({message:"aud array must contain only strings",path:["aud"]})}let f=["jti","scope"];for(let X of f)if(X in J&&J[X]!==void 0){if(typeof J[X]!=="string")D.push({message:`${X} must be a string`,path:[X]})}let x=["exp","iat"];for(let X of x)if(X in J){if(typeof J[X]!=="number")D.push({message:`${X} must be a number`,path:[X]})}else D.push({message:`${X} is required`,path:[X]});if(D.length>0)return{issues:D};return{value:$}}}}}function L0(L){return{"~standard":{version:1,vendor:L,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let J=T,D=[],$={};if("access_token"in J)if(typeof J.access_token==="string")$.access_token=J.access_token;else D.push({message:"access_token must be a string",path:["access_token"]});else D.push({message:"access_token is required",path:["access_token"]});if("token_type"in J)if(typeof J.token_type==="string")$.token_type=J.token_type;else D.push({message:"token_type must be a string",path:["token_type"]});else D.push({message:"token_type is required",path:["token_type"]});if("scope"in J)if(typeof J.scope==="string"||J.scope===void 0)$.scope=J.scope;else D.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in J)if(typeof J.refresh_token==="string"||J.refresh_token===void 0)$.refresh_token=J.refresh_token;else D.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in J)if(typeof J.expires==="string"||J.expires===void 0)$.expires=J.expires;else D.push({message:"expires must be a string",path:["expires"]});if("expires_in"in J)if(typeof J.expires_in==="number"||J.expires_in===void 0)$.expires_in=J.expires_in;else D.push({message:"expires_in must be a number",path:["expires_in"]});if(D.length>0)return{issues:D};return{value:$}}}}}export{L0 as workloadTokenResponseSchema,f0 as withValidate,G0 as waitOn,k as version,A0 as validationFailureResponse,a as userSchema,T0 as tokenResponseSchema,X0 as stripJsonComments,y0 as silentLogger,W0 as setActiveSession,E as serializeESConfig,P as sendTenantWebhook,Z0 as parseJsonc,D0 as oidcCallbackSchema,b as normalizeTenantRoutingStrategy,R as normalizeTenantPathNamespace,x0 as must,Q0 as mergeConfig,o as matchTenantPath,M0 as listSsoClientIdsFromCookies,z as list,J0 as jwtAssertionClaimsSchema,z0 as infoLogger,$0 as idTokenClaimsSchema,s as groupResourceSchema,N0 as getActiveSession,_0 as findTenantFromStateParam,c0 as defaultLogger,Y0 as decodeUser,B0 as debugLogger,H0 as consoleLogger,C0 as clearActiveSession,R0 as claimsToUser,n as buildTenantPath,N as TenantRequestError,c as MultipleTenantsForUserError,M as InMemoryTenantStore,p as DEFAULT_TENANT_UI_NAMESPACE,m as DEFAULT_TENANT_API_NAMESPACE};

package/dist/server.d.ts

@@ -1665,8 +1665,8 @@ interface SessionStore<TExtended = object> {
 	delete(sid: string): Promise<void>;
 }
 type SSOConfig<
-	TSessionData = {},
-	TUserData = {}
+	TSessionData = Record<string, never>,
+	TUserData = Record<string, never>
 > = {
 	authority?: string;
 	tokenUrl?: string;
@@ -1732,8 +1732,8 @@ type SSOValidators = {
 	tokenResponse: StandardSchemaV16<unknown, TokenResponse>;
 };
 type SSO<
-	TSessionData = {},
-	TUserData = {}
+	TSessionData = Record<string, never>,
+	TUserData = Record<string, never>
 > = SSOConfig<TSessionData, TUserData> & {
 	getUser: (request: Request) => Promise<User2 | undefined>;
 	getRequiredUser: (request: Request) => Promise<User2>;
@@ -1745,8 +1745,8 @@ type SSO<
 	handler: (request: Request) => Promise<Response>;
 };
 declare function sso<
-	TSessionData = {},
-	TUserData = {}
+	TSessionData = Record<string, never>,
+	TUserData = Record<string, never>
 >(validators: SSOValidators, _log: Logger, fromVault?: Partial<SSOConfig<TSessionData, TUserData>>, fromCode?: Partial<SSOConfig<TSessionData, TUserData>>): SSO<TSessionData, TUserData> | undefined;
 declare function getSSOUser(request: Request, es: EnterpriseStandard): Promise<User2 | undefined>;
 declare function getSSOorCIAMUser(request: Request, es: EnterpriseStandard): Promise<User2 | undefined>;

package/dist/server.js

@@ -1 +1 @@
-import{A as _M,B as GM,C as JM,D as LM,E as DM,F as jM,G as IM,H as EM,I as PM,c as XM,d as YM,e,k as ZM,r as $M,s as FM,y as NM,z as VM}from"./shared/core-kk9hdwwp.js";function zM(W,D,j,h,q){if(!j&&!h)return;let E={...j,...h},Y={...E,signingKey:j?.signingKey,magicLinkTtl:E.magicLinkTtl??3600,sessionTtl:E.sessionTtl??86400,cookiesSecure:E.cookiesSecure!==void 0?E.cookiesSecure:!0,cookiesSameSite:E.cookiesSameSite!==void 0?E.cookiesSameSite:"Strict",cookiesPrefix:E.cookiesPrefix??(E.ciamId?`es.ciam.${E.ciamId}`:"es.ciam"),cookiesPath:E.cookiesPath??"/",sessionValidation:E.sessionValidation??"always"};function U(){if(!Y.signingKey)throw Error("Missing CIAM configuration field: signingKey. CIAM signingKey is required for JWT token signing and must be provided via Vault (ciam.signingKey).")}function g(){if(!Y.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and backchannel logout.");return Y.sessionStore}function m(){U(),g()}function i(M=32){let A=new Uint8Array(M);return crypto.getRandomValues(A),Array.from(A,(X)=>X.toString(16).padStart(2,"0")).join("").substring(0,M)}function l(M){let A=typeof M==="string"?new TextEncoder().encode(M):M,X="";return A.forEach((Z)=>{X+=String.fromCharCode(Z)}),btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function t(M){let A=M.replace(/-/g,"+").replace(/_/g,"/"),X=A.padEnd(A.length+(4-A.length%4)%4,"=");return atob(X)}async function x(){U();let M=new TextEncoder().encode(Y.signingKey??"");return crypto.subtle.importKey("raw",M,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function f(M){let X=l(JSON.stringify({alg:"HS256",typ:"JWT"})),Z=l(JSON.stringify(M)),K=`${X}.${Z}`,_=await x(),O=await crypto.subtle.sign("HMAC",_,new TextEncoder().encode(K)),I=l(new Uint8Array(O));return`${K}.${I}`}async function k(M){let A=M.split(".");if(A.length!==3)throw Error("Invalid JWT");let[X,Z,K]=A,_=`${X}.${Z}`,O=await x(),I=new Uint8Array(t(K).split("").map((T)=>T.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",O,I,new TextEncoder().encode(_)))throw Error("Invalid JWT signature");let u=t(Z),c=JSON.parse(u);if(typeof c.exp==="number"&&c.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return c}function B(M,A,X){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(M=`${Y.cookiesPrefix}.${M}`,typeof A!=="string")A=btoa(JSON.stringify(A));let Z;if(X instanceof Date)Z=`Expires=${X.toUTCString()}`;else if(typeof X==="number")Z=`Max-Age=${X}`;else throw Error("Invalid expires type",X);if(A.length>4000)throw Error(`Error setting cookie: ${M}. Cookie length is: ${A.length}`);return`${M}=${A}; ${Z}; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function G(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");return`${Y.cookiesPrefix}.${M}=; Max-Age=0; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function J(M,A,X=!1){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");let Z=A.headers.get("cookie");if(!Z)return null;let K=`${Y.cookiesPrefix}.${M}`,_=Z.split(";").find((C)=>C.trim().startsWith(`${K}=`));if(!_)return null;let O=_.indexOf("="),I=_.substring(O+1).trim();if(!X)return I;try{let C=atob(I);return JSON.parse(C)}catch(C){return console.error(`[CIAM] Failed to parse cookie '${K}':`,C),null}}function P(M,A,X){let Z={expires_in:Y.sessionTtl??86400,token_type:"Bearer",expires:X.toISOString()};return[["Set-Cookie",B("access",M,X)],["Set-Cookie",B("id",A,X)],["Set-Cookie",B("control",Z,X)]]}function v(M){let A=J("access",M),X=J("id",M),Z=J("control",M,!0);if(!A||!X||!Z)return;if(Z.expires&&Date.now()>new Date(Z.expires).getTime())return;return{access:A,id:X,control:Z}}async function w(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=v(M);if(!A)return;let X=await k(A.access),Z=await k(A.id);if(!X.sid||!Z.sub)return;if(Y.sessionValidation!=="disabled"){if(!await g().get(X.sid))return}return z(Z)}catch(A){return}}async function b(M){let A=await w(M);if(A)return A;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function p(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let O=v(M);if(O){let I=await k(O.access);if(I.sid)await g().delete(I.sid)}}catch(O){console.warn("Failed to delete CIAM session:",O)}let A=[["Set-Cookie",G("access")],["Set-Cookie",G("id")],["Set-Cookie",G("control")]],Z=new URL(M.url).searchParams.get("redirect");if(Z)return new Response("Logged out",{status:302,headers:[["Location",Z],...A]});let K=M.headers.get("accept");if(K?.includes("application/json")||K?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...A]});return new Response("Logout Complete",{status:200,headers:[["Content-Type","text/plain"],...A]})}async function y(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=M.headers.get("content-type");if(!A||!A.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let X=await M.text(),K=new URLSearchParams(X).get("logout_token");if(!K)return new Response("Missing logout_token parameter",{status:400});let O=(await k(K)).sid;if(!O)return new Response("Invalid logout_token: missing sid claim",{status:400});return await g().delete(O),new Response("OK",{status:200})}catch(A){return console.error("Error during CIAM back-channel logout:",A),new Response("Internal Server Error",{status:500})}}function S(M){return M.id||M.email||`ciam-${M.userName}`}function V(M,A,X){return{sub:S(M),iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),email:M.email,name:M.name,preferred_username:M.userName,picture:M.avatar,sid:A}}function Q(M,A,X){return{sub:M,iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:A,scope:"openid profile email"}}function z(M){let A=M.exp?new Date(M.exp*1000):new Date;return{id:M.sub,userName:M.preferred_username??"",name:M.name??"",email:M.email??"",avatar:M.picture,userType:"customer",sso:{profile:M,tenant:{id:"ciam",name:"CIAM"},scope:"openid profile email",tokenType:"Bearer",expires:A}}}async function H(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(!q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await q.getWorkloadIdentity(M))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let X,Z;try{let n=M.headers.get("content-type");if(!n||!n.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let a=await M.text(),R=JSON.parse(a);if(Z=typeof R?.redirect==="string"&&R.redirect.length>0?R.redirect:void 0,X={userName:R.userName,name:R.name,email:R.email,avatar:R.avatar},!X.userName||!X.name||!X.email)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}})}catch(n){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let _=new URL(M.url).searchParams.get("ttl"),O=_?parseInt(_,10):Y.magicLinkTtl??3600;if(Number.isNaN(O)||O<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let I=i(32),C=new Date(Date.now()+O*1000);if(!Y.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await Y.magicLinkStore.create(I,X,C)}catch(n){return console.error("Error creating magic link:",n),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let u=new URL(M.url),c=Y.magicLinkLoginUrl||"/magic-link/login",T=new URL(c,u.origin);if(T.searchParams.set("token",I),Z)T.searchParams.set("redirect",Z);return new Response(JSON.stringify({magicLink:T.toString(),expiresAt:C.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function F(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=new URL(M.url),X=A.searchParams.get("token");if(!X){let L=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:L}})}if(!Y.magicLinkStore){let L=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:L}})}let Z=await Y.magicLinkStore.get(X);if(!Z){let L=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:L}})}let K=new Date(Date.now()+(Y.sessionTtl??86400)*1000),_=i(32),O=S(Z.user),I=V(Z.user,_,K),C=Q(O,_,K),u=z(I);try{let L={sid:_,sub:O,createdAt:new Date,lastActivityAt:new Date};await g().create(L)}catch(L){console.warn("Failed to create session:",L)}if(Y.userStore)try{let L=u.id;if(L){let r=new Date,o=await Y.userStore.get(L);if(o||Y.enableJitUserProvisioning){let HM={...o??{},...u,id:L,tenantId:o?.tenantId,createdAt:o?.createdAt??r,updatedAt:r,userType:o?.userType??"customer"};await Y.userStore.upsert(HM)}}}catch(L){console.warn("Failed to store user:",L)}try{await Y.magicLinkStore.delete(X)}catch(L){console.warn("Failed to delete magic link:",L)}let c=await f(C),T=await f(I),n=Y.landingUrl||"/",a=A.searchParams.get("redirect"),R=n;if(a)if(a.startsWith("/"))R=a;else try{if(new URL(a).origin===new URL(M.url).origin)R=a}catch{}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",R],...P(c,T,K)]})}async function $(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=Y.magicLinkUrl||"/magic-link",X=Y.magicLinkLoginUrl||"/magic-link/login",Z=Y.logoutUrl||"/auth/logout",K=Y.logoutBackChannelUrl||"/auth/logout/backchannel",_=new URL(M.url).pathname,O=(T)=>{if(!T)return;try{return new URL(T).pathname}catch{return T.startsWith("/")?T:`/${T}`}};if(O(A)===_&&M.method==="POST")return H(M);if(O(X)===_&&M.method==="GET")return F(M);if(O(Z)===_&&M.method==="GET")return p(M);if(O(K)===_&&M.method==="POST")return y(M);return new Response("Not Found",{status:404})}return{...Y,getUser:w,getRequiredUser:b,logout:p,logoutBackChannel:y,handler:$}}async function BM(W,D){return e(D,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),D.ciam?.getUser(W)}function N(W,D,j){return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:String(W),scimType:j,detail:D}),{status:W,headers:{"Content-Type":"application/scim+json"}})}function MM(W,D){let j=D?.totalResults??W.length,h=D?.startIndex??1,q=D?.itemsPerPage??W.length;return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:ListResponse"],totalResults:j,startIndex:h,itemsPerPage:q,Resources:W}),{status:200,headers:{"Content-Type":"application/scim+json"}})}function d(W,D=200){return new Response(JSON.stringify(W),{status:D,headers:{"Content-Type":"application/scim+json"}})}function s(W){return{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],id:W.id,externalId:W.externalId,displayName:W.displayName,members:W.members,meta:{resourceType:"Group",created:W.createdAt.toISOString(),lastModified:W.updatedAt.toISOString()}}}function AM(){return crypto.randomUUID()}function SM(W,D,j,h,q){if(!h&&!q)return;let Y={...h,...q};function U(){if(!j)throw D.error?.("IAM requires workload configuration before use"),Error("IAM requires workload configuration");return j}async function g(){let B=U(),G=typeof B.getServerToken==="function"?await B.getServerToken():await B.getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${G}`})}async function m(B,G,J,P){if(!Y.url)throw Error("IAM URL not configured for outgoing requests");let v=`${Y.url}${G}`;try{let w=await g(),b=await fetch(v,{method:B,headers:w,body:J?JSON.stringify(J):void 0}),p=await b.json();if(!b.ok)return{success:!1,error:p,status:b.status};let y=await P["~standard"].validate(p);if(y.issues)return console.error("SCIM response validation failed:",y.issues),{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${y.issues.map((S)=>S.message).join("; ")}`},status:400};return{success:!0,data:y.value,status:b.status}}catch(w){return{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"500",detail:w instanceof Error?w.message:"Unknown error occurred"},status:500}}}function i(){return Y.url}let l,t;if(Y.url)t=async(G,J)=>{let P={...G,schemas:G.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return m("POST","/Users",P,W.user)},l={createGroup:async(G,J)=>{let P={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:G,externalId:J?.externalId,members:J?.members};return m("POST","/Groups",P,W.group)}};let x;if(Y.groupStore){let B=Y.groupStore,G=async(S)=>{let V=U(),Q=S.headers.get("Authorization");if(!Q||!Q.startsWith("Bearer "))return!1;try{let z=Q.substring(7);return(await V.validateToken(z)).valid}catch{return!1}},J=async(S,V)=>{if(!await G(S))return N(401,"Authorization required");let z=new URL(S.url),H=V?.basePath??"/Groups",F=z.pathname;if(F.startsWith(H))F=F.substring(H.length);let M=F.match(/^\/([^/]+)$/)?.[1],A=S.method;try{if(M)switch(A){case"GET":return await v(M);case"PUT":return await b(S,M);case"PATCH":return await p(S,M);case"DELETE":return await y(M);default:return N(405,"Method not allowed")}else if(F===""||F==="/")switch(A){case"GET":return await P(S);case"POST":return await w(S);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(X){return console.error("Groups inbound handler error:",X),N(500,X instanceof Error?X.message:"Internal server error")}},P=async(S)=>{let V=new URL(S.url),Q=V.searchParams.get("startIndex"),z=V.searchParams.get("count"),H=Q!=null?parseInt(Q,10):void 0,F=z!=null?parseInt(z,10):void 0,$=H!=null&&!Number.isNaN(H)?Math.max(0,H-1):0,M=F!=null&&!Number.isNaN(F)?F:void 0,A=await B.list({start:$,limit:M}),X=A.items.map(s);return MM(X,{totalResults:A.total,startIndex:$+1,itemsPerPage:A.count})},v=async(S)=>{let V=await B.get(S);if(!V)return N(404,`Group ${S} not found`,"invalidValue");return d(s(V))},w=async(S)=>{let V=await S.json(),Q=await W.group["~standard"].validate(V);if(Q.issues)return console.error("Group creation validation failed:",Q.issues),N(400,`Request validation failed: ${Q.issues.map(($)=>$.message).join("; ")}`,"invalidValue");let z=Q.value;if(!z.displayName)return N(400,"displayName is required","invalidValue");let H=new Date,F={id:AM(),displayName:z.displayName,externalId:z.externalId,members:z.members,createdAt:H,updatedAt:H};return await B.upsert(F),d(s(F),201)},b=async(S,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let z=await S.json(),H=await W.group["~standard"].validate(z);if(H.issues)return console.error("Group replacement validation failed:",H.issues),N(400,`Request validation failed: ${H.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let F=H.value,$={...Q,displayName:F.displayName??Q.displayName,externalId:F.externalId,members:F.members,updatedAt:new Date};return await B.upsert($),d(s($))},p=async(S,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let H=(await S.json()).Operations??[],F={...Q};for(let $ of H)if($.op==="replace"&&$.path&&$.value!==void 0){if($.path==="displayName")F.displayName=$.value}else if($.op==="add"&&$.path&&$.value!==void 0){if($.path==="members"){let M=$.value;F.members=[...F.members??[],...M]}}else if($.op==="remove"&&$.path){if($.path.startsWith("members[")){let M=$.path.match(/members\[value eq "([^"]+)"\]/);if(M)F.members=(F.members??[]).filter((A)=>A.value!==M[1])}}return F.updatedAt=new Date,await B.upsert(F),d(s(F))},y=async(S)=>{if(!await B.get(S))return N(404,`Group ${S} not found`,"invalidValue");return await B.delete(S),new Response(null,{status:204})};x={handler:J}}let f;if(Y.userStore){let B=Y.userStore,G=async(Q)=>{let z=U(),H=Q.headers.get("Authorization");if(!H||!H.startsWith("Bearer "))return!1;try{let F=H.substring(7);return(await z.validateToken(F)).valid}catch{return!1}},J=(Q)=>{return{schemas:["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],id:Q.id,userName:Q.userName||Q.email||Q.id,displayName:Q.name||Q.userName||Q.email,name:Q.name?{givenName:Q.name.split(" ")[0],familyName:Q.name.split(" ").slice(1).join(" ")||void 0}:void 0,emails:Q.email?[{value:Q.email,primary:!0}]:[],active:!0,...Q.userType!=null&&{userType:Q.userType},meta:{resourceType:"User",created:Q.createdAt.toISOString(),lastModified:Q.updatedAt.toISOString()}}},P=(Q)=>{let z=new Date,H=Q.emails?.find((A)=>A.primary)?.value||Q.emails?.[0]?.value,F=Q.name?`${Q.name.givenName||""} ${Q.name.familyName||""}`.trim():Q.displayName,$=Q.id||AM(),M=Q.userName||H||$;return{id:$,userName:M,name:F||Q.displayName||M,email:H||M,avatar:Q.profileUrl,sso:{profile:{sub:$,iss:"iam-provisioned",aud:"iam-provisioned",exp:Math.floor(Date.now()/1000)+3600,iat:Math.floor(Date.now()/1000),email:H||M,email_verified:!0,name:F||Q.displayName||M,preferred_username:M},tenant:{id:"iam-provisioned",name:"IAM Provisioned"},scope:"openid profile email",tokenType:"Bearer",expires:new Date(Date.now()+3600000)},createdAt:Q.meta?.created?new Date(Q.meta.created):z,updatedAt:Q.meta?.lastModified?new Date(Q.meta.lastModified):z,...Q.userType!=null&&{userType:Q.userType}}},v=async(Q,z)=>{if(!await G(Q))return N(401,"Authorization required");let F=new URL(Q.url),$=z?.basePath??"/Users",M=F.pathname;if(M.startsWith($))M=M.substring($.length);let X=M.match(/^\/([^/]+)$/)?.[1],Z=Q.method;try{if(X)switch(Z){case"GET":return await b(X);case"PUT":return await y(Q,X);case"PATCH":return await S(Q,X);case"DELETE":return await V(X);default:return N(405,"Method not allowed")}else if(M===""||M==="/")switch(Z){case"GET":return await w(Q);case"POST":return await p(Q);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(K){return console.error("Users inbound handler error:",K),N(500,K instanceof Error?K.message:"Internal server error")}},w=async(Q)=>{let z=new URL(Q.url),H=z.searchParams.get("startIndex"),F=z.searchParams.get("count"),$=H!=null?parseInt(H,10):void 0,M=F!=null?parseInt(F,10):void 0,A=$!=null&&!Number.isNaN($)?Math.max(0,$-1):0,X=M!=null&&!Number.isNaN(M)?M:void 0,Z=await B.list({start:A,limit:X}),K=Z.items.map(J);return MM(K,{totalResults:Z.total,startIndex:A+1,itemsPerPage:Z.count})},b=async(Q)=>{let z=await B.get(Q);if(!z)return N(404,`User ${Q} not found`,"invalidValue");return d(J(z))},p=async(Q)=>{let z=await Q.json(),H=await W.user["~standard"].validate(z);if(H.issues)return console.error("User creation validation failed:",H.issues),N(400,`Request validation failed: ${H.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let F=H.value;if(!F.userName&&!F.emails?.[0]?.value)return N(400,"userName or email is required","invalidValue");let $=P(F);return await B.upsert($),d(J($),201)},y=async(Q,z)=>{let H=await B.get(z);if(!H)return N(404,`User ${z} not found`,"invalidValue");let F=await Q.json(),$=await W.user["~standard"].validate(F);if($.issues)return console.error("User replacement validation failed:",$.issues),N(400,`Request validation failed: ${$.issues.map((X)=>X.message).join("; ")}`,"invalidValue");let M=$.value,A=P({...M,id:z});return A.createdAt=H.createdAt,A.updatedAt=new Date,await B.upsert(A),d(J(A))},S=async(Q,z)=>{let H=await B.get(z);if(!H)return N(404,`User ${z} not found`,"invalidValue");let $=(await Q.json()).Operations??[],M={...H};for(let A of $)if(A.op==="replace"&&A.path&&A.value!==void 0){if(A.path==="displayName")M.name=A.value;else if(A.path==="userName")M.userName=A.value;else if(A.path.startsWith("name.")){let X=A.path.split(".")[1];if(!M.name)M.name="";if(X==="givenName")M.name=`${A.value} ${M.name.split(" ").slice(1).join(" ")}`.trim();else if(X==="familyName")M.name=`${M.name.split(" ")[0]} ${A.value}`.trim()}else if(A.path==="emails"){let X=A.value,Z=X?.find((K)=>K.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="add"&&A.path&&A.value!==void 0){if(A.path==="emails"){let X=A.value,Z=X?.find((K)=>K.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="remove"&&A.path){if(A.path==="displayName")M.name=""}return M.updatedAt=new Date,await B.upsert(M),d(J(M))},V=async(Q)=>{if(!await B.get(Q))return N(404,`User ${Q} not found`,"invalidValue");return await B.delete(Q),new Response(null,{status:204})};f={handler:v}}async function k(B,G){U();let P=new URL(B.url).pathname,v=G?.usersUrl??Y.usersUrl??"/api/iam/Users",w=G?.groupsUrl??Y.groupsUrl??"/api/iam/Groups";if(P.startsWith(v)&&f)return f.handler(B,{basePath:v});if(P.startsWith(w)&&x)return x.handler(B,{basePath:w});return N(404,"Resource not found")}return{...Y,createUser:t,getBaseUrl:i,groups_outbound:l,groups_inbound:x,users_inbound:f,handler:k}}var KM="@enterprisestandard/core",WM=YM(XM(KM));function QM(W){let D=W.replace(/-/g,"+").replace(/_/g,"/");return atob(D)}async function OM(W,D){let j=W.split(".");if(j.length!==3)throw Error("Invalid JWT");let h=JSON.parse(QM(j[0])),q=JSON.parse(QM(j[1])),E=j[2].replace(/-/g,"+").replace(/_/g,"/"),Y=h.kid;if(!Y)throw Error("JWT header missing kid");let U=await $M(D),g=await FM(U,Y),i=new TextEncoder().encode(`${j[0]}.${j[1]}`),l=Uint8Array.from(atob(E),(B)=>B.charCodeAt(0));if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",g,l,i))throw Error("Invalid JWT signature");let x=await WM.validate(q);if(x.issues)throw Error(`ID token claims validation failed: ${x.issues.map((B)=>B.message).join("; ")}`);let f=x.value;if(f===void 0)throw Error("ID token claims missing");let k=f;if(typeof k.exp==="number"&&k.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return ZM(k)}export{PM as withTenantConfigMethod,OM as verifyUser,EM as tenantConfigSource,NM as sso,IM as registerTenantConfigSourceFactory,jM as logoutBackChannel,DM as logout,JM as initiateLogin,SM as iam,_M as getSSOorCIAMUser,VM as getSSOUser,GM as getRequiredSSOorCIAMUser,BM as getCIAMUser,zM as ciam,LM as callback};
+import{A as _M,B as GM,C as JM,D as LM,E as DM,F as jM,G as IM,H as EM,I as PM,c as XM,d as YM,e,k as ZM,r as $M,s as FM,y as NM,z as VM}from"./shared/core-5zkmzncy.js";function zM(W,D,j,h,q){if(!j&&!h)return;let E={...j,...h},Y={...E,signingKey:j?.signingKey,magicLinkTtl:E.magicLinkTtl??3600,sessionTtl:E.sessionTtl??86400,cookiesSecure:E.cookiesSecure!==void 0?E.cookiesSecure:!0,cookiesSameSite:E.cookiesSameSite!==void 0?E.cookiesSameSite:"Strict",cookiesPrefix:E.cookiesPrefix??(E.ciamId?`es.ciam.${E.ciamId}`:"es.ciam"),cookiesPath:E.cookiesPath??"/",sessionValidation:E.sessionValidation??"always"};function U(){if(!Y.signingKey)throw Error("Missing CIAM configuration field: signingKey. CIAM signingKey is required for JWT token signing and must be provided via Vault (ciam.signingKey).")}function g(){if(!Y.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and backchannel logout.");return Y.sessionStore}function m(){U(),g()}function i(M=32){let A=new Uint8Array(M);return crypto.getRandomValues(A),Array.from(A,(X)=>X.toString(16).padStart(2,"0")).join("").substring(0,M)}function l(M){let A=typeof M==="string"?new TextEncoder().encode(M):M,X="";return A.forEach((Z)=>{X+=String.fromCharCode(Z)}),btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function t(M){let A=M.replace(/-/g,"+").replace(/_/g,"/"),X=A.padEnd(A.length+(4-A.length%4)%4,"=");return atob(X)}async function x(){U();let M=new TextEncoder().encode(Y.signingKey??"");return crypto.subtle.importKey("raw",M,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function f(M){let X=l(JSON.stringify({alg:"HS256",typ:"JWT"})),Z=l(JSON.stringify(M)),K=`${X}.${Z}`,_=await x(),O=await crypto.subtle.sign("HMAC",_,new TextEncoder().encode(K)),I=l(new Uint8Array(O));return`${K}.${I}`}async function k(M){let A=M.split(".");if(A.length!==3)throw Error("Invalid JWT");let[X,Z,K]=A,_=`${X}.${Z}`,O=await x(),I=new Uint8Array(t(K).split("").map((T)=>T.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",O,I,new TextEncoder().encode(_)))throw Error("Invalid JWT signature");let u=t(Z),c=JSON.parse(u);if(typeof c.exp==="number"&&c.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return c}function B(M,A,X){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(M=`${Y.cookiesPrefix}.${M}`,typeof A!=="string")A=btoa(JSON.stringify(A));let Z;if(X instanceof Date)Z=`Expires=${X.toUTCString()}`;else if(typeof X==="number")Z=`Max-Age=${X}`;else throw Error("Invalid expires type",X);if(A.length>4000)throw Error(`Error setting cookie: ${M}. Cookie length is: ${A.length}`);return`${M}=${A}; ${Z}; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function G(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");return`${Y.cookiesPrefix}.${M}=; Max-Age=0; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function J(M,A,X=!1){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");let Z=A.headers.get("cookie");if(!Z)return null;let K=`${Y.cookiesPrefix}.${M}`,_=Z.split(";").find((C)=>C.trim().startsWith(`${K}=`));if(!_)return null;let O=_.indexOf("="),I=_.substring(O+1).trim();if(!X)return I;try{let C=atob(I);return JSON.parse(C)}catch(C){return console.error(`[CIAM] Failed to parse cookie '${K}':`,C),null}}function P(M,A,X){let Z={expires_in:Y.sessionTtl??86400,token_type:"Bearer",expires:X.toISOString()};return[["Set-Cookie",B("access",M,X)],["Set-Cookie",B("id",A,X)],["Set-Cookie",B("control",Z,X)]]}function v(M){let A=J("access",M),X=J("id",M),Z=J("control",M,!0);if(!A||!X||!Z)return;if(Z.expires&&Date.now()>new Date(Z.expires).getTime())return;return{access:A,id:X,control:Z}}async function w(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=v(M);if(!A)return;let X=await k(A.access),Z=await k(A.id);if(!X.sid||!Z.sub)return;if(Y.sessionValidation!=="disabled"){if(!await g().get(X.sid))return}return z(Z)}catch(A){return}}async function b(M){let A=await w(M);if(A)return A;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function p(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let O=v(M);if(O){let I=await k(O.access);if(I.sid)await g().delete(I.sid)}}catch(O){console.warn("Failed to delete CIAM session:",O)}let A=[["Set-Cookie",G("access")],["Set-Cookie",G("id")],["Set-Cookie",G("control")]],Z=new URL(M.url).searchParams.get("redirect");if(Z)return new Response("Logged out",{status:302,headers:[["Location",Z],...A]});let K=M.headers.get("accept");if(K?.includes("application/json")||K?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...A]});return new Response("Logout Complete",{status:200,headers:[["Content-Type","text/plain"],...A]})}async function y(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=M.headers.get("content-type");if(!A||!A.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let X=await M.text(),K=new URLSearchParams(X).get("logout_token");if(!K)return new Response("Missing logout_token parameter",{status:400});let O=(await k(K)).sid;if(!O)return new Response("Invalid logout_token: missing sid claim",{status:400});return await g().delete(O),new Response("OK",{status:200})}catch(A){return console.error("Error during CIAM back-channel logout:",A),new Response("Internal Server Error",{status:500})}}function S(M){return M.id||M.email||`ciam-${M.userName}`}function V(M,A,X){return{sub:S(M),iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),email:M.email,name:M.name,preferred_username:M.userName,picture:M.avatar,sid:A}}function Q(M,A,X){return{sub:M,iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:A,scope:"openid profile email"}}function z(M){let A=M.exp?new Date(M.exp*1000):new Date;return{id:M.sub,userName:M.preferred_username??"",name:M.name??"",email:M.email??"",avatar:M.picture,userType:"customer",sso:{profile:M,tenant:{id:"ciam",name:"CIAM"},scope:"openid profile email",tokenType:"Bearer",expires:A}}}async function H(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(!q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await q.getWorkloadIdentity(M))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let X,Z;try{let n=M.headers.get("content-type");if(!n||!n.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let a=await M.text(),R=JSON.parse(a);if(Z=typeof R?.redirect==="string"&&R.redirect.length>0?R.redirect:void 0,X={userName:R.userName,name:R.name,email:R.email,avatar:R.avatar},!X.userName||!X.name||!X.email)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}})}catch(n){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let _=new URL(M.url).searchParams.get("ttl"),O=_?parseInt(_,10):Y.magicLinkTtl??3600;if(Number.isNaN(O)||O<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let I=i(32),C=new Date(Date.now()+O*1000);if(!Y.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await Y.magicLinkStore.create(I,X,C)}catch(n){return console.error("Error creating magic link:",n),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let u=new URL(M.url),c=Y.magicLinkLoginUrl||"/magic-link/login",T=new URL(c,u.origin);if(T.searchParams.set("token",I),Z)T.searchParams.set("redirect",Z);return new Response(JSON.stringify({magicLink:T.toString(),expiresAt:C.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function F(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=new URL(M.url),X=A.searchParams.get("token");if(!X){let L=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:L}})}if(!Y.magicLinkStore){let L=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:L}})}let Z=await Y.magicLinkStore.get(X);if(!Z){let L=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:L}})}let K=new Date(Date.now()+(Y.sessionTtl??86400)*1000),_=i(32),O=S(Z.user),I=V(Z.user,_,K),C=Q(O,_,K),u=z(I);try{let L={sid:_,sub:O,createdAt:new Date,lastActivityAt:new Date};await g().create(L)}catch(L){console.warn("Failed to create session:",L)}if(Y.userStore)try{let L=u.id;if(L){let r=new Date,o=await Y.userStore.get(L);if(o||Y.enableJitUserProvisioning){let HM={...o??{},...u,id:L,tenantId:o?.tenantId,createdAt:o?.createdAt??r,updatedAt:r,userType:o?.userType??"customer"};await Y.userStore.upsert(HM)}}}catch(L){console.warn("Failed to store user:",L)}try{await Y.magicLinkStore.delete(X)}catch(L){console.warn("Failed to delete magic link:",L)}let c=await f(C),T=await f(I),n=Y.landingUrl||"/",a=A.searchParams.get("redirect"),R=n;if(a)if(a.startsWith("/"))R=a;else try{if(new URL(a).origin===new URL(M.url).origin)R=a}catch{}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",R],...P(c,T,K)]})}async function $(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=Y.magicLinkUrl||"/magic-link",X=Y.magicLinkLoginUrl||"/magic-link/login",Z=Y.logoutUrl||"/auth/logout",K=Y.logoutBackChannelUrl||"/auth/logout/backchannel",_=new URL(M.url).pathname,O=(T)=>{if(!T)return;try{return new URL(T).pathname}catch{return T.startsWith("/")?T:`/${T}`}};if(O(A)===_&&M.method==="POST")return H(M);if(O(X)===_&&M.method==="GET")return F(M);if(O(Z)===_&&M.method==="GET")return p(M);if(O(K)===_&&M.method==="POST")return y(M);return new Response("Not Found",{status:404})}return{...Y,getUser:w,getRequiredUser:b,logout:p,logoutBackChannel:y,handler:$}}async function BM(W,D){return e(D,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),D.ciam?.getUser(W)}function N(W,D,j){return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:String(W),scimType:j,detail:D}),{status:W,headers:{"Content-Type":"application/scim+json"}})}function MM(W,D){let j=D?.totalResults??W.length,h=D?.startIndex??1,q=D?.itemsPerPage??W.length;return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:ListResponse"],totalResults:j,startIndex:h,itemsPerPage:q,Resources:W}),{status:200,headers:{"Content-Type":"application/scim+json"}})}function d(W,D=200){return new Response(JSON.stringify(W),{status:D,headers:{"Content-Type":"application/scim+json"}})}function s(W){return{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],id:W.id,externalId:W.externalId,displayName:W.displayName,members:W.members,meta:{resourceType:"Group",created:W.createdAt.toISOString(),lastModified:W.updatedAt.toISOString()}}}function AM(){return crypto.randomUUID()}function SM(W,D,j,h,q){if(!h&&!q)return;let Y={...h,...q};function U(){if(!j)throw D.error?.("IAM requires workload configuration before use"),Error("IAM requires workload configuration");return j}async function g(){let B=U(),G=typeof B.getServerToken==="function"?await B.getServerToken():await B.getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${G}`})}async function m(B,G,J,P){if(!Y.url)throw Error("IAM URL not configured for outgoing requests");let v=`${Y.url}${G}`;try{let w=await g(),b=await fetch(v,{method:B,headers:w,body:J?JSON.stringify(J):void 0}),p=await b.json();if(!b.ok)return{success:!1,error:p,status:b.status};let y=await P["~standard"].validate(p);if(y.issues)return console.error("SCIM response validation failed:",y.issues),{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${y.issues.map((S)=>S.message).join("; ")}`},status:400};return{success:!0,data:y.value,status:b.status}}catch(w){return{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"500",detail:w instanceof Error?w.message:"Unknown error occurred"},status:500}}}function i(){return Y.url}let l,t;if(Y.url)t=async(G,J)=>{let P={...G,schemas:G.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return m("POST","/Users",P,W.user)},l={createGroup:async(G,J)=>{let P={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:G,externalId:J?.externalId,members:J?.members};return m("POST","/Groups",P,W.group)}};let x;if(Y.groupStore){let B=Y.groupStore,G=async(S)=>{let V=U(),Q=S.headers.get("Authorization");if(!Q||!Q.startsWith("Bearer "))return!1;try{let z=Q.substring(7);return(await V.validateToken(z)).valid}catch{return!1}},J=async(S,V)=>{if(!await G(S))return N(401,"Authorization required");let z=new URL(S.url),H=V?.basePath??"/Groups",F=z.pathname;if(F.startsWith(H))F=F.substring(H.length);let M=F.match(/^\/([^/]+)$/)?.[1],A=S.method;try{if(M)switch(A){case"GET":return await v(M);case"PUT":return await b(S,M);case"PATCH":return await p(S,M);case"DELETE":return await y(M);default:return N(405,"Method not allowed")}else if(F===""||F==="/")switch(A){case"GET":return await P(S);case"POST":return await w(S);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(X){return console.error("Groups inbound handler error:",X),N(500,X instanceof Error?X.message:"Internal server error")}},P=async(S)=>{let V=new URL(S.url),Q=V.searchParams.get("startIndex"),z=V.searchParams.get("count"),H=Q!=null?parseInt(Q,10):void 0,F=z!=null?parseInt(z,10):void 0,$=H!=null&&!Number.isNaN(H)?Math.max(0,H-1):0,M=F!=null&&!Number.isNaN(F)?F:void 0,A=await B.list({start:$,limit:M}),X=A.items.map(s);return MM(X,{totalResults:A.total,startIndex:$+1,itemsPerPage:A.count})},v=async(S)=>{let V=await B.get(S);if(!V)return N(404,`Group ${S} not found`,"invalidValue");return d(s(V))},w=async(S)=>{let V=await S.json(),Q=await W.group["~standard"].validate(V);if(Q.issues)return console.error("Group creation validation failed:",Q.issues),N(400,`Request validation failed: ${Q.issues.map(($)=>$.message).join("; ")}`,"invalidValue");let z=Q.value;if(!z.displayName)return N(400,"displayName is required","invalidValue");let H=new Date,F={id:AM(),displayName:z.displayName,externalId:z.externalId,members:z.members,createdAt:H,updatedAt:H};return await B.upsert(F),d(s(F),201)},b=async(S,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let z=await S.json(),H=await W.group["~standard"].validate(z);if(H.issues)return console.error("Group replacement validation failed:",H.issues),N(400,`Request validation failed: ${H.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let F=H.value,$={...Q,displayName:F.displayName??Q.displayName,externalId:F.externalId,members:F.members,updatedAt:new Date};return await B.upsert($),d(s($))},p=async(S,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let H=(await S.json()).Operations??[],F={...Q};for(let $ of H)if($.op==="replace"&&$.path&&$.value!==void 0){if($.path==="displayName")F.displayName=$.value}else if($.op==="add"&&$.path&&$.value!==void 0){if($.path==="members"){let M=$.value;F.members=[...F.members??[],...M]}}else if($.op==="remove"&&$.path){if($.path.startsWith("members[")){let M=$.path.match(/members\[value eq "([^"]+)"\]/);if(M)F.members=(F.members??[]).filter((A)=>A.value!==M[1])}}return F.updatedAt=new Date,await B.upsert(F),d(s(F))},y=async(S)=>{if(!await B.get(S))return N(404,`Group ${S} not found`,"invalidValue");return await B.delete(S),new Response(null,{status:204})};x={handler:J}}let f;if(Y.userStore){let B=Y.userStore,G=async(Q)=>{let z=U(),H=Q.headers.get("Authorization");if(!H||!H.startsWith("Bearer "))return!1;try{let F=H.substring(7);return(await z.validateToken(F)).valid}catch{return!1}},J=(Q)=>{return{schemas:["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],id:Q.id,userName:Q.userName||Q.email||Q.id,displayName:Q.name||Q.userName||Q.email,name:Q.name?{givenName:Q.name.split(" ")[0],familyName:Q.name.split(" ").slice(1).join(" ")||void 0}:void 0,emails:Q.email?[{value:Q.email,primary:!0}]:[],active:!0,...Q.userType!=null&&{userType:Q.userType},meta:{resourceType:"User",created:Q.createdAt.toISOString(),lastModified:Q.updatedAt.toISOString()}}},P=(Q)=>{let z=new Date,H=Q.emails?.find((A)=>A.primary)?.value||Q.emails?.[0]?.value,F=Q.name?`${Q.name.givenName||""} ${Q.name.familyName||""}`.trim():Q.displayName,$=Q.id||AM(),M=Q.userName||H||$;return{id:$,userName:M,name:F||Q.displayName||M,email:H||M,avatar:Q.profileUrl,sso:{profile:{sub:$,iss:"iam-provisioned",aud:"iam-provisioned",exp:Math.floor(Date.now()/1000)+3600,iat:Math.floor(Date.now()/1000),email:H||M,email_verified:!0,name:F||Q.displayName||M,preferred_username:M},tenant:{id:"iam-provisioned",name:"IAM Provisioned"},scope:"openid profile email",tokenType:"Bearer",expires:new Date(Date.now()+3600000)},createdAt:Q.meta?.created?new Date(Q.meta.created):z,updatedAt:Q.meta?.lastModified?new Date(Q.meta.lastModified):z,...Q.userType!=null&&{userType:Q.userType}}},v=async(Q,z)=>{if(!await G(Q))return N(401,"Authorization required");let F=new URL(Q.url),$=z?.basePath??"/Users",M=F.pathname;if(M.startsWith($))M=M.substring($.length);let X=M.match(/^\/([^/]+)$/)?.[1],Z=Q.method;try{if(X)switch(Z){case"GET":return await b(X);case"PUT":return await y(Q,X);case"PATCH":return await S(Q,X);case"DELETE":return await V(X);default:return N(405,"Method not allowed")}else if(M===""||M==="/")switch(Z){case"GET":return await w(Q);case"POST":return await p(Q);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(K){return console.error("Users inbound handler error:",K),N(500,K instanceof Error?K.message:"Internal server error")}},w=async(Q)=>{let z=new URL(Q.url),H=z.searchParams.get("startIndex"),F=z.searchParams.get("count"),$=H!=null?parseInt(H,10):void 0,M=F!=null?parseInt(F,10):void 0,A=$!=null&&!Number.isNaN($)?Math.max(0,$-1):0,X=M!=null&&!Number.isNaN(M)?M:void 0,Z=await B.list({start:A,limit:X}),K=Z.items.map(J);return MM(K,{totalResults:Z.total,startIndex:A+1,itemsPerPage:Z.count})},b=async(Q)=>{let z=await B.get(Q);if(!z)return N(404,`User ${Q} not found`,"invalidValue");return d(J(z))},p=async(Q)=>{let z=await Q.json(),H=await W.user["~standard"].validate(z);if(H.issues)return console.error("User creation validation failed:",H.issues),N(400,`Request validation failed: ${H.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let F=H.value;if(!F.userName&&!F.emails?.[0]?.value)return N(400,"userName or email is required","invalidValue");let $=P(F);return await B.upsert($),d(J($),201)},y=async(Q,z)=>{let H=await B.get(z);if(!H)return N(404,`User ${z} not found`,"invalidValue");let F=await Q.json(),$=await W.user["~standard"].validate(F);if($.issues)return console.error("User replacement validation failed:",$.issues),N(400,`Request validation failed: ${$.issues.map((X)=>X.message).join("; ")}`,"invalidValue");let M=$.value,A=P({...M,id:z});return A.createdAt=H.createdAt,A.updatedAt=new Date,await B.upsert(A),d(J(A))},S=async(Q,z)=>{let H=await B.get(z);if(!H)return N(404,`User ${z} not found`,"invalidValue");let $=(await Q.json()).Operations??[],M={...H};for(let A of $)if(A.op==="replace"&&A.path&&A.value!==void 0){if(A.path==="displayName")M.name=A.value;else if(A.path==="userName")M.userName=A.value;else if(A.path.startsWith("name.")){let X=A.path.split(".")[1];if(!M.name)M.name="";if(X==="givenName")M.name=`${A.value} ${M.name.split(" ").slice(1).join(" ")}`.trim();else if(X==="familyName")M.name=`${M.name.split(" ")[0]} ${A.value}`.trim()}else if(A.path==="emails"){let X=A.value,Z=X?.find((K)=>K.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="add"&&A.path&&A.value!==void 0){if(A.path==="emails"){let X=A.value,Z=X?.find((K)=>K.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="remove"&&A.path){if(A.path==="displayName")M.name=""}return M.updatedAt=new Date,await B.upsert(M),d(J(M))},V=async(Q)=>{if(!await B.get(Q))return N(404,`User ${Q} not found`,"invalidValue");return await B.delete(Q),new Response(null,{status:204})};f={handler:v}}async function k(B,G){U();let P=new URL(B.url).pathname,v=G?.usersUrl??Y.usersUrl??"/api/iam/Users",w=G?.groupsUrl??Y.groupsUrl??"/api/iam/Groups";if(P.startsWith(v)&&f)return f.handler(B,{basePath:v});if(P.startsWith(w)&&x)return x.handler(B,{basePath:w});return N(404,"Resource not found")}return{...Y,createUser:t,getBaseUrl:i,groups_outbound:l,groups_inbound:x,users_inbound:f,handler:k}}var KM="@enterprisestandard/core",WM=YM(XM(KM));function QM(W){let D=W.replace(/-/g,"+").replace(/_/g,"/");return atob(D)}async function OM(W,D){let j=W.split(".");if(j.length!==3)throw Error("Invalid JWT");let h=JSON.parse(QM(j[0])),q=JSON.parse(QM(j[1])),E=j[2].replace(/-/g,"+").replace(/_/g,"/"),Y=h.kid;if(!Y)throw Error("JWT header missing kid");let U=await $M(D),g=await FM(U,Y),i=new TextEncoder().encode(`${j[0]}.${j[1]}`),l=Uint8Array.from(atob(E),(B)=>B.charCodeAt(0));if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",g,l,i))throw Error("Invalid JWT signature");let x=await WM.validate(q);if(x.issues)throw Error(`ID token claims validation failed: ${x.issues.map((B)=>B.message).join("; ")}`);let f=x.value;if(f===void 0)throw Error("ID token claims missing");let k=f;if(typeof k.exp==="number"&&k.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return ZM(k)}export{PM as withTenantConfigMethod,OM as verifyUser,EM as tenantConfigSource,NM as sso,IM as registerTenantConfigSourceFactory,jM as logoutBackChannel,DM as logout,JM as initiateLogin,SM as iam,_M as getSSOorCIAMUser,VM as getSSOUser,GM as getRequiredSSOorCIAMUser,BM as getCIAMUser,zM as ciam,LM as callback};

package/dist/shared/core-5zkmzncy.js

@@ -0,0 +1,12 @@
+function DS(X){return{"~standard":{version:1,vendor:X,validate:(Y)=>{if(typeof Y!=="object"||Y===null)return{issues:[{message:"Expected an object"}]};let S=Y,N=[],$={};if("code"in S)if(typeof S.code==="string")$.code=S.code;else N.push({message:"code must be a string",path:["code"]});else if(!("error"in S))N.push({message:"code is required",path:["code"]});if("state"in S)if(typeof S.state==="string"||S.state===void 0)$.state=S.state;else N.push({message:"state must be a string",path:["state"]});if("session_state"in S)if(typeof S.session_state==="string"||S.session_state===void 0)$.session_state=S.session_state;else N.push({message:"session_state must be a string",path:["session_state"]});if("error"in S){if(typeof S.error==="string")$.error=S.error;else N.push({message:"error must be a string",path:["error"]});if("error_description"in S)if(typeof S.error_description==="string"||S.error_description===void 0)$.error_description=S.error_description;else N.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in S)if(typeof S.error_uri==="string"||S.error_uri===void 0)$.error_uri=S.error_uri;else N.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in S)if(typeof S.iss==="string"||S.iss===void 0)$.iss=S.iss;else N.push({message:"iss must be a string",path:["iss"]});if(N.length>0)return{issues:N};return{value:$}}}}}function ES(X){return{"~standard":{version:1,vendor:X,validate:(Y)=>{if(typeof Y!=="object"||Y===null)return{issues:[{message:"Expected an object"}]};let S=Y,N=[],$={};if("access_token"in S)if(typeof S.access_token==="string")$.access_token=S.access_token;else N.push({message:"access_token must be a string",path:["access_token"]});else N.push({message:"access_token is required",path:["access_token"]});if("id_token"in S)if(typeof S.id_token==="string")$.id_token=S.id_token;else N.push({message:"id_token must be a string",path:["id_token"]});else N.push({message:"id_token is required",path:["id_token"]});if("token_type"in S)if(typeof S.token_type==="string")$.token_type=S.token_type;else N.push({message:"token_type must be a string",path:["token_type"]});else N.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in S)if(typeof S.refresh_token==="string"||S.refresh_token===void 0)$.refresh_token=S.refresh_token;else N.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in S)if(typeof S.scope==="string"||S.scope===void 0)$.scope=S.scope;else N.push({message:"scope must be a string",path:["scope"]});if("session_state"in S)if(typeof S.session_state==="string"||S.session_state===void 0)$.session_state=S.session_state;else N.push({message:"session_state must be a string",path:["session_state"]});if("expires"in S)if(typeof S.expires==="string"||S.expires===void 0)$.expires=S.expires;else N.push({message:"expires must be a string",path:["expires"]});if("expires_in"in S)if(typeof S.expires_in==="number"||S.expires_in===void 0)$.expires_in=S.expires_in;else N.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in S)if(typeof S.refresh_expires_in==="number"||S.refresh_expires_in===void 0)$.refresh_expires_in=S.refresh_expires_in;else N.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(N.length>0)return{issues:N};return{value:$}}}}}function i(X){return{"~standard":{version:1,vendor:X,validate:(Y)=>{if(typeof Y!=="object"||Y===null)return{issues:[{message:"Expected an object"}]};let S=Y,N=[],$={...S},Q=["iss","aud","sub","sid","name","email","preferred_username","picture"];for(let W of Q)if(W in S&&S[W]!==void 0){if(typeof S[W]!=="string")N.push({message:`${W} must be a string`,path:[W]})}let Z=["exp","iat"];for(let W of Z)if(W in S&&S[W]!==void 0){if(typeof S[W]!=="number")N.push({message:`${W} must be a number`,path:[W]})}if(N.length>0)return{issues:N};return{value:$}}}}}function a(X){let Y=X["~standard"];return Object.assign({},X,{validate(S){return Promise.resolve(Y.validate(S))}})}function V(X,Y="Assertion failed. Required value is null or undefined."){if(X===void 0||X===null)throw Error(Y);return X}function o(X,Y){return Response.json({error:"validation_failed",message:Y,issues:X},{status:400,headers:{"Content-Type":"application/json"}})}function PS(X,Y,S=[]){let N={...X,...Y};for(let $ of S)N[$]=X?.[$]??Y?.[$];return N}function BS(X){let Y="",S=0,N=X.length;while(S<N){let $=X[S];if($==='"'||$==="'"){let Q=$;Y+=$,S++;while(S<N){let Z=X[S];if(Z==="\\"){if(Y+=Z,S+1<N)Y+=X[S+1],S+=2;else S++;continue}if(Z===Q){Y+=Z,S++;break}Y+=Z,S++}continue}if($==="/"&&S+1<N){let Q=X[S+1];if(Q==="/"){S+=2;while(S<N&&X[S]!==`
+`)S++;if(S<N)Y+=`
+`;S++;continue}if(Q==="*"){S+=2;while(S+1<N&&!(X[S]==="*"&&X[S+1]==="/"))S++;S+=2;continue}}Y+=$,S++}return Y}function TS(X){let Y=BS(X);return JSON.parse(Y)}async function _S(X,Y=async(Q)=>Q.status===200,S=1000,N=1e4,$){let Q=Date.now(),Z="Awaiting Ping";return new Promise((W,x)=>{let z=null,y=null,h=async()=>{try{let P=await fetch(X);if(P.ok)if(await Y(P)){if(z)clearInterval(z);if(y)clearInterval(y);W()}else Z=`Response test failed: ${P.status}: ${P.statusText} - ${X}`;else try{let U=await P.json();Z=`Response error: ${P.status}: ${P.statusText} - ${X}: ${JSON.stringify(U)}`}catch(U){Z=`Response error: ${P.status}: ${P.statusText} - ${X}`}}catch(P){Z=`${P instanceof Error?P.message:String(P)} - ${X}`}};if(h(),z=setInterval(h,S),N>0)y=setInterval(()=>{console.warn(`${Z}: ${Date.now()-Q}ms`)},N);if($)setTimeout(()=>{if(z)clearInterval(z);if(y)clearInterval(y);x(Error(`Timeout: ${$}ms: ${Z}`))},$)})}var WS="@enterprisestandard/core",MS=a(i(WS));function LS(X){let Y=X.exp!=null?new Date(X.exp*1000):new Date,S=X.iss??"";return{id:X.sub??"",userName:X.preferred_username??"",name:X.name??"",email:X.email??"",avatar:X.picture,sso:{profile:{...X,iss:X.iss??S,aud:X.aud},tenant:{id:X.idp??S,name:S},tokenType:"Bearer",expires:Y}}}function FS(X){let Y=X.replace(/-/g,"+").replace(/_/g,"/");return atob(Y)}async function wS(X){let Y=X.split(".");if(Y.length!==3)throw Error("Invalid JWT");let S=FS(Y[1]),N=JSON.parse(S),$=await MS.validate(N);if($.issues)throw Error(`ID token claims validation failed: ${$.issues.map((Q)=>Q.message).join("; ")}`);if($.value)return LS($.value);throw Error("ID token claims validation failed")}var w=(X,Y,...S)=>{if(S.length>0)console[X](`[${X.toUpperCase()}]`,Y,...S);else console[X](`[${X.toUpperCase()}]`,Y)},r={debug:()=>{},info:()=>{},warn(X,...Y){w("warn",X,...Y)},error(X,...Y){w("error",X,...Y)}},RS={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},bS={debug:()=>{},info:w.bind(console,"info"),warn:w.bind(console,"warn"),error:w.bind(console,"error")},s=(X,...Y)=>{if(Y.length>0)console.log("[DEBUG]",X,...Y);else console.log("[DEBUG]",X)},CS={debug:s,info:w.bind(console,"info"),warn:w.bind(console,"warn"),error:w.bind(console,"error")},qS={debug:s,info:w.bind(console,"info"),warn:w.bind(console,"warn"),error:w.bind(console,"error")};var e=new Map;async function c(X,Y=3,S=1000,N=30000){let $=Error("Placeholder Error");for(let Q=0;Q<=Y;Q++)try{return await X()}catch(Z){if($=Z instanceof Error?Z:Error(String(Z)),Z instanceof Error&&Z.message.includes("400"))throw Z;if(Q===Y)throw $;let W=Math.min(S*2**Q,N),x=Math.random()*0.1*W;await new Promise((z)=>setTimeout(z,W+x)),console.warn(`Retry attempt ${Q+1} after ${W+x}ms delay`)}throw $}async function SS(X){let Y=e.get(X);if(Y)return Y;return c(async()=>{let S=await fetch(X);if(!S.ok)throw Error("Failed to fetch JWKS");let N=await S.json();return e.set(X,N),N})}async function XS(X,Y){let S=X.keys.find((N)=>N.kid===Y);if(!S)throw Error("Public key not found");return crypto.subtle.importKey("jwk",{kty:S.kty,n:S.n,e:S.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}function gS(X,Y={}){let S=Y.cookieName??"es.active_session",N=X.headers.get("cookie");if(!N)return;return m(N)[S]}function pS(X,Y={}){let S=Y.cookieName??"es.active_session",N=Y.path??"/",$=Y.secure??!1,Q=Y.sameSite??"Lax",Z=Y.maxAge,W=[`${S}=${X}`,`Path=${N}`,"HttpOnly",`SameSite=${Q}`];if($)W.push("Secure");if(typeof Z==="number")W.push(`Max-Age=${Z}`);return W.join("; ")}function cS(X={}){let Y=X.cookieName??"es.active_session",S=X.path??"/",N=X.secure??!1,$=X.sameSite??"Lax",Q=[`${Y}=`,"Max-Age=0",`Path=${S}`,"HttpOnly",`SameSite=${$}`];if(N)Q.push("Secure");return Q.join("; ")}function mS(X,Y={}){let S=typeof X==="string"?X:X?.headers.get("cookie")??void 0;if(!S)return[];let $=`${Y.cookiePrefix??"es.sso"}.`,Q=new Set;for(let Z of Object.keys(m(S))){if(!Z.startsWith($))continue;let W=Z.slice($.length),x=W.lastIndexOf(".");if(x<=0)continue;let z=W.slice(0,x).trim();if(z)Q.add(z)}return Array.from(Q)}function dS(X,Y){if(!X)return;let S=m(X);for(let[N,$]of Object.entries(S)){if(!N.startsWith("es.sso.")||!N.endsWith(".state"))continue;try{let Q=JSON.parse(atob($));if(Q?.state===Y)return{clientId:N.slice(7,-6),stateCookie:Q}}catch{}}return}function uS(X,Y,S,N){if(!S&&!N)return;let $={...S,...N},Q=!!($.authority&&$.tokenUrl&&$.authorizationUrl&&$.clientId&&$.redirectUri&&$.scope),Z={...$,authority:Q?V($.authority,"Missing 'authority' from SSO Config"):$.authority,tokenUrl:Q?V($.tokenUrl,"Missing 'tokenUrl' from SSO Config"):$.tokenUrl,authorizationUrl:Q?V($.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):$.authorizationUrl,clientId:Q?V($.clientId,"Missing 'clientId' from SSO Config"):$.clientId,redirectUri:Q?V($.redirectUri,"Missing 'redirectUri' from SSO Config"):$.redirectUri,scope:Q?V($.scope,"Missing 'scope' from SSO Config"):$.scope,responseType:$.responseType??"code",cookiesSecure:$.cookiesSecure!==void 0?$.cookiesSecure:!0,cookiesSameSite:$.cookiesSameSite!==void 0?$.cookiesSameSite:"Strict",cookiesPrefix:$.cookiesPrefix??($.clientId?`es.sso.${$.clientId}`:"es.sso"),cookiesPath:$.cookiesPath??"/"};function W(){let K=[];if(!Z.authority)K.push("authority");if(!Z.tokenUrl)K.push("tokenUrl");if(!Z.authorizationUrl)K.push("authorizationUrl");if(!Z.clientId)K.push("clientId");if(!Z.redirectUri)K.push("redirectUri");if(!Z.scope)K.push("scope");if(K.length>0)throw Error(`Missing OIDC configuration fields: ${K.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function x(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");try{let{tokens:A}=await g(K);if(!A)return;return await f(A)}catch(A){console.error("Error parsing user from cookies:",A);return}}async function z(K){let A=await x(K);if(A)return A;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function y({landingUrl:K,errorUrl:A},G){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");W();let B=V(Z.redirectUri,"Missing 'redirectUri' from SSO Config"),L=V(Z.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),O=V(Z.clientId,"Missing 'clientId' from SSO Config"),F=V(Z.scope,"Missing 'scope' from SSO Config"),J=t(),D=t(64),M=B;try{new URL(M)}catch{if(G)try{let j=new URL(G),E=M.startsWith("//")?M.slice(1):M.startsWith("/")?M:`/${M}`;M=new URL(E,j.origin).toString()}catch{try{let j=new URL(L),E=M.startsWith("//")?M.slice(1):M.startsWith("/")?M:`/${M}`;M=new URL(E,j.origin).toString()}catch{throw Error(`Invalid redirectUri: "${B}". It must be a valid absolute URL.`)}}}let H=new URL(L);H.searchParams.append("client_id",O),H.searchParams.append("redirect_uri",M),H.searchParams.append("response_type","code"),H.searchParams.append("scope",F),H.searchParams.append("state",J);let T=await KS(D);H.searchParams.append("code_challenge",T),H.searchParams.append("code_challenge_method","S256");let _={state:J,codeVerifier:D,landingUrl:K,errorUrl:A};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:H.toString(),"Set-Cookie":k("state",_,86400)}})}async function h(K,A){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");try{let J=R("refresh",K);if(J)await $S(J)}catch(J){console.warn("Failed to revoke token:",J)}if(Z.sessionStore)try{let J=await x(K);if(J?.sso?.profile.sid){let D=J.sso.profile.sid;await Z.sessionStore.delete(D)}}catch(J){console.warn("Failed to delete session:",J)}let G=[["Set-Cookie",C("access")],["Set-Cookie",C("id")],["Set-Cookie",C("refresh")],["Set-Cookie",C("control")],["Set-Cookie",C("state")]],L=new URL(K.url).searchParams.get("redirect");if(L)return new Response("Logged out",{status:302,headers:[["Location",L],...G]});let O=K.headers.get("accept");if(O?.includes("application/json")||O?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...G]});else return new Response(`
+          <!DOCTYPE html><html lang="en"><body>
+            <h1>Logout Complete</h1>
+            <div style="display: none">
+              It is not recommended to show the default logout page. Include '?redirect=/someHomePage' or logout asynchronously.
+              Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
+            </div>
+          </body></html>
+        `,{status:200,headers:[["Content-Type","text/html"],...G]})}async function P(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(!Z.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{let A=K.headers.get("content-type");if(!A||!A.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let G=await K.text(),L=new URLSearchParams(G).get("logout_token");if(!L)return new Response("Missing logout_token parameter",{status:400});let F=(await n(L)).sid;if(!F)return console.warn("Back-Channel Logout: logout_token missing sid claim"),new Response("Invalid logout_token: missing sid claim",{status:400});return await Z.sessionStore.delete(F),console.log(`Back-Channel Logout: successfully deleted session ${F}`),new Response("OK",{status:200})}catch(A){return console.error("Error during back-channel logout:",A),new Response("Internal Server Error",{status:500})}}async function U(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let A=new URL(K.url),G=new URLSearchParams(A.search),B=Object.fromEntries(G.entries()),L=await X.callbackParams["~standard"].validate(B);if(L.issues)return o(L.issues,"OIDC callback parameters validation failed");let{code:O,state:F}=L.value;try{let J=R("state",K,!0),{codeVerifier:D,state:M,landingUrl:H}=J??{};if(V(D,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),V(M,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),V(H,'OIDC "landingUrl" was not present in cookies'),F!==M)throw Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');let T=Z.cookiesSecure?K.url.replace(/^http:\/\//,"https://"):K.url,_=await ZS(O,D,T),j=await f(_);if(Z.sessionStore)try{let E=j.sso.profile.sid,I=j.id;if(E&&I){let b={sid:E,sub:I,createdAt:new Date,lastActivityAt:new Date};await Z.sessionStore.create(b)}else console.warn("Session creation skipped: missing sid or sub in ID token claims")}catch(E){console.warn("Failed to create session:",E)}if(Z.userStore)try{let E=j.id;if(E){let I=new Date,b=await Z.userStore.get(E);if(b||Z.enableJitUserProvisioning){let QS={...b??{},...j,id:E,tenantId:b?.tenantId,createdAt:b?.createdAt??I,updatedAt:I};await Z.userStore.upsert(QS)}else console.warn("JIT user provisioning disabled: user not found in store and will not be created")}else console.warn("User storage skipped: missing sub in ID token claims")}catch(E){console.warn("Failed to store user:",E)}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",H],["Set-Cookie",C("state")],...p(_,j.sso.expires)]})}catch(J){console.error("Error during sign-in callback:",J);try{let D=R("state",K,!0),{errorUrl:M}=D??{};if(M)return new Response("Redirecting to error url",{status:302,headers:[["Location",M]]})}catch(D){console.warn("Error parsing the errorUrl from the OIDC cookie")}return console.warn("No error page was found in the cookies. The user will be shown a default error page."),new Response("An error occurred during authentication, please return to the application homepage and try again.",{status:500})}}async function f(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let A=await n(K.id_token),G=Number(K.refresh_expires_in??K.expires_in??3600),B=K.expires?new Date(K.expires):new Date(Date.now()+G*1000);return{id:A.sub,userName:A.preferred_username||"",name:A.name||"",email:A.email||"",emails:[{value:A.email||"",primary:!0}],avatar:A.picture,sso:{profile:{...A,iss:A.iss||Z.authority,aud:A.aud||Z.clientId},tenant:{id:A.idp||A.iss||Z.authority||"",name:A.iss||Z.authority||""},scope:K.scope,tokenType:K.token_type,sessionState:K.session_state,expires:B}}}async function ZS(K,A,G){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");W();let B=V(Z.tokenUrl,"Missing 'tokenUrl' from SSO Config"),L=V(Z.redirectUri,"Missing 'redirectUri' from SSO Config"),O=V(Z.clientId,"Missing 'clientId' from SSO Config"),F=L;try{new URL(F)}catch{if(G)try{let D=new URL(G),M=F.startsWith("//")?F.slice(1):F.startsWith("/")?F:`/${F}`;F=new URL(M,D.origin).toString()}catch{try{let D=new URL(B),M=F.startsWith("//")?F.slice(1):F.startsWith("/")?F:`/${F}`;F=new URL(M,D.origin).toString()}catch{throw Error(`Invalid redirectUri: "${L}". It must be a valid absolute URL.`)}}}let J=new URLSearchParams;if(J.append("grant_type","authorization_code"),J.append("code",K),J.append("redirect_uri",F),J.append("client_id",O),Z.clientSecret)J.append("client_secret",Z.clientSecret);J.append("code_verifier",A);try{let D=await fetch(B,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:J.toString()}),M=await D.json();if(!D.ok){console.error("Token exchange error:",M);let T=M;throw Error(`Token exchange failed: ${T.error||D.statusText} - ${T.error_description||""}`.trim())}let H=await X.tokenResponse["~standard"].validate(M);if(H.issues)throw console.error("Token response validation failed:",H.issues),Error(`Token response validation failed: ${H.issues}`);return H.value}catch(D){throw console.error("Error during token exchange:",D),D}}async function u(K){return c(async()=>{if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");W();let A=V(Z.tokenUrl,"Missing 'tokenUrl' from SSO Config"),G=V(Z.clientId,"Missing 'clientId' from SSO Config"),B=new URLSearchParams;B.append("grant_type","refresh_token"),B.append("refresh_token",K),B.append("client_id",G);let L=await fetch(A,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:B.toString()}),O=await L.json();if(!L.ok){console.error("Token refresh error:",O);let F=O;throw Error(`Token refresh failed: ${F.error||L.statusText} - ${F.error_description||""}`.trim())}return O})}async function $S(K){try{if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(!Z.revocationEndpoint)return;let A=V(Z.clientId,"Missing 'clientId' from SSO Config"),G=new URLSearchParams;G.append("token",K),G.append("token_type_hint","refresh_token"),G.append("client_id",A);let B=await fetch(Z.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:G.toString()});if(!B.ok)console.warn("Token revocation failed:",B.status,B.statusText);else console.log("Token revoked successfully")}catch(A){console.warn("Error revoking token:",A)}}async function l(){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let K=Z.authority;if(!Z.jwksUri&&!K)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let A=Z.jwksUri||`${K}/protocol/openid-connect/certs`;return SS(A)}async function n(K){try{let A=K.split(".");if(A.length!==3)throw Error("Invalid JWT");let G=JSON.parse(atob(A[0].replace(/-/g,"+").replace(/_/g,"/"))),B=JSON.parse(atob(A[1].replace(/-/g,"+").replace(/_/g,"/"))),L=A[2].replace(/-/g,"+").replace(/_/g,"/"),O=await NS(G.kid),J=new TextEncoder().encode(`${A[0]}.${A[1]}`);if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",O,Uint8Array.from(atob(L),(H)=>H.charCodeAt(0)),J))throw Error("Invalid JWT signature");let M=await X.idTokenClaims["~standard"].validate(B);if(M.issues)throw console.error("ID token claims validation failed:",M.issues),Error(`ID token claims validation failed: ${M.issues}`);return M.value}catch(A){throw console.error("Error verifying JWT:",A),A}}function t(K=32){let A=new Uint8Array(K);return crypto.getRandomValues(A),Array.from(A,(G)=>G.toString(16).padStart(2,"0")).join("").substring(0,K)}async function KS(K){let G=new TextEncoder().encode(K),B=await crypto.subtle.digest("SHA-256",G),L=Array.from(new Uint8Array(B));return btoa(String.fromCharCode(...L)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function NS(K){let A=await l();return XS(A,K)}function p(K,A){let G=A instanceof Date?A:new Date(A);if(Number.isNaN(G.getTime()))throw Error(`Invalid SSO token expiry: ${String(A)}`);let B={expires_in:K.expires_in,refresh_expires_in:K.refresh_expires_in,scope:K.scope,session_state:K.session_state,token_type:K.token_type,expires:G.toISOString()};return[["Set-Cookie",k("access",K.access_token,G)],["Set-Cookie",k("id",K.id_token,G)],["Set-Cookie",k("refresh",K.refresh_token??"",G)],["Set-Cookie",k("control",B,G)]]}async function g(K){let A=R("access",K),G=R("id",K),B=R("refresh",K),L=R("control",K,!0);if(!A||!G||!B||!L)return{tokens:void 0,refreshHeaders:[]};let O={access_token:A,id_token:G,refresh_token:B,...L};if(L.expires&&B&&Date.now()>new Date(L.expires).getTime()){O=await u(B);let F=await f(O),J=p(O,F.sso.expires);return{tokens:O,refreshHeaders:J}}return{tokens:O,refreshHeaders:[]}}async function AS(K){let{tokens:A}=await g(K);if(!A)return;return A.access_token}function k(K,A,G){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(K=`${Z.cookiesPrefix}.${K}`,typeof A!=="string")A=btoa(JSON.stringify(A));let B;if(G instanceof Date)B=`Expires=${G.toUTCString()}`;else if(typeof G==="number")B=`Max-Age=${G}`;else throw Error("Invalid expires type",G);if(A.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${A.length}`);return`${K}=${A}; ${B}; Path=${Z.cookiesPath}; HttpOnly;${Z.cookiesSecure?" Secure;":""} SameSite=${Z.cookiesSameSite};`}function C(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");return`${Z.cookiesPrefix}.${K}=; Max-Age=0; Path=${Z.cookiesPath}; HttpOnly;${Z.cookiesSecure?" Secure;":""} SameSite=${Z.cookiesSameSite};`}function R(K,A,G=!1){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let B=A.headers.get("cookie");if(!B)return null;let L=B.split(";").find((J)=>J.trim().startsWith(`${Z.cookiesPrefix}.${K}=`));if(!L)return null;let O=L.split("=")[1].trim();if(!G)return O;let F=atob(O);return JSON.parse(F)}async function GS(K,A){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:G,userUrl:B,errorUrl:L,landingUrl:O,tokenUrl:F,refreshUrl:J,logoutUrl:D,logoutBackChannelUrl:M,jwksUrl:H,redirectUri:T}={...Z,...A},_=new URL(K.url).pathname;if(T){let j;try{j=new URL(T).pathname}catch{try{let E=new URL(K.url),I=T.startsWith("//")?T.slice(1):T;j=new URL(I,E.origin).pathname}catch{j=T.startsWith("/")?T:`/${T}`}}if(j===_)return U(K)}if(G===_){let j=Z.cookiesSecure?K.url.replace(/^http:\/\//,"https://"):K.url;return y({landingUrl:O||"/",errorUrl:L},j)}if(B===_){let{tokens:j,refreshHeaders:E}=await g(K);if(!j)return new Response("User not logged in",{status:401});let I=await f(j);return new Response(JSON.stringify(I),{headers:[["Content-Type","application/json"],...E]})}if(F===_){let{tokens:j,refreshHeaders:E}=await g(K);if(!j)return new Response("User not logged in",{status:401});return new Response(JSON.stringify({token:j.access_token,expires:j.expires}),{headers:[["Content-Type","application/json"],...E]})}if(J===_){let j=R("refresh",K);if(!j)return new Response("User not logged in",{status:401});let E=await u(j),I=await f(E),b=p(E,I.sso.expires);return new Response("Refresh Complete",{status:200,headers:b})}if(D===_)return h(K,{landingUrl:O||"/"});if(M===_)return P(K);if(H===_){let j=await l();return new Response(JSON.stringify(j),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...Z,getUser:x,getRequiredUser:z,getJwt:AS,initiateLogin:y,logout:h,logoutBackChannel:P,callbackHandler:U,handler:GS}}function m(X){let Y={},S=X.split(";");for(let N of S){let $=N.trim();if(!$)continue;let Q=$.indexOf("=");if(Q===-1)continue;let Z=$.slice(0,Q).trim(),W=$.slice(Q+1).trim();Y[Z]=W}return Y}function q(X){return X=X??"SSO Unavailable",new Response(JSON.stringify({error:X}),{status:503,statusText:X,headers:{"Content-Type":"application/json"}})}function YS(X){if(!X)return[];let Y=X.headers;if(Y.getSetCookie)return Y.getSetCookie();let S=X.headers.get("set-cookie");return S?[S]:[]}function JS(X,Y){let S=new Headers;X.headers.forEach((N,$)=>{if($.toLowerCase()!=="set-cookie")S.set($,N)});for(let N of Y)S.append("Set-Cookie",N);return new Response(X.body,{status:X.status,statusText:X.statusText,headers:S})}var v="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function lS(X,Y){return V(Y,v),Y.sso?.getUser(X)}async function OS(X,Y){V(Y,v);let S=Y.logger??r;S.debug?.("getUser called",{hasInstance:!0,hasSso:!!Y.sso,hasCiam:!!Y.ciam});let N=await Y.sso?.getUser(X);if(N)return S.debug?.("Found SSO user",{email:N.email}),N;S.debug?.("No SSO user, trying CIAM");let $=await Y.ciam?.getUser(X);return S.debug?.("CIAM user result",{email:$?.email??void 0}),$}async function nS(X,Y){let S=await OS(X,Y);if(S)return S;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function tS(X,Y){V(Y,v);let S=Y.sso;if(!S)return q();return S.initiateLogin(X)}async function iS(X,Y){V(Y,v);let S=Y.sso;if(!S)return q();return S.callbackHandler(X)}async function aS(X,Y){V(Y,v);let{sso:S,ciam:N}=Y;if(!S&&!N)return q("Logout Unavailable");let $=S?await S.logout(X,{landingUrl:"/"}):void 0,Q=N?await N.logout(X):void 0,Z=$??Q;if(!Z)return q("Logout Unavailable");let W=[...YS($),...YS(Q)];return JS(Z,W)}async function oS(X,Y){V(Y,v);let{sso:S,ciam:N}=Y;if(!S&&!N)return q("Back-Channel Logout Unavailable");let $=X.clone(),Q=X.clone(),Z=S?await S.logoutBackChannel($):void 0;if(Z?.status===200)return Z;let W=N?await N.logoutBackChannel(Q):void 0;if(W)return W;return Z??q("Back-Channel Logout Unavailable")}var d;function sS(X){d=X}function jS(X,Y){if(VS(X.configSource))return X.configSource;if(!d)throw Error("Tenant config hydration is not registered. Import @enterprisestandard/server before using tenant.config().");return d(X.configSource,Y)}function eS(X){let Y=X.configSource;return{...X,config:(S)=>jS({configSource:Y},S)}}function VS(X){let Y=X;return typeof X==="object"&&X!==null&&typeof Y.load==="function"&&typeof Y.subscribe==="function"}
+export{DS as a,ES as b,i as c,a as d,V as e,o as f,PS as g,BS as h,TS as i,_S as j,LS as k,wS as l,r as m,RS as n,bS as o,CS as p,qS as q,SS as r,XS as s,gS as t,pS as u,cS as v,mS as w,dS as x,uS as y,lS as z,OS as A,nS as B,tS as C,iS as D,aS as E,oS as F,sS as G,jS as H,eS as I};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enterprisestandard/core",
-  "version": "0.0.14",
+  "version": "0.0.15-beta.20260407.1",
   "description": "Enterprise Standard Core (Server-only)",
   "private": false,
   "author": "enterprisestandard",
@@ -27,7 +27,7 @@
     }
   },
   "peerDependencies": {
-    "@enterprisestandard/zod": "^0.0.14",
-    "@enterprisestandard/valibot": "^0.0.14"
+    "@enterprisestandard/zod": "0.0.15-beta.20260407.1",
+    "@enterprisestandard/valibot": "0.0.15-beta.20260407.1"
   }
 }

package/dist/shared/core-kk9hdwwp.js

@@ -1,12 +0,0 @@
-function DS(X){return{"~standard":{version:1,vendor:X,validate:(Y)=>{if(typeof Y!=="object"||Y===null)return{issues:[{message:"Expected an object"}]};let S=Y,N=[],$={};if("code"in S)if(typeof S.code==="string")$.code=S.code;else N.push({message:"code must be a string",path:["code"]});else if(!("error"in S))N.push({message:"code is required",path:["code"]});if("state"in S)if(typeof S.state==="string"||S.state===void 0)$.state=S.state;else N.push({message:"state must be a string",path:["state"]});if("session_state"in S)if(typeof S.session_state==="string"||S.session_state===void 0)$.session_state=S.session_state;else N.push({message:"session_state must be a string",path:["session_state"]});if("error"in S){if(typeof S.error==="string")$.error=S.error;else N.push({message:"error must be a string",path:["error"]});if("error_description"in S)if(typeof S.error_description==="string"||S.error_description===void 0)$.error_description=S.error_description;else N.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in S)if(typeof S.error_uri==="string"||S.error_uri===void 0)$.error_uri=S.error_uri;else N.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in S)if(typeof S.iss==="string"||S.iss===void 0)$.iss=S.iss;else N.push({message:"iss must be a string",path:["iss"]});if(N.length>0)return{issues:N};return{value:$}}}}}function ES(X){return{"~standard":{version:1,vendor:X,validate:(Y)=>{if(typeof Y!=="object"||Y===null)return{issues:[{message:"Expected an object"}]};let S=Y,N=[],$={};if("access_token"in S)if(typeof S.access_token==="string")$.access_token=S.access_token;else N.push({message:"access_token must be a string",path:["access_token"]});else N.push({message:"access_token is required",path:["access_token"]});if("id_token"in S)if(typeof S.id_token==="string")$.id_token=S.id_token;else N.push({message:"id_token must be a string",path:["id_token"]});else N.push({message:"id_token is required",path:["id_token"]});if("token_type"in S)if(typeof S.token_type==="string")$.token_type=S.token_type;else N.push({message:"token_type must be a string",path:["token_type"]});else N.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in S)if(typeof S.refresh_token==="string"||S.refresh_token===void 0)$.refresh_token=S.refresh_token;else N.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in S)if(typeof S.scope==="string"||S.scope===void 0)$.scope=S.scope;else N.push({message:"scope must be a string",path:["scope"]});if("session_state"in S)if(typeof S.session_state==="string"||S.session_state===void 0)$.session_state=S.session_state;else N.push({message:"session_state must be a string",path:["session_state"]});if("expires"in S)if(typeof S.expires==="string"||S.expires===void 0)$.expires=S.expires;else N.push({message:"expires must be a string",path:["expires"]});if("expires_in"in S)if(typeof S.expires_in==="number"||S.expires_in===void 0)$.expires_in=S.expires_in;else N.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in S)if(typeof S.refresh_expires_in==="number"||S.refresh_expires_in===void 0)$.refresh_expires_in=S.refresh_expires_in;else N.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(N.length>0)return{issues:N};return{value:$}}}}}function i(X){return{"~standard":{version:1,vendor:X,validate:(Y)=>{if(typeof Y!=="object"||Y===null)return{issues:[{message:"Expected an object"}]};let S=Y,N=[],$={...S},B=["iss","aud","sub","sid","name","email","preferred_username","picture"];for(let M of B)if(M in S&&S[M]!==void 0){if(typeof S[M]!=="string")N.push({message:`${M} must be a string`,path:[M]})}let Z=["exp","iat"];for(let M of Z)if(M in S&&S[M]!==void 0){if(typeof S[M]!=="number")N.push({message:`${M} must be a number`,path:[M]})}if(N.length>0)return{issues:N};return{value:$}}}}}function a(X){let Y=X["~standard"];return Object.assign({},X,{validate(S){return Promise.resolve(Y.validate(S))}})}function H(X,Y="Assertion failed. Required value is null or undefined."){if(X===void 0||X===null)throw Error(Y);return X}function o(X,Y){return Response.json({error:"validation_failed",message:Y,issues:X},{status:400,headers:{"Content-Type":"application/json"}})}function PS(X,Y,S=[]){let N={...X,...Y};for(let $ of S)N[$]=X?.[$]??Y?.[$];return N}function BS(X){let Y="",S=0,N=X.length;while(S<N){let $=X[S];if($==='"'||$==="'"){let B=$;Y+=$,S++;while(S<N){let Z=X[S];if(Z==="\\"){if(Y+=Z,S+1<N)Y+=X[S+1],S+=2;else S++;continue}if(Z===B){Y+=Z,S++;break}Y+=Z,S++}continue}if($==="/"&&S+1<N){let B=X[S+1];if(B==="/"){S+=2;while(S<N&&X[S]!==`
-`)S++;if(S<N)Y+=`
-`;S++;continue}if(B==="*"){S+=2;while(S+1<N&&!(X[S]==="*"&&X[S+1]==="/"))S++;S+=2;continue}}Y+=$,S++}return Y}function TS(X){let Y=BS(X);return JSON.parse(Y)}async function zS(X,Y=async(B)=>B.status===200,S=1000,N=1e4,$){let B=Date.now(),Z="Awaiting Ping";return new Promise((M,T)=>{let P=null,y=null,h=async()=>{try{let E=await fetch(X);if(E.ok)if(await Y(E)){if(P)clearInterval(P);if(y)clearInterval(y);M()}else Z=`Response test failed: ${E.status}: ${E.statusText} - ${X}`;else try{let U=await E.json();Z=`Response error: ${E.status}: ${E.statusText} - ${X}: ${JSON.stringify(U)}`}catch(U){Z=`Response error: ${E.status}: ${E.statusText} - ${X}`}}catch(E){Z=`${E instanceof Error?E.message:String(E)} - ${X}`}};if(h(),P=setInterval(h,S),N>0)y=setInterval(()=>{console.warn(`${Z}: ${Date.now()-B}ms`)},N);if($)setTimeout(()=>{if(P)clearInterval(P);if(y)clearInterval(y);T(Error(`Timeout: ${$}ms: ${Z}`))},$)})}var WS="@enterprisestandard/core",MS=a(i(WS));function LS(X){let Y=X.exp!=null?new Date(X.exp*1000):new Date,S=X.iss??"";return{id:X.sub??"",userName:X.preferred_username??"",name:X.name??"",email:X.email??"",avatar:X.picture,sso:{profile:{...X,iss:X.iss??S,aud:X.aud},tenant:{id:X.idp??S,name:S},tokenType:"Bearer",expires:Y}}}function FS(X){let Y=X.replace(/-/g,"+").replace(/_/g,"/");return atob(Y)}async function wS(X){let Y=X.split(".");if(Y.length!==3)throw Error("Invalid JWT");let S=FS(Y[1]),N=JSON.parse(S),$=await MS.validate(N);if($.issues)throw Error(`ID token claims validation failed: ${$.issues.map((B)=>B.message).join("; ")}`);if($.value)return LS($.value);throw Error("ID token claims validation failed")}var x=(X,Y,...S)=>{if(S.length>0)console[X](`[${X.toUpperCase()}]`,Y,...S);else console[X](`[${X.toUpperCase()}]`,Y)},r={debug:()=>{},info:()=>{},warn(X,...Y){x("warn",X,...Y)},error(X,...Y){x("error",X,...Y)}},RS={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},bS={debug:()=>{},info:x.bind(console,"info"),warn:x.bind(console,"warn"),error:x.bind(console,"error")},s=(X,...Y)=>{if(Y.length>0)console.log("[DEBUG]",X,...Y);else console.log("[DEBUG]",X)},CS={debug:s,info:x.bind(console,"info"),warn:x.bind(console,"warn"),error:x.bind(console,"error")},qS={debug:s,info:x.bind(console,"info"),warn:x.bind(console,"warn"),error:x.bind(console,"error")};var e=new Map;async function m(X,Y=3,S=1000,N=30000){let $=Error("Placeholder Error");for(let B=0;B<=Y;B++)try{return await X()}catch(Z){if($=Z instanceof Error?Z:Error(String(Z)),Z instanceof Error&&Z.message.includes("400"))throw Z;if(B===Y)throw $;let M=Math.min(S*2**B,N),T=Math.random()*0.1*M;await new Promise((P)=>setTimeout(P,M+T)),console.warn(`Retry attempt ${B+1} after ${M+T}ms delay`)}throw $}async function SS(X){let Y=e.get(X);if(Y)return Y;return m(async()=>{let S=await fetch(X);if(!S.ok)throw Error("Failed to fetch JWKS");let N=await S.json();return e.set(X,N),N})}async function XS(X,Y){let S=X.keys.find((N)=>N.kid===Y);if(!S)throw Error("Public key not found");return crypto.subtle.importKey("jwk",{kty:S.kty,n:S.n,e:S.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}function gS(X,Y={}){let S=Y.cookieName??"es.active_session",N=X.headers.get("cookie");if(!N)return;return c(N)[S]}function pS(X,Y={}){let S=Y.cookieName??"es.active_session",N=Y.path??"/",$=Y.secure??!1,B=Y.sameSite??"Lax",Z=Y.maxAge,M=[`${S}=${X}`,`Path=${N}`,"HttpOnly",`SameSite=${B}`];if($)M.push("Secure");if(typeof Z==="number")M.push(`Max-Age=${Z}`);return M.join("; ")}function mS(X={}){let Y=X.cookieName??"es.active_session",S=X.path??"/",N=X.secure??!1,$=X.sameSite??"Lax",B=[`${Y}=`,"Max-Age=0",`Path=${S}`,"HttpOnly",`SameSite=${$}`];if(N)B.push("Secure");return B.join("; ")}function cS(X,Y={}){let S=typeof X==="string"?X:X?.headers.get("cookie")??void 0;if(!S)return[];let $=`${Y.cookiePrefix??"es.sso"}.`,B=new Set;for(let Z of Object.keys(c(S))){if(!Z.startsWith($))continue;let M=Z.slice($.length),T=M.lastIndexOf(".");if(T<=0)continue;let P=M.slice(0,T).trim();if(P)B.add(P)}return Array.from(B)}function uS(X,Y){if(!X)return;let S=c(X);for(let[N,$]of Object.entries(S)){if(!N.startsWith("es.sso.")||!N.endsWith(".state"))continue;try{let B=JSON.parse(atob($));if(B?.state===Y)return{clientId:N.slice(7,-6),stateCookie:B}}catch{}}return}function dS(X,Y,S,N){if(!S&&!N)return;let $={...S,...N},B=!!($.authority&&$.tokenUrl&&$.authorizationUrl&&$.clientId&&$.redirectUri&&$.scope),Z={...$,authority:B?H($.authority,"Missing 'authority' from SSO Config"):$.authority,tokenUrl:B?H($.tokenUrl,"Missing 'tokenUrl' from SSO Config"):$.tokenUrl,authorizationUrl:B?H($.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):$.authorizationUrl,clientId:B?H($.clientId,"Missing 'clientId' from SSO Config"):$.clientId,redirectUri:B?H($.redirectUri,"Missing 'redirectUri' from SSO Config"):$.redirectUri,scope:B?H($.scope,"Missing 'scope' from SSO Config"):$.scope,responseType:$.responseType??"code",cookiesSecure:$.cookiesSecure!==void 0?$.cookiesSecure:!0,cookiesSameSite:$.cookiesSameSite!==void 0?$.cookiesSameSite:"Strict",cookiesPrefix:$.cookiesPrefix??($.clientId?`es.sso.${$.clientId}`:"es.sso"),cookiesPath:$.cookiesPath??"/"};function M(){let K=[];if(!Z.authority)K.push("authority");if(!Z.tokenUrl)K.push("tokenUrl");if(!Z.authorizationUrl)K.push("authorizationUrl");if(!Z.clientId)K.push("clientId");if(!Z.redirectUri)K.push("redirectUri");if(!Z.scope)K.push("scope");if(K.length>0)throw Error(`Missing OIDC configuration fields: ${K.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function T(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");try{let{tokens:A}=await g(K);if(!A)return;return await f(A)}catch(A){console.error("Error parsing user from cookies:",A);return}}async function P(K){let A=await T(K);if(A)return A;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function y({landingUrl:K,errorUrl:A},G){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");M();let L=t(),W=t(64),Q=Z.redirectUri;try{new URL(Q)}catch{if(G)try{let j=new URL(G),I=Q.startsWith("//")?Q.slice(1):Q.startsWith("/")?Q:`/${Q}`;Q=new URL(I,j.origin).toString()}catch{try{let j=new URL(Z.authorizationUrl),I=Q.startsWith("//")?Q.slice(1):Q.startsWith("/")?Q:`/${Q}`;Q=new URL(I,j.origin).toString()}catch{throw Error(`Invalid redirectUri: "${Z.redirectUri}". It must be a valid absolute URL.`)}}}let F=new URL(Z.authorizationUrl);F.searchParams.append("client_id",Z.clientId),F.searchParams.append("redirect_uri",Q),F.searchParams.append("response_type","code"),F.searchParams.append("scope",Z.scope),F.searchParams.append("state",L);let J=await KS(W);F.searchParams.append("code_challenge",J),F.searchParams.append("code_challenge_method","S256");let D={state:L,codeVerifier:W,landingUrl:K,errorUrl:A};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:F.toString(),"Set-Cookie":k("state",D,86400)}})}async function h(K,A){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");try{let J=R("refresh",K);if(J)await $S(J)}catch(J){console.warn("Failed to revoke token:",J)}if(Z.sessionStore)try{let J=await T(K);if(J?.sso?.profile.sid){let D=J.sso.profile.sid;await Z.sessionStore.delete(D)}}catch(J){console.warn("Failed to delete session:",J)}let G=[["Set-Cookie",C("access")],["Set-Cookie",C("id")],["Set-Cookie",C("refresh")],["Set-Cookie",C("control")],["Set-Cookie",C("state")]],W=new URL(K.url).searchParams.get("redirect");if(W)return new Response("Logged out",{status:302,headers:[["Location",W],...G]});let Q=K.headers.get("accept");if(Q?.includes("application/json")||Q?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...G]});else return new Response(`
-          <!DOCTYPE html><html lang="en"><body>
-            <h1>Logout Complete</h1>
-            <div style="display: none">
-              It is not recommended to show the default logout page. Include '?redirect=/someHomePage' or logout asynchronously.
-              Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
-            </div>
-          </body></html>
-        `,{status:200,headers:[["Content-Type","text/html"],...G]})}async function E(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(!Z.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{let A=K.headers.get("content-type");if(!A||!A.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let G=await K.text(),W=new URLSearchParams(G).get("logout_token");if(!W)return new Response("Missing logout_token parameter",{status:400});let F=(await n(W)).sid;if(!F)return console.warn("Back-Channel Logout: logout_token missing sid claim"),new Response("Invalid logout_token: missing sid claim",{status:400});return await Z.sessionStore.delete(F),console.log(`Back-Channel Logout: successfully deleted session ${F}`),new Response("OK",{status:200})}catch(A){return console.error("Error during back-channel logout:",A),new Response("Internal Server Error",{status:500})}}async function U(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let A=new URL(K.url),G=new URLSearchParams(A.search),L=Object.fromEntries(G.entries()),W=await X.callbackParams["~standard"].validate(L);if(W.issues)return o(W.issues,"OIDC callback parameters validation failed");let{code:Q,state:F}=W.value;try{let J=R("state",K,!0),{codeVerifier:D,state:j,landingUrl:I}=J??{};if(H(D,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),H(j,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),H(I,'OIDC "landingUrl" was not present in cookies'),F!==j)throw Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');let w=Z.cookiesSecure?K.url.replace(/^http:\/\//,"https://"):K.url,z=await ZS(Q,D,w),O=await f(z);if(Z.sessionStore)try{let V=O.sso.profile.sid,_=O.id;if(V&&_){let b={sid:V,sub:_,createdAt:new Date,lastActivityAt:new Date};await Z.sessionStore.create(b)}else console.warn("Session creation skipped: missing sid or sub in ID token claims")}catch(V){console.warn("Failed to create session:",V)}if(Z.userStore)try{let V=O.id;if(V){let _=new Date,b=await Z.userStore.get(V);if(b||Z.enableJitUserProvisioning){let QS={...b??{},...O,id:V,tenantId:b?.tenantId,createdAt:b?.createdAt??_,updatedAt:_};await Z.userStore.upsert(QS)}else console.warn("JIT user provisioning disabled: user not found in store and will not be created")}else console.warn("User storage skipped: missing sub in ID token claims")}catch(V){console.warn("Failed to store user:",V)}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",I],["Set-Cookie",C("state")],...p(z,O.sso.expires)]})}catch(J){console.error("Error during sign-in callback:",J);try{let D=R("state",K,!0),{errorUrl:j}=D??{};if(j)return new Response("Redirecting to error url",{status:302,headers:[["Location",j]]})}catch(D){console.warn("Error parsing the errorUrl from the OIDC cookie")}return console.warn("No error page was found in the cookies. The user will be shown a default error page."),new Response("An error occurred during authentication, please return to the application homepage and try again.",{status:500})}}async function f(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let A=await n(K.id_token),G=Number(K.refresh_expires_in??K.expires_in??3600),L=K.expires?new Date(K.expires):new Date(Date.now()+G*1000);return{id:A.sub,userName:A.preferred_username||"",name:A.name||"",email:A.email||"",emails:[{value:A.email||"",primary:!0}],avatar:A.picture,sso:{profile:{...A,iss:A.iss||Z.authority,aud:A.aud||Z.clientId},tenant:{id:A.idp||A.iss||Z.authority||"",name:A.iss||Z.authority||""},scope:K.scope,tokenType:K.token_type,sessionState:K.session_state,expires:L}}}async function ZS(K,A,G){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");M();let{tokenUrl:L,redirectUri:W}=Z;try{new URL(W)}catch{if(G)try{let F=new URL(G),J=W.startsWith("//")?W.slice(1):W.startsWith("/")?W:`/${W}`;W=new URL(J,F.origin).toString()}catch{try{let F=new URL(L),J=W.startsWith("//")?W.slice(1):W.startsWith("/")?W:`/${W}`;W=new URL(J,F.origin).toString()}catch{throw Error(`Invalid redirectUri: "${Z.redirectUri}". It must be a valid absolute URL.`)}}}let Q=new URLSearchParams;if(Q.append("grant_type","authorization_code"),Q.append("code",K),Q.append("redirect_uri",W),Q.append("client_id",Z.clientId),Z.clientSecret)Q.append("client_secret",Z.clientSecret);Q.append("code_verifier",A);try{let F=await fetch(L,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Q.toString()}),J=await F.json();if(!F.ok){console.error("Token exchange error:",J);let j=J;throw Error(`Token exchange failed: ${j.error||F.statusText} - ${j.error_description||""}`.trim())}let D=await X.tokenResponse["~standard"].validate(J);if(D.issues)throw console.error("Token response validation failed:",D.issues),Error(`Token response validation failed: ${D.issues}`);return D.value}catch(F){throw console.error("Error during token exchange:",F),F}}async function d(K){return m(async()=>{if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");M();let A=Z.tokenUrl,G=new URLSearchParams;G.append("grant_type","refresh_token"),G.append("refresh_token",K),G.append("client_id",Z.clientId);let L=await fetch(A,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:G.toString()}),W=await L.json();if(!L.ok){console.error("Token refresh error:",W);let Q=W;throw Error(`Token refresh failed: ${Q.error||L.statusText} - ${Q.error_description||""}`.trim())}return W})}async function $S(K){try{if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(!Z.revocationEndpoint)return;let A=new URLSearchParams;A.append("token",K),A.append("token_type_hint","refresh_token"),A.append("client_id",Z.clientId);let G=await fetch(Z.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:A.toString()});if(!G.ok)console.warn("Token revocation failed:",G.status,G.statusText);else console.log("Token revoked successfully")}catch(A){console.warn("Error revoking token:",A)}}async function l(){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(!Z.jwksUri&&!Z.authority)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let K=Z.jwksUri||`${Z.authority}/protocol/openid-connect/certs`;return SS(K)}async function n(K){try{let A=K.split(".");if(A.length!==3)throw Error("Invalid JWT");let G=JSON.parse(atob(A[0].replace(/-/g,"+").replace(/_/g,"/"))),L=JSON.parse(atob(A[1].replace(/-/g,"+").replace(/_/g,"/"))),W=A[2].replace(/-/g,"+").replace(/_/g,"/"),Q=await NS(G.kid),J=new TextEncoder().encode(`${A[0]}.${A[1]}`);if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",Q,Uint8Array.from(atob(W),(I)=>I.charCodeAt(0)),J))throw Error("Invalid JWT signature");let j=await X.idTokenClaims["~standard"].validate(L);if(j.issues)throw console.error("ID token claims validation failed:",j.issues),Error(`ID token claims validation failed: ${j.issues}`);return j.value}catch(A){throw console.error("Error verifying JWT:",A),A}}function t(K=32){let A=new Uint8Array(K);return crypto.getRandomValues(A),Array.from(A,(G)=>G.toString(16).padStart(2,"0")).join("").substring(0,K)}async function KS(K){let G=new TextEncoder().encode(K),L=await crypto.subtle.digest("SHA-256",G),W=Array.from(new Uint8Array(L));return btoa(String.fromCharCode(...W)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function NS(K){let A=await l();return XS(A,K)}function p(K,A){let G=A instanceof Date?A:new Date(A);if(Number.isNaN(G.getTime()))throw Error(`Invalid SSO token expiry: ${String(A)}`);let L={expires_in:K.expires_in,refresh_expires_in:K.refresh_expires_in,scope:K.scope,session_state:K.session_state,token_type:K.token_type,expires:G.toISOString()};return[["Set-Cookie",k("access",K.access_token,G)],["Set-Cookie",k("id",K.id_token,G)],["Set-Cookie",k("refresh",K.refresh_token??"",G)],["Set-Cookie",k("control",L,G)]]}async function g(K){let A=R("access",K),G=R("id",K),L=R("refresh",K),W=R("control",K,!0);if(!A||!G||!L||!W)return{tokens:void 0,refreshHeaders:[]};let Q={access_token:A,id_token:G,refresh_token:L,...W};if(W.expires&&L&&Date.now()>new Date(W.expires).getTime()){Q=await d(L);let F=await f(Q),J=p(Q,F.sso.expires);return{tokens:Q,refreshHeaders:J}}return{tokens:Q,refreshHeaders:[]}}async function AS(K){let{tokens:A}=await g(K);if(!A)return;return A.access_token}function k(K,A,G){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");if(K=`${Z.cookiesPrefix}.${K}`,typeof A!=="string")A=btoa(JSON.stringify(A));let L;if(G instanceof Date)L=`Expires=${G.toUTCString()}`;else if(typeof G==="number")L=`Max-Age=${G}`;else throw Error("Invalid expires type",G);if(A.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${A.length}`);return`${K}=${A}; ${L}; Path=${Z.cookiesPath}; HttpOnly;${Z.cookiesSecure?" Secure;":""} SameSite=${Z.cookiesSameSite};`}function C(K){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");return`${Z.cookiesPrefix}.${K}=; Max-Age=0; Path=${Z.cookiesPath}; HttpOnly;${Z.cookiesSecure?" Secure;":""} SameSite=${Z.cookiesSameSite};`}function R(K,A,G=!1){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let L=A.headers.get("cookie");if(!L)return null;let W=L.split(";").find((J)=>J.trim().startsWith(`${Z.cookiesPrefix}.${K}=`));if(!W)return null;let Q=W.split("=")[1].trim();if(!G)return Q;let F=atob(Q);return JSON.parse(F)}async function GS(K,A){if(!Z)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:G,userUrl:L,errorUrl:W,landingUrl:Q,tokenUrl:F,refreshUrl:J,logoutUrl:D,logoutBackChannelUrl:j,jwksUrl:I,redirectUri:w}={...Z,...A},z=new URL(K.url).pathname;if(w){let O;try{O=new URL(w).pathname}catch{try{let V=new URL(K.url),_=w.startsWith("//")?w.slice(1):w;O=new URL(_,V.origin).pathname}catch{O=w.startsWith("/")?w:`/${w}`}}if(O===z)return U(K)}if(G===z){let O=Z.cookiesSecure?K.url.replace(/^http:\/\//,"https://"):K.url;return y({landingUrl:Q||"/",errorUrl:W},O)}if(L===z){let{tokens:O,refreshHeaders:V}=await g(K);if(!O)return new Response("User not logged in",{status:401});let _=await f(O);return new Response(JSON.stringify(_),{headers:[["Content-Type","application/json"],...V]})}if(F===z){let{tokens:O,refreshHeaders:V}=await g(K);if(!O)return new Response("User not logged in",{status:401});return new Response(JSON.stringify({token:O.access_token,expires:O.expires}),{headers:[["Content-Type","application/json"],...V]})}if(J===z){let O=R("refresh",K);if(!O)return new Response("User not logged in",{status:401});let V=await d(O),_=await f(V),b=p(V,_.sso.expires);return new Response("Refresh Complete",{status:200,headers:b})}if(D===z)return h(K,{landingUrl:Q||"/"});if(j===z)return E(K);if(I===z){let O=await l();return new Response(JSON.stringify(O),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...Z,getUser:T,getRequiredUser:P,getJwt:AS,initiateLogin:y,logout:h,logoutBackChannel:E,callbackHandler:U,handler:GS}}function c(X){let Y={},S=X.split(";");for(let N of S){let $=N.trim();if(!$)continue;let B=$.indexOf("=");if(B===-1)continue;let Z=$.slice(0,B).trim(),M=$.slice(B+1).trim();Y[Z]=M}return Y}function q(X){return X=X??"SSO Unavailable",new Response(JSON.stringify({error:X}),{status:503,statusText:X,headers:{"Content-Type":"application/json"}})}function YS(X){if(!X)return[];let Y=X.headers;if(Y.getSetCookie)return Y.getSetCookie();let S=X.headers.get("set-cookie");return S?[S]:[]}function JS(X,Y){let S=new Headers;X.headers.forEach((N,$)=>{if($.toLowerCase()!=="set-cookie")S.set($,N)});for(let N of Y)S.append("Set-Cookie",N);return new Response(X.body,{status:X.status,statusText:X.statusText,headers:S})}var v="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function lS(X,Y){return H(Y,v),Y.sso?.getUser(X)}async function OS(X,Y){H(Y,v);let S=Y.logger??r;S.debug?.("getUser called",{hasInstance:!0,hasSso:!!Y.sso,hasCiam:!!Y.ciam});let N=await Y.sso?.getUser(X);if(N)return S.debug?.("Found SSO user",{email:N.email}),N;S.debug?.("No SSO user, trying CIAM");let $=await Y.ciam?.getUser(X);return S.debug?.("CIAM user result",{email:$?.email??void 0}),$}async function nS(X,Y){let S=await OS(X,Y);if(S)return S;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function tS(X,Y){H(Y,v);let S=Y.sso;if(!S)return q();return S.initiateLogin(X)}async function iS(X,Y){H(Y,v);let S=Y.sso;if(!S)return q();return S.callbackHandler(X)}async function aS(X,Y){H(Y,v);let{sso:S,ciam:N}=Y;if(!S&&!N)return q("Logout Unavailable");let $=S?await S.logout(X,{landingUrl:"/"}):void 0,B=N?await N.logout(X):void 0,Z=$??B;if(!Z)return q("Logout Unavailable");let M=[...YS($),...YS(B)];return JS(Z,M)}async function oS(X,Y){H(Y,v);let{sso:S,ciam:N}=Y;if(!S&&!N)return q("Back-Channel Logout Unavailable");let $=X.clone(),B=X.clone(),Z=S?await S.logoutBackChannel($):void 0;if(Z?.status===200)return Z;let M=N?await N.logoutBackChannel(B):void 0;if(M)return M;return Z??q("Back-Channel Logout Unavailable")}var u;function sS(X){u=X}function jS(X,Y){if(VS(X.configSource))return X.configSource;if(!u)throw Error("Tenant config hydration is not registered. Import @enterprisestandard/server before using tenant.config().");return u(X.configSource,Y)}function eS(X){let Y=X.configSource;return{...X,config:(S)=>jS({configSource:Y},S)}}function VS(X){let Y=X;return typeof X==="object"&&X!==null&&typeof Y.load==="function"&&typeof Y.subscribe==="function"}
-export{DS as a,ES as b,i as c,a as d,H as e,o as f,PS as g,BS as h,TS as i,zS as j,LS as k,wS as l,r as m,RS as n,bS as o,CS as p,qS as q,SS as r,XS as s,gS as t,pS as u,mS as v,cS as w,uS as x,dS as y,lS as z,OS as A,nS as B,tS as C,iS as D,aS as E,oS as F,sS as G,jS as H,eS as I};