@enterprisestandard/core 0.0.19-beta.20260518.2 → 0.0.19

package/dist/index.d.ts

@@ -47,54 +47,26 @@ interface ListResult<T> {
 }
 /** Sort direction for list options. */
 type SortDirection = "asc" | "desc";
-/** Allowed sort fields for groups (top-level strings, dates; no members array). */
-type GroupSortField = "id" | "displayName" | "externalId" | "createdAt" | "updatedAt";
-/** Single sort option for group list. */
-interface GroupSortOptions {
-	field: GroupSortField;
+/** Single sort option for paginated list operations. */
+interface SortOptions<TField extends string = string> {
+	field: TField;
 	direction: SortDirection;
 }
-/** Options for GroupStore.list(). */
-interface GroupListOptions {
+/** Shared options for paginated list operations. */
+interface ListOptions<TField extends string = string> {
 	/** 0-based index of first item. Default 0. */
 	start?: number;
 	/** Max items to return. Omitted = implementation-defined (InMemory: no limit). */
 	limit?: number;
 	/** Sort order (applied in array order). */
-	sort?: GroupSortOptions[];
-}
-/** Allowed sort fields for users (top-level strings, dates; no sso nested). */
-type UserSortField = "id" | "userName" | "name" | "email" | "avatar" | "createdAt" | "updatedAt";
-/** Single sort option for user list. */
-interface UserSortOptions {
-	field: UserSortField;
-	direction: SortDirection;
-}
-/** Options for UserStore.list(). */
-interface UserListOptions {
-	/** 0-based index of first item. Default 0. */
-	start?: number;
-	/** Max items to return. Omitted = implementation-defined (InMemory: no limit). */
-	limit?: number;
-	/** Sort order (applied in array order). */
-	sort?: UserSortOptions[];
-}
-/** Allowed sort fields for tenants (no config). */
-type TenantSortField = "id" | "companyId" | "companyName" | "environmentType" | "email" | "webhookUrl" | "callbackUrl" | "tenantUrl" | "status" | "error" | "createdAt" | "updatedAt";
-/** Single sort option for tenant list. */
-interface TenantSortOptions {
-	field: TenantSortField;
-	direction: SortDirection;
-}
-/** Options for TenantStore.list() and getByCompanyId(). */
-interface TenantListOptions {
-	/** 0-based index of first item. Default 0. */
-	start?: number;
-	/** Max items to return. Omitted = implementation-defined (InMemory: no limit). */
-	limit?: number;
-	/** Sort order (applied in array order). */
-	sort?: TenantSortOptions[];
+	sort?: SortOptions<TField>[];
 }
+type GroupSortOptions = SortOptions;
+type GroupListOptions = ListOptions;
+type UserSortOptions = SortOptions;
+type UserListOptions = ListOptions;
+type TenantSortOptions = SortOptions;
+type TenantListOptions = ListOptions;
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
 * SCIM 2.0 User Resource
@@ -600,7 +572,7 @@ interface GroupStore<TExtended = Record<string, never>> {
 	* @param options - Optional start (0-based), limit (page size), and sort
 	* @returns ListResult with total, count, items, size, page, pages
 	*/
-	list(options?: GroupListOptions): Promise<ListResult<StoredGroup<TExtended>>>;
+	list(options?: ListOptions): Promise<ListResult<StoredGroup<TExtended>>>;
 	/**
 	* Create or update a group in the store.
 	*
@@ -640,17 +612,6 @@ type TenantResponse<TExtended extends object = object> = {
 	tenantUrl?: string;
 	status?: string;
 } & TExtended;
-type TenantDirectorySortOptions = {
-	field: string;
-	direction: SortDirection;
-};
-type TenantDirectoryOptions = {
-	start?: number;
-	limit?: number;
-	order?: string;
-	sort?: TenantDirectorySortOptions[];
-	filters?: Record<string, string | string[]>;
-};
 type DefaultTenantResponse = TenantResponse<{
 	clientId: string;
 	companyId: string;
@@ -2521,11 +2482,12 @@ interface TenantStore<
 	TTenantResponse extends TenantResponse = DefaultTenantResponse
 > {
 	get(id: string): Promise<TTenant | undefined>;
-	list(options?: TenantListOptions): Promise<ListResult<TTenant>>;
+	list(options?: ListOptions): Promise<ListResult<TTenant>>;
 	upsert(tenant: TTenant): Promise<TTenant>;
 	delete(id: string): Promise<number>;
 	getEs(id: string): Promise<EnterpriseStandard | undefined>;
-	findTenants(sessions: Session[], options?: TenantDirectoryOptions): Promise<ListResult<TTenantResponse>>;
+	findTenants(sessions: Session[], options?: ListOptions): Promise<ListResult<TTenantResponse>>;
+	findUserTenants(filters: Record<string, unknown>, options?: ListOptions): Promise<ListResult<TTenantResponse>>;
 }
 type InMemoryTenantStoreOptions<
 	TTenant extends BaseTenant = BaseTenant,
@@ -2543,11 +2505,12 @@ declare class InMemoryTenantStore<
 	private readonly createEs?;
 	constructor(options?: InMemoryTenantStoreOptions<TTenant, TTenantResponse>);
 	get(id: string): Promise<TTenant | undefined>;
-	list(options?: TenantListOptions): Promise<ListResult<TTenant>>;
+	list(options?: ListOptions): Promise<ListResult<TTenant>>;
 	upsert(tenant: TTenant): Promise<TTenant>;
 	delete(id: string): Promise<number>;
 	registerUserTenantId(userId: string, tenantId: string | null | undefined): Promise<void>;
-	findTenants(sessions: Session[], options?: TenantDirectoryOptions): Promise<ListResult<TTenantResponse>>;
+	findTenants(sessions: Session[], options?: ListOptions): Promise<ListResult<TTenantResponse>>;
+	findUserTenants(filters: Record<string, unknown>, options?: ListOptions): Promise<ListResult<TTenantResponse>>;
 	getEs(id: string): Promise<EnterpriseStandard | undefined>;
 }
 declare function sendTenantWebhook(webhookUrl: string, payload: TenantWebhookPayload, log: Logger): Promise<void>;
@@ -2766,7 +2729,7 @@ interface UserStore<TExtended = object> {
 	* @param options - Optional start (0-based), limit (page size), and sort
 	* @returns ListResult with total, count, items, size, page, pages
 	*/
-	list(options?: UserListOptions): Promise<ListResult<StoredUser<TExtended>>>;
+	list(options?: ListOptions): Promise<ListResult<StoredUser<TExtended>>>;
 }
 /**
 * SCIM Error response structure
@@ -3711,4 +3674,4 @@ type LfvErrorResponse = {
 	error: LfvErrorCode;
 	message: string;
 };
-export { workloadTokenResponseSchema, withValidate, waitOn, version, validationFailureResponse, userSchema, tokenResponseSchema, stripJsonComments, silentLogger, serializeESConfig, sendTenantWebhook, parseJsonc, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listSsoClientIdsFromCookies, list, jwtAssertionClaimsSchema, isConfigLocator, idTokenClaimsSchema, hydrateTenantForEs, groupResourceSchema, findTenantFromStateParam, discoverSessions, discoverSessionRecords, defaultLogger, deepEqualPlain, decodeUser, claimsToUser, buildTenantPath, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadIncomingOutgoing, WorkloadIdentity, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UserSortOptions, UserSortField, UserListOptions, UpsertTenantResponse, UpsertTenantRequest, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantSortOptions, TenantSortField, TenantRoutingStrategy, TenantResponse, TenantRequestError, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantListOptions, TenantJwtRoutingStrategy, TenantEsFactory, TenantDirectorySortOptions, TenantDirectoryResponse, TenantDirectoryOptions, SubscriptionMode, StoredUser, StoredGroup, StateCookie, StandardSchemaWithValidate, SortDirection, SessionStore, SessionResponse, Session, ServerOnlyWorkloadConfig, SerializableTenant, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimListResponse, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, Role, ResolvedVaultLfvSecretsConfig, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReactiveHandle, Photo, PhoneNumber, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, Name, MultipleTenantsForUserError, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, LoginConfig, Logger, ListResult, LfvOtpResponse, LfvOtpRequest, LfvErrorResponse, LfvErrorCode, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, JwtBearerWorkloadConfig, JWTAssertionClaims, InMemoryTenantStoreOptions, InMemoryTenantStore, IdTokenClaims, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfig, IAMAppValidators, IAMAppRole, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupStore, GroupSortOptions, GroupSortField, GroupResource, GroupMember, GroupListOptions, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkConfig, EnvironmentType, EnterpriseUser, EnterpriseStandardFromConfig, EnterpriseStandardBase, EnterpriseStandard, EnterpriseExtension, Email, ESValidators, ESRoutingOptions, ESRouteModule, ESRouteFilterResult, ESResolvedRoute, ESModuleFromConfig, ESConfigChangeResult, ESConfigChangeOptions, ESConfigChangeCallback, ESConfig, DevSecretsConfig, DefaultTenantResponse, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, Customer, CreateUserOptions, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceEnv, ConfigSource, ConfigLocator, ClientCredentialsWorkloadConfig, ChangeListener, CachedWorkloadToken, CIAMValidators, CIAMConfigFromCode, CIAMConfig, CIAM, BaseUser, BaseTenant, AzureSecretsConfig, AzureConfigLocator, AwsSecretsConfig, AwsConfigLocator, AwsAuthMethod, AuthenticatedUser, ApplicationValidators, Address };
+export { workloadTokenResponseSchema, withValidate, waitOn, version, validationFailureResponse, userSchema, tokenResponseSchema, stripJsonComments, silentLogger, serializeESConfig, sendTenantWebhook, parseJsonc, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listSsoClientIdsFromCookies, list, jwtAssertionClaimsSchema, isConfigLocator, idTokenClaimsSchema, hydrateTenantForEs, groupResourceSchema, findTenantFromStateParam, discoverSessions, discoverSessionRecords, defaultLogger, deepEqualPlain, decodeUser, claimsToUser, buildTenantPath, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadIncomingOutgoing, WorkloadIdentity, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UserSortOptions, UserListOptions, UpsertTenantResponse, UpsertTenantRequest, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantSortOptions, TenantRoutingStrategy, TenantResponse, TenantRequestError, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantListOptions, TenantJwtRoutingStrategy, TenantEsFactory, TenantDirectoryResponse, SubscriptionMode, StoredUser, StoredGroup, StateCookie, StandardSchemaWithValidate, SortOptions, SortDirection, SessionStore, SessionResponse, Session, ServerOnlyWorkloadConfig, SerializableTenant, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimListResponse, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, Role, ResolvedVaultLfvSecretsConfig, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReactiveHandle, Photo, PhoneNumber, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, Name, MultipleTenantsForUserError, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, LoginConfig, Logger, ListResult, ListOptions, LfvOtpResponse, LfvOtpRequest, LfvErrorResponse, LfvErrorCode, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, JwtBearerWorkloadConfig, JWTAssertionClaims, InMemoryTenantStoreOptions, InMemoryTenantStore, IdTokenClaims, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfig, IAMAppValidators, IAMAppRole, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupStore, GroupSortOptions, GroupResource, GroupMember, GroupListOptions, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkConfig, EnvironmentType, EnterpriseUser, EnterpriseStandardFromConfig, EnterpriseStandardBase, EnterpriseStandard, EnterpriseExtension, Email, ESValidators, ESRoutingOptions, ESRouteModule, ESRouteFilterResult, ESResolvedRoute, ESModuleFromConfig, ESConfigChangeResult, ESConfigChangeOptions, ESConfigChangeCallback, ESConfig, DevSecretsConfig, DefaultTenantResponse, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, Customer, CreateUserOptions, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceEnv, ConfigSource, ConfigLocator, ClientCredentialsWorkloadConfig, ChangeListener, CachedWorkloadToken, CIAMValidators, CIAMConfigFromCode, CIAMConfig, CIAM, BaseUser, BaseTenant, AzureSecretsConfig, AzureConfigLocator, AwsSecretsConfig, AwsConfigLocator, AwsAuthMethod, AuthenticatedUser, ApplicationValidators, Address };

package/dist/index.js

@@ -1 +1 @@
-import{G as B,a as $x,b as Cx,c as Hx,d as Qx,e as Xx,f as Zx,g as zx,h as Gx,i as Lx,j as Rx,k as Yx,l as fx,m as wx,n as Dx,o as Ex,p as Mx,q as Wx,u as Bx,v as Fx}from"./shared/core-cf4cna3e.js";var j="0.0.19-beta.20260518.2";var S=["sessionStore","userStore","groupStore","tokenStore","magicLinkStore"];function W(x){if(x===null||typeof x!=="object")return x;let T={};for(let[A,_]of Object.entries(x)){if(S.includes(A)||A==="validators"||A==="setStores")continue;T[A]=_!==null&&typeof _==="object"&&!Array.isArray(_)&&Object.getPrototypeOf(_)===Object.prototype?W(_):_}return T}function O(x){return W(x)}function R(x,T,A,_){let J=T.length,$=_??x,N=$>0?Math.floor(A/$)+1:1,C=$>0?Math.ceil(x/$):0;return{total:x,count:J,items:T,size:$,page:N,pages:C}}class D extends Error{constructor(x,T){super(x,T);this.name="TenantRequestError",Object.setPrototypeOf(this,D.prototype)}}class E extends Error{userId;conflictingIds;constructor(x,T,A){super(`Multiple tenants found for user id "${x}"`,A);this.name="MultipleTenantsForUserError",this.userId=x,this.conflictingIds=T,Object.setPrototypeOf(this,E.prototype)}}function g(x){if(typeof x!=="object"||x==null)return!1;let T=x.type;return T==="vault"||T==="aws"||T==="azure"||T==="gcp"}function F(x){if(typeof x.config==="function")return x;if(!x.configLocator)return x;return B({...x,configLocator:x.configLocator})}class K{tenants=new Map;userTenantIds=new Map;toTenantResponse;constructor(x){this.toTenantResponse=x}async get(x){return this.tenants.get(x)}async list(x){let T=Array.from(this.tenants.values()),A=Math.max(0,x?.start??0),_=x?.limit,J=x?.sort;if(J?.length)T=[...T].sort((Q,Z)=>{for(let{field:X,direction:f}of J){let z=Q[X],y=Z[X],w=U(z,y);if(w!==0)return f==="desc"?-w:w}return 0});let $=T.length,N=_!=null?A+_:void 0,C=T.slice(A,N);return R($,C,A,_)}async upsert(x){return this.tenants.set(x.id,x),x}async delete(x){let T=this.tenants.has(x);return this.tenants.delete(x),T?1:0}async registerUserTenantId(x,T){if(!x)return;let A=I(T),_=this.userTenantIds.get(x);if(_){_.add(A);return}this.userTenantIds.set(x,new Set([A]))}async findTenants(x,T){let A=new Map;for(let J of h(x))for(let $ of await this.resolveTenantsByUserId(J))A.set($.id,$);let _=Array.from(A.values()).map((J)=>this.toTenantResponse(J));return m(_,T)}async resolveTenantsByUserId(x){let T=this.userTenantIds.get(x);if(!T||T.size===0)return[];let A=T.has(null),_=Array.from(T).filter((N)=>N!=null);if(_.length===0)return[];let J=await Promise.all(_.map(async(N)=>({id:N,tenant:await this.get(N)}))),$=J.filter((N)=>N.tenant!=null).map((N)=>N.id);if($.length===0){if(A)this.userTenantIds.set(x,new Set([null]));else this.userTenantIds.delete(x);return[]}if($.length!==_.length){let N=A?[null,...$]:$;this.userTenantIds.set(x,new Set(N))}return J.map((N)=>N.tenant).filter((N)=>N!=null)}}class q{store;createEs;constructor(x={}){this.createEs=x.createEs,this.store=new K(x.toTenantResponse??((T)=>P(T)))}async get(x){return this.store.get(x)}async list(x){return this.store.list(x)}async upsert(x){return this.store.upsert(x)}async delete(x){return this.store.delete(x)}async registerUserTenantId(x,T){return this.store.registerUserTenantId(x,T)}async findTenants(x,T){return this.store.findTenants(x,T)}async getEs(x){let T=await this.get(x);if(!T)return;if(!this.createEs)throw Error(`${this.constructor.name} requires options.createEs to use getEs()`);return this.createEs(F(T))}}function U(x,T){let A=x===void 0||x===null,_=T===void 0||T===null;if(A&&_)return 0;if(A)return 1;if(_)return-1;if(x instanceof Date&&T instanceof Date)return x.getTime()-T.getTime();let J=String(x),$=String(T);return J.localeCompare($)}function I(x){if(typeof x!=="string")return null;return x.trim()||null}function P(x){return{clientId:x.id,id:x.id,companyId:x.companyId,companyName:x.companyName,environmentType:x.environmentType,status:x.status,email:x.email,webhookUrl:x.webhookUrl,callbackUrl:x.callbackUrl,tenantUrl:x.tenantUrl,error:x.error,actionUrl:x.actionUrl,expiresAt:x.expiresAt,createdAt:x.createdAt.toISOString(),updatedAt:x.updatedAt.toISOString()}}function h(x){let T=new Set;for(let A of x){Y(T,A.sub);let _=A.claims;if(!_||typeof _!=="object"||Array.isArray(_))continue;Y(T,_.sub),Y(T,_.email),Y(T,_.preferred_username)}return[...T]}function Y(x,T){if(typeof T!=="string")return;let A=T.trim();if(!A)return;x.add(A),x.add(A.toLowerCase())}function m(x,T){let A=Math.max(0,T?.start??0),_=T?.limit,J=x,$=T?.sort;if($?.length)J=[...x].sort((Q,Z)=>{for(let{field:X,direction:f}of $){let z=U(Q[X],Z[X]);if(z!==0)return f==="desc"?-z:z}return 0});let N=J.length,C=_!=null?A+_:void 0;return R(N,J.slice(A,C),A,_)}function p(x,T,A){return(async()=>{try{let _=await fetch(x,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(T)});if(!_.ok)A.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure",status:_.status,statusText:_.statusText})}catch(_){A.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure"},_)}})()}async function b(x,T,A){return p(x,T,A)}var v={beforeTenantSegments:["ui"]},n={beforeTenantSegments:["api"]};function c(x){return{segments:M(x?.segments)}}function M(x){return(x??[]).map((T)=>T.trim()).filter(Boolean)}function o(x){let T=x.trim();if(!T)return"/";let A=T.replace(/\\/g,"/").replace(/\/+/g,"/");return A.startsWith("/")?A:`/${A}`}function V(x){return o(x).split("/").filter(Boolean)}function G(x){return{beforeTenantSegments:M(x?.beforeTenantSegments),afterTenantSegments:M(x?.afterTenantSegments)}}function d(x){if(!x||x.type===void 0||x.type==="path"){let A=x;return{type:"path",ui:G(A?.ui),api:G(A?.api)}}let T=x;return{...T,ui:c(T.ui),api:c(T.api)}}function r(x,T){let A=G(T),_=A.beforeTenantSegments??[],J=A.afterTenantSegments??[],$=V(x),N=_.length+1+J.length;if($.length<N)return null;for(let X=0;X<_.length;X++)if($[X]!==_[X])return null;let C=_.length,Q=$[C];if(!Q)return null;for(let X=0;X<J.length;X++)if($[C+1+X]!==J[X])return null;let Z=$.slice(C+1+J.length);return{id:decodeURIComponent(Q),restSegments:Z,restPath:Z.length>0?`/${Z.join("/")}`:"/"}}function l(x,T="/",A){let _=G(A),J=_.beforeTenantSegments??[],$=_.afterTenantSegments??[],N=V(T),C=[...J,encodeURIComponent(x),...$,...N];return C.length>0?`/${C.join("/")}`:"/"}function H(x,T,A,_,J){if(x===void 0||x===null){if(A)_.push({message:`${T} is required`,path:J});return}if(typeof x!=="string"){_.push({message:`${T} must be a string`,path:J});return}return x}function L(x,T,A,_){if(x===void 0||x===null)return;if(typeof x!=="boolean"){A.push({message:`${T} must be a boolean`,path:_});return}return x}function t(x,T,A){if(x===void 0||x===null)return;if(typeof x!=="object"||x===null){T.push({message:"name must be an object",path:A});return}let _=x,J={};return J.formatted=H(_.formatted,"formatted",!1,T,[...A,"formatted"]),J.familyName=H(_.familyName,"familyName",!1,T,[...A,"familyName"]),J.givenName=H(_.givenName,"givenName",!1,T,[...A,"givenName"]),J.middleName=H(_.middleName,"middleName",!1,T,[...A,"middleName"]),J.honorificPrefix=H(_.honorificPrefix,"honorificPrefix",!1,T,[...A,"honorificPrefix"]),J.honorificSuffix=H(_.honorificSuffix,"honorificSuffix",!1,T,[...A,"honorificSuffix"]),J}function u(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"emails must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"email must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:L(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function i(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"phoneNumbers must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"phoneNumber must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:L(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function a(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"addresses must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"address must be an object",path:N});continue}let C=$;_.push({formatted:H(C.formatted,"formatted",!1,T,[...N,"formatted"]),streetAddress:H(C.streetAddress,"streetAddress",!1,T,[...N,"streetAddress"]),locality:H(C.locality,"locality",!1,T,[...N,"locality"]),region:H(C.region,"region",!1,T,[...N,"region"]),postalCode:H(C.postalCode,"postalCode",!1,T,[...N,"postalCode"]),country:H(C.country,"country",!1,T,[...N,"country"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:L(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function e(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"groups must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"group must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,$ref:H(C.$ref,"$ref",!1,T,[...N,"$ref"]),display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"])})}return _.length>0?_:void 0}function s(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"roles must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"role must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:L(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function xx(x,T,A){if(x===void 0||x===null)return;if(typeof x!=="object"||x===null){T.push({message:"Enterprise User extension must be an object",path:A});return}let _=x,J={};if(J.employeeNumber=H(_.employeeNumber,"employeeNumber",!1,T,[...A,"employeeNumber"]),J.costCenter=H(_.costCenter,"costCenter",!1,T,[...A,"costCenter"]),J.organization=H(_.organization,"organization",!1,T,[...A,"organization"]),J.division=H(_.division,"division",!1,T,[...A,"division"]),J.department=H(_.department,"department",!1,T,[...A,"department"]),_.manager!==void 0&&_.manager!==null)if(typeof _.manager!=="object"||_.manager===null)T.push({message:"manager must be an object",path:[...A,"manager"]});else{let $=_.manager;J.manager={value:H($.value,"value",!1,T,[...A,"manager","value"]),$ref:H($.$ref,"$ref",!1,T,[...A,"manager","$ref"]),displayName:H($.displayName,"displayName",!1,T,[...A,"manager","displayName"])}}return J}function Ax(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={},$=H(A.userName,"userName",!0,_,["userName"]);if(!$)return{issues:_};J.userName=$,J.id=H(A.id,"id",!1,_,["id"]),J.externalId=H(A.externalId,"externalId",!1,_,["externalId"]),J.displayName=H(A.displayName,"displayName",!1,_,["displayName"]),J.nickName=H(A.nickName,"nickName",!1,_,["nickName"]),J.profileUrl=H(A.profileUrl,"profileUrl",!1,_,["profileUrl"]),J.title=H(A.title,"title",!1,_,["title"]),J.userType=H(A.userType,"userType",!1,_,["userType"]),J.preferredLanguage=H(A.preferredLanguage,"preferredLanguage",!1,_,["preferredLanguage"]),J.locale=H(A.locale,"locale",!1,_,["locale"]),J.timezone=H(A.timezone,"timezone",!1,_,["timezone"]),J.password=H(A.password,"password",!1,_,["password"]),J.active=L(A.active,"active",_,["active"]),J.name=t(A.name,_,["name"]),J.emails=u(A.emails,_,["emails"]),J.phoneNumbers=i(A.phoneNumbers,_,["phoneNumbers"]),J.addresses=a(A.addresses,_,["addresses"]),J.groups=e(A.groups,_,["groups"]),J.roles=s(A.roles,_,["roles"]);let N="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(A[N]!==void 0)J[N]=xx(A[N],_,[N]);if(A.schemas!==void 0)if(Array.isArray(A.schemas))J.schemas=A.schemas.filter((C)=>typeof C==="string");else _.push({message:"schemas must be an array",path:["schemas"]});if(A.meta!==void 0)if(typeof A.meta==="object"&&A.meta!==null){let C=A.meta;J.meta={resourceType:typeof C.resourceType==="string"?C.resourceType:void 0,created:typeof C.created==="string"?C.created:void 0,lastModified:typeof C.lastModified==="string"?C.lastModified:void 0,location:typeof C.location==="string"?C.location:void 0,version:typeof C.version==="string"?C.version:void 0}}else _.push({message:"meta must be an object",path:["meta"]});if(_.length>0)return{issues:_};return{value:J}}}}}function Tx(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"members must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"member must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q){let Z=H(C.type,"type",!1,T,[...N,"type"]);_.push({value:Q,$ref:H(C.$ref,"$ref",!1,T,[...N,"$ref"]),display:H(C.display,"display",!1,T,[...N,"display"]),type:Z==="User"||Z==="Group"?Z:void 0})}}return _.length>0?_:void 0}function _x(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={},$=H(A.displayName,"displayName",!0,_,["displayName"]);if(!$)return{issues:_};if(J.displayName=$,J.id=H(A.id,"id",!1,_,["id"]),J.externalId=H(A.externalId,"externalId",!1,_,["externalId"]),J.members=Tx(A.members,_,["members"]),A.schemas!==void 0)if(Array.isArray(A.schemas))J.schemas=A.schemas.filter((N)=>typeof N==="string");else _.push({message:"schemas must be an array",path:["schemas"]});if(A.meta!==void 0)if(typeof A.meta==="object"&&A.meta!==null){let N=A.meta;J.meta={resourceType:typeof N.resourceType==="string"?N.resourceType:void 0,created:typeof N.created==="string"?N.created:void 0,lastModified:typeof N.lastModified==="string"?N.lastModified:void 0,location:typeof N.location==="string"?N.location:void 0,version:typeof N.version==="string"?N.version:void 0}}else _.push({message:"meta must be an object",path:["meta"]});if(_.length>0)return{issues:_};return{value:J}}}}}function Jx(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={...A},$=["iss","sub"];for(let Q of $)if(Q in A){if(typeof A[Q]!=="string")_.push({message:`${Q} must be a string`,path:[Q]})}else _.push({message:`${Q} is required`,path:[Q]});if("aud"in A&&A.aud!==void 0){let Q=A.aud;if(typeof Q!=="string"&&!Array.isArray(Q))_.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(Q)&&!Q.every((Z)=>typeof Z==="string"))_.push({message:"aud array must contain only strings",path:["aud"]})}let N=["jti","scope"];for(let Q of N)if(Q in A&&A[Q]!==void 0){if(typeof A[Q]!=="string")_.push({message:`${Q} must be a string`,path:[Q]})}let C=["exp","iat"];for(let Q of C)if(Q in A){if(typeof A[Q]!=="number")_.push({message:`${Q} must be a number`,path:[Q]})}else _.push({message:`${Q} is required`,path:[Q]});if(_.length>0)return{issues:_};return{value:J}}}}}function Nx(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={};if("access_token"in A)if(typeof A.access_token==="string")J.access_token=A.access_token;else _.push({message:"access_token must be a string",path:["access_token"]});else _.push({message:"access_token is required",path:["access_token"]});if("token_type"in A)if(typeof A.token_type==="string")J.token_type=A.token_type;else _.push({message:"token_type must be a string",path:["token_type"]});else _.push({message:"token_type is required",path:["token_type"]});if("scope"in A)if(typeof A.scope==="string"||A.scope===void 0)J.scope=A.scope;else _.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in A)if(typeof A.refresh_token==="string"||A.refresh_token===void 0)J.refresh_token=A.refresh_token;else _.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in A)if(typeof A.expires==="string"||A.expires===void 0)J.expires=A.expires;else _.push({message:"expires must be a string",path:["expires"]});if("expires_in"in A)if(typeof A.expires_in==="number"||A.expires_in===void 0)J.expires_in=A.expires_in;else _.push({message:"expires_in must be a number",path:["expires_in"]});if(_.length>0)return{issues:_};return{value:J}}}}}export{Nx as workloadTokenResponseSchema,Qx as withValidate,Yx as waitOn,j as version,Zx as validationFailureResponse,Ax as userSchema,Cx as tokenResponseSchema,Gx as stripJsonComments,Dx as silentLogger,O as serializeESConfig,b as sendTenantWebhook,Lx as parseJsonc,$x as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,G as normalizeTenantPathNamespace,Xx as must,zx as mergeConfig,r as matchTenantPath,Bx as listSsoClientIdsFromCookies,R as list,Jx as jwtAssertionClaimsSchema,g as isConfigLocator,Hx as idTokenClaimsSchema,F as hydrateTenantForEs,_x as groupResourceSchema,Fx as findTenantFromStateParam,Mx as discoverSessions,Wx as discoverSessionRecords,Ex as defaultLogger,Rx as deepEqualPlain,wx as decodeUser,fx as claimsToUser,l as buildTenantPath,D as TenantRequestError,E as MultipleTenantsForUserError,q as InMemoryTenantStore,v as DEFAULT_TENANT_UI_NAMESPACE,n as DEFAULT_TENANT_API_NAMESPACE};
+import{G as B,a as Cx,b as Hx,c as Qx,d as Xx,e as Zx,f as zx,g as Gx,h as Yx,i as wx,j as Ex,k as Rx,l as Dx,m as Mx,n as Wx,o as Lx,p as Kx,q as qx,u as Bx,v as Fx}from"./shared/core-cf4cna3e.js";var O="0.0.19";var k=["sessionStore","userStore","groupStore","tokenStore","magicLinkStore"];function K(x){if(x===null||typeof x!=="object")return x;let T={};for(let[A,_]of Object.entries(x)){if(k.includes(A)||A==="validators"||A==="setStores")continue;T[A]=_!==null&&typeof _==="object"&&!Array.isArray(_)&&Object.getPrototypeOf(_)===Object.prototype?K(_):_}return T}function g(x){return K(x)}function E(x,T,A,_){let J=T.length,$=_??x,N=$>0?Math.floor(A/$)+1:1,C=$>0?Math.ceil(x/$):0;return{total:x,count:J,items:T,size:$,page:N,pages:C}}class M extends Error{constructor(x,T){super(x,T);this.name="TenantRequestError",Object.setPrototypeOf(this,M.prototype)}}class W extends Error{userId;conflictingIds;constructor(x,T,A){super(`Multiple tenants found for user id "${x}"`,A);this.name="MultipleTenantsForUserError",this.userId=x,this.conflictingIds=T,Object.setPrototypeOf(this,W.prototype)}}function P(x){if(typeof x!=="object"||x==null)return!1;let T=x.type;return T==="vault"||T==="aws"||T==="azure"||T==="gcp"}function F(x){if(typeof x.config==="function")return x;if(!x.configLocator)return x;return B({...x,configLocator:x.configLocator})}class U{tenants=new Map;userTenantIds=new Map;toTenantResponse;constructor(x){this.toTenantResponse=x}async get(x){return this.tenants.get(x)}async list(x){let T=Array.from(this.tenants.values()),A=Math.max(0,x?.start??0),_=x?.limit,J=x?.sort;if(J?.length)T=[...T].sort((Q,Z)=>{for(let{field:X,direction:R}of J){let G=Q[X],j=Z[X],D=c(G,j);if(D!==0)return R==="desc"?-D:D}return 0});let $=T.length,N=_!=null?A+_:void 0,C=T.slice(A,N);return E($,C,A,_)}async upsert(x){return this.tenants.set(x.id,x),x}async delete(x){let T=this.tenants.has(x);return this.tenants.delete(x),T?1:0}async registerUserTenantId(x,T){if(!x)return;let A=I(T),_=this.userTenantIds.get(x);if(_){_.add(A);return}this.userTenantIds.set(x,new Set([A]))}async findTenants(x,T){let A=new Map;for(let J of m(x))for(let $ of await this.resolveTenantsByUserId(J))A.set($.id,$);let _=Array.from(A.values()).map((J)=>this.toTenantResponse(J));return q(_,T)}async findUserTenants(x,T){let A=new Map;for(let J of p(x))for(let $ of await this.resolveTenantsByUserId(J))A.set($.id,$);let _=Array.from(A.values()).map((J)=>this.toTenantResponse(J));return q(_,T)}async resolveTenantsByUserId(x){let T=this.userTenantIds.get(x);if(!T||T.size===0)return[];let A=T.has(null),_=Array.from(T).filter((N)=>N!=null);if(_.length===0)return[];let J=await Promise.all(_.map(async(N)=>({id:N,tenant:await this.get(N)}))),$=J.filter((N)=>N.tenant!=null).map((N)=>N.id);if($.length===0){if(A)this.userTenantIds.set(x,new Set([null]));else this.userTenantIds.delete(x);return[]}if($.length!==_.length){let N=A?[null,...$]:$;this.userTenantIds.set(x,new Set(N))}return J.map((N)=>N.tenant).filter((N)=>N!=null)}}class f{store;createEs;constructor(x={}){this.createEs=x.createEs,this.store=new U(x.toTenantResponse??((T)=>h(T)))}async get(x){return this.store.get(x)}async list(x){return this.store.list(x)}async upsert(x){return this.store.upsert(x)}async delete(x){return this.store.delete(x)}async registerUserTenantId(x,T){return this.store.registerUserTenantId(x,T)}async findTenants(x,T){return this.store.findTenants(x,T)}async findUserTenants(x,T){return this.store.findUserTenants(x,T)}async getEs(x){let T=await this.get(x);if(!T)return;if(!this.createEs)throw Error(`${this.constructor.name} requires options.createEs to use getEs()`);return this.createEs(F(T))}}function c(x,T){let A=x===void 0||x===null,_=T===void 0||T===null;if(A&&_)return 0;if(A)return 1;if(_)return-1;if(x instanceof Date&&T instanceof Date)return x.getTime()-T.getTime();let J=String(x),$=String(T);return J.localeCompare($)}function I(x){if(typeof x!=="string")return null;return x.trim()||null}function h(x){return{clientId:x.id,id:x.id,companyId:x.companyId,companyName:x.companyName,environmentType:x.environmentType,status:x.status,email:x.email,webhookUrl:x.webhookUrl,callbackUrl:x.callbackUrl,tenantUrl:x.tenantUrl,error:x.error,actionUrl:x.actionUrl,expiresAt:x.expiresAt,createdAt:x.createdAt.toISOString(),updatedAt:x.updatedAt.toISOString()}}function m(x){let T=new Set;for(let A of x){z(T,A.sub);let _=A.claims;if(!_||typeof _!=="object"||Array.isArray(_))continue;z(T,_.sub),z(T,_.email),z(T,_.preferred_username)}return[...T]}function p(x){let T=new Set;for(let A of Object.values(x)){if(Array.isArray(A)){for(let _ of A)z(T,_);continue}z(T,A)}return[...T]}function z(x,T){if(typeof T!=="string")return;let A=T.trim();if(!A)return;x.add(A),x.add(A.toLowerCase())}function q(x,T){let A=Math.max(0,T?.start??0),_=T?.limit,J=x,$=T?.sort;if($?.length)J=[...x].sort((Q,Z)=>{for(let{field:X,direction:R}of $){let G=c(Q[X],Z[X]);if(G!==0)return R==="desc"?-G:G}return 0});let N=J.length,C=_!=null?A+_:void 0;return E(N,J.slice(A,C),A,_)}function b(x,T,A){return(async()=>{try{let _=await fetch(x,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(T)});if(!_.ok)A.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure",status:_.status,statusText:_.statusText})}catch(_){A.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure"},_)}})()}async function v(x,T,A){return b(x,T,A)}var n={beforeTenantSegments:["ui"]},d={beforeTenantSegments:["api"]};function V(x){return{segments:L(x?.segments)}}function L(x){return(x??[]).map((T)=>T.trim()).filter(Boolean)}function o(x){let T=x.trim();if(!T)return"/";let A=T.replace(/\\/g,"/").replace(/\/+/g,"/");return A.startsWith("/")?A:`/${A}`}function y(x){return o(x).split("/").filter(Boolean)}function Y(x){return{beforeTenantSegments:L(x?.beforeTenantSegments),afterTenantSegments:L(x?.afterTenantSegments)}}function r(x){if(!x||x.type===void 0||x.type==="path"){let A=x;return{type:"path",ui:Y(A?.ui),api:Y(A?.api)}}let T=x;return{...T,ui:V(T.ui),api:V(T.api)}}function l(x,T){let A=Y(T),_=A.beforeTenantSegments??[],J=A.afterTenantSegments??[],$=y(x),N=_.length+1+J.length;if($.length<N)return null;for(let X=0;X<_.length;X++)if($[X]!==_[X])return null;let C=_.length,Q=$[C];if(!Q)return null;for(let X=0;X<J.length;X++)if($[C+1+X]!==J[X])return null;let Z=$.slice(C+1+J.length);return{id:decodeURIComponent(Q),restSegments:Z,restPath:Z.length>0?`/${Z.join("/")}`:"/"}}function t(x,T="/",A){let _=Y(A),J=_.beforeTenantSegments??[],$=_.afterTenantSegments??[],N=y(T),C=[...J,encodeURIComponent(x),...$,...N];return C.length>0?`/${C.join("/")}`:"/"}function H(x,T,A,_,J){if(x===void 0||x===null){if(A)_.push({message:`${T} is required`,path:J});return}if(typeof x!=="string"){_.push({message:`${T} must be a string`,path:J});return}return x}function w(x,T,A,_){if(x===void 0||x===null)return;if(typeof x!=="boolean"){A.push({message:`${T} must be a boolean`,path:_});return}return x}function u(x,T,A){if(x===void 0||x===null)return;if(typeof x!=="object"||x===null){T.push({message:"name must be an object",path:A});return}let _=x,J={};return J.formatted=H(_.formatted,"formatted",!1,T,[...A,"formatted"]),J.familyName=H(_.familyName,"familyName",!1,T,[...A,"familyName"]),J.givenName=H(_.givenName,"givenName",!1,T,[...A,"givenName"]),J.middleName=H(_.middleName,"middleName",!1,T,[...A,"middleName"]),J.honorificPrefix=H(_.honorificPrefix,"honorificPrefix",!1,T,[...A,"honorificPrefix"]),J.honorificSuffix=H(_.honorificSuffix,"honorificSuffix",!1,T,[...A,"honorificSuffix"]),J}function i(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"emails must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"email must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:w(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function a(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"phoneNumbers must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"phoneNumber must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:w(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function e(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"addresses must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"address must be an object",path:N});continue}let C=$;_.push({formatted:H(C.formatted,"formatted",!1,T,[...N,"formatted"]),streetAddress:H(C.streetAddress,"streetAddress",!1,T,[...N,"streetAddress"]),locality:H(C.locality,"locality",!1,T,[...N,"locality"]),region:H(C.region,"region",!1,T,[...N,"region"]),postalCode:H(C.postalCode,"postalCode",!1,T,[...N,"postalCode"]),country:H(C.country,"country",!1,T,[...N,"country"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:w(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function s(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"groups must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"group must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,$ref:H(C.$ref,"$ref",!1,T,[...N,"$ref"]),display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"])})}return _.length>0?_:void 0}function xx(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"roles must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"role must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q)_.push({value:Q,display:H(C.display,"display",!1,T,[...N,"display"]),type:H(C.type,"type",!1,T,[...N,"type"]),primary:w(C.primary,"primary",T,[...N,"primary"])})}return _.length>0?_:void 0}function Ax(x,T,A){if(x===void 0||x===null)return;if(typeof x!=="object"||x===null){T.push({message:"Enterprise User extension must be an object",path:A});return}let _=x,J={};if(J.employeeNumber=H(_.employeeNumber,"employeeNumber",!1,T,[...A,"employeeNumber"]),J.costCenter=H(_.costCenter,"costCenter",!1,T,[...A,"costCenter"]),J.organization=H(_.organization,"organization",!1,T,[...A,"organization"]),J.division=H(_.division,"division",!1,T,[...A,"division"]),J.department=H(_.department,"department",!1,T,[...A,"department"]),_.manager!==void 0&&_.manager!==null)if(typeof _.manager!=="object"||_.manager===null)T.push({message:"manager must be an object",path:[...A,"manager"]});else{let $=_.manager;J.manager={value:H($.value,"value",!1,T,[...A,"manager","value"]),$ref:H($.$ref,"$ref",!1,T,[...A,"manager","$ref"]),displayName:H($.displayName,"displayName",!1,T,[...A,"manager","displayName"])}}return J}function Tx(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={},$=H(A.userName,"userName",!0,_,["userName"]);if(!$)return{issues:_};J.userName=$,J.id=H(A.id,"id",!1,_,["id"]),J.externalId=H(A.externalId,"externalId",!1,_,["externalId"]),J.displayName=H(A.displayName,"displayName",!1,_,["displayName"]),J.nickName=H(A.nickName,"nickName",!1,_,["nickName"]),J.profileUrl=H(A.profileUrl,"profileUrl",!1,_,["profileUrl"]),J.title=H(A.title,"title",!1,_,["title"]),J.userType=H(A.userType,"userType",!1,_,["userType"]),J.preferredLanguage=H(A.preferredLanguage,"preferredLanguage",!1,_,["preferredLanguage"]),J.locale=H(A.locale,"locale",!1,_,["locale"]),J.timezone=H(A.timezone,"timezone",!1,_,["timezone"]),J.password=H(A.password,"password",!1,_,["password"]),J.active=w(A.active,"active",_,["active"]),J.name=u(A.name,_,["name"]),J.emails=i(A.emails,_,["emails"]),J.phoneNumbers=a(A.phoneNumbers,_,["phoneNumbers"]),J.addresses=e(A.addresses,_,["addresses"]),J.groups=s(A.groups,_,["groups"]),J.roles=xx(A.roles,_,["roles"]);let N="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(A[N]!==void 0)J[N]=Ax(A[N],_,[N]);if(A.schemas!==void 0)if(Array.isArray(A.schemas))J.schemas=A.schemas.filter((C)=>typeof C==="string");else _.push({message:"schemas must be an array",path:["schemas"]});if(A.meta!==void 0)if(typeof A.meta==="object"&&A.meta!==null){let C=A.meta;J.meta={resourceType:typeof C.resourceType==="string"?C.resourceType:void 0,created:typeof C.created==="string"?C.created:void 0,lastModified:typeof C.lastModified==="string"?C.lastModified:void 0,location:typeof C.location==="string"?C.location:void 0,version:typeof C.version==="string"?C.version:void 0}}else _.push({message:"meta must be an object",path:["meta"]});if(_.length>0)return{issues:_};return{value:J}}}}}function _x(x,T,A){if(x===void 0||x===null)return;if(!Array.isArray(x)){T.push({message:"members must be an array",path:A});return}let _=[];for(let J=0;J<x.length;J++){let $=x[J],N=[...A,J];if(typeof $!=="object"||$===null){T.push({message:"member must be an object",path:N});continue}let C=$,Q=H(C.value,"value",!0,T,[...N,"value"]);if(Q){let Z=H(C.type,"type",!1,T,[...N,"type"]);_.push({value:Q,$ref:H(C.$ref,"$ref",!1,T,[...N,"$ref"]),display:H(C.display,"display",!1,T,[...N,"display"]),type:Z==="User"||Z==="Group"?Z:void 0})}}return _.length>0?_:void 0}function Jx(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={},$=H(A.displayName,"displayName",!0,_,["displayName"]);if(!$)return{issues:_};if(J.displayName=$,J.id=H(A.id,"id",!1,_,["id"]),J.externalId=H(A.externalId,"externalId",!1,_,["externalId"]),J.members=_x(A.members,_,["members"]),A.schemas!==void 0)if(Array.isArray(A.schemas))J.schemas=A.schemas.filter((N)=>typeof N==="string");else _.push({message:"schemas must be an array",path:["schemas"]});if(A.meta!==void 0)if(typeof A.meta==="object"&&A.meta!==null){let N=A.meta;J.meta={resourceType:typeof N.resourceType==="string"?N.resourceType:void 0,created:typeof N.created==="string"?N.created:void 0,lastModified:typeof N.lastModified==="string"?N.lastModified:void 0,location:typeof N.location==="string"?N.location:void 0,version:typeof N.version==="string"?N.version:void 0}}else _.push({message:"meta must be an object",path:["meta"]});if(_.length>0)return{issues:_};return{value:J}}}}}function Nx(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={...A},$=["iss","sub"];for(let Q of $)if(Q in A){if(typeof A[Q]!=="string")_.push({message:`${Q} must be a string`,path:[Q]})}else _.push({message:`${Q} is required`,path:[Q]});if("aud"in A&&A.aud!==void 0){let Q=A.aud;if(typeof Q!=="string"&&!Array.isArray(Q))_.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(Q)&&!Q.every((Z)=>typeof Z==="string"))_.push({message:"aud array must contain only strings",path:["aud"]})}let N=["jti","scope"];for(let Q of N)if(Q in A&&A[Q]!==void 0){if(typeof A[Q]!=="string")_.push({message:`${Q} must be a string`,path:[Q]})}let C=["exp","iat"];for(let Q of C)if(Q in A){if(typeof A[Q]!=="number")_.push({message:`${Q} must be a number`,path:[Q]})}else _.push({message:`${Q} is required`,path:[Q]});if(_.length>0)return{issues:_};return{value:J}}}}}function $x(x){return{"~standard":{version:1,vendor:x,validate:(T)=>{if(typeof T!=="object"||T===null)return{issues:[{message:"Expected an object"}]};let A=T,_=[],J={};if("access_token"in A)if(typeof A.access_token==="string")J.access_token=A.access_token;else _.push({message:"access_token must be a string",path:["access_token"]});else _.push({message:"access_token is required",path:["access_token"]});if("token_type"in A)if(typeof A.token_type==="string")J.token_type=A.token_type;else _.push({message:"token_type must be a string",path:["token_type"]});else _.push({message:"token_type is required",path:["token_type"]});if("scope"in A)if(typeof A.scope==="string"||A.scope===void 0)J.scope=A.scope;else _.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in A)if(typeof A.refresh_token==="string"||A.refresh_token===void 0)J.refresh_token=A.refresh_token;else _.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in A)if(typeof A.expires==="string"||A.expires===void 0)J.expires=A.expires;else _.push({message:"expires must be a string",path:["expires"]});if("expires_in"in A)if(typeof A.expires_in==="number"||A.expires_in===void 0)J.expires_in=A.expires_in;else _.push({message:"expires_in must be a number",path:["expires_in"]});if(_.length>0)return{issues:_};return{value:J}}}}}export{$x as workloadTokenResponseSchema,Xx as withValidate,Rx as waitOn,O as version,zx as validationFailureResponse,Tx as userSchema,Hx as tokenResponseSchema,Yx as stripJsonComments,Wx as silentLogger,g as serializeESConfig,v as sendTenantWebhook,wx as parseJsonc,Cx as oidcCallbackSchema,r as normalizeTenantRoutingStrategy,Y as normalizeTenantPathNamespace,Zx as must,Gx as mergeConfig,l as matchTenantPath,Bx as listSsoClientIdsFromCookies,E as list,Nx as jwtAssertionClaimsSchema,P as isConfigLocator,Qx as idTokenClaimsSchema,F as hydrateTenantForEs,Jx as groupResourceSchema,Fx as findTenantFromStateParam,Kx as discoverSessions,qx as discoverSessionRecords,Lx as defaultLogger,Ex as deepEqualPlain,Mx as decodeUser,Dx as claimsToUser,t as buildTenantPath,M as TenantRequestError,W as MultipleTenantsForUserError,f as InMemoryTenantStore,n as DEFAULT_TENANT_UI_NAMESPACE,d as DEFAULT_TENANT_API_NAMESPACE};

package/dist/server.d.ts

@@ -37,37 +37,19 @@ interface ListResult<T> {
 }
 /** Sort direction for list options. */
 type SortDirection = "asc" | "desc";
-/** Allowed sort fields for groups (top-level strings, dates; no members array). */
-type GroupSortField = "id" | "displayName" | "externalId" | "createdAt" | "updatedAt";
-/** Single sort option for group list. */
-interface GroupSortOptions {
-	field: GroupSortField;
+/** Single sort option for paginated list operations. */
+interface SortOptions<TField extends string = string> {
+	field: TField;
 	direction: SortDirection;
 }
-/** Options for GroupStore.list(). */
-interface GroupListOptions {
+/** Shared options for paginated list operations. */
+interface ListOptions<TField extends string = string> {
 	/** 0-based index of first item. Default 0. */
 	start?: number;
 	/** Max items to return. Omitted = implementation-defined (InMemory: no limit). */
 	limit?: number;
 	/** Sort order (applied in array order). */
-	sort?: GroupSortOptions[];
-}
-/** Allowed sort fields for users (top-level strings, dates; no sso nested). */
-type UserSortField = "id" | "userName" | "name" | "email" | "avatar" | "createdAt" | "updatedAt";
-/** Single sort option for user list. */
-interface UserSortOptions {
-	field: UserSortField;
-	direction: SortDirection;
-}
-/** Options for UserStore.list(). */
-interface UserListOptions {
-	/** 0-based index of first item. Default 0. */
-	start?: number;
-	/** Max items to return. Omitted = implementation-defined (InMemory: no limit). */
-	limit?: number;
-	/** Sort order (applied in array order). */
-	sort?: UserSortOptions[];
+	sort?: SortOptions<TField>[];
 }
 /**
 * SCIM 2.0 User Resource
@@ -561,7 +543,7 @@ interface GroupStore<TExtended = Record<string, never>> {
 	* @param options - Optional start (0-based), limit (page size), and sort
 	* @returns ListResult with total, count, items, size, page, pages
 	*/
-	list(options?: GroupListOptions): Promise<ListResult<StoredGroup<TExtended>>>;
+	list(options?: ListOptions): Promise<ListResult<StoredGroup<TExtended>>>;
 	/**
 	* Create or update a group in the store.
 	*
@@ -2392,7 +2374,7 @@ interface UserStore<TExtended = object> {
 	* @param options - Optional start (0-based), limit (page size), and sort
 	* @returns ListResult with total, count, items, size, page, pages
 	*/
-	list(options?: UserListOptions): Promise<ListResult<StoredUser<TExtended>>>;
+	list(options?: ListOptions): Promise<ListResult<StoredUser<TExtended>>>;
 }
 /**
 * SCIM Error response structure

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enterprisestandard/core",
-  "version": "0.0.19-beta.20260518.2",
+  "version": "0.0.19",
   "description": "Enterprise Standard Core (Server-only)",
   "private": false,
   "author": "enterprisestandard",