@enterprisestandard/core 0.0.20-beta.20260706.1 → 0.0.20

package/dist/server.js

@@ -1 +1 @@
-import{$ as oX,A as iZ,C as u6,D as d6,E as c6,F as n6,G as a6,H as i6,I as o6,J as t6,K as r6,L as s6,M as e6,N as tX,O as rX,P as X8,Q as Z8,R as $8,S as J8,T as Q8,U as Y8,V as G8,W as W8,X as F8,Y as H8,Z as B8,_ as K8,a as kZ,aa as AZ,ba as DZ,c as FX,ca as MZ,d as mX,da as V8,ea as A8,f as lZ,fa as jX,ga as D8,ha as M8,ia as L8,ja as LZ,ka as OZ,la as zZ,m as uZ,n as qZ,na as O8,o as vZ,oa as z8,p as sX,pa as N8,q as EX,qa as _8,r as fX,ra as w8,sa as dZ,ta as IZ,ua as $X,va as TZ,w as $Z,xa as WX}from"./shared/core-51h35vdb.js";var oZ="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.",xZ=["user","customer","workload"],tZ={user:async(X,Z)=>Z.sso?.getUser(X),customer:async(X,Z)=>Z.ciam?.getCustomer(X),workload:async(X,Z)=>{let $=await Z.workload?.getWorkloadIdentity?.(X);if(!$)return;let Y=$.clientId??$.workloadId??$.claims.sub;return Y?{...$,id:Y}:void 0}};function rZ(X){if(X==="any")return xZ;let Z=Array.isArray(X)?X:[X];return xZ.filter(($)=>Z.includes($))}function sZ(X){let Z=X.headers.get("cookie");if(!Z)return[];return Z.split(";").map(($)=>$.slice(0,$.indexOf("=")===-1?$.length:$.indexOf("=")).trim()).filter(Boolean)}function eZ(X,Z){let $=X.headers.get("authorization")?.toLowerCase().startsWith("bearer ")??!1,Y=sZ(X),G=new Set;for(let K of Y){if(K.startsWith("es.sso"))G.add("user");if(K.startsWith("es.ciam"))G.add("customer")}let L=Y.length>0&&!G.has("user")&&!G.has("customer");return Z.filter((K)=>{if(K==="workload")return $;if(Y.length===0)return!1;return G.has(K)||L})}function c(X){return typeof X==="string"?X:X.id}function yZ(X){let{subject:Z,subjectType:$}=X,Y;if($==="user")Y=Z.sso?.scope;else if($==="customer")Y=Z.ciam?.scope;else if($==="workload")Y=Z.scope;return new Set((Y??"").split(/\s+/).filter(Boolean))}function HZ(X,Z,$){let Y=yZ(X),G=Z.filter((K)=>Y.has(K));return{allow:$==="any"?G.length>0:Z.length>0&&G.length===Z.length,metadata:{reason:"scope",wantedScopes:Z,matchedScopes:G}}}function _X(X,Z){return($)=>{if(X.length===0)return;let Y=yZ($),G=X.filter((K)=>Y.has(K));return(Z==="any"?G.length>0:G.length===X.length)?G:void 0}}function aX(X,Z,$){return(Y)=>{if(Z.length===0||Y.subjectType!=="workload")return;let G=kZ(X.config?.authz,Y.subject);if(!G)return;let L=Z.filter((z)=>G.has(z));return($==="any"?L.length>0:L.length===Z.length)?L:void 0}}function X6(X,Z){if(X.subjectType==="workload"){let $=X.subject.scopesAsEntitlements;if(typeof $==="boolean")return $}return Z.config?.authz?.scopesAsEntitlements===!0}function FZ(X,Z,$,Y,G){return{allow:$==="ok",subject:Z?.subject,subjectType:Z?.subjectType,reason:$,decision:Y,response(){if($==="ok")return new Response(null,{status:204});if($==="unauthenticated")return X.log.warn("authz.denied",{reason:$,...G()}),Response.json({error:"Unauthorized"},{status:401});if($==="not_configured")return X.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...G()}),Response.json({error:"not_configured"},{status:503});return X.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...G()}),Response.json({error:"Forbidden"},{status:403})}}}function Z6(X,Z){return new Promise(($)=>{let Y=[],G=X.length,L=!1;for(let K of X)Z(K).then((z)=>{if(Y.push({principal:K,decision:z}),!L&&z.allow){L=!0,$({matched:{principal:K,decision:z},outcomes:Y});return}if(G-=1,G===0&&!L)L=!0,$({outcomes:Y})},()=>{if(G-=1,G===0&&!L)L=!0,$({outcomes:Y})})})}async function GX(X,Z,$,Y,G,L,K){fX(Z,oZ);let z=eZ(X,rZ($)),V=(await Promise.all(z.map(async(l)=>{let r=await tZ[l](X,Z);return r?.id?{subject:r,subjectType:l,subjectId:r.id}:void 0}))).filter((l)=>l!==void 0);if(V.length===0)return FZ(Z,void 0,"unauthenticated",void 0,G);let g=async(l)=>{if(K){let r=K(l);if(r&&r.length>0)return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:r}}}if(L&&X6(l,Z)){let r=L(l);if(r&&r.length>0)return{allow:!0,metadata:{reason:"scope",matchedScopes:r}}}return Y(l)},{matched:f,outcomes:y}=await Z6(V,g);if(f)return FZ(Z,f.principal,"ok",f.decision,G);let MX=y.length>0&&y.every((l)=>l.decision.metadata?.reason==="access_index_not_configured"),b=y[0],o=MX?"not_configured":"forbidden";return FZ(Z,b?.principal,o,b?.decision,G)}async function $6(X,Z,$,Y,G,L="any"){return GX(X,Z,L,(K)=>Z.authz.has(K.subjectId,$,Y,G,K.subjectType),()=>({targetType:$,target:c(Y),resource:G?c(G):void 0}),G?void 0:_X([c(Y)],"any"),$==="permission"&&!G?aX(Z,[c(Y)],"any"):void 0)}async function J6(X,Z,$,Y,G="any"){return GX(X,Z,G,(L)=>Z.authz.hasPermission(L.subjectId,$,Y,L.subjectType),()=>({targetType:"permission",target:c($),resource:Y?c(Y):void 0}),Y?void 0:_X([c($)],"any"),Y?void 0:aX(Z,[c($)],"any"))}async function Q6(X,Z,$,Y,G="any"){return GX(X,Z,G,(L)=>Z.authz.hasRole(L.subjectId,$,Y,L.subjectType),()=>({targetType:"role",target:c($),resource:Y?c(Y):void 0}),Y?void 0:_X([c($)],"any"))}async function Y6(X,Z,$,Y,G="any"){return GX(X,Z,G,(L)=>Z.authz.hasGroup(L.subjectId,$,Y,L.subjectType),()=>({targetType:"group",target:c($),resource:Y?c(Y):void 0}),Y?void 0:_X([c($)],"any"))}async function G6(X,Z,$,Y="any"){let G=$.filter((K)=>!K.resource).map((K)=>c(K.target)),L=$.filter((K)=>!K.resource&&K.targetType==="permission").map((K)=>c(K.target));return GX(X,Z,Y,(K)=>Z.authz.hasAny(K.subjectId,$,K.subjectType),()=>({targets:$.map((K)=>`${K.targetType}:${c(K.target)}`)}),G.length>0?_X(G,"any"):void 0,L.length>0?aX(Z,L,"any"):void 0)}async function W6(X,Z,$,Y="any"){let G=$.length>0&&$.every((z)=>!z.resource),L=$.length>0&&$.every((z)=>!z.resource&&z.targetType==="permission"),K=$.map((z)=>c(z.target));return GX(X,Z,Y,(z)=>Z.authz.hasAll(z.subjectId,$,z.subjectType),()=>({targets:$.map((z)=>`${z.targetType}:${c(z.target)}`)}),G?_X(K,"all"):void 0,L?aX(Z,K,"all"):void 0)}async function F6(X,Z,$,Y="any"){return GX(X,Z,Y,(G)=>Promise.resolve(HZ(G,[$],"any")),()=>({scope:$}))}async function H6(X,Z,$,Y="any"){return GX(X,Z,Y,(G)=>Promise.resolve(HZ(G,$,"any")),()=>({scopes:$}))}async function B6(X,Z,$,Y="any"){return GX(X,Z,Y,(G)=>Promise.resolve(HZ(G,$,"all")),()=>({scopes:$}))}function XX(X){return typeof X==="string"&&X.length>0?X:void 0}function bZ(X){let Z=XX(X.email);return{sub:String(X.sub??""),email:Z,name:XX(X.name),userName:XX(X.preferred_username)??Z,avatar:XX(X.picture)}}var fZ={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:bZ},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:bZ},microsoft:{flow:"id_token",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(X)=>{let Z=XX(X.email)??XX(X.preferred_username);return{sub:String(X.sub??X.oid??""),email:Z,name:XX(X.name),userName:XX(X.preferred_username)??Z,avatar:XX(X.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(X)=>{let Z=XX(X.email);return{sub:String(X.sub??""),email:Z,name:XX(X.name),userName:Z}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(X)=>({sub:String(X.id??X.node_id??""),email:XX(X.email),name:XX(X.name)??XX(X.login),userName:XX(X.login),avatar:XX(X.avatar_url)})}};function BZ(X){if(X==="magic-link")return;return fZ[X]}function iX(X,Z){if(Z.type==="magic-link")return;let $=BZ(Z.type);if(!$)return;return{name:X,type:Z.type,flow:$.flow,authorizationUrl:Z.authorizationUrl??$.authorizationUrl,tokenUrl:Z.tokenUrl??$.tokenUrl,jwksUri:Z.jwksUri??$.jwksUri,userInfoUrl:Z.userInfoUrl??$.userInfoUrl,scope:Z.scope??$.scope,clientId:Z.clientId,clientSecret:Z.clientSecret,extraAuthParams:$.extraAuthParams,branding:{...$.branding,...Z.branding},mapClaims:$.mapClaims,config:Z}}function KZ(X){return{...BZ(X.type)?.branding??{displayName:X.type},...X.branding}}function VZ(X){if(!X)return[];return Object.entries(X).filter(([,Z])=>Z.enabled!==!1).map(([Z,$],Y)=>({name:Z,config:$,index:Y})).sort((Z,$)=>{let Y=Z.config.order??Number.MAX_SAFE_INTEGER,G=$.config.order??Number.MAX_SAFE_INTEGER;if(Y!==G)return Y-G;return Z.index-$.index}).map(({name:Z,config:$})=>({name:Z,config:$}))}var wX="ciam",K6="id_token",V6="access_token";function A6(X,Z,$,Y,G,L){if(!$&&!Y)return;let K=L?.sessionCache?.activityUpdateMs??60000,z=new WeakMap,k={...$,...Y},V={...k,signingKey:$?.signingKey,magicLinkTtl:k.magicLinkTtl??3600,sessionTtl:k.sessionTtl??86400,cookiesSecure:k.cookiesSecure!==void 0?k.cookiesSecure:!0,cookiesSameSite:k.cookiesSameSite!==void 0?k.cookiesSameSite:"Strict",cookiesPrefix:k.cookiesPrefix??(k.ciamId?`es.ciam.${k.ciamId}`:"es.ciam"),cookiesPath:k.cookiesPath??"/"};function g(){if(!V.signingKey)throw Error("Missing CIAM configuration field: signingKey. CIAM signingKey is required for JWT token signing and must be provided via Vault (ciam.signingKey).")}function f(){if(!V.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return V.sessionStore}function y(){f()}let MX=X.callbackParams??EX(qZ("enterprisestandard.ciam")),b=X.idTokenClaims??EX(sX("enterprisestandard.ciam")),o=X.tokenResponse??EX(vZ("enterprisestandard.ciam"));function l(Q=32){let B=new Uint8Array(Q);return crypto.getRandomValues(B),Array.from(B,(W)=>W.toString(16).padStart(2,"0")).join("").substring(0,Q)}function r(Q){let B=typeof Q==="string"?new TextEncoder().encode(Q):Q,W="";return B.forEach((D)=>{W+=String.fromCharCode(D)}),btoa(W).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function LX(Q){let B=Q.replace(/-/g,"+").replace(/_/g,"/"),W=B.padEnd(B.length+(4-B.length%4)%4,"=");return atob(W)}async function OX(){g();let Q=new TextEncoder().encode(V.signingKey??"");return crypto.subtle.importKey("raw",Q,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function lX(Q){let W=r(JSON.stringify({alg:"HS256",typ:"JWT"})),D=r(JSON.stringify(Q)),O=`${W}.${D}`,J=await OX(),F=await crypto.subtle.sign("HMAC",J,new TextEncoder().encode(O)),H=r(new Uint8Array(F));return`${O}.${H}`}async function WZ(Q,B){let W=Q.split(".");if(W.length!==3)throw Error("Invalid JWT");let[D,O,J]=W,F=`${D}.${O}`,H=await OX(),M=new Uint8Array(LX(J).split("").map((P)=>P.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",H,M,new TextEncoder().encode(F)))throw Error("Invalid JWT signature");let E=LX(O),_=JSON.parse(E);if(_.iss!==wX)throw Error("CIAM token issuer mismatch");if(_.aud!==wX)throw Error("CIAM token audience mismatch");if(B?.expectedTyp&&_.typ!==B.expectedTyp)throw Error("CIAM token type mismatch");if(typeof _.exp==="number"&&_.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return _}function uX(Q,B,W){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");if(Q=`${V.cookiesPrefix}.${Q}`,typeof B!=="string")B=btoa(JSON.stringify(B));let D;if(W instanceof Date)D=`Expires=${W.toUTCString()}`;else if(typeof W==="number")D=`Max-Age=${W}`;else throw Error("Invalid expires type",W);if(B.length>4000)throw Error(`Error setting cookie: ${Q}. Cookie length is: ${B.length}`);return`${Q}=${B}; ${D}; Path=${V.cookiesPath}; HttpOnly;${V.cookiesSecure?" Secure;":""} SameSite=${V.cookiesSameSite};`}function CX(Q){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");return`${V.cookiesPrefix}.${Q}=; Max-Age=0; Path=${V.cookiesPath}; HttpOnly;${V.cookiesSecure?" Secure;":""} SameSite=${V.cookiesSameSite};`}function xX(Q,B,W=!1){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");let D=B.headers.get("cookie");if(!D)return null;let O=`${V.cookiesPrefix}.${Q}`,J=D.split(";").find((M)=>M.trim().startsWith(`${O}=`));if(!J)return null;let F=J.indexOf("="),H=J.substring(F+1).trim();if(!W)return H;try{let M=atob(H);return JSON.parse(M)}catch(M){return Z.error("[CIAM] Failed to parse cookie",{"es.operation":"cookie.parse","es.outcome":"failure",cookieName:O},M),null}}function kX(Q){return`cstate_${Q}`}async function QX(Q,B,W,D){let O=await V.afterLogin?.({...B,request:Q,context:W}),J=tX(O,"/",Q.url);if(J.response)return rX(J.response,D.map(([,F])=>F));return new Response(B.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",J.location],...D]})}function dX(Q,B){return["Set-Cookie",uX("session",Q,B)]}function yX(Q){if(!Q)return;if(Q instanceof Date)return Q;let B=new Date(Q);return Number.isNaN(B.getTime())?void 0:B}async function cX(Q){let B=xX("session",Q);if(!B)return;let W=await f().get(B);if(W&&V.tenantId&&W.tenantId&&W.tenantId!==V.tenantId)return;if(W?.authType!=="ciam")return;let D=yX(W.expiresAt);if(D&&Date.now()>D.getTime()){await f().delete(B);return}let O=yX(W.lastActivityAt)?.getTime()??0;if(K===0||Date.now()-O>=K)await f().update(B,{lastActivityAt:new Date});return W}async function VX(Q){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");y();let B=z.get(Q);if(B)return B;let W=zX(Q);return z.set(Q,W),W}async function zX(Q){try{let B=await cX(Q);if(!B?.claims?.sub)return{status:"unauthenticated"};return{status:"authenticated",value:u(B.claims)}}catch(B){return Z.error("CIAM session resolution failed",{"es.operation":"ciam.session","es.outcome":"degraded"},B),{status:"degraded",error:B instanceof Error?B:void 0}}}async function nX(Q){let B=await VX(Q);return B.status==="authenticated"?B.value:void 0}async function w(Q){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");y();let B;try{B=await nX(Q)}catch{B=void 0}let W=await V.beforeLogout?.({request:Q,user:B});try{let N=xX("session",Q);if(N)await f().delete(N)}catch(N){Z.warn("Failed to delete CIAM session",{"es.operation":"session.delete","es.outcome":"degraded"},N)}let D=[["Set-Cookie",CX("session")]],O=await V.afterLogout?.({request:Q,context:W}),J=tX(O,"/",Q.url);if(J.response)return rX(J.response,D.map(([,N])=>N));let F=J.location??"/",H=Q.headers.get("accept");if(H?.includes("application/json")||H?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:F}),{status:200,headers:[["Content-Type","application/json"],...D]});return new Response("Logged out",{status:302,headers:[["Location",F],...D]})}function T(Q){return Q.id||Q.email||`ciam-${Q.userName}`}function q(Q,B,W){return{sub:T(Q),iss:wX,aud:wX,typ:K6,exp:Math.floor(W.getTime()/1000),iat:Math.floor(Date.now()/1000),email:Q.email,name:Q.name,preferred_username:Q.userName,picture:Q.avatar,sid:B}}function m(Q,B,W){return{sub:Q,iss:wX,aud:wX,typ:V6,exp:Math.floor(W.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:B,scope:"openid profile email"}}function u(Q){let B=Q.exp?new Date(Q.exp*1000):new Date;return{id:Q.sub,userName:Q.preferred_username??"",name:Q.name??"",email:Q.email??"",avatar:Q.picture,userType:"customer",ciam:{profile:Q,scope:"openid profile email",tokenType:"Bearer",expires:B}}}async function U(Q){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");if(!G)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await G.getWorkloadIdentity(Q))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let W,D;try{if(!Q.headers.get("content-type")?.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let I=await Q.text(),j=JSON.parse(I);D=typeof j?.redirect==="string"&&j.redirect.length>0?j.redirect:void 0;let d={userName:j.userName,name:j.name,email:j.email,avatar:j.avatar},a=await X.customer.validate(d);if(a.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}});W=a.value}catch(P){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let J=new URL(Q.url).searchParams.get("ttl"),F=J?parseInt(J,10):V.magicLinkTtl??3600;if(Number.isNaN(F)||F<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let H=l(32),M=new Date(Date.now()+F*1000);if(!V.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await V.magicLinkStore.create(H,W,M)}catch(P){return Z.error("Error creating magic link",{"es.operation":"magic_link.create","es.outcome":"failure"},P),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let N=new URL(Q.url),E=V.magicLinkLoginUrl||"/magic-link/login",_=new URL(E,N.origin);if(_.searchParams.set("token",H),D)_.searchParams.set("redirect",D);return new Response(JSON.stringify({magicLink:_.toString(),expiresAt:M.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function ZX(Q){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");y();let W=new URL(Q.url).searchParams.get("token");if(!W)return QX(Q,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!V.magicLinkStore)return QX(Q,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let D=await V.magicLinkStore.getAndDelete(W);if(!D)return QX(Q,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let O=new Date(Date.now()+(V.sessionTtl??86400)*1000),J=l(32),F=T(D.customer),H=q(D.customer,J,O),M=m(F,J,O),N=u(H),E=await lX(M),_=await lX(H),P;try{let j={sid:J,sub:F,authType:"ciam",tenantId:V.tenantId,expiresAt:O,claims:H,accessClaims:M,tokens:{access_token:E,id_token:_,token_type:"Bearer",expires:O.toISOString()},createdAt:new Date,lastActivityAt:new Date};await f().create(j),P=j}catch(j){throw Z.warn("Failed to create session",{"es.operation":"session.create","es.outcome":"degraded"},j),j}if(V.customerStore)try{let j=N.id;if(j){let d=new Date,a=await V.customerStore.get(j);if(a||V.enableJitUserProvisioning){let i={...a??{},...N,id:j,tenantId:a?.tenantId,createdAt:a?.createdAt??d,updatedAt:d,userType:a?.userType??"customer"};await V.customerStore.upsert(i)}}}catch(j){Z.warn("Failed to store customer",{"es.operation":"customer.store","es.outcome":"degraded"},j)}let I=[dX(J,O)];return QX(Q,{ok:!0,user:N,session:P},void 0,I)}function s(Q,B=200,W=[]){return new Response(JSON.stringify(Q),{status:B,headers:[["Content-Type","application/json"],...W]})}function R(Q,B){try{return new URL(Q).toString()}catch{let W=new URL(B).origin,D=V.cookiesSecure?W.replace(/^http:\/\//,"https://"):W;return new URL(Q,D).toString()}}function S(){let Q=V.customerLoginUrl||"/auth/customer/login",B=Q.includes("?")?"&":"?";return VZ(V.providers).map(({name:W,config:D})=>{let O=KZ(D);return{name:W,type:D.type,displayName:O.displayName,loginUrl:`${Q}${B}provider=${encodeURIComponent(W)}`,iconUrl:O.iconUrl,colors:O.colors,url:O.url}})}async function v(Q){if(!Q)return{};let{authorizationUrl:B,tokenUrl:W,jwksUri:D,userInfoUrl:O}=Q,J=Q.config.authority;if(J&&(!B||!W||Q.flow==="id_token"&&!D))try{let H=await LZ(J);B=B??H.authorizationUrl,W=W??H.tokenUrl,D=D??H.jwksUri,O=O??H.userInfoUrl}catch(H){Z.error("CIAM provider OIDC discovery failed",{"es.operation":"ciam.oidc.discovery","es.outcome":"failure"},H)}return{authorizationUrl:B,tokenUrl:W,jwksUri:D,userInfoUrl:O}}async function p(Q){if(Q.type==="apple"){let{teamId:B,keyId:W,privateKey:D,clientId:O}=Q.config;if(B&&W&&D&&O)return zZ({teamId:B,keyId:W,privateKey:D,clientId:O})}return Q.clientSecret}async function x(Q){f();let W=new URL(Q.url).searchParams.get("provider");if(!W)return s({error:"Missing required query parameter: provider"},400);let D=V.providers?.[W];if(!D||D.enabled===!1||D.type==="magic-link")return s({error:`Unknown or disabled CIAM provider: ${W}`},404);let O=iX(W,D);if(!O?.clientId)return s({error:`CIAM provider ${W} is not fully configured`},500);let J=await v(O);if(!J.authorizationUrl)return s({error:`CIAM provider ${W} is missing an authorization endpoint`},500);let F=V.customerCallbackUrl||"/auth/customer/callback",H=R(F,Q.url),M=oX(),N=oX(64),E=O.flow==="id_token",_=E?await AZ(N):void 0,P=await V.beforeLogin?.({request:Q}),I=DZ({authorizationUrl:J.authorizationUrl,clientId:O.clientId,redirectUri:H,scope:O.scope,state:M,codeChallenge:_,extraParams:O.extraAuthParams}),j={provider:W,state:M,codeVerifier:E?N:void 0,redirectUri:H,...P===void 0?{}:{context:P}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",I],["Set-Cookie",uX(kX(M),j,V.loginStateTtl??600)]]})}async function h(Q){if(Q.method==="POST"){if((Q.headers.get("content-type")??"").includes("application/x-www-form-urlencoded")){let W=await Q.text();return Object.fromEntries(new URLSearchParams(W).entries())}}return Object.fromEntries(new URL(Q.url).searchParams.entries())}async function e(Q,B){let W=Q.mapClaims(B);if(!W.sub)return{ok:!1};let D=`${Q.name}:${W.sub}`,O={id:D,userName:W.userName||W.email||D,name:W.name||"",email:W.email||"",avatar:W.avatar,userType:"customer"},J=D;if(V.customerStore){let _=await V.customerStore.lookup(O)??await V.customerStore.get(D);if(J=_?.id??D,!_&&!V.enableJitUserProvisioning)return Z.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"es.operation":"customer.store","es.outcome":"skipped"}),{ok:!1};let P=new Date,I={..._??{},...O,id:J,tenantId:_?.tenantId,createdAt:_?.createdAt??P,updatedAt:P,userType:_?.userType??"customer"};await V.customerStore.upsert(I)}let F=new Date(Date.now()+(V.sessionTtl??86400)*1000),H=oX(32),M={sub:J,iss:Q.name,aud:Q.clientId,exp:Math.floor(F.getTime()/1000),iat:Math.floor(Date.now()/1000),email:W.email,name:W.name,preferred_username:W.userName??W.email,picture:W.avatar,sid:H},N={sid:H,sub:J,authType:"ciam",tenantId:V.tenantId,expiresAt:F,claims:M,accessClaims:{sub:J,sid:H,scope:Q.scope},createdAt:new Date,lastActivityAt:new Date},E=f();try{await E.create(N)}catch(_){if(!await E.get(H))throw _;await E.update(H,N)}return{ok:!0,claims:M,sid:H,expires:F}}async function n(Q){f();let B,W,D=(O)=>{let J=B?[["Set-Cookie",CX(B)]]:[];return QX(Q,{ok:!1,error:O},W,J)};try{let O=await h(Q),J=await MX.validate(O);if(J.issues||!J.value)return D(Error("Invalid CIAM callback parameters"));let{code:F,state:H}=J.value;if(!H)return D(Error("Missing CIAM callback state"));B=kX(H);let M=xX(B,Q,!0);if(W=M?.context,!M?.provider||!M.state||M.state!==H)return Z.warn("CIAM callback state verification failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),D(Error("CIAM callback state verification failed"));let N=V.providers?.[M.provider];if(!N)return D(Error("Unknown CIAM provider"));let E=iX(M.provider,N);if(!E?.clientId)return D(Error("CIAM provider not configured"));let _=await v(E);if(!_.tokenUrl)return D(Error("CIAM provider missing token endpoint"));let P=await p(E),I=await MZ({tokenUrl:_.tokenUrl,clientId:E.clientId,clientSecret:P,redirectUri:M.redirectUri||R(V.customerCallbackUrl||"/auth/customer/callback",Q.url),code:F,codeVerifier:E.flow==="id_token"?M.codeVerifier:void 0,log:Z}),j;if(E.flow==="id_token"){let YX=E.config.authority;if(!I.id_token||!_.jwksUri||!YX)return D(Error("CIAM id_token flow misconfigured"));if((await o.validate(I)).issues)return Z.warn("CIAM token response validation failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),D(Error("CIAM token response validation failed"));j=await jX({idToken:I.id_token,jwksUri:_.jwksUri,issuer:YX,audience:E.clientId,log:Z});let NX=await b.validate(j);if(!NX.issues)j=NX.value}else{if(!_.userInfoUrl)return D(Error("CIAM provider missing userinfo endpoint"));j=await OZ(_.userInfoUrl,I.access_token);let YX=E.config.authority;if(I.id_token&&_.jwksUri&&YX){let bX=await jX({idToken:I.id_token,jwksUri:_.jwksUri,issuer:YX,audience:E.clientId,log:Z}),NX=typeof bX.sub==="string"?bX.sub:"";if(NX){if(typeof j.sub==="string"&&j.sub.length>0&&j.sub!==NX)return Z.warn("CIAM UserInfo sub does not match verified id_token sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),D(Error("CIAM UserInfo sub mismatch"));j.sub=NX}}if(typeof j.sub!=="string"||j.sub.length===0)return Z.warn("CIAM UserInfo response missing sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),D(Error("CIAM UserInfo response missing sub"))}let d=await e(E,j);if(!d.ok)return D(Error("Failed to persist CIAM customer"));let a=u(d.claims);Z.info("CIAM third-party sign-in succeeded",{"es.operation":"ciam.oidc.callback","es.outcome":"success",provider:E.name});let i=[["Set-Cookie",CX(B)],dX(d.sid,d.expires)];return QX(Q,{ok:!0,user:a,session:void 0},W,i)}catch(O){return Z.error("Error during CIAM third-party sign-in callback",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"},O),D(O)}}async function t(Q){if(!V)throw Error("Enterprise Standard CIAM Manager not initialized");y();let B=V.magicLinkUrl||"/magic-link",W=V.magicLinkLoginUrl||"/magic-link/login",D=V.logoutUrl||"/auth/customer/logout",O=V.customerLoginUrl||"/auth/customer/login",J=V.customerCallbackUrl||"/auth/customer/callback",F=V.customerProvidersUrl||"/auth/customer/providers",H=new URL(Q.url).pathname,M=(d)=>{if(!d)return;try{return new URL(d).pathname}catch{return d.startsWith("/")?d:`/${d}`}};if(M(B)===H&&Q.method==="POST")return U(Q);if(M(W)===H&&Q.method==="GET")return ZX(Q);if(M(D)===H&&Q.method==="GET")return w(Q);if(M(F)===H&&Q.method==="GET")return s({providers:S()});if(M(O)===H&&Q.method==="GET")return x(Q);if(M(J)===H&&(Q.method==="GET"||Q.method==="POST"))return n(Q);return new Response("Not Found",{status:404})}return{...V,getCustomer:nX,resolveCustomer:VX,logout:w,handler:t,listCustomerProviders:S}}async function D6(X,Z){return fX(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),Z.ciam?.getCustomer(X)}async function M6(X,Z){return fX(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),await Z.ciam?.resolveCustomer(X)??{status:"unauthenticated"}}var UX="application/scim+json",L6="urn:ietf:params:scim:api:messages:2.0:ListResponse",RZ="urn:ietf:params:scim:api:messages:2.0:Error",JZ="urn:ietf:params:scim:schemas:core:2.0:User",DX="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",QZ="urn:ietf:params:scim:schemas:core:2.0:Group",O6="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",hZ="urn:ietf:params:scim:schemas:core:2.0:ResourceType",qX="urn:ietf:params:scim:schemas:core:2.0:Schema",z6="00000000000000000000000000000000";function N6(X){let Z={timestamp:new Date().toISOString()};if(X)Z.actor=X;try{let G=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),L=G?.traceId;if(L&&L!==z6){if(Z.traceId=L,G?.spanId)Z.spanId=G.spanId}}catch{}return Z}class gX extends Error{constructor(X){super(X);this.name="SubjectTypeNotAssignableError",Object.setPrototypeOf(this,gX.prototype)}}async function _6(X,Z){let $=Z.subjectType??"user";if(!TZ.includes($))throw new gX(`Cannot grant ${Z.targetType} "${FX(Z.target)}" to a "${$}" principal: only [${TZ.join(", ")}] principals are assignable on this platform.`);if(!X)return;let Y=FX(Z.target),K=(await(Z.targetType==="group"?X.groups:Z.targetType==="role"?X.roles:X.permissions).get(Y))?.assignableSubjectTypes;if(K&&K.length>0&&!K.includes($))throw new gX(`Cannot grant ${Z.targetType} "${Y}" to a "${$}" principal: this entitlement restricts assignment to [${K.join(", ")}].`)}async function w6(X,Z){await _6(X.catalogStore,Z);let $={...Z,status:Z.status??"active",provenance:Z.provenance??N6()};if($.id=mX($),await X.accessStore?.grant($),X.accessIndex&&X.catalogStore){let Y=await lZ($,X.catalogStore);await X.accessIndex.materialize($.id,Y)}if(X.authz.oaa.isReady())await X.authz.oaa.grant($);return X.iamDelta?.onGrant($),$}async function YZ(X,Z){let $=Z.id??mX(Z);if(await X.accessStore?.revoke(Z),await X.accessIndex?.removeByRoot($),X.authz.oaa.isReady())await X.authz.oaa.revoke(Z);X.iamDelta?.onRevoke({...Z,id:$})}class GZ extends Error{constructor(X){super(X);this.name="DerivedRevokeError",Object.setPrototypeOf(this,GZ.prototype)}}class TX extends Error{summary;clientError;constructor(X,Z,$=!1){super(X);this.name="ScimMutationError",this.summary=Z,this.clientError=$,Object.setPrototypeOf(this,TX.prototype)}}function C(X,Z,$){return new Response(JSON.stringify({schemas:[RZ],status:String(X),scimType:$,detail:Z}),{status:X,headers:{"Content-Type":UX}})}function SX(X,Z){let $=Z?.totalResults??X.length,Y=Z?.startIndex??1,G=Z?.itemsPerPage??X.length;return new Response(JSON.stringify({schemas:[L6],totalResults:$,startIndex:Y,itemsPerPage:G,Resources:X}),{status:200,headers:{"Content-Type":UX}})}function JX(X,Z=200){return new Response(JSON.stringify(X),{status:Z,headers:{"Content-Type":UX}})}function UZ(X){return C(X.clientError?409:500,`${X.message}; authz mutation summary: ${JSON.stringify(X.summary)}`,X.clientError?"mutability":"invalidValue")}function hX(X){return mX(X)}function NZ(X,Z){return ZZ(gZ(X),gZ(Z))}function gZ(X){let Z=new Map;if(!X?.id)return Z;for(let $ of X.groups??[]){let Y={subject:X.id,targetType:"group",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type}:void 0};Z.set(hX(Y),Y)}for(let $ of X.roles??[]){let Y={subject:X.id,targetType:"role",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(hX(Y),Y)}for(let $ of X.entitlements??[]){let Y={subject:X.id,targetType:"permission",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(hX(Y),Y)}return Z}function eX(X,Z,$,Y){let G=new Map,L=Y&&Y.length>0?Y:void 0;for(let K of X??[]){let z={subject:K.value,targetType:Z,target:$,resources:L,metadata:K.display||K.type?{display:K.display,type:K.type}:void 0};G.set(hX(z),z)}return G}function _Z(X){let Z=X[$X]?.resources;return Z&&Z.length>0?Z:void 0}function E6(X){let Z=new Map;for(let $ of X)Z.set(hX($),$);return Z}async function BX(X,Z,$,Y,G,L){let K=[],z=new Set,k=L?L.get(`${$}:${Y}`)??[]:Z?(await Z.listByTarget($,Y)).items:[];for(let V of k){let g=FX(V.subject);if(z.has(g))continue;z.add(g);let f=V.metadata,y=V.subjectType==="workload"?"Workload":f?.type??"User";K.push({value:g,...f?.display?{display:f.display}:{},type:y})}for(let V of G??[]){if(V.targetType!==$||FX(V.target)!==Y)continue;let g=FX(V.subject);if(z.has(g))continue;z.add(g),K.push({value:g,type:"Workload"})}if($==="group"){let V=await X.groups.get(Y);for(let g of V?.groups??[]){let f=FX(g);if(!f||z.has(f))continue;z.add(f),K.push({value:f,type:"Group"})}}return K.length>0?K:void 0}function ZZ(X,Z){let $=[];for(let[Y,G]of Z)if(!X.has(Y))$.push({action:"grant",change:G});for(let[Y,G]of X)if(!Z.has(Y))$.push({action:"revoke",change:G});return $}async function wZ(X,Z){if(X.oaa.isReady())await X.oaa.pushUser(Z)}async function PX(X,Z,$,Y){let G={metadataApplied:!1,access:[]},L=(K,z)=>{throw jZ(X,G),new TX(K,G,z)};try{await Z(),G.metadataApplied=!0,await Y?.()}catch(K){for(let z of $)G.access.push({change:z.change,status:"rolled_back"});throw G.metadataApplied=!1,jZ(X,G),new TX(`SCIM metadata write failed: ${EZ(K)}`,G,!1)}for(let K=0;K<$.length;K++){let z=$[K];try{if(z.action==="grant")await w6(X,z.change);else await j6(X,z.change);G.access.push({change:z.change,status:"applied"})}catch(k){G.access.push({change:z.change,status:"failed",error:k});for(let g=K+1;g<$.length;g++)G.access.push({change:$[g].change,status:"rolled_back"});let V=k instanceof GZ||k instanceof gX;return L(V?EZ(k):`SCIM access mutation failed: ${EZ(k)}`,V)}}return jZ(X,G),G}function EZ(X){return X instanceof Error?X.message:String(X)}function jZ(X,Z){if(!X.onAccessMutation)return;try{X.onAccessMutation(Z)}catch{}}async function j6(X,Z){if(X.accessStore){let $=Z.id??mX(Z);if(!await X.accessStore.get($)){if((X.accessIndex?await X.accessIndex.has(Z.subject,Z.targetType,Z.target,Z.resources?.[0],Z.subjectType):{allow:!1}).allow)throw new GZ(`Cannot revoke ${Z.targetType} "${FX(Z.target)}" for "${FX(Z.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await YZ(X,Z);return}}await YZ(X,Z)}function vX(X){let Z=X[$X]?.type??"group";if(Z==="group"||Z==="role"||Z==="permission")return Z;throw Error(`Unsupported Enterprise Standard SCIM Group authz type "${String(Z)}"`)}async function SZ(X,Z,$){if(!X.oaa.isReady())return;if($==="role"){await X.oaa.pushRole(Z);return}if($==="permission"){await X.oaa.pushPermission(Z);return}await X.oaa.pushGroup(Z)}function S6(X){let Z=X.resources;if(!Z||Z.length===0)return;let $=Z.map((Y)=>typeof Y==="string"?Y:Y.id).filter(Boolean);return $.length>0?$:void 0}function KX(X,Z,$){return{schemas:[QZ],id:X.id,externalId:X.externalId,displayName:X.displayName??X.name,members:$,[$X]:{type:Z,requestable:X.requestable,description:X.description,resources:Z==="group"?S6(X):void 0,assignableSubjectTypes:X.assignableSubjectTypes,recommendedSubjectTypes:X.recommendedSubjectTypes}}}function P6(X,Z){let $=X[$X],Y={id:Z,name:X.displayName,displayName:X.displayName,description:$?.description??X.displayName,externalId:X.externalId,requestable:$?.requestable};if($?.resources!==void 0)Y.resources=$.resources;return Y}function I6(X){if(!X)return;let Z=X.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!Z)return;return{requestable:Z[1]?.toLowerCase()==="true"}}function mZ(X){if(!X)return;let Z=X.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return Z?Z[1]:void 0}async function T6(X,Z,$,Y){let G=[{store:X.groups,type:"group"},{store:X.roles,type:"role"},{store:X.permissions,type:"permission"}],L;if(G.every(({store:z})=>typeof z.getByExternalId==="function"))L=(await Promise.all(G.map(async({store:k,type:V})=>{let g=await k.getByExternalId?.($);return g?{entity:g,type:V}:void 0}))).filter((k)=>k!==void 0);else{let z={start:0},[k,V,g]=await Promise.all([X.groups.list(z),X.roles.list(z),X.permissions.list(z)]);L=[...k.items.map((y)=>({entity:y,type:"group"})),...V.items.map((y)=>({entity:y,type:"role"})),...g.items.map((y)=>({entity:y,type:"permission"}))].filter(({entity:y})=>y.externalId===$)}if(L.length>1)throw new dZ(`Ambiguous externalId "${$}": ${L.length} entitlements share it (${L.map((z)=>`${z.type}:${z.entity.id}`).join(", ")})`,"unique_violation","externalId");let K=L[0];if(!K)return;return KX(K.entity,K.type,await BX(X,Z,K.type,K.entity.id,Y))}async function R6(X,Z,$,Y){let G=Math.max(0,$.start),L=$.limit!=null?G+$.limit:void 0,K={start:0,limit:L,filter:$.filter},[z,k,V]=await Promise.all([X.groups.list(K),X.roles.list(K),X.permissions.list(K)]),g=[...z.items.map((o)=>({entity:o,type:"group"})),...k.items.map((o)=>({entity:o,type:"role"})),...V.items.map((o)=>({entity:o,type:"permission"}))],f=z.total+k.total+V.total,y=g.slice(G,L),MX=Z?.listByTargets?await Z.listByTargets(y.map(({entity:o,type:l})=>({targetType:l,target:o.id}))):void 0,b=await Promise.all(y.map(async({entity:o,type:l})=>KX(o,l,await BX(X,Z,l,o.id,Y,MX))));return{resources:b,total:f,count:b.length}}async function XZ(X,Z,$,Y){let[G,L,K]=await Promise.all([X.groups.get($),X.roles.get($),X.permissions.get($)]);if(G)return KX(G,"group",await BX(X,Z,"group",$,Y));if(L)return KX(L,"role",await BX(X,Z,"role",$,Y));if(K)return KX(K,"permission",await BX(X,Z,"permission",$,Y));return}async function PZ(X,Z,$){let Y=vX(Z),L={...(Y==="role"?await X.roles.get($):Y==="permission"?await X.permissions.get($):await X.groups.get($))??{},...P6(Z,$)},K=Y==="role"?X.roles.set(L):Y==="permission"?X.permissions.set(L):X.groups.set(L);return await K.ready(),K}async function C6(X,Z){await Promise.all([X.groups.delete(Z),X.roles.delete(Z),X.permissions.delete(Z)])}function pZ(){return crypto.randomUUID()}function IX(X,Z){let $=X;if(typeof $.validate==="function")return $.validate(Z);return Promise.resolve(X["~standard"].validate(Z))}function x6(X){if(!X)return;try{return new URL(X).pathname}catch{return X.startsWith("/")?X:`/${X}`}}function AX(X){let Z=x6(X);return Z?$Z(Z):void 0}function k6(X,Z){let $=AX(X);if($?.endsWith("/Users"))return $.slice(0,-6);let Y=AX(Z);if(Y?.endsWith("/Groups"))return Y.slice(0,-7);return}function HX(X,Z){return new URL(Z,X.url).toString()}function A(X,Z,$,Y){let{multiValued:G=!1,...L}=Y??{};return{name:X,type:Z,description:$,multiValued:G,...L}}function y6(X,Z){return{schemas:[O6],documentationUri:Z?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an Enterprise Standard workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:HX(X.request,`${X.basePath}/ServiceProviderConfig`)}}}function b6(X){let Z=[];if(X.supportsUsers)Z.push({schemas:[hZ],id:"User",name:"User",description:"User Account",endpoint:X.usersUrl,schema:JZ,schemaExtensions:[{schema:DX,required:!1},{schema:WX,required:!1}],meta:{resourceType:"ResourceType",location:HX(X.request,`${X.basePath}/ResourceTypes/User`)}});if(X.supportsGroups)Z.push({schemas:[hZ],id:"Group",name:"Group",description:"Group",endpoint:X.groupsUrl,schema:QZ,schemaExtensions:[{schema:$X,required:!1}],meta:{resourceType:"ResourceType",location:HX(X.request,`${X.basePath}/ResourceTypes/Group`)}});return Z}function f6(X){let Z=[];if(X.supportsUsers)Z.push({schemas:[qX],id:JZ,name:"User",description:"User Account",meta:{resourceType:"Schema",location:HX(X.request,`${X.basePath}/Schemas/${encodeURIComponent(JZ)}`)},attributes:[A("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),A("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),A("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),A("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[A("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),A("familyName","string","The family name of the User.",{multiValued:!1}),A("givenName","string","The given name of the User.",{multiValued:!1}),A("middleName","string","The middle name(s) of the User.",{multiValued:!1}),A("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),A("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),A("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),A("nickName","string","The casual way to address the user.",{multiValued:!1}),A("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),A("title","string","The user title, such as Vice President.",{multiValued:!1}),A("userType","string","The relationship between the organization and the User.",{multiValued:!1}),A("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),A("locale","string","Default location for localizing values.",{multiValued:!1}),A("timezone","string","The User time zone.",{multiValued:!1}),A("active","boolean","The User administrative status.",{multiValued:!1}),A("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[A("value","string","Email address value.",{multiValued:!1,required:!0}),A("display","string","Display label for the email.",{multiValued:!1}),A("type","string","Email type such as work or home.",{multiValued:!1}),A("primary","boolean","Primary email indicator.",{multiValued:!1})]}),A("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[A("value","string","Phone number value.",{multiValued:!1,required:!0}),A("display","string","Display label for the phone number.",{multiValued:!1}),A("type","string","Phone number type.",{multiValued:!1}),A("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),A("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[A("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),A("display","string","Display label for the photo.",{multiValued:!1}),A("type","string","Photo type.",{multiValued:!1}),A("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),A("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[A("formatted","string","Formatted mailing address.",{multiValued:!1}),A("streetAddress","string","Full street address component.",{multiValued:!1}),A("locality","string","City or locality.",{multiValued:!1}),A("region","string","State or region.",{multiValued:!1}),A("postalCode","string","Postal code.",{multiValued:!1}),A("country","string","Country.",{multiValued:!1}),A("type","string","Address type.",{multiValued:!1}),A("primary","boolean","Primary address indicator.",{multiValued:!1})]}),A("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[A("value","string","Group identifier.",{multiValued:!1,required:!0}),A("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),A("display","string","Display name of the group.",{multiValued:!1}),A("type","string","Relationship type.",{multiValued:!1})]}),A("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[A("value","string","Entitlement value.",{multiValued:!1,required:!0}),A("display","string","Display value.",{multiValued:!1}),A("type","string","Entitlement type.",{multiValued:!1}),A("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),A("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[A("value","string","Role value.",{multiValued:!1,required:!0}),A("display","string","Display value.",{multiValued:!1}),A("type","string","Role type.",{multiValued:!1}),A("primary","boolean","Primary role indicator.",{multiValued:!1})]}),A("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[A("value","string","Certificate value.",{multiValued:!1,required:!0}),A("display","string","Display value.",{multiValued:!1}),A("type","string","Certificate type.",{multiValued:!1}),A("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),Z.push({schemas:[qX],id:DX,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:HX(X.request,`${X.basePath}/Schemas/${encodeURIComponent(DX)}`)},attributes:[A("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),A("costCenter","string","Name of a cost center.",{multiValued:!1}),A("organization","string","Name of an organization.",{multiValued:!1}),A("division","string","Name of a division.",{multiValued:!1}),A("department","string","Name of a department.",{multiValued:!1}),A("manager","complex","The User manager.",{multiValued:!1,subAttributes:[A("value","string","Identifier of the manager User resource.",{multiValued:!1}),A("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),A("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),Z.push({schemas:[qX],id:WX,name:"EnterpriseStandardUser",description:"Enterprise Standard User extension carrying the Enterprise Controlled ID (ECID) identity correlator and the account purpose (accountClass). See https://enterprisestandard.com/llms-ecid.txt.",meta:{resourceType:"Schema",location:HX(X.request,`${X.basePath}/Schemas/${encodeURIComponent(WX)}`)},attributes:[A("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),A("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1})]}),Z.push({schemas:[qX],id:$X,name:"EnterpriseStandardAuthzGroup",description:"Enterprise Standard authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:HX(X.request,`${X.basePath}/Schemas/${encodeURIComponent($X)}`)},attributes:[A("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),A("requestable","boolean","Whether this catalog entry should be requestable access in IAM tooling.",{multiValued:!1,required:!1}),A("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),A("assignableSubjectTypes","string","AppDev-owned hard ceiling of principal kinds (user, workload) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]}),A("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]})]});if(X.supportsGroups)Z.push({schemas:[qX],id:QZ,name:"Group",description:"Group",meta:{resourceType:"Schema",location:HX(X.request,`${X.basePath}/Schemas/${encodeURIComponent(QZ)}`)},attributes:[A("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),A("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),A("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),A("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[A("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),A("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group"]}),A("display","string","Display name of the member.",{multiValued:!1}),A("type","string","Member type.",{multiValued:!1})]})]});return Z}function q6(X,Z,$,Y,G,L,K,z,k,V,g,f){let y={authz:Y,accessStore:G,accessIndex:L,catalogStore:K,iamDelta:V,onAccessMutation:g};if(!z&&!k)return;let b={...z,...k},o=b.users?.enabled!==!1,l=b.groups?.enabled!==!1;if(Boolean(b.url||b.userStore||K)&&!$)Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"});function LX(){if(!$)throw Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return $}async function OX(w){let T=LX(),q=w.headers.get("Authorization");if(!q?.startsWith("Bearer "))return!1;try{let m=q.substring(7);return(await T.validateToken(m)).valid}catch{return!1}}async function lX(){let w=LX(),T=typeof w.getServerToken==="function"?await w.getServerToken():await w.getToken();return new Headers({"Content-Type":UX,Accept:UX,Authorization:`Bearer ${T}`})}async function WZ(w,T,q,m){if(!b.url)throw Error("IAM URL not configured for outgoing requests");let u=`${b.url}${T}`;try{let U=await lX(),ZX=await fetch(u,{method:w,headers:U,body:q?JSON.stringify(q):void 0}),s=await ZX.json();if(!ZX.ok)return{success:!1,error:s,status:ZX.status};let R=await m["~standard"].validate(s);if(R.issues)return Z.error("SCIM response validation failed",{"es.operation":"scim.response.validate","es.outcome":"failure",validationIssues:R.issues}),{success:!1,error:{schemas:[RZ],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${R.issues.map((S)=>S.message).join("; ")}`},status:400};return{success:!0,data:R.value,status:ZX.status}}catch(U){return{success:!1,error:{schemas:[RZ],status:"500",detail:U instanceof Error?U.message:"Unknown error occurred"},status:500}}}function uX(){return b.url}function CX(w,T){let q=AX(T?.usersUrl??b.usersUrl??"/api/iam/Users")??"/api/iam/Users",m=AX(T?.groupsUrl??b.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",u=AX(T?.discovery?.basePath??b.discovery?.basePath)??k6(q,m);if(!u)return;return{request:w,basePath:u,usersUrl:q,groupsUrl:m,supportsUsers:o&&Boolean(b.userStore),supportsGroups:l&&Boolean(K)}}async function xX(w){let T=y6(w,b.discovery);return await b.discovery?.buildServiceProviderConfig?.(w,T)??T}async function kX(w){let T=b6(w);return await b.discovery?.buildResourceTypes?.(w,T)??T}async function QX(w){let T=f6(w);return await b.discovery?.buildSchemas?.(w,T)??T}async function dX(w,T){let q=CX(w,T);if(!q)return;let m=$Z(new URL(w.url).pathname),{basePath:u}=q;if(m!==u&&!m.startsWith(`${u}/`))return;let U=$Z(m.slice(u.length)||"/");if(!(U==="/ServiceProviderConfig"||U==="/ResourceTypes"||U.startsWith("/ResourceTypes/")||U==="/Schemas"||U.startsWith("/Schemas/")))return;if(w.method!=="GET")return C(405,"Method not allowed");if(!await OX(w))return C(401,"Authorization required");if(U==="/ServiceProviderConfig")return JX(await xX(q));if(U==="/ResourceTypes")return SX(await kX(q));if(U.startsWith("/ResourceTypes/")){let R=decodeURIComponent(U.slice(15)),S=(await kX(q)).find((v)=>v.id===R||v.name===R);return S?JX(S):C(404,"Resource not found")}if(U==="/Schemas")return SX(await QX(q));if(U.startsWith("/Schemas/")){let R=decodeURIComponent(U.slice(9)),S=(await QX(q)).find((v)=>v.id===R);return S?JX(S):C(404,"Resource not found")}return}let yX,cX;if(b.url)cX=async(T,q)=>{let m={...T,schemas:T.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return WZ("POST","/Users",m,X.user)},yX={createGroup:async(T,q)=>{let m={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:T,externalId:q?.externalId,members:q?.members};return WZ("POST","/Groups",m,X.group)}};let VX;if(K){let w=K,T=async(R,S)=>{if(!await OX(R))return C(401,"Authorization required");let p=new URL(R.url),x=S?.basePath??"/Groups",h=p.pathname;if(h.startsWith(x))h=h.substring(x.length);let n=h.match(/^\/([^/]+)$/)?.[1],t=R.method;try{if(n)switch(t){case"GET":return await m(n);case"PUT":return await U(R,n);case"PATCH":return await ZX(R,n);case"DELETE":return await s(n);default:return C(405,"Method not allowed")}else if(h===""||h==="/")switch(t){case"GET":return await q(R);case"POST":return await u(R);default:return C(405,"Method not allowed")}return C(404,"Resource not found")}catch(Q){if(Q instanceof TX)return UZ(Q);if(IZ(Q))return C(409,Q.message,"uniqueness");return Z.error("Groups inbound handler error",{"es.operation":"scim.groups.handler","es.outcome":"failure"},Q),C(500,Q instanceof Error?Q.message:"Internal server error")}},q=async(R)=>{let S=new URL(R.url),v=S.searchParams.get("startIndex"),p=S.searchParams.get("count"),x=v!=null?parseInt(v,10):void 0,h=p!=null?parseInt(p,10):void 0,e=x!=null&&!Number.isNaN(x)?Math.max(0,x-1):0,n=h!=null&&!Number.isNaN(h)?h:void 0,t=S.searchParams.get("filter"),Q=mZ(t);if(Q!==void 0){let D=await T6(w,G,Q,f),O=D?[D]:[];return SX(O,{totalResults:O.length,startIndex:1,itemsPerPage:O.length})}let B=I6(t),W=await R6(w,G,{start:e,limit:n,filter:B},f);return SX(W.resources,{totalResults:W.total,startIndex:e+1,itemsPerPage:W.count})},m=async(R)=>{let S=await XZ(w,G,R,f);if(!S)return C(404,`Group ${R} not found`,"invalidValue");return JX(S)},u=async(R)=>{let S=await R.json(),v=await IX(X.group,S);if(v.issues)return Z.error("Group creation validation failed",{"es.operation":"scim.group.create","es.outcome":"failure",validationIssues:v.issues}),C(400,`Request validation failed: ${v.issues.map((B)=>B.message).join("; ")}`,"invalidValue");let p=v.value;if(!p.displayName)return C(400,"displayName is required","invalidValue");let x=vX(p),h=pZ(),e=_Z(p),n=ZZ(new Map,eX(p.members,x,h,e)),t;await PX(y,async()=>{t=await PZ(w,p,h)},n,()=>SZ(Y,t,x));let Q=await BX(w,G,x,h);return JX(KX(t,x,Q),201)},U=async(R,S)=>{let v=await R.json(),p=await IX(X.group,v);if(p.issues)return Z.error("Group replacement validation failed",{"es.operation":"scim.group.replace","es.outcome":"failure",validationIssues:p.issues}),C(400,`Request validation failed: ${p.issues.map((D)=>D.message).join("; ")}`,"invalidValue");let x=p.value,h=vX(x);if(!await XZ(w,G,S))return C(404,`Group ${S} not found`,"invalidValue");let n=_Z(x),t=G?(await G.listByTarget(h,S)).items:[],Q=ZZ(E6(t),eX(x.members,h,S,n)),B;await PX(y,async()=>{B=await PZ(w,x,S)},Q,()=>SZ(Y,B,h));let W=await BX(w,G,h,S);return JX(KX(B,h,W))},ZX=async(R,S)=>{let v=await XZ(w,G,S);if(!v)return C(404,`Group ${S} not found`,"invalidValue");let p=await R.json(),x={...v};for(let W of p.Operations??[])if(W.op==="replace"&&W.path&&W.value!==void 0){if(W.path==="displayName")x.displayName=W.value;else if(W.path===`${$X}.requestable`)x[$X]={...x[$X],requestable:Boolean(W.value)};else if(W.path===`${$X}.description`)x[$X]={...x[$X],description:String(W.value)}}else if(W.op==="add"&&W.path==="members"&&W.value!==void 0){let D=W.value;x.members=[...x.members??[],...D]}else if(W.op==="remove"&&W.path?.startsWith("members[")){let D=W.path.match(/members\[value eq "([^"]+)"\]/);if(D)x.members=(x.members??[]).filter((O)=>O.value!==D[1])}let h=await IX(X.group,x);if(h.issues)return Z.error("Group patch validation failed",{"es.operation":"scim.group.patch","es.outcome":"failure",validationIssues:h.issues}),C(400,`Request validation failed: ${h.issues.map((W)=>W.message).join("; ")}`,"invalidValue");let e=vX(x),n=_Z(x),t=ZZ(eX(v.members,e,S,n),eX(x.members,e,S,n)),Q;await PX(y,async()=>{Q=await PZ(w,x,S)},t,()=>SZ(Y,Q,e));let B=await BX(w,G,e,S);return JX(KX(Q,e,B))},s=async(R)=>{let S=await XZ(w,G,R);if(!S)return C(404,`Group ${R} not found`,"invalidValue");let v=vX(S);if(G){let p=await G.listByTarget(v,R);for(let x of p.items)await YZ(y,x)}return await C6(w,R),new Response(null,{status:204})};VX={handler:T}}let zX;if(b.userStore){let{userStore:w,inboundUsers:T}=b,q=(J)=>J?.find((F)=>F.primary)?.value||J?.[0]?.value,m=(J)=>{if(J.scimName)return J.scimName;if(!J.name)return;let[F,...H]=J.name.split(" ");return{givenName:F,familyName:H.join(" ")||void 0}},u=(J)=>Object.keys(J.scimSchemaExtensions??{}).filter((F)=>F.startsWith("urn:")&&J.scimSchemaExtensions?.[F]!==void 0),U=(J)=>{let F={};if(J.ecid!==void 0)F.ecid=J.ecid;if(J.accountClass!==void 0)F.accountClass=J.accountClass;return F.ecid!==void 0||F.accountClass!==void 0?F:void 0},ZX=(J)=>{let F=new Set([JZ]);if(J.scimEnterprise!==void 0)F.add(DX);if(U(J)!==void 0)F.add(WX);for(let H of u(J))F.add(H);return Array.from(F)},s=(J)=>{let F={};if(J.scimEnterprise!==void 0)F[DX]=J.scimEnterprise;let H=U(J);if(H!==void 0)F[WX]=H;for(let[M,N]of Object.entries(J.scimSchemaExtensions??{}))if(M.startsWith("urn:")&&M!==WX&&N!==void 0)F[M]=N;return F},R=(J)=>{let F=J.userName||J.email||J.id||"",H=J.emails??(J.email?[{value:J.email,primary:!0}]:[]);return{schemas:ZX(J),id:J.id,externalId:J.externalId,userName:F,displayName:J.displayName??J.name??F,name:m(J),nickName:J.nickName,profileUrl:J.avatar,title:J.title,userType:J.userType,preferredLanguage:J.preferredLanguage,locale:J.locale,timezone:J.timezone,active:J.active??!0,emails:H,phoneNumbers:J.phoneNumbers,ims:J.ims,photos:J.photos,addresses:J.addresses,groups:J.groups,entitlements:J.entitlements,roles:J.roles,x509Certificates:J.x509Certificates,meta:{resourceType:"User",created:(J.createdAt??J.updatedAt??new Date).toISOString(),lastModified:(J.updatedAt??J.createdAt??new Date).toISOString()},...s(J)}},S=async(J)=>{if(T?.mapBaseUserToScim)return await T.mapBaseUserToScim(J);return R(J)},v=async(J,F)=>{if(T?.mapValidatedScimToBaseUser)return await T.mapValidatedScimToBaseUser(J,F);let H=new Date,M=q(J.emails),N=J.name?.formatted||[J.name?.givenName,J.name?.middleName,J.name?.familyName].filter(Boolean).join(" ").trim()||J.displayName,E=J.id||F.existing?.id||pZ(),_=J.userName||M||F.existing?.userName||E,P=N||J.displayName||F.existing?.name||_,I=Object.fromEntries(Object.entries(J).filter(([YX,bX])=>YX.startsWith("urn:")&&YX!==DX&&YX!==WX&&bX!==void 0)),j=J[WX],d=j?.ecid!==void 0&&j.ecid!==null?uZ(j.ecid):F.existing?.ecid,a=j?.accountClass??F.existing?.accountClass,i=F.existing?.sso;return{...F.existing??{},id:E,userName:_,name:P,email:M||F.existing?.email||_,avatar:J.profileUrl,sso:{...i??{},profile:{...i?.profile??{},sub:E,iss:i?.profile.iss??"iam-provisioned",aud:i?.profile.aud??"iam-provisioned",exp:i?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:i?.profile.iat??Math.floor(Date.now()/1000),email:M||F.existing?.email||_,email_verified:!0,name:P,preferred_username:_},tenant:i?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:i?.scope??"openid profile email",tokenType:i?.tokenType??"Bearer",expires:i?.expires??new Date(Date.now()+3600000)},externalId:J.externalId,ecid:d,accountClass:a,displayName:J.displayName,scimName:J.name,emails:J.emails,nickName:J.nickName,title:J.title,preferredLanguage:J.preferredLanguage,locale:J.locale,timezone:J.timezone,active:J.active,phoneNumbers:J.phoneNumbers,ims:J.ims,photos:J.photos,addresses:J.addresses,groups:J.groups,entitlements:J.entitlements,roles:J.roles,x509Certificates:J.x509Certificates,scimEnterprise:J[DX],scimSchemaExtensions:Object.keys(I).length>0?I:void 0,createdAt:F.existing?.createdAt??(J.meta?.created?new Date(J.meta.created):H),updatedAt:J.meta?.lastModified?new Date(J.meta.lastModified):H,userType:J.userType}},p=(J,F,H)=>{J[F]=H},x=(J,F,H)=>{let M=J[F];if(Array.isArray(M)){J[F]=[...M,...Array.isArray(H)?H:[H]];return}if(M&&typeof M==="object"&&!Array.isArray(M)&&H&&typeof H==="object"&&!Array.isArray(H)){J[F]={...M,...H};return}J[F]=H},h=(J,F,H)=>{let M=F.match(/^(urn:.*:(?:User|Group))(?::(.+))?$/),N=M?[M[1],...M[2]?.split(":")??[]]:F.split("."),E=J;for(let P of N.slice(0,-1)){let I=E[P];if(I===void 0){if(!H)return null;E[P]={}}else if(I===null||typeof I!=="object"||Array.isArray(I)){if(!H)return null;E[P]={}}E=E[P]}let _=N.at(-1);if(!_)return null;return{parent:E,key:_}},e=(J,F)=>{let H=F.op.toLowerCase();if(!F.path){if(H!=="remove"&&F.value&&typeof F.value==="object"&&!Array.isArray(F.value))Object.assign(J,F.value);return}let M=F.path.match(/^([A-Za-z0-9]+)\[value eq "([^"]+)"\]$/);if(M&&H==="remove"){let[,E,_]=M,P=J[E];if(Array.isArray(P))J[E]=P.filter((I)=>!(I&&typeof I==="object"&&("value"in I)&&I.value===_));return}let N=h(J,F.path,H!=="remove");if(!N)return;if(H==="remove"){delete N.parent[N.key];return}if(H==="add"){x(N.parent,N.key,F.value);return}p(N.parent,N.key,F.value)},n=async(J,F)=>{if(!await OX(J))return C(401,"Authorization required");let M=new URL(J.url),N=F?.basePath??"/Users",E=M.pathname;if(E.startsWith(N))E=E.substring(N.length);let P=E.match(/^\/([^/]+)$/)?.[1],I=J.method;try{if(P)switch(I){case"GET":return await Q(P);case"PUT":return await W(J,P);case"PATCH":return await D(J,P);case"DELETE":return await O(P);default:return C(405,"Method not allowed")}else if(E===""||E==="/")switch(I){case"GET":return await t(J);case"POST":return await B(J);default:return C(405,"Method not allowed")}return C(404,"Resource not found")}catch(j){if(j instanceof TX)return UZ(j);if(IZ(j))return C(409,j.message,"uniqueness");return Z.error("Users inbound handler error",{"es.operation":"scim.users.handler","es.outcome":"failure"},j),C(500,j instanceof Error?j.message:"Internal server error")}},t=async(J)=>{let F=new URL(J.url),H=F.searchParams.get("startIndex"),M=F.searchParams.get("count"),N=H!=null?parseInt(H,10):void 0,E=M!=null?parseInt(M,10):void 0,_=N!=null&&!Number.isNaN(N)?Math.max(0,N-1):0,P=E!=null&&!Number.isNaN(E)?E:void 0,I=mZ(F.searchParams.get("filter"));if(I!==void 0){let a=await w.lookup({externalId:I}),i=a?[await S(a)]:[];return SX(i,{totalResults:i.length,startIndex:1,itemsPerPage:i.length})}let j=await w.list({start:_,limit:P}),d=await Promise.all(j.items.map((a)=>S(a)));return SX(d,{totalResults:j.total,startIndex:_+1,itemsPerPage:j.count})},Q=async(J)=>{let F=await w.get(J);if(!F)return C(404,`User ${J} not found`,"invalidValue");return JX(await S(F))},B=async(J)=>{let F=await J.json(),H=await IX(X.user,F);if(H.issues)return Z.error("User creation validation failed",{"es.operation":"scim.user.create","es.outcome":"failure",validationIssues:H.issues}),C(400,`Request validation failed: ${H.issues.map((E)=>E.message).join("; ")}`,"invalidValue");let M=H.value;if(!M.userName&&!M.emails?.[0]?.value)return C(400,"userName or email is required","invalidValue");let N=await v(M,{mode:"create"});return await PX(y,async()=>{await w.upsert(N)},NZ(void 0,N),async()=>{await wZ(Y,N)}),JX(await S(N),201)},W=async(J,F)=>{let H=await w.get(F);if(!H)return C(404,`User ${F} not found`,"invalidValue");let M=await J.json(),N=await IX(X.user,M);if(N.issues)return Z.error("User replacement validation failed",{"es.operation":"scim.user.replace","es.outcome":"failure",validationIssues:N.issues}),C(400,`Request validation failed: ${N.issues.map((P)=>P.message).join("; ")}`,"invalidValue");let E=N.value,_=await v({...E,id:F},{existing:H,mode:"replace"});return _.createdAt=H.createdAt,_.updatedAt=new Date,await PX(y,async()=>{await w.upsert(_)},NZ(H,_),async()=>{await wZ(Y,_)}),JX(await S(_))},D=async(J,F)=>{let H=await w.get(F);if(!H)return C(404,`User ${F} not found`,"invalidValue");let N=(await J.json()).Operations??[],_={...await S(H)};for(let j of N)e(_,j);let P=await IX(X.user,_);if(P.issues)return Z.error("User patch validation failed",{"es.operation":"scim.user.patch","es.outcome":"failure",validationIssues:P.issues}),C(400,`Request validation failed: ${P.issues.map((j)=>j.message).join("; ")}`,"invalidValue");let I=await v(P.value,{existing:H,mode:"patch"});return I.updatedAt=new Date,await PX(y,async()=>{await w.upsert(I)},NZ(H,I),async()=>{await wZ(Y,I)}),JX(await S(I))},O=async(J)=>{if(!await w.get(J))return C(404,`User ${J} not found`,"invalidValue");if(G){let H=await G.listBySubject(J,"user");for(let M of H.items)await YZ(y,M)}if(await w.delete(J),y.authz.oaa.isReady())await y.authz.oaa.deleteUser(J).catch((H)=>{Z.warn("OAA incremental user delete failed; full sync will reconcile",{id:J,error:H})});return new Response(null,{status:204})};zX={handler:n}}async function nX(w,T){LX();let q=new URL(w.url).pathname,m=AX(T?.usersUrl??b.usersUrl??"/api/iam/Users")??"/api/iam/Users",u=AX(T?.groupsUrl??b.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",U=await dX(w,T);if(U)return U;let ZX=(s)=>q===s||q.startsWith(`${s}/`);if(ZX(m)){if(!o)return C(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!zX)return C(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return zX.handler(w,{basePath:m})}if(ZX(u)){if(!l)return C(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!VX)return C(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return VX.handler(w,{basePath:u})}return C(404,"Resource not found")}return{...b,createUser:cX,getBaseUrl:uX,groups_outbound:yX,groups_inbound:VX,users_inbound:zX,handler:nX,delta:V}}var RX={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},activityUpdateSeconds:{min:0,max:86400,default:60},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function pX(X,Z){if(typeof X!=="number"||!Number.isFinite(X))return Z.default;let $=Math.floor(X);if($<Z.min)return Z.min;if($>Z.max)return Z.max;return $}function cZ(X){return{ttlMs:pX(X?.ttlSeconds,RX.jwksTtlSeconds)*1000,maxEntries:pX(X?.maxEntries,RX.jwksMaxEntries)}}function nZ(X){let Z=X?.read;return{activityUpdateMs:pX(X?.activityUpdateSeconds,RX.activityUpdateSeconds)*1000,read:{enabled:Z?.enabled===!0,ttlMs:pX(Z?.ttlSeconds,RX.sessionReadTtlSeconds)*1000,maxEntries:pX(Z?.maxEntries,RX.sessionReadMaxEntries)}}}function v6(X){return{jwks:cZ(X?.jwks),session:nZ(X?.session)}}var CZ,aZ;function h6(X){CZ=X}function U6(X){aZ=X}function g6(X,Z){if(!CZ)throw Error("Tenant config hydration is not registered. Import @enterprisestandard/server before using tenantConfigSource().");return aZ?.({locator:X}),CZ(X,Z)}var m6="@enterprisestandard/core",p6=EX(sX(m6));async function l6(X,Z){let $=await jX({idToken:X,jwksUri:Z.jwksUri,issuer:Z.issuer,audience:Z.audience}),Y=await p6.validate($);if(Y.issues)throw Error(`ID token claims validation failed: ${Y.issues.map((K)=>K.message).join("; ")}`);let G=Y.value;if(G===void 0)throw Error("ID token claims missing");return iZ(G)}export{rX as withSetCookies,l6 as verifyUser,D8 as verifyLogoutToken,jX as verifyIdToken,g6 as tenantConfigSource,O8 as sso,Q8 as setJwksClock,M8 as setDiscoveryClock,i6 as sameOriginRedirectRules,N8 as resolveUser,nZ as resolveSessionCacheConfig,t6 as resolveRedirect,KZ as resolveProviderBranding,cZ as resolveJwksCacheConfig,W8 as resolveJwkForKid,M6 as resolveCustomer,iX as resolveCiamProvider,e6 as resolveCapturedRedirect,v6 as resolveCacheConfig,tX as resolveAfterRedirect,h6 as registerTenantConfigSourceFactory,U6 as registerConfigLocatorAssert,AZ as pkceChallengeFromVerifier,VZ as orderedEnabledProviders,V8 as normalizeOidcIssuer,o6 as isRedirectAllowed,_8 as initiateLogin,q6 as iam,F6 as hasScope,Q6 as hasRole,J6 as hasPermission,Y6 as hasGroup,H6 as hasAnyScope,G6 as hasAny,B6 as hasAllScope,W6 as hasAll,$6 as has,K8 as getVerificationKeyForKid,z8 as getUser,H8 as getPublicKeyFromJwks,B8 as getPublicKeyForKid,BZ as getProviderPreset,Y8 as getJwks,$8 as getDiscoveredSessionUsers,D6 as getCustomer,F8 as getCachedVerificationKey,zZ as generateAppleClientSecret,OZ as fetchUserInfo,MZ as exchangeAuthorizationCode,X8 as discoverSessions,Z8 as discoverSessionRecords,LZ as discoverOidcEndpoints,r6 as defaultRedirectPolicies,J8 as configureJwksCache,G8 as clearJwksCache,L8 as clearDiscoveryCache,A6 as ciam,s6 as captureRedirect,w8 as callback,DZ as buildAuthorizationUrl,u6 as blockDangerousUrls,A8 as assertTrustedIdTokenClaims,c6 as allowSameOrigin,d6 as allowRelativePaths,n6 as allowOrigins,a6 as allowHosts,fZ as CIAM_PROVIDER_PRESETS,RX as CACHE_BOUNDS};
+import{A as s9,E as z1,I as o9,K as L9,L as $9,O as a4,P as i4,Q as Y5,R as X9,T as I5,a as D9,d as l9,e as V5,f as W1,g as G1,h as Y9,i as B9,j as W9,k as n4,o as G9,u as A1,v as U9,w as k9,x as D1,y as c5,z as m}from"./shared/core-9dvscte3.js";var J2="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.",M9=["user","customer","workload"],Z2={user:async(J,Z)=>Z.sso?.getUser(J),customer:async(J,Z)=>Z.ciam?.getCustomer(J),workload:async(J,Z)=>{let $=await Z.workload?.getWorkloadIdentity?.(J);if(!$)return;let X=$.clientId??$.workloadId??$.claims.sub;return X?{...$,id:X}:void 0}};function $2(J){if(J==="any")return M9;let Z=Array.isArray(J)?J:[J];return M9.filter(($)=>Z.includes($))}function X2(J){let Z=J.headers.get("cookie");if(!Z)return[];return Z.split(";").map(($)=>$.slice(0,$.indexOf("=")===-1?$.length:$.indexOf("=")).trim()).filter(Boolean)}function Q2(J,Z){let $=J.headers.get("authorization")?.toLowerCase().startsWith("bearer ")??!1,X=X2(J),Q=new Set;for(let F of X){if(F.startsWith("es.sso"))Q.add("user");if(F.startsWith("es.ciam"))Q.add("customer")}let G=X.length>0&&!Q.has("user")&&!Q.has("customer");return Z.filter((F)=>{if(F==="workload")return $;if(X.length===0)return!1;return Q.has(F)||G})}function X5(J){return typeof J==="string"?J:J.id}function _9(J){let{subject:Z,subjectType:$}=J,X;if($==="user")X=Z.sso?.scope;else if($==="customer")X=Z.ciam?.scope;else if($==="workload")X=Z.scope;return new Set((X??"").split(/\s+/).filter(Boolean))}function b1(J,Z,$){let X=_9(J),Q=Z.filter((F)=>X.has(F));return{allow:$==="any"?Q.length>0:Z.length>0&&Q.length===Z.length,metadata:{reason:"scope",wantedScopes:Z,matchedScopes:Q}}}function l5(J,Z){return($)=>{if(J.length===0)return;let X=_9($),Q=J.filter((F)=>X.has(F));return(Z==="any"?Q.length>0:Q.length===J.length)?Q:void 0}}function H1(J,Z,$){return(X)=>{if(Z.length===0||X.subjectType!=="workload")return;let Q=D9(J.config?.authz,X.subject);if(!Q)return;let G=Z.filter((B)=>Q.has(B));return($==="any"?G.length>0:G.length===Z.length)?G:void 0}}function K2(J,Z){if(J.subjectType==="workload"){let $=J.subject.scopesAsEntitlements;if(typeof $==="boolean")return $}return Z.config?.authz?.scopesAsEntitlements===!0}function y1(J,Z,$,X,Q){return{allow:$==="ok",subject:Z?.subject,subjectType:Z?.subjectType,reason:$,decision:X,response(){if($==="ok")return new Response(null,{status:204});if($==="unauthenticated")return J.log.warn("authz.denied",{reason:$,...Q()}),Response.json({error:"Unauthorized"},{status:401});if($==="not_configured")return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"not_configured"},{status:503});return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"Forbidden"},{status:403})}}}function Y2(J,Z,$){return new Promise((X)=>{let Q=[],G=J.length,F=!1,B=()=>{if(G-=1,G===0&&!F)F=!0,X({outcomes:Q})};for(let W of J)Z(W).then((L)=>{if(Q.push({principal:W,decision:L}),!F&&L.allow){F=!0,X({matched:{principal:W,decision:L},outcomes:Q});return}B()},(L)=>{$?.(W,L),Q.push({principal:W,decision:{allow:!1,metadata:{reason:"error"}}}),B()})})}async function A5(J,Z,$,X,Q,G,F){m(Z,J2);let B=Q2(J,$2($)),L=(await Promise.all(B.map(async(c)=>{let l=await Z2[c](J,Z);return l?.id?{subject:l,subjectType:c,subjectId:l.id}:void 0}))).filter((c)=>c!==void 0);if(L.length===0)return y1(Z,void 0,"unauthenticated",void 0,Q);let f=async(c)=>{let l=Z.authz.accessIndex;if(!l?.isSubjectDisabled)return!1;return l.isSubjectDisabled(c.subjectId,c.subjectType)},u=async(c)=>{if(F){let l=F(c);if(l&&l.length>0){if(await f(c))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:l}}}}if(G&&K2(c,Z)){let l=G(c);if(l&&l.length>0){if(await f(c))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"scope",matchedScopes:l}}}}return X(c)},{matched:i,outcomes:J5}=await Y2(L,u,(c,l)=>{Z.log.warn("authz.check_error",{"es.operation":"authz.check","es.outcome":"error",subject:c.subjectId,subjectType:c.subjectType,error:l instanceof Error?l.message:String(l),...Q()})});if(i){if(i.decision.metadata?.reason==="scope")Z.log.info("authz.scope_honor",{"es.operation":"authz.scope_honor","es.outcome":"allow",subject:i.principal.subjectId,subjectType:i.principal.subjectType,matchedScopes:i.decision.metadata.matchedScopes,...Q()});return y1(Z,i.principal,"ok",i.decision,Q)}let r=J5.length>0&&J5.every((c)=>{let l=c.decision.metadata?.reason;return l==="access_index_not_configured"||l==="error"}),G5=J5[0],p=r?"not_configured":"forbidden";return y1(Z,G5?.principal,p,G5?.decision,Q)}async function B2(J,Z,$,X,Q,G="any"){return A5(J,Z,G,(F)=>Z.authz.has(F.subjectId,$,X,Q,F.subjectType),()=>({targetType:$,target:X5(X),resource:Q?X5(Q):void 0}),Q?void 0:l5([X5(X)],"any"),$==="permission"&&!Q?H1(Z,[X5(X)],"any"):void 0)}async function W2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasPermission(G.subjectId,$,X,G.subjectType),()=>({targetType:"permission",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"),X?void 0:H1(Z,[X5($)],"any"))}async function G2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasRole(G.subjectId,$,X,G.subjectType),()=>({targetType:"role",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"))}async function L2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasGroup(G.subjectId,$,X,G.subjectType),()=>({targetType:"group",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"))}async function F2(J,Z,$,X="any"){let Q=$.filter((F)=>!F.resource).map((F)=>X5(F.target)),G=$.filter((F)=>!F.resource&&F.targetType==="permission").map((F)=>X5(F.target));return A5(J,Z,X,(F)=>Z.authz.hasAny(F.subjectId,$,F.subjectType),()=>({targets:$.map((F)=>`${F.targetType}:${X5(F.target)}`)}),Q.length>0?l5(Q,"any"):void 0,G.length>0?H1(Z,G,"any"):void 0)}async function H2(J,Z,$,X="any"){let Q=$.length>0&&$.every((B)=>!B.resource),G=$.length>0&&$.every((B)=>!B.resource&&B.targetType==="permission"),F=$.map((B)=>X5(B.target));return A5(J,Z,X,(B)=>Z.authz.hasAll(B.subjectId,$,B.subjectType),()=>({targets:$.map((B)=>`${B.targetType}:${X5(B.target)}`)}),Q?l5(F,"all"):void 0,G?H1(Z,F,"all"):void 0)}async function V2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,[$],"any")),()=>({scope:$}))}async function N2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"any")),()=>({scopes:$}))}async function M2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"all")),()=>({scopes:$}))}function Q5(J){return typeof J==="string"&&J.length>0?J:void 0}function z9(J){let Z=Q5(J.email);return{sub:String(J.sub??""),email:Z,name:Q5(J.name),userName:Q5(J.preferred_username)??Z,avatar:Q5(J.picture)}}var P9={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:z9},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:z9},microsoft:{flow:"id_token",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(J)=>{let Z=Q5(J.email)??Q5(J.preferred_username);return{sub:String(J.sub??J.oid??""),email:Z,name:Q5(J.name),userName:Q5(J.preferred_username)??Z,avatar:Q5(J.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(J)=>{let Z=Q5(J.email);return{sub:String(J.sub??""),email:Z,name:Q5(J.name),userName:Z}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(J)=>({sub:String(J.id??J.node_id??""),email:Q5(J.email),name:Q5(J.name)??Q5(J.login),userName:Q5(J.login),avatar:Q5(J.avatar_url)})}};function q1(J){if(J==="magic-link")return;return P9[J]}function V1(J,Z){if(Z.type==="magic-link")return;let $=q1(Z.type);if(!$)return;return{name:J,type:Z.type,flow:$.flow,authorizationUrl:Z.authorizationUrl??$.authorizationUrl,tokenUrl:Z.tokenUrl??$.tokenUrl,jwksUri:Z.jwksUri??$.jwksUri,userInfoUrl:Z.userInfoUrl??$.userInfoUrl,scope:Z.scope??$.scope,clientId:Z.clientId,clientSecret:Z.clientSecret,extraAuthParams:$.extraAuthParams,branding:{...$.branding,...Z.branding},mapClaims:$.mapClaims,config:Z}}function C1(J){return{...q1(J.type)?.branding??{displayName:J.type},...J.branding}}function v1(J){if(!J)return[];return Object.entries(J).filter(([,Z])=>Z.enabled!==!1).map(([Z,$],X)=>({name:Z,config:$,index:X})).sort((Z,$)=>{let X=Z.config.order??Number.MAX_SAFE_INTEGER,Q=$.config.order??Number.MAX_SAFE_INTEGER;if(X!==Q)return X-Q;return Z.index-$.index}).map(({name:Z,config:$})=>({name:Z,config:$}))}var E9=600000,k1=256,W5=new Map;function D2(J){if(typeof J?.ttlMs==="number"&&Number.isFinite(J.ttlMs))E9=Math.min(Math.max(J.ttlMs,60000),86400000);if(typeof J?.maxEntries==="number"&&Number.isFinite(J.maxEntries)){k1=Math.max(1,Math.floor(J.maxEntries));while(W5.size>k1){let Z=W5.keys().next().value;if(Z===void 0)break;W5.delete(Z)}}}function O9(J,Z){W5.delete(J),W5.set(J,Z);while(W5.size>k1){let $=W5.keys().next().value;if($===void 0)break;W5.delete($)}}var o5=new Map,f1=()=>Date.now();function _2(J){f1=J??(()=>Date.now())}var h1={};function z2(J){h1=J??{}}function P2(J){if(!J)return;if(/\bno-store\b/i.test(J))return 60000;let Z=/max-age\s*=\s*(\d+)/i.exec(J);if(!Z)return;let $=Number(Z[1]);return Number.isFinite($)?$*1000:void 0}function O2(J){let $=P2(J)??E9;return Math.min(Math.max($,60000),86400000)}async function g1(J,Z=3,$=1000,X=30000,Q){let G=Error("Placeholder Error");for(let F=0;F<=Z;F++)try{return await J()}catch(B){if(G=B instanceof Error?B:Error(String(B)),B instanceof Error&&B.message.includes("400"))throw B;if(F===Z)throw G;let W=Math.min($*2**F,X),L=Math.random()*0.1*W;await new Promise((f)=>setTimeout(f,W+L)),Q?.warn(`Retry attempt ${F+1} after ${W+L}ms delay`)}throw G}async function r5(J,Z,$){let X=W5.get(J);if(!$?.forceRefresh&&X&&X.expiresAt>f1())return O9(J,X),X.jwks;let Q=o5.get(J);if(Q)return Q;let G=(async()=>{try{return await g1(async()=>{let F=await fetch(J);if(!F.ok)throw Error("Failed to fetch JWKS");let B=await F.json(),W=O2(F.headers.get("cache-control"));return O9(J,{jwks:B,expiresAt:f1()+W,importedKeys:new Map}),B},h1.maxRetries,h1.baseDelayMs,void 0,Z)}catch(F){let B=W5.get(J);if(B)return Z?.warn("JWKS refresh failed; serving last-known-good keys",{"es.operation":"jwks.refresh","es.outcome":"degraded"}),B.jwks;throw F}finally{o5.delete(J)}})();return o5.set(J,G),G}function E2(J){if(J){W5.delete(J),o5.delete(J);return}W5.clear(),o5.clear()}async function j2(J,Z,$){return(await j9(J,Z,$)).jwk}async function j9(J,Z,$){if(!Z?.trim())throw Error("JWT header missing kid");await r5(J,$);let X=W5.get(J),Q=X?.jwks.keys.find((G)=>G.kid===Z);if(!Q)await r5(J,$,{forceRefresh:!0}),X=W5.get(J),Q=X?.jwks.keys.find((G)=>G.kid===Z);if(!X||!Q)throw Error("Public key not found");return{jwk:Q,entry:X}}async function m1(J,Z,$,X,Q){let{jwk:G,entry:F}=await j9(J,Z,Q),B=`${Z}\x00${$}`,W=F.importedKeys.get(B);if(W)return W;let L=X(G);return L.catch(()=>{if(F.importedKeys.get(B)===L)F.importedKeys.delete(B)}),F.importedKeys.set(B,L),L}async function A2(J,Z){let $=J.keys.find((X)=>X.kid===Z);if(!$)throw Error("Public key not found");return A9($)}function A9(J){return crypto.subtle.importKey("jwk",{kty:J.kty,n:J.n,e:J.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function w2(J,Z,$){return m1(J,Z,"rs256",A9,$)}var U1={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function p1(J,Z,$,X){if(typeof $!=="string"||!($ in U1))throw Error(`Unsupported JWT alg "${String($)}" (allowed: ${Object.keys(U1).join(", ")})`);let Q=U1[$];return{key:await m1(J,Z,`oidc:${$}`,(F)=>{if(F.kty!==Q.kty)throw Error(`JWK type "${F.kty}" does not match token alg "${$}"`);if(Q.kty==="EC"){let B=F;if(B.crv!==Q.crv)throw Error(`JWK curve "${String(B.crv)}" does not match token alg "${$}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:B.crv,x:B.x,y:B.y},Q.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:F.kty,n:F.n,e:F.e},Q.importParams,!1,["verify"])},X),algorithm:Q.verifyParams}}function D5(J=32){let Z=new Uint8Array(J);return crypto.getRandomValues(Z),Array.from(Z,($)=>$.toString(16).padStart(2,"0")).join("").substring(0,J)}function N1(J){let Z="";return J.forEach(($)=>{Z+=String.fromCharCode($)}),btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T9(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.padEnd(Z.length+(4-Z.length%4)%4,"="),X=atob($),Q=new Uint8Array(X.length);for(let G=0;G<X.length;G++)Q[G]=X.charCodeAt(G);return Q}function w9(J){let Z=new TextDecoder().decode(T9(J));return JSON.parse(Z)}async function J1(J){let Z=new TextEncoder().encode(J),$=await crypto.subtle.digest("SHA-256",Z);return N1(new Uint8Array($))}function l1(J){let Z=new URL(J.authorizationUrl);if(Z.searchParams.set("client_id",J.clientId),Z.searchParams.set("redirect_uri",J.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("scope",J.scope),Z.searchParams.set("state",J.state),J.codeChallenge)Z.searchParams.set("code_challenge",J.codeChallenge),Z.searchParams.set("code_challenge_method","S256");if(J.nonce)Z.searchParams.set("nonce",J.nonce);for(let[$,X]of Object.entries(J.extraParams??{}))Z.searchParams.set($,X);return Z.toString()}async function c1(J){let Z=new URLSearchParams;if(Z.append("grant_type","authorization_code"),Z.append("code",J.code),Z.append("redirect_uri",J.redirectUri),Z.append("client_id",J.clientId),J.clientSecret)Z.append("client_secret",J.clientSecret);if(J.codeVerifier)Z.append("code_verifier",J.codeVerifier);let $=await fetch(J.tokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()}),X=await $.json();if(!$.ok){let Q=X;throw J.log?.error("OIDC authorization-code exchange failed",{"es.operation":"token.exchange","es.outcome":"failure","http.status_code":$.status,oidc_error:Q.error}),Error(`Token exchange failed: ${Q.error||$.statusText} - ${Q.error_description||""}`.trim())}if(typeof X.access_token!=="string")throw Error("Token exchange response missing access_token");return X}var S9=60;function e5(J){return J.trim().replace(/\/$/,"")}function R9(J){let{claims:Z,audience:$}=J,X=e5(J.issuer),Q=J.nowSec??Math.floor(Date.now()/1000),G=J.clockSkewSec??S9,F=Z.iss;if(typeof F!=="string"||e5(F)!==X)throw Error("ID token issuer mismatch");let B=Z.aud,W=Array.isArray(B)?B.includes($):typeof B==="string"&&B===$,L=typeof Z.azp==="string"&&Z.azp===$;if(!W&&!L)throw Error("ID token audience mismatch");if(typeof Z.exp!=="number")throw Error("ID token missing exp");if(Z.exp<Q-G)throw Error("ID token expired");if(J.expectedNonce!==void 0){if(Z.nonce!==J.expectedNonce)throw Error("ID token nonce mismatch")}}async function x9(J,Z,$){let X=J.split(".");if(X.length!==3)throw Error("Invalid JWT");let Q=w9(X[0]),G=w9(X[1]),F=T9(X[2]),{key:B,algorithm:W}=await p1(Z,Q.kid,Q.alg,$),L=new TextEncoder().encode(`${X[0]}.${X[1]}`);if(!await crypto.subtle.verify(W,B,F,L))throw Error("Invalid JWT signature");return{header:Q,payload:G}}async function R5(J){let{payload:Z}=await x9(J.idToken,J.jwksUri,J.log);return R9({claims:Z,issuer:J.issuer,audience:J.audience,clockSkewSec:J.clockSkewSec,expectedNonce:J.expectedNonce}),Z}var I2="http://schemas.openid.net/event/backchannel-logout";async function d1(J){let{payload:Z}=await x9(J.logoutToken,J.jwksUri,J.log),$=e5(J.issuer),X=Z.iss;if(typeof X!=="string"||e5(X)!==$)throw Error("Logout token issuer mismatch");let Q=Z.aud,G=Array.isArray(Q)?Q.includes(J.audience):typeof Q==="string"&&Q===J.audience,F=typeof Z.azp==="string"&&Z.azp===J.audience;if(!G&&!F)throw Error("Logout token audience mismatch");if(Z.nonce!=null)throw Error("Logout token must not contain a nonce");let B=Z.events;if(!(typeof B==="object"&&B!==null&&!Array.isArray(B)&&Object.hasOwn(B,I2)))throw Error("Logout token missing back-channel logout event");let L=typeof Z.sid==="string"&&Z.sid.length>0,f=typeof Z.sub==="string"&&Z.sub.length>0;if(!L&&!f)throw Error("Logout token missing sid and sub");if(typeof Z.exp==="number"){let u=Math.floor(Date.now()/1000),i=J.clockSkewSec??S9;if(Z.exp<u-i)throw Error("Logout token expired")}return Z}var T2=3600000,S2=60000,R2=86400000,x2=256,w5=new Map,s5=new Map;function I9(J,Z){w5.delete(J),w5.set(J,Z);while(w5.size>x2){let $=w5.keys().next().value;if($===void 0)break;w5.delete($)}}var u1=()=>Date.now();function y2(J){u1=J??(()=>Date.now())}function b2(J){if(J){w5.delete(J),s5.delete(J);return}w5.clear(),s5.clear()}function q2(J){let Z=J?/max-age\s*=\s*(\d+)/i.exec(J):null,$=Z?Number(Z[1]):Number.NaN,X=Number.isFinite($)?$*1000:T2;return Math.min(Math.max(X,S2),R2)}async function n1(J){let Z=w5.get(J);if(Z&&Z.expiresAt>u1())return I9(J,Z),Z.endpoints;let $=s5.get(J);if($)return $;let X=(async()=>{try{let Q=J.replace(/\/$/,""),G=await fetch(`${Q}/.well-known/openid-configuration`,{headers:{Accept:"application/json"}});if(!G.ok)throw Error(`OIDC discovery failed for ${J} with status ${G.status}`);let F=await G.json(),B={authorizationUrl:typeof F.authorization_endpoint==="string"?F.authorization_endpoint:void 0,tokenUrl:typeof F.token_endpoint==="string"?F.token_endpoint:void 0,jwksUri:typeof F.jwks_uri==="string"?F.jwks_uri:void 0,userInfoUrl:typeof F.userinfo_endpoint==="string"?F.userinfo_endpoint:void 0};return I9(J,{endpoints:B,expiresAt:u1()+q2(G.headers.get("cache-control"))}),B}catch(Q){let G=w5.get(J);if(G)return G.endpoints;throw Q}finally{s5.delete(J)}})();return s5.set(J,X),X}async function a1(J,Z){let $=await fetch(J,{headers:{Authorization:`Bearer ${Z}`,Accept:"application/json","User-Agent":"enterprise-standard-ciam"}});if(!$.ok)throw Error(`UserInfo request failed with status ${$.status}`);return await $.json()}function C2(J){let Z=J.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),$=atob(Z),X=new Uint8Array($.length);for(let Q=0;Q<$.length;Q++)X[Q]=$.charCodeAt(Q);return X}async function i1(J){let Z=Math.floor(Date.now()/1000),$={alg:"ES256",kid:J.keyId,typ:"JWT"},X={iss:J.teamId,iat:Z,exp:Z+(J.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:J.clientId},Q=N1(new TextEncoder().encode(JSON.stringify($))),G=N1(new TextEncoder().encode(JSON.stringify(X))),F=`${Q}.${G}`,B=await crypto.subtle.importKey("pkcs8",C2(J.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),W=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},B,new TextEncoder().encode(F));return`${F}.${N1(new Uint8Array(W))}`}function v2(J){for(let Z=0;Z<J.length;Z++){let $=J.charCodeAt(Z);if($<=31||$===127)return!0}return!1}function U2(J,Z){let $=null;try{$=new URL(J,Z)}catch{$=null}let X="";try{X=new URL(Z).origin}catch{X=""}return{candidate:J,url:$,requestOrigin:X}}function y9(J,Z,$){let X=U2(J,$),Q=!1;for(let G of Z){let F=G(X);if(F==="deny")return!1;if(F==="allow")Q=!0}return Q}function b9(){return({candidate:J,url:Z})=>{if(v2(J))return"deny";if(J.includes("\\"))return"deny";if(J.startsWith("//"))return"deny";if(!Z)return"deny";if(Z.protocol!=="http:"&&Z.protocol!=="https:")return"deny";if(Z.username||Z.password)return"deny";return"abstain"}}function q9(){return({candidate:J})=>J.startsWith("/")&&!J.startsWith("//")&&!J.startsWith("/\\")?"allow":"abstain"}function C9(){return({url:J,requestOrigin:Z})=>J&&Z&&J.origin===Z?"allow":"abstain"}function k2(...J){let Z=new Set(J.map(($)=>{try{return new URL($).origin}catch{return $}}));return({url:$})=>$&&Z.has($.origin)?"allow":"abstain"}function f2(...J){let Z=J.map(($)=>$.toLowerCase());return({url:$})=>{if(!$)return"abstain";let X=$.hostname.toLowerCase();for(let Q of Z)if(Q.startsWith(".")){if(X===Q.slice(1)||X.endsWith(Q))return"allow"}else if(X===Q)return"allow";return"abstain"}}function t1(){return[b9(),q9(),C9()]}function v9(J,Z,$){if(!J)return!1;return y9(J,Z,$)}function o1(J,Z){if(!J)return Z.fallback;return y9(J,Z.rules,Z.requestUrl)?J:Z.fallback}var h2={rules:t1(),fallback:"/"};function g2(J,Z,$="redirect"){let X=new URL(J.url).searchParams.get($)??void 0;return v9(X,Z.rules,J.url)?{redirect:X}:void 0}function m2(J,Z){let $=J.context;return o1($?.redirect,{rules:Z.rules,fallback:Z.fallback,requestUrl:J.request.url})}function x5(J,Z,$){if(J instanceof Response)return{response:J};if(typeof J==="string")return{location:o1(J,{rules:t1(),fallback:Z,requestUrl:$})};return{location:Z}}function U5(J,Z){if(Z.length===0)return J;let $=new Headers(J.headers);for(let X of Z)$.append("Set-Cookie",X);return new Response(J.body,{status:J.status,statusText:J.statusText,headers:$})}var M1="ciam",p2="id_token",u2="access_token";function l2(J,Z,$,X,Q,G){if(!$&&!X)return;let F=new WeakMap,B={...$,...X},W={...B,magicLinkTtl:B.magicLinkTtl??3600,sessionTtl:B.sessionTtl??86400,cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.ciamId?`es.ciam.${B.ciamId}`:"es.ciam"),cookiesPath:B.cookiesPath??"/"};function L(){if(!W.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return W.sessionStore}function f(){L()}let u=J.callbackParams??c5(U9("enterprisestandard.ciam")),i=J.idTokenClaims??c5(D1("enterprisestandard.ciam")),J5=J.tokenResponse??c5(k9("enterprisestandard.ciam"));function r(K=32){let H=new Uint8Array(K);return crypto.getRandomValues(H),Array.from(H,(N)=>N.toString(16).padStart(2,"0")).join("").substring(0,K)}function G5(K,H,N,z=W.cookiesSameSite??"Strict"){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");if(K=`${W.cookiesPrefix}.${K}`,typeof H!=="string")H=btoa(JSON.stringify(H));let j;if(N instanceof Date)j=`Expires=${N.toUTCString()}`;else if(typeof N==="number")j=`Max-Age=${N}`;else throw Error("Invalid expires type",N);if(H.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${H.length}`);return`${K}=${H}; ${j}; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${z};`}function p(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");return`${W.cookiesPrefix}.${K}=; Max-Age=0; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${W.cookiesSameSite};`}function c(K,H,N=!1){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");let z=H.headers.get("cookie");if(!z)return null;let j=`${W.cookiesPrefix}.${K}`,M=z.split(";").find((E)=>E.trim().startsWith(`${j}=`));if(!M)return null;let _=M.indexOf("="),D=M.substring(_+1).trim();if(!N)return D;try{let E=atob(D);return JSON.parse(E)}catch(E){return Z.error("[CIAM] Failed to parse cookie",{"es.operation":"cookie.parse","es.outcome":"failure",cookieName:j},E),null}}function l(K){return`cstate_${K}`}async function B5(K,H,N,z){let j=await W.afterLogin?.({...H,request:K,context:N}),M=x5(j,"/",K.url);if(M.response)return U5(M.response,z.map(([,_])=>_));return new Response(H.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",M.location],...z]})}function s(K,H){return["Set-Cookie",G5("session",K,H)]}function $5(K){if(!K)return;if(K instanceof Date)return K;let H=new Date(K);return Number.isNaN(H.getTime())?void 0:H}async function j5(K){let H=c("session",K);if(!H)return;let N=await L().get(H);if(N&&W.tenantId&&N.tenantId&&N.tenantId!==W.tenantId)return;if(N?.authType!=="ciam")return;let z=$5(N.expiresAt);if(z&&Date.now()>z.getTime()){await L().delete(H);return}return N}async function q5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H=F.get(K);if(H)return H;let N=i5(K);return F.set(K,N),N}async function i5(K){try{let H=await j5(K);if(!H?.claims?.sub)return{status:"unauthenticated"};return{status:"authenticated",value:N5(H.claims)}}catch(H){return Z.error("CIAM session resolution failed",{"es.operation":"ciam.session","es.outcome":"degraded"},H),{status:"degraded",error:H instanceof Error?H:void 0}}}async function g5(K){let H=await q5(K);return H.status==="authenticated"?H.value:void 0}async function m5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H;try{H=await g5(K)}catch{H=void 0}let N=await W.beforeLogout?.({request:K,user:H});try{let P=c("session",K);if(P)await L().delete(P)}catch(P){Z.warn("Failed to delete CIAM session",{"es.operation":"session.delete","es.outcome":"degraded"},P)}let z=[["Set-Cookie",p("session")]],j=await W.afterLogout?.({request:K,context:N}),M=x5(j,"/",K.url);if(M.response)return U5(M.response,z.map(([,P])=>P));let _=M.location??"/",D=K.headers.get("accept");if(D?.includes("application/json")||D?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...z]});return new Response("Logged out",{status:302,headers:[["Location",_],...z]})}function C5(K){return K.id||K.email||`ciam-${K.userName}`}function T5(K,H,N){return{sub:C5(K),iss:M1,aud:M1,typ:p2,exp:Math.floor(N.getTime()/1000),iat:Math.floor(Date.now()/1000),email:K.email,name:K.name,preferred_username:K.userName,picture:K.avatar,sid:H}}function p5(K,H,N){return{sub:K,iss:M1,aud:M1,typ:u2,exp:Math.floor(N.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:H,scope:"openid profile email"}}function N5(K){let H=K.exp?new Date(K.exp*1000):new Date;return{id:K.sub,userName:K.preferred_username??"",name:K.name??"",email:K.email??"",avatar:K.picture,userType:"customer",ciam:{profile:K,scope:"openid profile email",tokenType:"Bearer",expires:H}}}async function u5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");if(!Q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await Q.getWorkloadIdentity(K))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let N,z;try{if(!K.headers.get("content-type")?.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let v=await K.text(),y=JSON.parse(v);z=typeof y?.redirect==="string"&&y.redirect.length>0?y.redirect:void 0;let Y={userName:y.userName,name:y.name,email:y.email,avatar:y.avatar},O=await J.customer.validate(Y);if(O.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}});N=O.value}catch(R){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let M=new URL(K.url).searchParams.get("ttl"),_=M?parseInt(M,10):W.magicLinkTtl??3600;if(Number.isNaN(_)||_<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let D=r(32),E=new Date(Date.now()+_*1000);if(!W.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await W.magicLinkStore.create(D,N,E)}catch(R){return Z.error("Error creating magic link",{"es.operation":"magic_link.create","es.outcome":"failure"},R),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let P=new URL(K.url),w=W.magicLinkLoginUrl||"/magic-link/login",q=new URL(w,P.origin);if(q.searchParams.set("token",D),z)q.searchParams.set("redirect",z);return new Response(JSON.stringify({magicLink:q.toString(),expiresAt:E.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function S5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let N=new URL(K.url).searchParams.get("token");if(!N)return B5(K,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!W.magicLinkStore)return B5(K,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let z=await W.magicLinkStore.getAndDelete(N);if(!z)return B5(K,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let j=new Date(Date.now()+(W.sessionTtl??86400)*1000),M=r(32),_=C5(z.customer),D=T5(z.customer,M,j),E=p5(_,M,j),P=N5(D),w;try{let R={sid:M,sub:_,authType:"ciam",tenantId:W.tenantId,expiresAt:j,claims:D,accessClaims:E,createdAt:new Date};await L().create(R),w=R}catch(R){throw Z.warn("Failed to create session",{"es.operation":"session.create","es.outcome":"degraded"},R),R}if(W.customerStore)try{let R=P.id;if(R){let v=new Date,y=await W.customerStore.get(R);if(y||W.enableJitUserProvisioning){let Y={...y??{},...P,id:R,tenantId:y?.tenantId,createdAt:y?.createdAt??v,updatedAt:v,userType:y?.userType??"customer"};await W.customerStore.upsert(Y)}}}catch(R){Z.warn("Failed to store customer",{"es.operation":"customer.store","es.outcome":"degraded"},R)}let q=[s(M,j)];return B5(K,{ok:!0,user:P,session:w},void 0,q)}function L5(K,H=200,N=[]){return new Response(JSON.stringify(K),{status:H,headers:[["Content-Type","application/json"],...N]})}function M5(K,H){try{return new URL(K).toString()}catch{let N=new URL(H).origin,z=W.cookiesSecure?N.replace(/^http:\/\//,"https://"):N;return new URL(K,z).toString()}}function x(){let K=W.customerLoginUrl||"/auth/customer/login",H=K.includes("?")?"&":"?";return v1(W.providers).map(({name:N,config:z})=>{let j=C1(z);return{name:N,type:z.type,displayName:j.displayName,loginUrl:`${K}${H}provider=${encodeURIComponent(N)}`,iconUrl:j.iconUrl,colors:j.colors,url:j.url}})}async function U(K){if(!K)return{};let{authorizationUrl:H,tokenUrl:N,jwksUri:z,userInfoUrl:j}=K,M=K.config.authority;if(M&&(!H||!N||K.flow==="id_token"&&!z))try{let D=await n1(M);H=H??D.authorizationUrl,N=N??D.tokenUrl,z=z??D.jwksUri,j=j??D.userInfoUrl}catch(D){Z.error("CIAM provider OIDC discovery failed",{"es.operation":"ciam.oidc.discovery","es.outcome":"failure"},D)}return{authorizationUrl:H,tokenUrl:N,jwksUri:z,userInfoUrl:j}}async function h(K){if(K.type==="apple"){let{teamId:H,keyId:N,privateKey:z,clientId:j}=K.config;if(H&&N&&z&&j)return i1({teamId:H,keyId:N,privateKey:z,clientId:j})}return K.clientSecret}async function n(K){L();let N=new URL(K.url).searchParams.get("provider");if(!N)return L5({error:"Missing required query parameter: provider"},400);let z=W.providers?.[N];if(!z||z.enabled===!1||z.type==="magic-link")return L5({error:`Unknown or disabled CIAM provider: ${N}`},404);let j=V1(N,z);if(!j?.clientId)return L5({error:`CIAM provider ${N} is not fully configured`},500);let M=await U(j);if(!M.authorizationUrl)return L5({error:`CIAM provider ${N} is missing an authorization endpoint`},500);let _=W.customerCallbackUrl||"/auth/customer/callback",D=M5(_,K.url),E=D5(),P=D5(64),w=D5(),q=j.flow==="id_token",R=q?await J1(P):void 0,v=await W.beforeLogin?.({request:K}),y=l1({authorizationUrl:M.authorizationUrl,clientId:j.clientId,redirectUri:D,scope:j.scope,state:E,codeChallenge:R,nonce:w,extraParams:j.extraAuthParams}),Y={provider:N,state:E,codeVerifier:q?P:void 0,nonce:w,redirectUri:D,...v===void 0?{}:{context:v}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",y],["Set-Cookie",G5(l(E),Y,W.loginStateTtl??600,"Lax")]]})}async function e(K){if(K.method==="POST"){if((K.headers.get("content-type")??"").includes("application/x-www-form-urlencoded")){let N=await K.text();return Object.fromEntries(new URLSearchParams(N).entries())}}return Object.fromEntries(new URL(K.url).searchParams.entries())}async function t(K,H){let N=K.mapClaims(H);if(!N.sub)return{ok:!1};let z=`${K.name}:${N.sub}`,j={id:z,userName:N.userName||N.email||z,name:N.name||"",email:N.email||"",avatar:N.avatar,userType:"customer"},M=z;if(W.customerStore){let q=await W.customerStore.lookup(j)??await W.customerStore.get(z);if(M=q?.id??z,!q&&!W.enableJitUserProvisioning)return Z.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"es.operation":"customer.store","es.outcome":"skipped"}),{ok:!1};let R=new Date,v={...q??{},...j,id:M,tenantId:q?.tenantId,createdAt:q?.createdAt??R,updatedAt:R,userType:q?.userType??"customer"};await W.customerStore.upsert(v)}let _=new Date(Date.now()+(W.sessionTtl??86400)*1000),D=D5(32),E={sub:M,iss:K.name,aud:K.clientId,exp:Math.floor(_.getTime()/1000),iat:Math.floor(Date.now()/1000),email:N.email,name:N.name,preferred_username:N.userName??N.email,picture:N.avatar,sid:D},P={sid:D,sub:M,authType:"ciam",tenantId:W.tenantId,expiresAt:_,claims:E,accessClaims:{sub:M,sid:D,scope:K.scope},createdAt:new Date},w=L();try{await w.create(P)}catch(q){if(!await w.get(D))throw q;await w.update(D,P)}return{ok:!0,claims:E,sid:D,expires:_}}async function V(K){L();let H,N,z=(j)=>{let M=H?[["Set-Cookie",p(H)]]:[];return B5(K,{ok:!1,error:j},N,M)};try{let j=await e(K),M=await u.validate(j);if(M.issues||!M.value)return z(Error("Invalid CIAM callback parameters"));let{code:_,state:D}=M.value;if(!D)return z(Error("Missing CIAM callback state"));H=l(D);let E=c(H,K,!0);if(N=E?.context,!E?.provider||!E.state||E.state!==D)return Z.warn("CIAM callback state verification failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM callback state verification failed"));let P=W.providers?.[E.provider];if(!P)return z(Error("Unknown CIAM provider"));let w=V1(E.provider,P);if(!w?.clientId)return z(Error("CIAM provider not configured"));let q=await U(w);if(!q.tokenUrl)return z(Error("CIAM provider missing token endpoint"));let R=await h(w),v=await c1({tokenUrl:q.tokenUrl,clientId:w.clientId,clientSecret:R,redirectUri:E.redirectUri||M5(W.customerCallbackUrl||"/auth/customer/callback",K.url),code:_,codeVerifier:w.flow==="id_token"?E.codeVerifier:void 0,log:Z}),y;if(w.flow==="id_token"){let b=w.config.authority;if(!v.id_token||!q.jwksUri||!b)return z(Error("CIAM id_token flow misconfigured"));if(!E.nonce)return z(Error("CIAM callback state cookie missing nonce"));if((await J5.validate(v)).issues)return Z.warn("CIAM token response validation failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM token response validation failed"));y=await R5({idToken:v.id_token,jwksUri:q.jwksUri,issuer:b,audience:w.clientId,expectedNonce:E.nonce,log:Z});let C=await i.validate(y);if(!C.issues)y=C.value}else{if(!q.userInfoUrl)return z(Error("CIAM provider missing userinfo endpoint"));y=await a1(q.userInfoUrl,v.access_token);let b=w.config.authority;if(v.id_token&&q.jwksUri&&b){let S=await R5({idToken:v.id_token,jwksUri:q.jwksUri,issuer:b,audience:w.clientId,expectedNonce:E.nonce||void 0,log:Z}),C=typeof S.sub==="string"?S.sub:"";if(C){if(typeof y.sub==="string"&&y.sub.length>0&&y.sub!==C)return Z.warn("CIAM UserInfo sub does not match verified id_token sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM UserInfo sub mismatch"));y.sub=C}}if(typeof y.sub!=="string"||y.sub.length===0)return Z.warn("CIAM UserInfo response missing sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM UserInfo response missing sub"))}let Y=await t(w,y);if(!Y.ok)return z(Error("Failed to persist CIAM customer"));let O=N5(Y.claims);Z.info("CIAM third-party sign-in succeeded",{"es.operation":"ciam.oidc.callback","es.outcome":"success",provider:w.name});let T=[["Set-Cookie",p(H)],s(Y.sid,Y.expires)];return B5(K,{ok:!0,user:O,session:void 0},N,T)}catch(j){return Z.error("Error during CIAM third-party sign-in callback",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"},j),z(j)}}async function A(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H=W.magicLinkUrl||"/magic-link",N=W.magicLinkLoginUrl||"/magic-link/login",z=W.logoutUrl||"/auth/customer/logout",j=W.customerLoginUrl||"/auth/customer/login",M=W.customerCallbackUrl||"/auth/customer/callback",_=W.customerProvidersUrl||"/auth/customer/providers",D=new URL(K.url).pathname,E=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(E(H)===D&&K.method==="POST")return u5(K);if(E(N)===D&&K.method==="GET")return S5(K);if(E(z)===D&&K.method==="GET")return m5(K);if(E(_)===D&&K.method==="GET")return L5({providers:x()});if(E(j)===D&&K.method==="GET")return n(K);if(E(M)===D&&(K.method==="GET"||K.method==="POST"))return V(K);return new Response("Not Found",{status:404})}return{...W,getCustomer:g5,resolveCustomer:q5,logout:m5,handler:A,listCustomerProviders:x}}async function c2(J,Z){return m(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),Z.ciam?.getCustomer(J)}async function d2(J,Z){return m(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),await Z.ciam?.resolveCustomer(J)??{status:"unauthenticated"}}var Y1="application/scim+json",n2="urn:ietf:params:scim:api:messages:2.0:ListResponse",Q9="urn:ietf:params:scim:api:messages:2.0:Error",P1="urn:ietf:params:scim:schemas:core:2.0:User",h5="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",O1="urn:ietf:params:scim:schemas:core:2.0:Group",a2="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",f9="urn:ietf:params:scim:schemas:core:2.0:ResourceType",Z1="urn:ietf:params:scim:schemas:core:2.0:Schema",i2="00000000000000000000000000000000";function t2(J){let Z={timestamp:new Date().toISOString()};if(J)Z.actor=J;try{let Q=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),G=Q?.traceId;if(G&&G!==i2){if(Z.traceId=G,Q?.spanId)Z.spanId=Q.spanId}}catch{}return Z}class B1 extends Error{constructor(J){super(J);this.name="SubjectTypeNotAssignableError",Object.setPrototypeOf(this,B1.prototype)}}async function o2(J,Z,$,X,Q){let G=X.subjectType??"user";if(!X9.includes(G))throw new B1(`Cannot grant ${X.targetType} "${V5(X.target)}" to a "${G}" principal: only [${X9.join(", ")}] principals are assignable on this platform.`);let F=G9(Z,J);if(!F&&!Q)return;let B=V5(X.target),W;if(Q)W=await Q.getNode(X.targetType,B);else if(F){if(W=await(X.targetType==="group"?F.groups:X.targetType==="role"?F.roles:F.permissions).get(B),!W&&X.targetType==="group")W=await $?.entitlement?.(B)}let L=W?.assignableSubjectTypes;if(L&&L.length>0&&!L.includes(G))throw new B1(`Cannot grant ${X.targetType} "${B}" to a "${G}" principal: this entitlement restricts assignment to [${L.join(", ")}].`)}async function r2(J,Z,$,X){await o2(J.catalogStore,J.codeCatalog,J.resources,Z,X);let Q={...Z,status:Z.status??"active",provenance:Z.provenance??t2()};if(Q.id=W1(Q),await J.accessStore?.grant(Q),J.accessIndex&&(J.catalogStore||J.codeCatalog)){let G=await B9(Q,{catalog:J.catalogStore,code:J.codeCatalog,resources:J.resources,cache:X});await J.accessIndex.materialize(Q.id,G)}return $?.push({op:"add",change:Q}),Q}async function E1(J,Z,$){let X=Z.id??W1(Z);await J.accessStore?.revoke(Z),await J.accessIndex?.removeByRoot(X),$?.push({op:"delete",change:{...Z,id:X}})}async function K9(J,Z){let $=await s2(J,Z),X=await J4(J,Z);return{oaa:$,delta:X}}async function s2(J,Z){if(Z.length===0||!J.authz.oaa.isReady())return{status:"skipped"};return F9(J,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>J.authz.oaa.pushAccessChanges(Z),{count:Z.length})}async function F9(J,Z,$,X,Q){try{return await X(),{status:"ok"}}catch(G){return J.log?.warn($,{"es.operation":Z,"es.outcome":"degraded",...Q,error:b5(G)}),{status:"degraded",reason:b5(G)}}}var e2=6;async function J4(J,Z){let $=J.iamDelta;if(!$?.isReady()||Z.length===0)return{status:"skipped"};let X=new Map;for(let W of Z){let L=`${W.change.subjectType??"user"}:${V5(W.change.subject)}\x00${W.change.targetType}:${V5(W.change.target)}`;X.set(L,W)}let Q=[...X.values()],G=Q.map(({op:W,change:L})=>()=>W==="add"?$.onGrant(L):$.onRevoke(L)),B=(await Z4(G,e2)).filter((W)=>W.status==="rejected");if(B.length>0)return J.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"es.operation":"iam.delta.egress","es.outcome":"degraded",failed:B.length,total:Q.length,error:b5(B[0]?.reason)}),{status:"degraded",reason:b5(B[0]?.reason)};return{status:"ok"}}async function Z4(J,Z){let $=Array(J.length),X=0,Q=async()=>{while(!0){let F=X++;if(F>=J.length)return;let B=J[F];if(!B)continue;try{$[F]={status:"fulfilled",value:await B()}}catch(W){$[F]={status:"rejected",reason:W}}}},G=Array.from({length:Math.min(Z,J.length)},Q);return await Promise.all(G),$}class w1 extends Error{constructor(J){super(J);this.name="DerivedRevokeError",Object.setPrototypeOf(this,w1.prototype)}}class a5 extends Error{summary;clientError;constructor(J,Z,$=!1){super(J);this.name="ScimMutationError",this.summary=Z,this.clientError=$,Object.setPrototypeOf(this,a5.prototype)}}function k(J,Z,$){return new Response(JSON.stringify({schemas:[Q9],status:String(J),scimType:$,detail:Z}),{status:J,headers:{"Content-Type":Y1}})}function d5(J,Z){let $=Z?.totalResults??J.length,X=Z?.startIndex??1,Q=Z?.itemsPerPage??J.length;return new Response(JSON.stringify({schemas:[n2],totalResults:$,startIndex:X,itemsPerPage:Q,Resources:J}),{status:200,headers:{"Content-Type":Y1}})}function H5(J,Z=200){return new Response(JSON.stringify(J),{status:Z,headers:{"Content-Type":Y1}})}function h9(J){return k(J.clientError?409:500,`${J.message}; authz mutation summary: ${JSON.stringify(J.summary)}`,J.clientError?"mutability":"invalidValue")}function K1(J){return W1(J)}function r1(J,Z){return X1(g9(J),g9(Z))}function g9(J){let Z=new Map;if(!J?.id)return Z;for(let $ of J.groups??[]){let X={subject:J.id,targetType:"group",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type}:void 0};Z.set(K1(X),X)}for(let $ of J.roles??[]){let X={subject:J.id,targetType:"role",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}for(let $ of J.entitlements??[]){let X={subject:J.id,targetType:"permission",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}return Z}function $1(J,Z,$,X){let Q=new Map,G=X&&X.length>0?X:void 0;for(let F of J??[]){let B={subject:F.value,targetType:Z,target:$,resources:G,metadata:F.display||F.type?{display:F.display,type:F.type}:void 0};Q.set(K1(B),B)}return Q}function s1(J){let Z=J[Y5]?.resources;return Z&&Z.length>0?Z:void 0}function $4(J,Z,$){let X=J[Y5];if(J.displayName!==void 0&&J.displayName!==(Z.displayName??Z.name))return!0;if(J.externalId!==void 0&&J.externalId!==Z.externalId)return!0;if(X?.type!==void 0&&X.type!==$)return!0;if(X?.requestable!==void 0&&Boolean(X.requestable)!==Boolean(Z.requestable))return!0;if(X?.description!==void 0&&X.description!==Z.description)return!0;if(X?.resources!==void 0){let Q=[...X.resources].sort().join(","),G=[...j1(Z)??[]].sort().join(",");if(Q!==G)return!0}return!1}function m9(J){let Z=new Map;for(let $ of J)Z.set(K1($),$);return Z}async function O5(J,Z,$,X,Q,G,F){let B=[],W=new Set,L=F?F.get(`${X}:${Q}`)??[]:Z?(await Z.listByTarget(X,Q)).items:[];for(let f of L){let u=V5(f.subject);if(W.has(u))continue;W.add(u);let i=f.metadata,J5=f.subjectType==="workload"?"Workload":i?.type??"User";B.push({value:u,...i?.display?{display:i.display}:{},type:J5})}for(let f of G??[]){if(f.targetType!==X||V5(f.target)!==Q)continue;let u=V5(f.subject);if(W.has(u))continue;W.add(u),B.push({value:u,type:"Workload"})}if(X==="group"){let f=await J.groups.get(Q)??await $?.entitlement?.(Q);for(let u of f?.groups??[]){let i=V5(u);if(!i||W.has(i))continue;W.add(i),B.push({value:i,type:"Group"})}}return B.length>0?B:void 0}function X1(J,Z){let $=[];for(let[X,Q]of Z)if(!J.has(X))$.push({action:"grant",change:Q});for(let[X,Q]of J)if(!Z.has(X))$.push({action:"revoke",change:Q});return $}async function e1(J,Z){if(J.oaa.isReady())await J.oaa.pushUser(Z)}async function k5(J,Z,$,X){let Q={metadataApplied:!1,access:[]},G=[],F=new Y9(J.catalogStore,J.resources,J.codeCatalog);try{try{await Z(),Q.metadataApplied=!0}catch(B){for(let W of $)Q.access.push({change:W.change,status:"rolled_back"});throw Q.metadataApplied=!1,new a5(`SCIM metadata write failed: ${b5(B)}`,Q,!1)}if(X)await F9(J,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",X);for(let B=0;B<$.length;B++){let W=$[B];try{if(W.action==="grant")await r2(J,W.change,G,F);else await Y4(J,W.change,G);Q.access.push({change:W.change,status:"applied"})}catch(L){Q.access.push({change:W.change,status:"failed",error:L});for(let u=B+1;u<$.length;u++)Q.access.push({change:$[u].change,status:"rolled_back"});let f=L instanceof w1||L instanceof B1;if(!f)await Q4(J,W.change,F);throw new a5(f?b5(L):`SCIM access mutation failed: ${b5(L)}`,Q,f)}}return Q}finally{await X4(J),Q.egress=await K9(J,G),K4(J,Q)}}function b5(J){return J instanceof Error?J.message:String(J)}async function X4(J){try{await J.authz.settle?.()}catch{}}async function Q4(J,Z,$){if(!J.accessIndex||!J.catalogStore&&!J.codeCatalog||!J.accessStore)return;let X=V5(Z.subject);if(!X)return;let Q=Z.subjectType??"user";try{await W9(X,Q,{accessStore:J.accessStore,accessIndex:J.accessIndex,catalogStore:J.catalogStore,code:J.codeCatalog,resources:J.resources},$)}catch(G){J.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"es.operation":"authz.reconcile.subject.repair","es.outcome":"degraded",subject:X,subjectType:Q,error:b5(G)})}}function K4(J,Z){if(!J.onAccessMutation)return;try{J.onAccessMutation(Z)}catch{}}async function Y4(J,Z,$){if(J.accessStore){let X=Z.id??W1(Z);if(!await J.accessStore.get(X)){if((J.accessIndex?await J.accessIndex.has(Z.subject,Z.targetType,Z.target,Z.resources?.[0],Z.subjectType):{allow:!1}).allow)throw new w1(`Cannot revoke ${Z.targetType} "${V5(Z.target)}" for "${V5(Z.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await E1(J,Z,$);return}}await E1(J,Z,$)}function Q1(J){let Z=J[Y5]?.type??"group";if(Z==="group"||Z==="role"||Z==="permission")return Z;throw Error(`Unsupported Enterprise Standard SCIM Group authz type "${String(Z)}"`)}async function J9(J,Z,$){if(!J.oaa.isReady())return;if($==="role"){await J.oaa.pushRole(Z);return}if($==="permission"){await J.oaa.pushPermission(Z);return}await J.oaa.pushGroup(Z)}function j1(J){let Z=J.resources;if(!Z||Z.length===0)return;let $=Z.map((X)=>typeof X==="string"?X:X.id).filter(Boolean);return $.length>0?$:void 0}function E5(J,Z,$){return{schemas:[O1],id:J.id,externalId:J.externalId,displayName:J.displayName??J.name,members:$,[Y5]:{type:Z,requestable:J.requestable,description:J.description,resources:Z==="group"?j1(J):void 0,assignableSubjectTypes:J.assignableSubjectTypes,recommendedSubjectTypes:J.recommendedSubjectTypes}}}function B4(J,Z){let $=J[Y5],X={id:Z,name:J.displayName,displayName:J.displayName,description:$?.description??J.displayName,externalId:J.externalId,requestable:$?.requestable};if($?.resources!==void 0)X.resources=$.resources;return X}function W4(J){if(!J)return;let Z=J.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!Z)return;return{requestable:Z[1]?.toLowerCase()==="true"}}function p9(J){if(!J)return;let Z=J.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return Z?Z[1]:void 0}async function H9(J,Z){if(!J?.entitlements)return[];let $=J.entitlements.bind(J),X=[];for await(let Q of l9((G,F)=>J.list({start:G,limit:F})))for(let G of $(Q)){if(Z?.requestable!==void 0&&Boolean(G.requestable)!==Z.requestable)continue;X.push(G1(G))}return X}async function G4(J,Z,$,X,Q){let G=[{store:J.groups,type:"group"},{store:J.roles,type:"role"},{store:J.permissions,type:"permission"}],F;if(G.every(({store:W})=>typeof W.getByExternalId==="function"))F=(await Promise.all(G.map(async({store:L,type:f})=>{let u=await L.getByExternalId?.(X);return u?{entity:u,type:f}:void 0}))).filter((L)=>L!==void 0);else{let W={start:0},[L,f,u]=await Promise.all([J.groups.list(W),J.roles.list(W),J.permissions.list(W)]);F=[...L.items.map((J5)=>({entity:J5,type:"group"})),...f.items.map((J5)=>({entity:J5,type:"role"})),...u.items.map((J5)=>({entity:J5,type:"permission"}))].filter(({entity:J5})=>J5.externalId===X)}if($?.entitlements){let W=await H9($);for(let L of W)if(L.externalId===X)F.push({entity:L,type:"group"})}if(F.length>1)throw new L9(`Ambiguous externalId "${X}": ${F.length} entitlements share it (${F.map((W)=>`${W.type}:${W.entity.id}`).join(", ")})`,"unique_violation","externalId");let B=F[0];if(!B)return;return E5(B.entity,B.type,await O5(J,Z,$,B.type,B.entity.id,Q))}async function L4(J,Z,$,X,Q){let G=Math.max(0,X.start),F=X.limit!=null?G+X.limit:void 0,B={start:0,limit:F,filter:X.filter},[W,L,f]=await Promise.all([J.groups.list(B),J.roles.list(B),J.permissions.list(B)]),u=[...W.items.map((s)=>({entity:s,type:"group"})),...L.items.map((s)=>({entity:s,type:"role"})),...f.items.map((s)=>({entity:s,type:"permission"}))],i=W.total+L.total+f.total,J5=u.slice(G,F),r=0,G5=[];if($?.entitlements){let s=await H9($,X.filter);r=s.length;let $5=X.limit!=null?X.limit-J5.length:void 0;if($5===void 0||$5>0){let j5=Math.max(0,G-i);G5=$5===void 0?s.slice(j5):s.slice(j5,j5+$5)}}let p=[...J5,...G5.map((s)=>({entity:s,type:"group"}))],c=i+r,l=Z?.listByTargets?await Z.listByTargets(p.map(({entity:s,type:$5})=>({targetType:$5,target:s.id}))):void 0,B5=await Promise.all(p.map(async({entity:s,type:$5})=>E5(s,$5,await O5(J,Z,$,$5,s.id,Q,l))));return{resources:B5,total:c,count:B5.length}}async function _1(J,Z,$,X,Q){let[G,F,B]=await Promise.all([J.groups.get(X),J.roles.get(X),J.permissions.get(X)]);if(G)return E5(G,"group",await O5(J,Z,$,"group",X,Q));if(F)return E5(F,"role",await O5(J,Z,$,"role",X,Q));if(B)return E5(B,"permission",await O5(J,Z,$,"permission",X,Q));let W=G1(await $?.entitlement?.(X));if(W)return E5(W,"group",await O5(J,Z,$,"group",X,Q));return}async function Z9(J,Z,$){let X=Q1(Z),G={...(X==="role"?await J.roles.get($):X==="permission"?await J.permissions.get($):await J.groups.get($))??{},...B4(Z,$)},F=X==="role"?J.roles.set(G):X==="permission"?J.permissions.set(G):J.groups.set(G);return await F.ready(),F}async function F4(J,Z){await Promise.all([J.groups.delete(Z),J.roles.delete(Z),J.permissions.delete(Z)])}function u9(){return crypto.randomUUID()}function n5(J,Z){let $=J;if(typeof $.validate==="function")return $.validate(Z);return Promise.resolve(J["~standard"].validate(Z))}function H4(J){if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}}function f5(J){let Z=H4(J);return Z?z1(Z):void 0}function V4(J,Z){let $=f5(J);if($?.endsWith("/Users"))return $.slice(0,-6);let X=f5(Z);if(X?.endsWith("/Groups"))return X.slice(0,-7);return}function y5(J,Z){return new URL(Z,J.url).toString()}function I(J,Z,$,X){let{multiValued:Q=!1,...G}=X??{};return{name:J,type:Z,description:$,multiValued:Q,...G}}function N4(J,Z){return{schemas:[a2],documentationUri:Z?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an Enterprise Standard workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:y5(J.request,`${J.basePath}/ServiceProviderConfig`)}}}function M4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[f9],id:"User",name:"User",description:"User Account",endpoint:J.usersUrl,schema:P1,schemaExtensions:[{schema:h5,required:!1},{schema:I5,required:!1}],meta:{resourceType:"ResourceType",location:y5(J.request,`${J.basePath}/ResourceTypes/User`)}});if(J.supportsGroups)Z.push({schemas:[f9],id:"Group",name:"Group",description:"Group",endpoint:J.groupsUrl,schema:O1,schemaExtensions:[{schema:Y5,required:!1}],meta:{resourceType:"ResourceType",location:y5(J.request,`${J.basePath}/ResourceTypes/Group`)}});return Z}function D4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[Z1],id:P1,name:"User",description:"User Account",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(P1)}`)},attributes:[I("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),I("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),I("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),I("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[I("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),I("familyName","string","The family name of the User.",{multiValued:!1}),I("givenName","string","The given name of the User.",{multiValued:!1}),I("middleName","string","The middle name(s) of the User.",{multiValued:!1}),I("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),I("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),I("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),I("nickName","string","The casual way to address the user.",{multiValued:!1}),I("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),I("title","string","The user title, such as Vice President.",{multiValued:!1}),I("userType","string","The relationship between the organization and the User.",{multiValued:!1}),I("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),I("locale","string","Default location for localizing values.",{multiValued:!1}),I("timezone","string","The User time zone.",{multiValued:!1}),I("active","boolean","The User administrative status.",{multiValued:!1}),I("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[I("value","string","Email address value.",{multiValued:!1,required:!0}),I("display","string","Display label for the email.",{multiValued:!1}),I("type","string","Email type such as work or home.",{multiValued:!1}),I("primary","boolean","Primary email indicator.",{multiValued:!1})]}),I("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[I("value","string","Phone number value.",{multiValued:!1,required:!0}),I("display","string","Display label for the phone number.",{multiValued:!1}),I("type","string","Phone number type.",{multiValued:!1}),I("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),I("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[I("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),I("display","string","Display label for the photo.",{multiValued:!1}),I("type","string","Photo type.",{multiValued:!1}),I("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),I("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[I("formatted","string","Formatted mailing address.",{multiValued:!1}),I("streetAddress","string","Full street address component.",{multiValued:!1}),I("locality","string","City or locality.",{multiValued:!1}),I("region","string","State or region.",{multiValued:!1}),I("postalCode","string","Postal code.",{multiValued:!1}),I("country","string","Country.",{multiValued:!1}),I("type","string","Address type.",{multiValued:!1}),I("primary","boolean","Primary address indicator.",{multiValued:!1})]}),I("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[I("value","string","Group identifier.",{multiValued:!1,required:!0}),I("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),I("display","string","Display name of the group.",{multiValued:!1}),I("type","string","Relationship type.",{multiValued:!1})]}),I("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[I("value","string","Entitlement value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Entitlement type.",{multiValued:!1}),I("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),I("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[I("value","string","Role value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Role type.",{multiValued:!1}),I("primary","boolean","Primary role indicator.",{multiValued:!1})]}),I("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[I("value","string","Certificate value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Certificate type.",{multiValued:!1}),I("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:h5,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(h5)}`)},attributes:[I("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),I("costCenter","string","Name of a cost center.",{multiValued:!1}),I("organization","string","Name of an organization.",{multiValued:!1}),I("division","string","Name of a division.",{multiValued:!1}),I("department","string","Name of a department.",{multiValued:!1}),I("manager","complex","The User manager.",{multiValued:!1,subAttributes:[I("value","string","Identifier of the manager User resource.",{multiValued:!1}),I("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),I("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:I5,name:"EnterpriseStandardUser",description:"Enterprise Standard User extension carrying the Enterprise Controlled ID (ECID) identity correlator and the account purpose (accountClass). See https://enterprisestandard.com/llms-ecid.txt.",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(I5)}`)},attributes:[I("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),I("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1})]}),Z.push({schemas:[Z1],id:Y5,name:"EnterpriseStandardAuthzGroup",description:"Enterprise Standard authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(Y5)}`)},attributes:[I("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),I("requestable","boolean","Whether this catalog entry should be requestable access in IAM tooling.",{multiValued:!1,required:!1}),I("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),I("assignableSubjectTypes","string","AppDev-owned hard ceiling of principal kinds (user, workload) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]}),I("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]})]});if(J.supportsGroups)Z.push({schemas:[Z1],id:O1,name:"Group",description:"Group",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(O1)}`)},attributes:[I("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),I("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),I("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),I("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[I("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),I("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group"]}),I("display","string","Display name of the member.",{multiValued:!1}),I("type","string","Member type.",{multiValued:!1})]})]});return Z}function _4(J,Z,$,X,Q,G,F,B,W,L,f,u,i,J5){let r={authz:X,accessStore:Q,accessIndex:G,catalogStore:F,codeCatalog:B,resources:W,log:Z,iamDelta:u,onAccessMutation:i};if(!L&&!f)return;let p={...L,...f},c=p.users?.enabled!==!1,l=p.groups?.enabled!==!1;if(Boolean(p.url||p.userStore||F||B)&&!$)Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"});function s(){if(!$)throw Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return $}async function $5(x){let U=s(),h=x.headers.get("Authorization");if(!h?.startsWith("Bearer "))return!1;try{let n=h.substring(7);return(await U.validateToken(n)).valid}catch{return!1}}async function j5(){let x=s(),U=typeof x.getServerToken==="function"?await x.getServerToken():await x.getToken();return new Headers({"Content-Type":Y1,Accept:Y1,Authorization:`Bearer ${U}`})}async function q5(x,U,h,n){if(!p.url)throw Error("IAM URL not configured for outgoing requests");let e=`${p.url}${U}`;try{let t=await j5(),V=await fetch(e,{method:x,headers:t,body:h?JSON.stringify(h):void 0}),A=await V.json();if(!V.ok)return{success:!1,error:A,status:V.status};let K=await n["~standard"].validate(A);if(K.issues)return Z.error("SCIM response validation failed",{"es.operation":"scim.response.validate","es.outcome":"failure",validationIssues:K.issues}),{success:!1,error:{schemas:[Q9],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${K.issues.map((H)=>H.message).join("; ")}`},status:400};return{success:!0,data:K.value,status:V.status}}catch(t){return{success:!1,error:{schemas:[Q9],status:"500",detail:t instanceof Error?t.message:"Unknown error occurred"},status:500}}}function i5(){return p.url}function g5(x,U){let h=f5(U?.usersUrl??p.usersUrl??"/api/iam/Users")??"/api/iam/Users",n=f5(U?.groupsUrl??p.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",e=f5(U?.discovery?.basePath??p.discovery?.basePath)??V4(h,n);if(!e)return;return{request:x,basePath:e,usersUrl:h,groupsUrl:n,supportsUsers:c&&Boolean(p.userStore),supportsGroups:l&&Boolean(F||B)}}async function m5(x){let U=N4(x,p.discovery);return await p.discovery?.buildServiceProviderConfig?.(x,U)??U}async function C5(x){let U=M4(x);return await p.discovery?.buildResourceTypes?.(x,U)??U}async function T5(x){let U=D4(x);return await p.discovery?.buildSchemas?.(x,U)??U}async function p5(x,U){let h=g5(x,U);if(!h)return;let n=z1(new URL(x.url).pathname),{basePath:e}=h;if(n!==e&&!n.startsWith(`${e}/`))return;let t=z1(n.slice(e.length)||"/");if(!(t==="/ServiceProviderConfig"||t==="/ResourceTypes"||t.startsWith("/ResourceTypes/")||t==="/Schemas"||t.startsWith("/Schemas/")))return;if(x.method!=="GET")return k(405,"Method not allowed");if(!await $5(x))return k(401,"Authorization required");if(t==="/ServiceProviderConfig")return H5(await m5(h));if(t==="/ResourceTypes")return d5(await C5(h));if(t.startsWith("/ResourceTypes/")){let K=decodeURIComponent(t.slice(15)),H=(await C5(h)).find((N)=>N.id===K||N.name===K);return H?H5(H):k(404,"Resource not found")}if(t==="/Schemas")return d5(await T5(h));if(t.startsWith("/Schemas/")){let K=decodeURIComponent(t.slice(9)),H=(await T5(h)).find((N)=>N.id===K);return H?H5(H):k(404,"Resource not found")}return}let N5,u5;if(p.url)u5=async(U,h)=>{let n={...U,schemas:U.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return q5("POST","/Users",n,J.user)},N5={createGroup:async(U,h)=>{let n={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:U,externalId:h?.externalId,members:h?.members};return q5("POST","/Groups",n,J.group)}};let S5;if(F||B){let x=G9(B,F),U=async(M)=>{if(!W?.entitlement)return;let[_,D,E]=await Promise.all([x.groups.get(M),x.roles.get(M),x.permissions.get(M)]);if(_||D||E)return;return G1(await W.entitlement(M))},h=(M,_)=>k(403,`Entitlement "${M}" is derived from the application's resource data (ResourceProvider.entitlements); its definition cannot be ${_} through SCIM. Member add/remove is allowed; the definition changes only when the application's resources or derivation logic change.`,"mutability"),n=(M)=>{if(!B)return;let _=B.groups.get(M);if(_)return{entity:_,type:"group"};let D=B.roles.get(M);if(D)return{entity:D,type:"role"};let E=B.permissions.get(M);if(E)return{entity:E,type:"permission"};return},e=(M,_)=>k(403,`Entitlement "${M}" is declared in application code (authz.catalog); its definition cannot be ${_} through SCIM. Member add/remove is allowed; the definition changes only when the application code changes.`,"mutability"),t=(M)=>M.path==="members"||Boolean(M.path?.startsWith("members[")),V=async(M,_)=>{if(!await $5(M))return k(401,"Authorization required");let E=new URL(M.url),P=_?.basePath??"/Groups",w=E.pathname;if(w.startsWith(P))w=w.substring(P.length);let R=w.match(/^\/([^/]+)$/)?.[1],v=M.method;try{if(R)switch(v){case"GET":return await K(R);case"PUT":return await N(M,R);case"PATCH":return await z(M,R);case"DELETE":return await j(R);default:return k(405,"Method not allowed")}else if(w===""||w==="/")switch(v){case"GET":return await A(M);case"POST":return await H(M);default:return k(405,"Method not allowed")}return k(404,"Resource not found")}catch(y){if(y instanceof a5)return h9(y);if($9(y))return k(409,y.message,"uniqueness");return Z.error("Groups inbound handler error",{"es.operation":"scim.groups.handler","es.outcome":"failure"},y),k(500,y instanceof Error?y.message:"Internal server error")}},A=async(M)=>{let _=new URL(M.url),D=_.searchParams.get("startIndex"),E=_.searchParams.get("count"),P=D!=null?parseInt(D,10):void 0,w=E!=null?parseInt(E,10):void 0,q=P!=null&&!Number.isNaN(P)?Math.max(0,P-1):0,R=w!=null&&!Number.isNaN(w)?w:void 0,v=_.searchParams.get("filter"),y=p9(v);if(y!==void 0){let T=await G4(x,Q,W,y,J5),b=T?[T]:[];return d5(b,{totalResults:b.length,startIndex:1,itemsPerPage:b.length})}let Y=W4(v),O=await L4(x,Q,W,{start:q,limit:R,filter:Y},J5);return d5(O.resources,{totalResults:O.total,startIndex:q+1,itemsPerPage:O.count})},K=async(M)=>{let _=await _1(x,Q,W,M,J5);if(!_)return k(404,`Group ${M} not found`,"invalidValue");return H5(_)},H=async(M)=>{let _=await M.json(),D=await n5(J.group,_);if(D.issues)return Z.error("Group creation validation failed",{"es.operation":"scim.group.create","es.outcome":"failure",validationIssues:D.issues}),k(400,`Request validation failed: ${D.issues.map((Y)=>Y.message).join("; ")}`,"invalidValue");let E=D.value;if(!E.displayName)return k(400,"displayName is required","invalidValue");if(!F)return k(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");if(E.externalId){let Y=E.externalId,O=B&&(B.groups.getByExternalId(Y)??B.roles.getByExternalId(Y)??B.permissions.getByExternalId(Y)),T=!O&&W?.entitlements?(await H9(W)).find((S)=>S.externalId===Y):void 0,b=O||T;if(b)throw new L9(`externalId "${Y}" is already used by ${O?"code-declared":"resource-derived"} entitlement "${b.id}"`,"unique_violation","externalId")}let P=Q1(E),w=u9(),q=s1(E),R=X1(new Map,$1(E.members,P,w,q)),v;await k5(r,async()=>{v=await Z9(x,E,w)},R,()=>J9(X,v,P));let y=await O5(x,Q,W,P,w);return H5(E5(v,P,y),201)},N=async(M,_)=>{let D=await M.json(),E=await n5(J.group,D);if(E.issues)return Z.error("Group replacement validation failed",{"es.operation":"scim.group.replace","es.outcome":"failure",validationIssues:E.issues}),k(400,`Request validation failed: ${E.issues.map((C)=>C.message).join("; ")}`,"invalidValue");let P=E.value,w=Q1(P);if(!await _1(x,Q,W,_))return k(404,`Group ${_} not found`,"invalidValue");let R=n(_),v=R?void 0:await U(_),y=R??(v?{entity:v,type:"group"}:void 0);if(y){if($4(P,y.entity,y.type))return R?e(_,"replaced"):h(_,"replaced");let C=j1(y.entity),g=Q?(await Q.listByTarget(y.type,_)).items:[],d=X1(m9(g),$1(P.members,y.type,_,C));await k5(r,async()=>{},d);let a=await O5(x,Q,W,y.type,_);return H5(E5(y.entity,y.type,a))}let Y=s1(P),O=Q?(await Q.listByTarget(w,_)).items:[],T=X1(m9(O),$1(P.members,w,_,Y)),b;await k5(r,async()=>{b=await Z9(x,P,_)},T,()=>J9(X,b,w));let S=await O5(x,Q,W,w,_);return H5(E5(b,w,S))},z=async(M,_)=>{let D=await _1(x,Q,W,_);if(!D)return k(404,`Group ${_} not found`,"invalidValue");let E=n(_),P=E?void 0:await U(_),w=E??(P?{entity:P,type:"group"}:void 0),q=await M.json();if(w&&(q.Operations??[]).some((S)=>!t(S)))return E?e(_,"patched"):h(_,"patched");let R={...D};for(let S of q.Operations??[])if(S.op==="replace"&&S.path&&S.value!==void 0){if(S.path==="displayName")R.displayName=S.value;else if(S.path===`${Y5}.requestable`)R[Y5]={...R[Y5],requestable:Boolean(S.value)};else if(S.path===`${Y5}.description`)R[Y5]={...R[Y5],description:String(S.value)}}else if(S.op==="add"&&S.path==="members"&&S.value!==void 0){let C=S.value;R.members=[...R.members??[],...C]}else if(S.op==="remove"&&S.path?.startsWith("members[")){let C=S.path.match(/members\[value eq "([^"]+)"\]/);if(C)R.members=(R.members??[]).filter((g)=>g.value!==C[1])}let v=await n5(J.group,R);if(v.issues)return Z.error("Group patch validation failed",{"es.operation":"scim.group.patch","es.outcome":"failure",validationIssues:v.issues}),k(400,`Request validation failed: ${v.issues.map((S)=>S.message).join("; ")}`,"invalidValue");let y=Q1(R),Y=w?j1(w.entity):s1(R),O=X1($1(D.members,y,_,Y),$1(R.members,y,_,Y)),T;await k5(r,async()=>{if(!w)T=await Z9(x,R,_)},O,w?void 0:()=>J9(X,T,y));let b=await O5(x,Q,W,y,_);return H5(E5(w?.entity??T,y,b))},j=async(M)=>{let _=await _1(x,Q,W,M);if(!_)return k(404,`Group ${M} not found`,"invalidValue");if(n(M))return e(M,"deleted");if(await U(M))return h(M,"deleted");let D=Q1(_);if(Q){let E=await Q.listByTarget(D,M),P=[];for(let w of E.items)await E1(r,w,P);await K9(r,P)}return await F4(x,M),new Response(null,{status:204})};S5={handler:V}}let L5;if(p.userStore){let{userStore:x,inboundUsers:U}=p,h=(Y)=>Y?.find((O)=>O.primary)?.value||Y?.[0]?.value,n=(Y)=>{if(Y.scimName)return Y.scimName;if(!Y.name)return;let[O,...T]=Y.name.split(" ");return{givenName:O,familyName:T.join(" ")||void 0}},e=(Y)=>Object.keys(Y.scimSchemaExtensions??{}).filter((O)=>O.startsWith("urn:")&&Y.scimSchemaExtensions?.[O]!==void 0),t=(Y)=>{let O={};if(Y.ecid!==void 0)O.ecid=Y.ecid;if(Y.accountClass!==void 0)O.accountClass=Y.accountClass;return O.ecid!==void 0||O.accountClass!==void 0?O:void 0},V=(Y)=>{let O=new Set([P1]);if(Y.scimEnterprise!==void 0)O.add(h5);if(t(Y)!==void 0)O.add(I5);for(let T of e(Y))O.add(T);return Array.from(O)},A=(Y)=>{let O={};if(Y.scimEnterprise!==void 0)O[h5]=Y.scimEnterprise;let T=t(Y);if(T!==void 0)O[I5]=T;for(let[b,S]of Object.entries(Y.scimSchemaExtensions??{}))if(b.startsWith("urn:")&&b!==I5&&S!==void 0)O[b]=S;return O},K=(Y)=>{let O=Y.userName||Y.email||Y.id||"",T=Y.emails??(Y.email?[{value:Y.email,primary:!0}]:[]);return{schemas:V(Y),id:Y.id,externalId:Y.externalId,userName:O,displayName:Y.displayName??Y.name??O,name:n(Y),nickName:Y.nickName,profileUrl:Y.avatar,title:Y.title,userType:Y.userType,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active??!0,emails:T,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,meta:{resourceType:"User",created:(Y.createdAt??Y.updatedAt??new Date).toISOString(),lastModified:(Y.updatedAt??Y.createdAt??new Date).toISOString()},...A(Y)}},H=async(Y)=>{if(U?.mapBaseUserToScim)return await U.mapBaseUserToScim(Y);return K(Y)},N=async(Y,O)=>{if(U?.mapValidatedScimToBaseUser)return await U.mapValidatedScimToBaseUser(Y,O);let T=new Date,b=h(Y.emails),S=Y.name?.formatted||[Y.name?.givenName,Y.name?.middleName,Y.name?.familyName].filter(Boolean).join(" ").trim()||Y.displayName,C=Y.id||O.existing?.id||u9(),g=Y.userName||b||O.existing?.userName||C,d=S||Y.displayName||O.existing?.name||g,a=Object.fromEntries(Object.entries(Y).filter(([P5,v5])=>P5.startsWith("urn:")&&P5!==h5&&P5!==I5&&v5!==void 0)),Z5=Y[I5],t5=Z5?.ecid!==void 0&&Z5.ecid!==null?A1(Z5.ecid):O.existing?.ecid,z5=Z5?.accountClass??O.existing?.accountClass,o=O.existing?.sso;return{...O.existing??{},id:C,userName:g,name:d,email:b||O.existing?.email||g,avatar:Y.profileUrl,sso:{...o??{},profile:{...o?.profile??{},sub:C,iss:o?.profile.iss??"iam-provisioned",aud:o?.profile.aud??"iam-provisioned",exp:o?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:o?.profile.iat??Math.floor(Date.now()/1000),email:b||O.existing?.email||g,email_verified:!0,name:d,preferred_username:g},tenant:o?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:o?.scope??"openid profile email",tokenType:o?.tokenType??"Bearer",expires:o?.expires??new Date(Date.now()+3600000)},externalId:Y.externalId,ecid:t5,accountClass:z5,displayName:Y.displayName,scimName:Y.name,emails:Y.emails,nickName:Y.nickName,title:Y.title,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,scimEnterprise:Y[h5],scimSchemaExtensions:Object.keys(a).length>0?a:void 0,createdAt:O.existing?.createdAt??(Y.meta?.created?new Date(Y.meta.created):T),updatedAt:Y.meta?.lastModified?new Date(Y.meta.lastModified):T,userType:Y.userType}},z=(Y,O,T)=>{Y[O]=T},j=(Y,O,T)=>{let b=Y[O];if(Array.isArray(b)){Y[O]=[...b,...Array.isArray(T)?T:[T]];return}if(b&&typeof b==="object"&&!Array.isArray(b)&&T&&typeof T==="object"&&!Array.isArray(T)){Y[O]={...b,...T};return}Y[O]=T},M=(Y,O,T)=>{let b=O.match(/^(urn:.*:(?:User|Group))(?::(.+))?$/),S=b?[b[1],...b[2]?.split(":")??[]]:O.split("."),C=Y;for(let d of S.slice(0,-1)){let a=C[d];if(a===void 0){if(!T)return null;C[d]={}}else if(a===null||typeof a!=="object"||Array.isArray(a)){if(!T)return null;C[d]={}}C=C[d]}let g=S.at(-1);if(!g)return null;return{parent:C,key:g}},_=(Y,O)=>{let T=O.op.toLowerCase();if(!O.path){if(T!=="remove"&&O.value&&typeof O.value==="object"&&!Array.isArray(O.value))Object.assign(Y,O.value);return}let b=O.path.match(/^([A-Za-z0-9]+)\[value eq "([^"]+)"\]$/);if(b&&T==="remove"){let[,C,g]=b,d=Y[C];if(Array.isArray(d))Y[C]=d.filter((a)=>!(a&&typeof a==="object"&&("value"in a)&&a.value===g));return}let S=M(Y,O.path,T!=="remove");if(!S)return;if(T==="remove"){delete S.parent[S.key];return}if(T==="add"){j(S.parent,S.key,O.value);return}z(S.parent,S.key,O.value)},D=async(Y,O)=>{if(!await $5(Y))return k(401,"Authorization required");let b=new URL(Y.url),S=O?.basePath??"/Users",C=b.pathname;if(C.startsWith(S))C=C.substring(S.length);let d=C.match(/^\/([^/]+)$/)?.[1],a=Y.method;try{if(d)switch(a){case"GET":return await P(d);case"PUT":return await R(Y,d);case"PATCH":return await v(Y,d);case"DELETE":return await y(d);default:return k(405,"Method not allowed")}else if(C===""||C==="/")switch(a){case"GET":return await E(Y);case"POST":return await q(Y);default:return k(405,"Method not allowed")}return k(404,"Resource not found")}catch(Z5){if(Z5 instanceof a5)return h9(Z5);if($9(Z5))return k(409,Z5.message,"uniqueness");return Z.error("Users inbound handler error",{"es.operation":"scim.users.handler","es.outcome":"failure"},Z5),k(500,Z5 instanceof Error?Z5.message:"Internal server error")}},E=async(Y)=>{let O=new URL(Y.url),T=O.searchParams.get("startIndex"),b=O.searchParams.get("count"),S=T!=null?parseInt(T,10):void 0,C=b!=null?parseInt(b,10):void 0,g=S!=null&&!Number.isNaN(S)?Math.max(0,S-1):0,d=C!=null&&!Number.isNaN(C)?C:void 0,a=p9(O.searchParams.get("filter"));if(a!==void 0){let z5=await x.lookup({externalId:a}),o=z5?[await H(z5)]:[];return d5(o,{totalResults:o.length,startIndex:1,itemsPerPage:o.length})}let Z5=await x.list({start:g,limit:d}),t5=await Promise.all(Z5.items.map((z5)=>H(z5)));return d5(t5,{totalResults:Z5.total,startIndex:g+1,itemsPerPage:Z5.count})},P=async(Y)=>{let O=await x.get(Y);if(!O)return k(404,`User ${Y} not found`,"invalidValue");return H5(await H(O))},w=async(Y,O)=>{let T=r.accessIndex;if(!T?.setSubjectDisabled||!O.id)return;let b=Y?Y.active??!0:!0,S=O.active??!0;if(Y&&b===S)return;if(!Y&&S)return;await T.setSubjectDisabled(O.id,"user",!S)},q=async(Y)=>{let O=await Y.json(),T=await n5(J.user,O);if(T.issues)return Z.error("User creation validation failed",{"es.operation":"scim.user.create","es.outcome":"failure",validationIssues:T.issues}),k(400,`Request validation failed: ${T.issues.map((C)=>C.message).join("; ")}`,"invalidValue");let b=T.value;if(!b.userName&&!b.emails?.[0]?.value)return k(400,"userName or email is required","invalidValue");let S=await N(b,{mode:"create"});return await k5(r,async()=>{await x.upsert(S),await w(void 0,S)},r1(void 0,S),async()=>{await e1(X,S)}),H5(await H(S),201)},R=async(Y,O)=>{let T=await x.get(O);if(!T)return k(404,`User ${O} not found`,"invalidValue");let b=await Y.json(),S=await n5(J.user,b);if(S.issues)return Z.error("User replacement validation failed",{"es.operation":"scim.user.replace","es.outcome":"failure",validationIssues:S.issues}),k(400,`Request validation failed: ${S.issues.map((d)=>d.message).join("; ")}`,"invalidValue");let C=S.value,g=await N({...C,id:O},{existing:T,mode:"replace"});return g.createdAt=T.createdAt,g.updatedAt=new Date,await k5(r,async()=>{await x.upsert(g),await w(T,g)},r1(T,g),async()=>{await e1(X,g)}),H5(await H(g))},v=async(Y,O)=>{let T=await x.get(O);if(!T)return k(404,`User ${O} not found`,"invalidValue");let S=(await Y.json()).Operations??[],g={...await H(T)};for(let Z5 of S)_(g,Z5);let d=await n5(J.user,g);if(d.issues)return Z.error("User patch validation failed",{"es.operation":"scim.user.patch","es.outcome":"failure",validationIssues:d.issues}),k(400,`Request validation failed: ${d.issues.map((Z5)=>Z5.message).join("; ")}`,"invalidValue");let a=await N(d.value,{existing:T,mode:"patch"});return a.updatedAt=new Date,await k5(r,async()=>{await x.upsert(a),await w(T,a)},r1(T,a),async()=>{await e1(X,a)}),H5(await H(a))},y=async(Y)=>{if(!await x.get(Y))return k(404,`User ${Y} not found`,"invalidValue");if(Q){let T=await Q.listBySubject(Y,"user"),b=[];for(let S of T.items)await E1(r,S,b);await K9(r,b)}if(await x.delete(Y),await r.accessIndex?.setSubjectDisabled?.(Y,"user",!1),r.authz.oaa.isReady())await F9(r,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>r.authz.oaa.deleteUser(Y),{id:Y,kind:"user"});return new Response(null,{status:204})};L5={handler:D}}async function M5(x,U){s();let h=new URL(x.url).pathname,n=f5(U?.usersUrl??p.usersUrl??"/api/iam/Users")??"/api/iam/Users",e=f5(U?.groupsUrl??p.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",t=await p5(x,U);if(t)return t;let V=(A)=>h===A||h.startsWith(`${A}/`);if(V(n)){if(!c)return k(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!L5)return k(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return L5.handler(x,{basePath:n})}if(V(e)){if(!l)return k(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!S5)return k(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return S5.handler(x,{basePath:e})}return k(404,"Resource not found")}return{...p,createUser:u5,getBaseUrl:i5,groups_outbound:N5,groups_inbound:S5,users_inbound:L5,handler:M5,delta:u}}function V9(J,Z){let $=new TextEncoder().encode(J),X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Q=new Uint8Array($.length+1+X.length);return Q.set($,0),Q[$.length]=46,Q.set(X,$.length+1),Q}function z4(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.length%4===0?"":"=".repeat(4-Z.length%4),X=atob(Z+$),Q=new Uint8Array(X.length);for(let G=0;G<X.length;G++)Q[G]=X.charCodeAt(G);return Q}function P4(J){let Z="";for(let $ of J)Z+=String.fromCharCode($);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function c9(J){let Z=JSON.parse(J);if(!Z||typeof Z!=="object"||!Array.isArray(Z.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return Z}function O4(J){return JSON.stringify(J)}async function E4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x},{name:"Ed25519"},!0,["verify"])}async function j4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x,d:J.d},{name:"Ed25519"},!0,["sign"])}async function A4(J){let $=(typeof J.jwks==="string"?c9(J.jwks):J.jwks).keys.find((X)=>X.kid===J.kid&&X.kty==="OKP"&&X.crv==="Ed25519");if(!$?.x)return!1;try{let X=await E4($),Q=V9(J.requestId,J.rawBody),G=z4(J.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},X,G,Q)}catch{return!1}}async function w4(J){let Z=await j4(J.privateKeyJwk),$=V9(J.requestId,J.rawBody),X=await crypto.subtle.sign({name:"Ed25519"},Z,$);return P4(new Uint8Array(X))}async function I4(J){let Z=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),$=await crypto.subtle.exportKey("jwk",Z.privateKey),Q=(await crypto.subtle.exportKey("jwk",Z.publicKey)).x,G=$.d;if(!Q||!G)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:Q,d:G,kid:J,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:Q,kid:J,alg:"EdDSA",use:"sig"}]}}}var L1={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function I1(J,Z){if(typeof J!=="number"||!Number.isFinite(J))return Z.default;let $=Math.floor(J);if($<Z.min)return Z.min;if($>Z.max)return Z.max;return $}function d9(J){return{ttlMs:I1(J?.ttlSeconds,L1.jwksTtlSeconds)*1000,maxEntries:I1(J?.maxEntries,L1.jwksMaxEntries)}}function n9(J){let Z=J?.read;return{read:{enabled:Z?.enabled===!0,ttlMs:I1(Z?.ttlSeconds,L1.sessionReadTtlSeconds)*1000,maxEntries:I1(Z?.maxEntries,L1.sessionReadMaxEntries)}}}function T4(J){return{jwks:d9(J?.jwks),session:n9(J?.session)}}function S4(J){let Z={};if(!J)return Z;let $=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let G=Q.indexOf("=");if(G===-1)continue;Z[Q.slice(0,G).trim()]=Q.slice(G+1).trim()}return Z}function a9(J){if(!J.expiresAt)return!1;let Z=J.expiresAt instanceof Date?J.expiresAt:new Date(J.expiresAt);return!Number.isNaN(Z.getTime())&&Date.now()>Z.getTime()}function R4(J){if(!J||typeof J!=="object"||Array.isArray(J))return;let{access_token:Z,id_token:$,refresh_token:X,tokens:Q,...G}=J;return G}function _5(J,Z){let $=J[Z];return typeof $==="string"?$:""}function x4(J,Z){let $=J.exp;if(typeof $==="number")return new Date($*1000);if(typeof $==="string"&&$.trim()){let X=Number($);if(!Number.isNaN(X))return new Date(X*1000)}if(Z instanceof Date)return Z;if(Z){let X=new Date(Z);if(!Number.isNaN(X.getTime()))return X}return new Date}function y4(J){let Z=J.claims;if(!Z?.sub||typeof Z.sub!=="string")return;let $=x4(Z,J.expiresAt);if(J.authType==="sso")return{id:Z.sub,userName:_5(Z,"preferred_username"),name:_5(Z,"name"),email:_5(Z,"email"),avatar:_5(Z,"picture")||void 0,sso:{profile:Z,tenant:{id:_5(Z,"idp")||_5(Z,"iss"),name:_5(Z,"iss")},tokenType:"Bearer",expires:$}};return{id:Z.sub,userName:_5(Z,"preferred_username"),name:_5(Z,"name"),email:_5(Z,"email"),avatar:_5(Z,"picture")||void 0,userType:"customer",ciam:{profile:Z,scope:"openid profile email",tokenType:"Bearer",expires:$}}}function b4(J){if(J.authType!=="sso"&&J.authType!=="ciam")return;if(a9(J))return;return{sid:J.sid,authType:J.authType,tenantId:typeof J.tenantId==="string"?J.tenantId:void 0,sub:J.sub,expiresAt:J.expiresAt,createdAt:J.createdAt,claims:R4(J.claims)}}function q4(J,Z){if(!J.endsWith(".session"))return!1;if(!Z||Z.length===0)return!0;return Z.some(($)=>J===`${$}.session`)}function C4(J){if(J===void 0)return;let Z=(Array.isArray(J)?J:[J]).map(($)=>$.trim()).filter(($)=>$.length>0);return Z.length>0?Z:void 0}async function i9(J,Z,$){return(await t9(J,Z,$)).map(b4).filter((Q)=>Boolean(Q))}async function t9(J,Z,$){let X=S4(J.headers.get("cookie")),Q=C4($?.cookiesPrefix),G=[],F=new Set;for(let[B,W]of Object.entries(X)){if(!q4(B,Q)||!W)continue;if(F.has(W))continue;F.add(W);let L=await Z.get(W);if(!L)continue;if(L.authType!=="sso"&&L.authType!=="ciam")continue;if(a9(L))continue;G.push(L)}return G}async function v4(J,Z,$){return(await i9(J,Z,$)).map(y4).filter((Q)=>Boolean(Q))}var U4="@enterprisestandard/core",k4=c5(D1(U4));async function f4(J,Z){let $=await R5({idToken:J,jwksUri:Z.jwksUri,issuer:Z.issuer,audience:Z.audience}),X=await k4.validate($);if(X.issues)throw Error(`ID token claims validation failed: ${X.issues.map((F)=>F.message).join("; ")}`);let Q=X.value;if(Q===void 0)throw Error("ID token claims missing");return o9(Q)}function K5(J){return Date.now()-J}function N9(J){if(J instanceof Error)return{"error.name":J.name,"error.message":J.message};return{"error.name":typeof J,"error.message":String(J)}}function T1(J,Z){if(!J)return{};try{let $=new URL(J);return{[`${Z}.origin`]:$.origin,[`${Z}.path`]:$.pathname}}catch{return{[`${Z}.path`]:J.startsWith("/")?J:`/${J}`}}}function S1(J,Z=5){if(!Array.isArray(J))return[String(J)];return J.slice(0,Z).map(($)=>{if(!$||typeof $!=="object")return String($);let X=$,Q=Array.isArray(X.path)?X.path.join("."):String(X.path??""),G=typeof X.message==="string"?X.message:String(X.message??"validation failed");return Q?`${Q}: ${G}`:G})}function h4(J){if(!J||typeof J!=="object")return{};let Z=J;return{oidc_error:typeof Z.error==="string"?Z.error:void 0,oidc_error_description:typeof Z.error_description==="string"?Z.error_description:void 0,oidc_error_uri:typeof Z.error_uri==="string"?Z.error_uri:void 0}}function g4(J,Z={}){let $=typeof J==="string"?J:J?.headers.get("cookie")??void 0;if(!$)return[];let Q=`${Z.cookiePrefix??"es.sso"}.`,G=new Set;for(let F of Object.keys(p4($))){if(!F.startsWith(Q))continue;let B=F.slice(Q.length),W=B.lastIndexOf(".");if(W<=0)continue;let L=B.slice(0,W).trim();if(L)G.add(L)}return Array.from(G)}function m4(J,Z,$,X,Q){if(!$&&!X)return;let G=new WeakMap,F=new Map,B={...$,...X},W=!!(B.authority&&B.tokenUrl&&B.authorizationUrl&&B.clientId&&B.redirectUri&&B.scope),L={...B,authority:W?m(B.authority,"Missing 'authority' from SSO Config"):B.authority,tokenUrl:W?m(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"):B.tokenUrl,authorizationUrl:W?m(B.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):B.authorizationUrl,clientId:W?m(B.clientId,"Missing 'clientId' from SSO Config"):B.clientId,redirectUri:W?m(B.redirectUri,"Missing 'redirectUri' from SSO Config"):B.redirectUri,scope:W?m(B.scope,"Missing 'scope' from SSO Config"):B.scope,responseType:B.responseType??"code",cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.clientId?`es.sso.${B.clientId}`:"es.sso"),cookiesPath:B.cookiesPath??"/"},f=Math.min(600,Math.max(0,Math.floor(Number(L.rotationGraceSeconds??60))||0))*1000;function u(){let V=[];if(!L.authority)V.push("authority");if(!L.tokenUrl)V.push("tokenUrl");if(!L.authorizationUrl)V.push("authorizationUrl");if(!L.clientId)V.push("clientId");if(!L.redirectUri)V.push("redirectUri");if(!L.scope)V.push("scope");if(V.length>0)throw Error(`Missing OIDC configuration fields: ${V.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function i(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A=G.get(V);if(A)return A;let K=J5(V);return G.set(V,K),K}async function J5(V){try{let{tokens:A,session:K,refreshedUser:H}=await M5(V);if(!A)return{status:"unauthenticated"};if(H)return{status:"authenticated",value:H};if(K?.claims)return{status:"authenticated",value:$5(K.claims,A,N5(K.expiresAt))};return{status:"unauthenticated"}}catch(A){if(r9(A))return{status:"unauthenticated"};return Z.error("Error parsing user from cookies",{"es.operation":"cookie.parse","es.outcome":"degraded"},A),{status:"degraded",error:A instanceof Error?A:void 0}}}async function r(V){let A=await i(V);return A.status==="authenticated"?A.value:void 0}async function G5(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let A=m(L.redirectUri,"Missing 'redirectUri' from SSO Config"),K=m(L.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),H=m(L.clientId,"Missing 'clientId' from SSO Config"),N=m(L.scope,"Missing 'scope' from SSO Config"),z=L.cookiesSecure?V.url.replace(/^http:\/\//,"https://"):V.url,j=D5(),M=D5(64),_=D5(),D=A;try{new URL(D)}catch{if(z)try{let R=new URL(z),v=D.startsWith("//")?D.slice(1):D.startsWith("/")?D:`/${D}`;D=new URL(v,R.origin).toString()}catch{try{let R=new URL(K),v=D.startsWith("//")?D.slice(1):D.startsWith("/")?D:`/${D}`;D=new URL(v,R.origin).toString()}catch{throw Error(`Invalid redirectUri: "${A}". It must be a valid absolute URL.`)}}}let E=new URL(K);E.searchParams.append("client_id",H),E.searchParams.append("redirect_uri",D),E.searchParams.append("response_type","code"),E.searchParams.append("scope",N),E.searchParams.append("state",j),E.searchParams.append("nonce",_);let P=await J1(M);E.searchParams.append("code_challenge",P),E.searchParams.append("code_challenge_method","S256");let w=await L.beforeLogin?.({request:V}),q=w===void 0?{state:j,codeVerifier:M,nonce:_}:{state:j,codeVerifier:M,nonce:_,context:w};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:E.toString(),"Set-Cookie":U(e(j),q,L.loginStateTtl??600,"Lax")}})}async function p(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A;try{A=await r(V)}catch{A=void 0}let K=await L.beforeLogout?.({request:V,user:A}),H=n("session",V),N;try{N=await M5(V);let P=N.tokens?.refresh_token??n("refresh",V);if(P)await g5(P)}catch(P){Z.warn("Failed to revoke token",{"es.operation":"token.revoke","es.outcome":"degraded"},P)}if(L.sessionStore)try{let P=N?.sid??H;if(P)await L.sessionStore.delete(P)}catch(P){Z.warn("Failed to delete session",{"es.operation":"session.delete","es.outcome":"degraded"},P)}let z=[["Set-Cookie",h("session")]],j=await L.afterLogout?.({request:V,context:K}),M=x5(j,"/",V.url);if(M.response){let P=new Headers(M.response.headers);for(let[,w]of z)P.append("Set-Cookie",w);return new Response(M.response.body,{status:M.response.status,statusText:M.response.statusText,headers:P})}let _=M.location??"/",D=V.headers.get("accept");if(D?.includes("application/json")||D?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...z]});return new Response("Logged out",{status:302,headers:[["Location",_],...z]})}async function c(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(!L.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!V.headers.get("content-type")?.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let K=await V.text(),N=new URLSearchParams(K).get("logout_token");if(!N)return new Response("Missing logout_token parameter",{status:400});let z=m(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),j=m(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),M=L.jwksUri||`${z}/protocol/openid-connect/certs`,_=await d1({logoutToken:N,jwksUri:M,issuer:z,audience:j,log:Z}),D=typeof _.sid==="string"?_.sid:void 0;if(!D)return Z.warn("Back-Channel Logout: logout_token missing sid claim",{"es.operation":"backchannel_logout","es.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await L.sessionStore.delete(D),Z.info("Back-Channel Logout: successfully deleted session",{"es.module":"sso",sid:D}),new Response("OK",{status:200})}catch(A){return Z.error("Error during back-channel logout",{"es.operation":"backchannel_logout","es.outcome":"failure"},A),new Response("Internal Server Error",{status:500})}}async function l(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A=Date.now(),K=new URL(V.url),H=new URLSearchParams(K.search);Z.debug("SSO callback received",{"es.event":"es.sso.callback.received","es.module":"sso","es.operation":"sign_in.callback","http.method":V.method,"url.path":K.pathname,hasCode:H.has("code"),hasState:H.has("state"),hasError:H.has("error"),...T1(H.get("iss")??void 0,"oidc.issuer")});let N=Object.fromEntries(H.entries()),z=await J.callbackParams.validate(N);if(z.issues)return Z.warn("SSO callback parameter validation failed",{"es.event":"es.sso.callback.validation_failed","es.operation":"sign_in.callback","es.outcome":"failure","validation.issues":S1(z.issues)}),s9(z.issues,"OIDC callback parameters validation failed");let{code:j,state:M}=z.value,_;try{let D=m(M,'OIDC "state" was not present in the callback parameters'),E=n(e(D),V,!0),{codeVerifier:P,state:w,nonce:q,context:R}=E??{};_=R,Z.debug("SSO callback state cookie read",{"es.event":"es.sso.callback.state_cookie_read","es.module":"sso","es.operation":"sign_in.callback",hasStateCookie:Boolean(E),hasCodeVerifier:Boolean(P),hasStateVerifier:Boolean(w),hasNonce:Boolean(q),hasContext:R!==void 0});let v=m(P,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');m(w,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let y=m(q,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),Y=m(j,'OIDC "code" was not present in the callback parameters');if(M!==w)throw Z.warn("SSO callback state verification failed",{"es.event":"es.sso.callback.state_verification_failed","es.operation":"sign_in.callback","es.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');Z.debug("SSO callback state verified",{"es.event":"es.sso.callback.state_verified","es.module":"sso","es.operation":"sign_in.callback"});let O=L.cookiesSecure?V.url.replace(/^http:\/\//,"https://"):V.url,T=await q5(Y,v,O),{tokenExpiresAt:b,sessionExpiresAt:S}=B5(T);T.expires=b.toISOString();let C=Date.now();Z.debug("SSO ID token parsing started",{"es.event":"es.sso.id_token.parse_started","es.module":"sso","es.operation":"id_token.parse"});let g=await s(T,y,S);Z.debug("SSO ID token parsing completed",{"es.event":"es.sso.id_token.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":K5(C),"user.id":g.id});let d,a;{let o=T5("SSO requires sessionStore configuration for opaque session cookies."),P5=typeof g.sso.profile.sid==="string"?g.sso.profile.sid:void 0,v5=P5||D5(32),F5=g.id;if(Z.debug("SSO session creation evaluated",{"es.event":"es.sso.session.create_evaluated","es.module":"sso","es.operation":"session.create",hasSid:Boolean(v5),hasIdpSid:Boolean(P5),hasSub:Boolean(F5),"user.id":F5}),!F5)throw Error("Session creation failed: missing sub in ID token claims");let x1=Date.now(),F1={sid:v5,sub:F5,idpSid:P5,authType:"sso",tenantId:L.tenantId,tokens:T,claims:g.sso.profile,expiresAt:S,createdAt:new Date};await p5(o,F1),a=F1,d=["Set-Cookie",U("session",v5,S)],Z.info("SSO session created",{"es.event":"es.sso.session.created","es.operation":"session.create","es.outcome":"success","duration.ms":K5(x1),"user.id":F5})}if(L.userStore)try{let o=g.id;if(o){let P5=new Date,v5=Date.now();Z.debug("SSO user store lookup started",{"es.event":"es.sso.user.lookup_started","es.module":"sso","es.operation":"user.lookup","user.id":o});let F5=await L.userStore.get(o);if(Z.debug("SSO user store lookup completed",{"es.event":"es.sso.user.lookup_completed","es.module":"sso","es.operation":"user.lookup","duration.ms":K5(v5),"user.id":o,found:Boolean(F5)}),F5||L.enableJitUserProvisioning){let x1=Date.now(),F1={...F5??{},...g,id:o,tenantId:F5?.tenantId,createdAt:F5?.createdAt??P5,updatedAt:P5};await L.userStore.upsert(F1),Z.info("SSO user stored",{"es.event":"es.sso.user.stored","es.operation":"user.store","es.outcome":"success","duration.ms":K5(x1),"user.id":o,existing:Boolean(F5),jitProvisioning:Boolean(L.enableJitUserProvisioning)})}else Z.warn("JIT user provisioning disabled: user not found in store and will not be created",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped","user.id":o})}else Z.warn("User storage skipped: missing sub in ID token claims",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped"})}catch(o){Z.warn("Failed to store user",{"es.event":"es.sso.user.store_failed","es.operation":"user.store","es.outcome":"degraded",...N9(o)})}Z.info("SSO sign-in succeeded",{"es.event":"es.sso.sign_in.succeeded","es.operation":"sign_in.callback","es.outcome":"success","duration.ms":K5(A),"user.id":g.id});let Z5=[["Set-Cookie",h(e(D))],...d?[d]:[]],t5=await L.afterLogin?.({ok:!0,request:V,user:g,session:a,context:_}),z5=x5(t5,"/",V.url);if(z5.response)return U5(z5.response,Z5.map(([,o])=>o));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",z5.location],...Z5]})}catch(D){Z.error("Error during sign-in callback",{"es.event":"es.sso.sign_in.callback_failed","es.operation":"sign_in.callback","es.outcome":"failure","duration.ms":K5(A),...N9(D)});let E=M?[["Set-Cookie",h(e(M))]]:[],P=await L.afterLogin?.({ok:!1,request:V,error:D,context:_}),w=x5(P,"/",V.url);if(w.response)return U5(w.response,E.map(([,q])=>q));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",w.location],...E]})}}function B5(V){let A=Date.now(),K=Number(V.expires_in??3600)||3600,H=new Date(A+K*1000),N;if(V.refresh_expires_in!=null&&Number.isFinite(Number(V.refresh_expires_in)))N=Number(V.refresh_expires_in);else if(V.refresh_token)N=86400;else N=K;return{tokenExpiresAt:H,sessionExpiresAt:new Date(A+N*1000)}}async function s(V,A,K){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let H=Date.now(),N=await C5(V.id_token,A);return Z.debug("SSO user parsed from ID token",{"es.event":"es.sso.user.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":K5(H),"user.id":N.sub,hasEmail:Boolean(N.email),hasName:Boolean(N.name)}),$5(N,V,K)}function $5(V,A,K){let H=K??B5(A).sessionExpiresAt,N=V.ecid!==void 0&&V.ecid!==null?A1(V.ecid):void 0;return{id:V.sub,userName:V.preferred_username||"",name:V.name||"",email:V.email||"",emails:[{value:V.email||"",primary:!0}],...N?{ecid:N}:{},avatar:V.picture,sso:{profile:{...V},tenant:{id:V.idp||V.iss||"",name:V.iss||""},scope:A.scope,tokenType:A.token_type,sessionState:A.session_state,expires:H}}}async function j5(V){if(!L.userStore)return V;let A=await L.userStore.lookup(V);if(!A)return V;return{...V,...A,id:V.id,sso:V.sso}}async function q5(V,A,K){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let H=m(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),N=m(L.redirectUri,"Missing 'redirectUri' from SSO Config"),z=m(L.clientId,"Missing 'clientId' from SSO Config"),j=N;try{new URL(j)}catch{if(K)try{let _=new URL(K),D=j.startsWith("//")?j.slice(1):j.startsWith("/")?j:`/${j}`;j=new URL(D,_.origin).toString()}catch{try{let _=new URL(H),D=j.startsWith("//")?j.slice(1):j.startsWith("/")?j:`/${j}`;j=new URL(D,_.origin).toString()}catch{throw Error(`Invalid redirectUri: "${N}". It must be a valid absolute URL.`)}}}let M=new URLSearchParams;if(M.append("grant_type","authorization_code"),M.append("code",V),M.append("redirect_uri",j),M.append("client_id",z),L.clientSecret)M.append("client_secret",L.clientSecret);M.append("code_verifier",A);try{let _=Date.now();Z.debug("SSO token exchange started",{"es.event":"es.sso.token.exchange_started","es.module":"sso","es.operation":"token.exchange",...T1(H,"oidc.token_url"),...T1(j,"oidc.redirect_uri"),hasClientSecret:Boolean(L.clientSecret)});let D=await fetch(H,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:M.toString()});Z.debug("SSO token exchange response received",{"es.event":"es.sso.token.response_received","es.module":"sso","es.operation":"token.exchange","http.status_code":D.status,"duration.ms":K5(_)}),Z.debug("SSO token exchange response body read started",{"es.event":"es.sso.token.response_body_read_started","es.module":"sso","es.operation":"token.exchange"});let E=await D.json();if(Z.debug("SSO token exchange response body read completed",{"es.event":"es.sso.token.response_body_read_completed","es.module":"sso","es.operation":"token.exchange","duration.ms":K5(_)}),!D.ok){Z.error("Token exchange error",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure","http.status_code":D.status,"duration.ms":K5(_),...h4(E)});let w=E;throw Error(`Token exchange failed: ${w.error||D.statusText} - ${w.error_description||""}`.trim())}let P=await J.tokenResponse.validate(E);if(P.issues)throw Z.error("Token response validation failed",{"es.event":"es.sso.token.response_validation_failed","es.operation":"token.exchange","es.outcome":"failure","duration.ms":K5(_),"validation.issues":S1(P.issues)}),Error(`Token response validation failed: ${P.issues}`);return Z.debug("SSO token exchange completed",{"es.event":"es.sso.token.exchange_completed","es.module":"sso","es.operation":"token.exchange","es.outcome":"success","duration.ms":K5(_),tokenType:P.value.token_type,hasAccessToken:Boolean(P.value.access_token),hasIdToken:Boolean(P.value.id_token),hasRefreshToken:Boolean(P.value.refresh_token),expiresIn:P.value.expires_in}),P.value}catch(_){throw Z.error("Error during token exchange",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure",...N9(_)}),_}}async function i5(V){return g1(async()=>{if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let A=m(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),K=m(L.clientId,"Missing 'clientId' from SSO Config"),H=new URLSearchParams;H.append("grant_type","refresh_token"),H.append("refresh_token",V),H.append("client_id",K);let N=await fetch(A,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:H.toString()}),z=await N.json();if(!N.ok){Z.error("Token refresh error",{"es.operation":"token.refresh","es.outcome":"failure",response:z});let M=z;throw Error(`Token refresh failed: ${M.error||N.statusText} - ${M.error_description||""}`.trim())}let j=await J.tokenResponse.validate(z);if(j.issues)throw Z.error("Token refresh response validation failed",{"es.event":"es.sso.token.refresh_validation_failed","es.operation":"token.refresh","es.outcome":"failure","validation.issues":S1(j.issues)}),Error(`Token refresh response validation failed: ${j.issues}`);return j.value},void 0,void 0,void 0,Z)}async function g5(V){try{if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(!L.revocationEndpoint)return;let A=m(L.clientId,"Missing 'clientId' from SSO Config"),K=new URLSearchParams;K.append("token",V),K.append("token_type_hint","refresh_token"),K.append("client_id",A);let H=await fetch(L.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:K.toString()});if(!H.ok)Z.warn("Token revocation failed",{"es.operation":"token.revoke","es.outcome":"degraded",status:H.status,statusText:H.statusText});else Z.info("Token revoked successfully",{"es.module":"sso"})}catch(A){Z.warn("Error revoking token",{"es.operation":"token.revoke","es.outcome":"degraded"},A)}}async function m5(){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let V=L.authority;if(!L.jwksUri&&!V)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let A=L.jwksUri||`${V}/protocol/openid-connect/certs`;return r5(A,Z)}async function C5(V,A){let K=Date.now(),H=m(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),N=m(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),z=L.jwksUri||`${H}/protocol/openid-connect/certs`;Z.debug("SSO ID token verification started",{"es.event":"es.sso.id_token.verify_started","es.module":"sso","es.operation":"id_token.verify",...T1(z,"oidc.jwks_uri")});let j;try{j=await R5({idToken:V,jwksUri:z,issuer:H,audience:N,expectedNonce:A,log:Z})}catch(_){throw Z.error("SSO ID token verification failed",{"es.event":"es.sso.id_token.verify_failed","es.module":"sso","es.operation":"id_token.verify","es.outcome":"failure","duration.ms":K5(K)},_),_}Z.debug("SSO ID token signature verified",{"es.event":"es.sso.id_token.signature_verified","es.module":"sso","es.operation":"id_token.verify","duration.ms":K5(K)});let M=await J.idTokenClaims.validate(j);if(M.issues)throw Z.error("ID token claims validation failed",{"es.event":"es.sso.id_token.validation_failed","es.operation":"id_token.validate","es.outcome":"failure","duration.ms":K5(K),"validation.issues":S1(M.issues)}),Error(`ID token claims validation failed: ${M.issues}`);return Z.debug("SSO ID token claims validated",{"es.event":"es.sso.id_token.claims_validated","es.module":"sso","es.operation":"id_token.validate","es.outcome":"success","duration.ms":K5(K),"user.id":M.value.sub,hasIssuer:Boolean(M.value.iss),hasAudience:Boolean(M.value.aud)}),M.value}function T5(V="SSO sessionStore is required for opaque session cookies."){if(!L.sessionStore)throw Error(V);return L.sessionStore}async function p5(V,A){try{await V.create(A)}catch(K){if(!await V.get(A.sid))throw K;await V.update(A.sid,A)}}function N5(V){if(!V)return;if(V instanceof Date)return V;let A=new Date(V);return Number.isNaN(A.getTime())?void 0:A}function u5(V){let A=V.tokens;if(!A?.access_token||!A.id_token||!A.token_type)return;return A}async function S5(V,A=!1){let K=T5(),H=n("session",V);if(!H)return{tokens:void 0,refreshHeaders:[]};let N=await K.get(H);if(N&&L.tenantId&&N.tenantId&&N.tenantId!==L.tenantId)return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};if(N?.authType!=="sso")return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};let z=u5(N);if(!z)return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};let j=N5(N.expiresAt);if(j?Date.now()>j.getTime():!1)return await K.delete(H),{tokens:void 0,sid:H,refreshHeaders:[["Set-Cookie",h("session")]]};let _=N5(z.expires),D=_?Date.now()>_.getTime():!0;if((A||D)&&z.refresh_token)return L5(H,N,z);return{tokens:z,sid:H,session:N,refreshHeaders:[]}}function L5(V,A,K){let H=F.get(V);if(H)return H;let N=T5(),z=(async()=>{let j=await i5(K.refresh_token),{tokenExpiresAt:M,sessionExpiresAt:_}=B5(j);j.expires=M.toISOString();let D=await s(j,void 0,_),E=D.sso.profile,P=D5(32),w={...A,sid:P,tokens:j,claims:E,expiresAt:_,createdAt:new Date};await p5(N,w);try{if(f<=0)await N.delete(V);else{let{refresh_token:q,...R}=K;await N.update(V,{tokens:R,expiresAt:new Date(Date.now()+f)})}}catch(q){Z.warn("Failed to retire rotated SSO session record",{"es.operation":"session.rotate","es.outcome":"degraded"},q)}return{tokens:j,sid:P,session:w,refreshedUser:D,refreshHeaders:[["Set-Cookie",U("session",P,_)]]}})();return F.set(V,z),z.finally(()=>{F.delete(V)})}async function M5(V,A=!1){return S5(V,A)}async function x(V){let{tokens:A}=await M5(V);if(!A)return;return A.access_token}function U(V,A,K,H=L.cookiesSameSite??"Strict"){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(V=`${L.cookiesPrefix}.${V}`,typeof A!=="string")A=btoa(JSON.stringify(A));let N;if(K instanceof Date)N=`Expires=${K.toUTCString()}`;else if(typeof K==="number")N=`Max-Age=${K}`;else throw Error("Invalid expires type",K);if(A.length>4000)throw Error(`Error setting cookie: ${V}. Cookie length is: ${A.length}`);return`${V}=${A}; ${N}; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${H};`}function h(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");return`${L.cookiesPrefix}.${V}=; Max-Age=0; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${L.cookiesSameSite};`}function n(V,A,K=!1){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let H=A.headers.get("cookie");if(!H)return null;let N=`${L.cookiesPrefix}.${V}`,z=H.split(";").find((D)=>D.trim().startsWith(`${N}=`));if(!z)return null;let j=z.indexOf("="),M=z.slice(j+1).trim();if(!K)return M;let _=atob(M);return JSON.parse(_)}function e(V){return`state_${V}`}async function t(V,A){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:K,userUrl:H,tokenUrl:N,refreshUrl:z,logoutUrl:j,logoutBackChannelUrl:M,jwksUrl:_,redirectUri:D}={...L,...A},E=new URL(V.url).pathname;if(D){let P;try{P=new URL(D).pathname}catch{try{let w=new URL(V.url),q=D.startsWith("//")?D.slice(1):D;P=new URL(q,w.origin).pathname}catch{P=D.startsWith("/")?D:`/${D}`}}if(P===E)return l(V)}if(K===E)return G5(V);if(H===E)try{let{tokens:P,session:w,refreshedUser:q,refreshHeaders:R}=await M5(V);if(!P)return new Response("User not logged in",{status:401,headers:R});let v=q??(w?.claims?$5(w.claims,P,N5(w.expiresAt)):void 0);if(!v)return new Response("User not logged in",{status:401,headers:R});let y=await j5(v);return new Response(JSON.stringify(y),{headers:[["Content-Type","application/json"],...R]})}catch(P){if(r9(P))return new Response("User not logged in",{status:401});return Z.error("Error resolving SSO user",{"es.operation":"sso.user","es.outcome":"degraded"},P),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(N===E){let{tokens:P,refreshHeaders:w}=await M5(V);if(!P)return new Response("User not logged in",{status:401,headers:w});return new Response(JSON.stringify({token:P.access_token,expires:P.expires}),{headers:[["Content-Type","application/json"],...w]})}if(z===E){let{tokens:P,refreshHeaders:w}=await M5(V,!0);if(!P)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:w})}if(j===E)return p(V);if(M===E)return c(V);if(_===E){let P=await m5();return new Response(JSON.stringify(P),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...L,getUser:r,resolveUser:i,getJwt:x,initiateLogin:G5,logout:p,logoutBackChannel:c,callbackHandler:l,handler:t}}function p4(J){let Z={},$=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let G=Q.indexOf("=");if(G===-1)continue;let F=Q.slice(0,G).trim(),B=Q.slice(G+1).trim();Z[F]=B}return Z}function r9(J){if(!(J instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((Z)=>J.message.includes(Z))}function e9(J){return J=J??"SSO Unavailable",new Response(JSON.stringify({error:J}),{status:503,statusText:J,headers:{"Content-Type":"application/json"}})}var R1="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function u4(J,Z){return m(Z,R1),Z.sso?.getUser(J)}async function l4(J,Z){return m(Z,R1),await Z.sso?.resolveUser(J)??{status:"unauthenticated"}}async function c4(J,Z){m(Z,R1);let $=Z.sso;if(!$)return e9();return $.initiateLogin(J)}async function d4(J,Z){m(Z,R1);let $=Z.sso;if(!$)return e9();return $.callbackHandler(J)}export{U5 as withSetCookies,G1 as withDefaultExternalId,f4 as verifyUser,d1 as verifyLogoutToken,A4 as verifyLfvSignature,R5 as verifyIdToken,O4 as stringifyLfvJwks,m4 as sso,w4 as signLfvPayload,z2 as setJwksRetry,_2 as setJwksClock,y2 as setDiscoveryClock,i4 as sendTenantWebhook,t1 as sameOriginRedirectRules,l4 as resolveUser,n9 as resolveSessionCacheConfig,o1 as resolveRedirect,C1 as resolveProviderBranding,d9 as resolveJwksCacheConfig,j2 as resolveJwkForKid,d2 as resolveCustomer,V1 as resolveCiamProvider,m2 as resolveCapturedRedirect,T4 as resolveCacheConfig,x5 as resolveAfterRedirect,W9 as reconcileSubjectAccess,J1 as pkceChallengeFromVerifier,c9 as parseLfvJwks,v1 as orderedEnabledProviders,e5 as normalizeOidcIssuer,g4 as listSsoClientIdsFromCookies,v9 as isRedirectAllowed,c4 as initiateLogin,_4 as iam,V2 as hasScope,G2 as hasRole,W2 as hasPermission,L2 as hasGroup,N2 as hasAnyScope,F2 as hasAny,M2 as hasAllScope,H2 as hasAll,B2 as has,p1 as getVerificationKeyForKid,u4 as getUser,A2 as getPublicKeyFromJwks,w2 as getPublicKeyForKid,q1 as getProviderPreset,r5 as getJwks,v4 as getDiscoveredSessionUsers,c2 as getCustomer,m1 as getCachedVerificationKey,I4 as generateLfvEd25519KeyPair,i1 as generateAppleClientSecret,a1 as fetchUserInfo,B9 as expandRoot,c1 as exchangeAuthorizationCode,i9 as discoverSessions,t9 as discoverSessionRecords,n1 as discoverOidcEndpoints,h2 as defaultRedirectPolicies,D2 as configureJwksCache,n4 as collectReferencedDefinitions,E2 as clearJwksCache,b2 as clearDiscoveryCache,l2 as ciam,g2 as captureRedirect,d4 as callback,V9 as buildLfvSigningInput,l1 as buildAuthorizationUrl,b9 as blockDangerousUrls,R9 as assertTrustedIdTokenClaims,C9 as allowSameOrigin,q9 as allowRelativePaths,k2 as allowOrigins,f2 as allowHosts,a4 as InMemoryTenantStore,Y9 as CatalogAdjacencyCache,P9 as CIAM_PROVIDER_PRESETS,L1 as CACHE_BOUNDS};

package/dist/shared/core-9dvscte3.js

@@ -0,0 +1,4 @@
+function f(H){if(H===void 0||H===null)return[];return Array.isArray(H)?H:[H]}function y(H){if(typeof H!=="string")return;return H.endsWith("/")?H.slice(0,-1):H}function a(H,Z){if(y(Z.issuer)!==y(H.claims?.iss))return!1;let X=f(Z.audience);if(X.length===0)return!1;let $=f(H.claims?.aud),Q=typeof H.claims?.azp==="string"?H.claims.azp:void 0;if(!(X.some((L)=>$.includes(L))||(Q?X.includes(Q):!1)))return!1;let Y=H.clientId??H.workloadId??H.claims?.sub;return Z.clientId===Y}function RH(H,Z){let X=H?.trustedProvisioningClients;if(!X?.length)return;let $=new Set;for(let Q of X){if(!a(Z,Q))continue;for(let G of Q.permissions??[])$.add(G)}return $.size>0?$:void 0}function OH(H){let Z=H?.trustedProvisioningClients;if(!Z?.length)return[];let X=[];for(let $ of Z)for(let Q of $.permissions??[])X.push({subject:$.clientId,subjectType:"workload",targetType:"permission",target:Q,status:"active",provenance:{source:"esi-trusted",actor:$.clientId}});return X}function R(H,Z,X,$){let Q=Z.length,G=$??H,Y=G>0?Math.floor(X/G)+1:1,L=G>0?Math.ceil(H/G):0;return{total:H,count:Q,items:Z,size:G,page:Y,pages:L}}async function*b(H,Z,X=1000){let $=0;while(!0){let Q=await H($,X);if(Q.items.length===0)break;for(let G of Q.items)yield(Z?await Z(G):G)??G;if(Q.items.length<X||$+Q.items.length>=Q.total)break;$+=X}}function z(H){if(typeof H==="string")return H.trim();if(H&&typeof H==="object"){let Z=H;for(let X of["id","value","name","displayName"]){let $=Z[X];if(typeof $==="string"&&$.trim())return $.trim()}}return""}function g(H){let Z=z(H.subject),X=z(H.target);if(!Z)throw Error("Access change subject must resolve to a non-empty id.");if(!H.targetType)throw Error("Access change targetType is required.");if(!X)throw Error("Access change target must resolve to a non-empty id.");let $=(H.resources??[]).map((Y)=>Y.trim()).filter(Boolean),Q=!H.applyToApplication&&$.length>0?[...$].sort().join(","):"app";return`${H.subjectType??"user"}:${Z}:${H.targetType}:${X}:${Q}`}function s(H){let Z=(H.resources??[]).map((X)=>X.trim()).filter(Boolean);if(H.applyToApplication||Z.length===0)return[void 0];return Z}function TH(H){if(!H)return;return H.externalId===void 0?{...H,externalId:H.id}:H}async function m(H,Z,X,$,Q){if($==="resource")return X?.get(Q);if(Z){let G=$==="group"?Z.groups.get(Q):$==="role"?Z.roles.get(Q):Z.permissions.get(Q);if(G)return G}if(H){let Y=await($==="group"?H.groups:$==="role"?H.roles:H.permissions).get(Q);if(Y)return Y}if($==="group")return X?.entitlement?.(Q);return}class e{catalog;resources;code;nodes=new Map;subResources=new Map;children=new Map;constructor(H,Z,X){this.catalog=H;this.resources=Z;this.code=X}getNode(H,Z){let X=`${H}:${Z}`,$=this.nodes.get(X);if(!$)$=m(this.catalog,this.code,this.resources,H,Z),this.nodes.set(X,$);return $}resourceChildren(H){let Z=this.children.get(H);if(!Z)Z=v(H,this.view()),this.children.set(H,Z);return Z}resourceAndSubResourceIds(H){let Z=this.subResources.get(H);if(!Z)Z=p(H,this.view()),this.subResources.set(H,Z);return Z}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(H){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function O(H,Z,X){if(H.cache)return H.cache.getNode(Z,X);return m(H.catalog,H.code,H.resources,Z,X)}async function h(H,Z){if(typeof H!=="string")return H;return O(Z,"resource",H)}async function v(H,Z){if(Z.resources?.children)return Z.resources.children(H);let X=await h(H,Z),$=[];for(let Q of X?.resources??[]){let G=await h(Q,Z);if(G)$.push(G);else if(typeof Q==="string"&&Q.trim())$.push({id:Q.trim()})}return $}async function c(H,Z){if(Z.cache)return Z.cache.resourceChildren(H);return v(H,Z)}async function p(H,Z){let X=[],$=new Set,Q=async(G)=>{if(!G||$.has(G))return;$.add(G),X.push(G);for(let Y of await c(G,Z))await Q(z(Y))};return await Q(z(H)),X}async function HH(H,Z){let X=H.id??g(H),$=z(H.subject);if(!$)throw Error("Access change subject must resolve to a non-empty id.");let Q=H.subjectType??"user",G=s(H),Y=[],L=new Set,D=new Set,J=(B,M,U)=>{if(!M)return;let F=`${B}:${M}:${U??""}`;if(L.has(F))return;L.add(F),Y.push({subject:$,subjectType:Q,targetType:B,target:M,resource:U,rootId:X})},q=async(B,M,U)=>{for(let F of G)if(B==="permission"&&U?.applyToSubResources&&F){let V=Z.cache?await Z.cache.resourceAndSubResourceIds(F):await p(F,Z);for(let A of V)J("permission",M,A)}else J(B,M,F)},W=async(B,M)=>{let U=z(M);if(!U)return;let F=`${B}:${U}`;if(D.has(F))return;if(D.add(F),B==="group"){let A=typeof M==="string"?await O(Z,"group",U):M;await q("group",U,void 0);for(let K of A?.groups??[])await W("group",K);for(let K of A?.roles??[])await W("role",K);for(let K of A?.permissions??[])await W("permission",K);return}if(B==="role"){let A=typeof M==="string"?await O(Z,"role",U):M;await q("role",U,void 0);for(let K of A?.permissions??[])await W("permission",K);return}let V=typeof M==="string"?await O(Z,"permission",U):M;await q("permission",U,V)};return await W(H.targetType,H.target),Y}async function EH(H,Z,X,$){let{accessStore:Q,accessIndex:G,catalogStore:Y,code:L,resources:D}=X;if(!G||!Y&&!L)return 0;if(await G.clear(H,Z),!Q)return 0;let J={catalog:Y,code:L,resources:D,cache:$},q=0;for await(let W of b((B,M)=>Q.listBySubject(H,Z,{start:B,limit:M}))){let B=W.id??g(W),M=await HH({...W,id:B},J);await G.materialize(B,M),q+=1}return q}async function kH(H,Z,X){let $=new Map,Q=new Map,G=new Map,Y=new Map,L=new Set,D=(W,B)=>O(X,W,B),J=async(W)=>{let B=z(W);if(!B||Y.has(B))return;let M=typeof W==="string"?await D("resource",B):W;if(!M)return;Y.set(B,M);let U=M.resources??(M.id?await c(M.id,X):[]);for(let F of U)await J(F)},q=async(W,B)=>{let M=z(B);if(!M)return;let U=`${W}:${M}`;if(L.has(U))return;if(L.add(U),W==="group"){let V=typeof B==="string"?await D("group",M):B;if(!V)return;$.set(M,V);for(let A of V.groups??[])await q("group",A);for(let A of V.roles??[])await q("role",A);for(let A of V.permissions??[])await q("permission",A);for(let A of V.resources??[])await J(A);return}if(W==="role"){let V=typeof B==="string"?await D("role",M):B;if(!V)return;Q.set(M,V);for(let A of V.permissions??[])await q("permission",A);return}let F=typeof B==="string"?await D("permission",M):B;if(!F)return;G.set(M,F)};if(L.add(`${Z}:${z(H)}`),Z==="group"){let W=H;for(let B of W.groups??[])await q("group",B);for(let B of W.roles??[])await q("role",B);for(let B of W.permissions??[])await q("permission",B);for(let B of W.resources??[])await J(B)}else{let W=H;for(let B of W.permissions??[])await q("permission",B)}return{groups:[...$.values()],roles:[...Q.values()],permissions:[...G.values()],resources:[...Y.values()]}}function XH(H){return typeof H.groups?.get==="function"}function PH(H){return XH(H)?H:$H(H)}class N extends Error{constructor(H){super(`defineCatalog: ${H}`);this.name="CodeCatalogError"}}function d(H){return typeof H==="string"?H:H.id}function ZH(H){for(let Z of Object.values(H))if(Array.isArray(Z))Object.freeze(Z);if(H.metadata)Object.freeze(H.metadata);Object.freeze(H)}function j(H,Z){let{assignableSubjectTypes:X,recommendedSubjectTypes:$}=Z;if(!$?.length)return;if(!X)return;for(let Q of $)if(!X.includes(Q))throw new N(`${H} "${Z.id}": recommendedSubjectTypes "${Q}" is not in assignableSubjectTypes.`)}function T(H){let Z=new Map(H.map((Q)=>[Q.id,Q])),X=new Map(H.map((Q)=>[Q.externalId,Q])),$=Object.freeze([...H]);return Object.freeze({get:(Q)=>Z.get(Q),getByExternalId:(Q)=>X.get(Q),list:()=>$})}function $H(H){let Z=H.groups??[],X=H.roles??[],$=H.permissions??[],Q=new Map,G=(W,B)=>{for(let M of B){if(!M.id)throw new N(`a ${W} is missing its required "id".`);let U=Q.get(M.id);if(U)throw new N(`duplicate id "${M.id}" (declared as both ${U} and ${W}).`);Q.set(M.id,W)}};G("group",Z),G("role",X),G("permission",$);let Y=new Map;for(let W of[...Z,...X,...$]){if(W.externalId===void 0)W.externalId=W.id;let B=W.externalId,M=Y.get(B);if(M!==void 0)throw new N(`duplicate externalId "${B}" (on "${M}" and "${W.id}").`);Y.set(B,W.id)}let L=(W,B,M,U)=>{let F=d(U),V=Q.get(F);if(V===void 0)throw new N(`${W} "${B}" references ${M} "${F}", which is not declared in the catalog.`);if(V!==M)throw new N(`${W} "${B}" references "${F}" as a ${M}, but it is a ${V}.`)};for(let W of X){j("role",W);for(let B of W.permissions??[])L("role",W.id,"permission",B)}for(let W of $)j("permission",W);for(let W of Z){j("group",W);for(let B of W.groups??[])L("group",W.id,"group",B);for(let B of W.roles??[])L("group",W.id,"role",B);for(let B of W.permissions??[])L("group",W.id,"permission",B)}let D=new Map(Z.map((W)=>[W.id,W])),J=new Map,q=(W,B)=>{let M=J.get(W);if(M==="done")return;if(M==="visiting")throw new N(`group composition cycle: ${[...B,W].join(" -> ")}.`);J.set(W,"visiting");for(let U of D.get(W)?.groups??[])q(d(U),[...B,W]);J.set(W,"done")};for(let W of Z)q(W.id,[]);for(let W of[...Z,...X,...$])ZH(W);return Object.freeze({groups:T(Z),roles:T(X),permissions:T($)})}function E(H,Z,X){let $=()=>{if(!X)throw Error(`Cannot write ${H} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return X},Q={async get(G){return Z.get(G)??await X?.get(G)},set(G){return $().set(G)},async delete(G){await $().delete(G)},async list(G){let Y=Math.max(0,G?.start??0),L=G?.limit,D=G?.filter?.requestable,J=Z.list().filter((F)=>D===void 0||Boolean(F.requestable)===D),q=L!=null?J.slice(Y,Y+L):J.slice(Y);if(!X)return R(J.length,q,Y,L);let W=Math.max(0,Y-J.length),B=L!=null?L-q.length:void 0,M=await X.list({start:W,limit:B!=null?Math.max(1,B):void 0,filter:G?.filter}),U=(B!=null?M.items.slice(0,B):M.items).filter((F)=>!Z.get(F.id));return R(J.length+M.total,[...q,...U],Y,L)}};if(!X||typeof X.getByExternalId==="function")Q.getByExternalId=async(G)=>Z.getByExternalId(G)??await X?.getByExternalId?.(G);return Q}function SH(H,Z){if(!H)return Z;return{groups:E("group",H.groups,Z?.groups),roles:E("role",H.roles,Z?.roles),permissions:E("permission",H.permissions,Z?.permissions),afterChange:Z?.afterChange?.bind(Z)}}var yH="ecid",n=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,QH=/^[A-Za-z0-9._-]+$/,YH=/^[A-Za-z0-9_-]+$/;class x extends Error{constructor(H){super(H);this.name="EcidFormatError"}}function GH(H){return typeof H==="string"&&n.test(H)}function bH(H,Z){if(!H||!QH.test(H))throw new x(`Invalid ECID realm ${JSON.stringify(H)}: must be non-empty and match [A-Za-z0-9._-].`);if(!Z||!YH.test(Z))throw new x(`Invalid ECID opaque ${JSON.stringify(Z)}: must be non-empty and match [A-Za-z0-9_-].`);return`ecid:${H}:${Z}`}function hH(H){let Z=typeof H==="string"?H.match(n):null;if(!Z)throw new x(`Invalid ECID ${JSON.stringify(H)}: expected "ecid:<realm>:<opaque>".`);return{realm:Z[1],opaque:Z[2]}}function gH(H){if(!GH(H))throw new x(`Invalid ECID ${JSON.stringify(H)}: expected "ecid:<realm>:<opaque>".`);return H}function vH(H){return{"~standard":{version:1,vendor:H,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,$=[],Q={};if("code"in X)if(typeof X.code==="string")Q.code=X.code;else $.push({message:"code must be a string",path:["code"]});else if(!("error"in X))$.push({message:"code is required",path:["code"]});if("state"in X)if(typeof X.state==="string"||X.state===void 0)Q.state=X.state;else $.push({message:"state must be a string",path:["state"]});if("session_state"in X)if(typeof X.session_state==="string"||X.session_state===void 0)Q.session_state=X.session_state;else $.push({message:"session_state must be a string",path:["session_state"]});if("error"in X){if(typeof X.error==="string")Q.error=X.error;else $.push({message:"error must be a string",path:["error"]});if("error_description"in X)if(typeof X.error_description==="string"||X.error_description===void 0)Q.error_description=X.error_description;else $.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in X)if(typeof X.error_uri==="string"||X.error_uri===void 0)Q.error_uri=X.error_uri;else $.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in X)if(typeof X.iss==="string"||X.iss===void 0)Q.iss=X.iss;else $.push({message:"iss must be a string",path:["iss"]});if($.length>0)return{issues:$};return{value:Q}}}}}function cH(H){return{"~standard":{version:1,vendor:H,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,$=[],Q={};if("access_token"in X)if(typeof X.access_token==="string")Q.access_token=X.access_token;else $.push({message:"access_token must be a string",path:["access_token"]});else $.push({message:"access_token is required",path:["access_token"]});if("id_token"in X)if(typeof X.id_token==="string")Q.id_token=X.id_token;else $.push({message:"id_token must be a string",path:["id_token"]});else $.push({message:"id_token is required",path:["id_token"]});if("token_type"in X)if(typeof X.token_type==="string")Q.token_type=X.token_type;else $.push({message:"token_type must be a string",path:["token_type"]});else $.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)Q.refresh_token=X.refresh_token;else $.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)Q.scope=X.scope;else $.push({message:"scope must be a string",path:["scope"]});if("session_state"in X)if(typeof X.session_state==="string"||X.session_state===void 0)Q.session_state=X.session_state;else $.push({message:"session_state must be a string",path:["session_state"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)Q.expires=X.expires;else $.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)Q.expires_in=X.expires_in;else $.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in X)if(typeof X.refresh_expires_in==="number"||X.refresh_expires_in===void 0)Q.refresh_expires_in=X.refresh_expires_in;else $.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if($.length>0)return{issues:$};return{value:Q}}}}}function l(H){return{"~standard":{version:1,vendor:H,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,$=[],Q={...X},G=["iss","sub"];for(let J of G)if(typeof X[J]!=="string")$.push({message:`${J} is required and must be a string`,path:[J]});let Y=X.aud;if(!(typeof Y==="string"||Array.isArray(Y)&&Y.length>0&&Y.every((J)=>typeof J==="string")))$.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof X.exp!=="number")$.push({message:"exp is required and must be a number",path:["exp"]});let D=["sid","name","email","preferred_username","picture"];for(let J of D)if(J in X&&X[J]!==void 0){if(typeof X[J]!=="string")$.push({message:`${J} must be a string`,path:[J]})}if("iat"in X&&X.iat!==void 0&&typeof X.iat!=="number")$.push({message:"iat must be a number",path:["iat"]});if($.length>0)return{issues:$};return{value:Q}}}}}function o(H){let Z=H["~standard"];return Object.assign(H,{validate(X){return Promise.resolve(Z.validate(X))}})}function dH(H,Z="Assertion failed. Required value is null or undefined."){if(H===void 0||H===null)throw Error(Z);return H}function nH(H,Z){return Response.json({error:"validation_failed",message:Z,issues:H},{status:400,headers:{"Content-Type":"application/json"}})}function lH(H,Z,X=[]){let $={...H,...Z};for(let Q of X)$[Q]=H?.[Q]??Z?.[Q];return $}function LH(H){let Z="",X=0,$=H.length;while(X<$){let Q=H[X];if(Q==='"'||Q==="'"){let G=Q;Z+=Q,X++;while(X<$){let Y=H[X];if(Y==="\\"){if(Z+=Y,X+1<$)Z+=H[X+1],X+=2;else X++;continue}if(Y===G){Z+=Y,X++;break}Z+=Y,X++}continue}if(Q==="/"&&X+1<$){let G=H[X+1];if(G==="/"){X+=2;while(X<$&&H[X]!==`
+`)X++;if(X<$)Z+=`
+`;X++;continue}if(G==="*"){X+=2;while(X+1<$&&!(H[X]==="*"&&H[X+1]==="/"))X++;X+=2;continue}}Z+=Q,X++}return Z}function uH(H){let Z=LH(H);return JSON.parse(Z)}function oH(H){return H==="/"?H:H.replace(/\/+$/,"")}function k(H){if(H===null||typeof H!=="object"||Array.isArray(H))return!1;let Z=Object.getPrototypeOf(H);return Z===Object.prototype||Z===null}function I(H){return Object.keys(H).filter((Z)=>H[Z]!==void 0).sort()}function u(H,Z){if(Object.is(H,Z))return!0;if(H===null||Z===null)return H===Z;if(Array.isArray(H)||Array.isArray(Z)){if(!Array.isArray(H)||!Array.isArray(Z)||H.length!==Z.length)return!1;for(let Q=0;Q<H.length;Q+=1)if(!u(H[Q],Z[Q]))return!1;return!0}if(!k(H)||!k(Z))return!1;let X=I(H),$=I(Z);if(X.length!==$.length)return!1;for(let Q=0;Q<X.length;Q+=1)if(X[Q]!==$[Q])return!1;for(let Q of X)if(!u(H[Q],Z[Q]))return!1;return!0}function w(H,Z){if(H===null||H===void 0){Z.push("n");return}if(Array.isArray(H)){Z.push("[");for(let X of H)w(X,Z);Z.push("]");return}if(k(H)){Z.push("{");for(let X of I(H))Z.push(JSON.stringify(X),":"),w(H[X],Z);Z.push("}");return}Z.push(JSON.stringify(H))}function rH(H){let Z=[];w(H,Z);let X=Z.join(""),$=2166136261;for(let Q=0;Q<X.length;Q+=1)$^=X.charCodeAt(Q),$=$*16777619%9007199254740992;return`${X.length.toString(36)}:${$.toString(36)}`}async function tH(H,Z=async(Y)=>Y.status===200,X=1000,$=1e4,Q,G){let Y=Date.now(),L=`Awaiting Ping (${H})`;return new Promise((D,J)=>{let q=null,W=null,B=null,M=!1,U=()=>{if(q)clearTimeout(q);if(W)clearInterval(W);if(B)clearTimeout(B);q=null,W=null,B=null},F=(K)=>{if(M)return;M=!0,U(),K()},V=Math.max(X,1e4),A=async()=>{try{let K=await fetch(H,{signal:AbortSignal.timeout(V)});if(K.ok){if(await Z(K)){F(D);return}L=`Response test failed: ${K.status}: ${K.statusText} - ${H}`}else try{let S=await K.json();L=`Response error: ${K.status}: ${K.statusText} - ${H}: ${JSON.stringify(S)}`}catch(S){L=`Response error: ${K.status}: ${K.statusText} - ${H}`}}catch(K){L=`${K instanceof Error?K.message:String(K)} - ${H}`}if(!M)q=setTimeout(()=>void A(),X)};if($>0)W=setInterval(()=>{G?.warn(`${L}: ${Date.now()-Y}ms`)},$);if(Q)B=setTimeout(()=>{F(()=>J(Error(`Timeout: ${Q}ms: ${L}`)))},Q);A()})}var WH="@enterprisestandard/core",BH=o(l(WH));function MH(H){let Z=H.exp!=null?new Date(H.exp*1000):new Date,X=H.iss??"";return{id:H.sub??"",userName:H.preferred_username??"",name:H.name??"",email:H.email??"",avatar:H.picture,sso:{profile:{...H,iss:H.iss??X,aud:H.aud},tenant:{id:H.idp??X,name:X},tokenType:"Bearer",expires:Z}}}function _H(H){let Z=H.replace(/-/g,"+").replace(/_/g,"/");return atob(Z)}async function eH(H){let Z=H.split(".");if(Z.length!==3)throw Error("Invalid JWT");let X=_H(Z[1]),$=JSON.parse(X),Q=await BH.validate($);if(Q.issues)throw Error(`ID token claims validation failed: ${Q.issues.map((G)=>G.message).join("; ")}`);if(Q.value)return MH(Q.value);throw Error("ID token claims validation failed")}class P extends Error{code="conflict";kind;field;constructor(H,Z,X){super(H);this.name="StoreConflictError",this.kind=Z,this.field=X,Object.setPrototypeOf(this,P.prototype)}}function XX(H){return H instanceof P||typeof H==="object"&&H!=null&&H.code==="conflict"}class r extends Error{status;statusText;constructor(H,Z={}){super(H,{cause:Z.cause});this.name="ESError",this.status=Z.status,this.statusText=Z.statusText,Object.setPrototypeOf(this,r.prototype)}}function QX(H){if(typeof H!=="object"||H==null)return!1;let Z=H.type;return Z==="vault"||Z==="aws"||Z==="azure"||Z==="gcp"}class t{tenants=new Map;async get(H){return this.tenants.get(H)}async list(H){let Z=Array.from(this.tenants.values()),X=Math.max(0,H?.start??0),$=H?.limit,Q=Z.length,G=$!=null?X+$:void 0,Y=Z.slice(X,G);return R(Q,Y,X,$)}async upsert(H){return this.tenants.set(H.id,H),H}async delete(H){let Z=this.tenants.has(H);return this.tenants.delete(H),Z?1:0}}class JH{store;esCache;constructor(H={}){this.esCache=H.esCache,this.store=new t}async get(H){return this.store.get(H)}async list(H){return this.store.list(H)}async upsert(H){let Z=await this.store.upsert(H);return this.esCache?.delete(H.id),Z}async delete(H){let Z=await this.store.delete(H);return this.esCache?.delete(H),Z}async getEs(H){if(!this.esCache)throw Error(`${this.constructor.name}.getEs() requires an app-owned esCache. Pass { esCache } (an lru-cache instance whose fetchMethod builds the tenant EnterpriseStandard and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.esCache.fetch(H)}}function DH(H,Z,X){return(async()=>{try{let $=await fetch(H,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(Z)});if(!$.ok)X.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure",status:$.status,statusText:$.statusText})}catch($){X.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure"},$)}})()}async function YX(H,Z,X){return DH(H,Z,X)}var LX="urn:enterprisestandard:params:scim:schemas:extension:authz:2.0:Group",i=["user","workload"];function WX(H){let{assignableSubjectTypes:Z,recommendedSubjectTypes:X}=H,$=H.id?` for "${H.id}"`:"";if(Z){let Q=Z.filter((G)=>!i.includes(G));if(Q.length>0)throw Error(`assignableSubjectTypes${$} contains values outside the platform ceiling [${i.join(", ")}]: ${Q.join(", ")}`)}if(X&&Z){let Q=X.filter((G)=>!Z.includes(G));if(Q.length>0)throw Error(`recommendedSubjectTypes${$} must be a subset of assignableSubjectTypes; offending values: ${Q.join(", ")}`)}}var MX="urn:enterprisestandard:scim:schemas:extension:es:2.0:User";function _(H,Z,X,$,Q){if(H===void 0||H===null){if(X)$.push({message:`${Z} is required`,path:Q});return}if(typeof H!=="string"){$.push({message:`${Z} must be a string`,path:Q});return}return H}function C(H,Z,X,$){if(H===void 0||H===null)return;if(typeof H!=="boolean"){X.push({message:`${Z} must be a boolean`,path:$});return}return H}function UH(H,Z,X){if(H===void 0||H===null)return;if(typeof H!=="object"||H===null){Z.push({message:"name must be an object",path:X});return}let $=H,Q={};return Q.formatted=_($.formatted,"formatted",!1,Z,[...X,"formatted"]),Q.familyName=_($.familyName,"familyName",!1,Z,[...X,"familyName"]),Q.givenName=_($.givenName,"givenName",!1,Z,[...X,"givenName"]),Q.middleName=_($.middleName,"middleName",!1,Z,[...X,"middleName"]),Q.honorificPrefix=_($.honorificPrefix,"honorificPrefix",!1,Z,[...X,"honorificPrefix"]),Q.honorificSuffix=_($.honorificSuffix,"honorificSuffix",!1,Z,[...X,"honorificSuffix"]),Q}function qH(H,Z,X){if(H===void 0||H===null)return;if(!Array.isArray(H)){Z.push({message:"emails must be an array",path:X});return}let $=[];for(let Q=0;Q<H.length;Q++){let G=H[Q],Y=[...X,Q];if(typeof G!=="object"||G===null){Z.push({message:"email must be an object",path:Y});continue}let L=G,D=_(L.value,"value",!0,Z,[...Y,"value"]);if(D)$.push({value:D,display:_(L.display,"display",!1,Z,[...Y,"display"]),type:_(L.type,"type",!1,Z,[...Y,"type"]),primary:C(L.primary,"primary",Z,[...Y,"primary"])})}return $.length>0?$:void 0}function FH(H,Z,X){if(H===void 0||H===null)return;if(!Array.isArray(H)){Z.push({message:"phoneNumbers must be an array",path:X});return}let $=[];for(let Q=0;Q<H.length;Q++){let G=H[Q],Y=[...X,Q];if(typeof G!=="object"||G===null){Z.push({message:"phoneNumber must be an object",path:Y});continue}let L=G,D=_(L.value,"value",!0,Z,[...Y,"value"]);if(D)$.push({value:D,display:_(L.display,"display",!1,Z,[...Y,"display"]),type:_(L.type,"type",!1,Z,[...Y,"type"]),primary:C(L.primary,"primary",Z,[...Y,"primary"])})}return $.length>0?$:void 0}function KH(H,Z,X){if(H===void 0||H===null)return;if(!Array.isArray(H)){Z.push({message:"addresses must be an array",path:X});return}let $=[];for(let Q=0;Q<H.length;Q++){let G=H[Q],Y=[...X,Q];if(typeof G!=="object"||G===null){Z.push({message:"address must be an object",path:Y});continue}let L=G;$.push({formatted:_(L.formatted,"formatted",!1,Z,[...Y,"formatted"]),streetAddress:_(L.streetAddress,"streetAddress",!1,Z,[...Y,"streetAddress"]),locality:_(L.locality,"locality",!1,Z,[...Y,"locality"]),region:_(L.region,"region",!1,Z,[...Y,"region"]),postalCode:_(L.postalCode,"postalCode",!1,Z,[...Y,"postalCode"]),country:_(L.country,"country",!1,Z,[...Y,"country"]),type:_(L.type,"type",!1,Z,[...Y,"type"]),primary:C(L.primary,"primary",Z,[...Y,"primary"])})}return $.length>0?$:void 0}function VH(H,Z,X){if(H===void 0||H===null)return;if(!Array.isArray(H)){Z.push({message:"groups must be an array",path:X});return}let $=[];for(let Q=0;Q<H.length;Q++){let G=H[Q],Y=[...X,Q];if(typeof G!=="object"||G===null){Z.push({message:"group must be an object",path:Y});continue}let L=G,D=_(L.value,"value",!0,Z,[...Y,"value"]);if(D)$.push({value:D,$ref:_(L.$ref,"$ref",!1,Z,[...Y,"$ref"]),display:_(L.display,"display",!1,Z,[...Y,"display"]),type:_(L.type,"type",!1,Z,[...Y,"type"])})}return $.length>0?$:void 0}function AH(H,Z,X){if(H===void 0||H===null)return;if(!Array.isArray(H)){Z.push({message:"roles must be an array",path:X});return}let $=[];for(let Q=0;Q<H.length;Q++){let G=H[Q],Y=[...X,Q];if(typeof G!=="object"||G===null){Z.push({message:"role must be an object",path:Y});continue}let L=G,D=_(L.value,"value",!0,Z,[...Y,"value"]);if(D)$.push({value:D,display:_(L.display,"display",!1,Z,[...Y,"display"]),type:_(L.type,"type",!1,Z,[...Y,"type"]),primary:C(L.primary,"primary",Z,[...Y,"primary"])})}return $.length>0?$:void 0}function zH(H,Z,X){if(H===void 0||H===null)return;if(typeof H!=="object"||H===null){Z.push({message:"Enterprise User extension must be an object",path:X});return}let $=H,Q={};if(Q.employeeNumber=_($.employeeNumber,"employeeNumber",!1,Z,[...X,"employeeNumber"]),Q.costCenter=_($.costCenter,"costCenter",!1,Z,[...X,"costCenter"]),Q.organization=_($.organization,"organization",!1,Z,[...X,"organization"]),Q.division=_($.division,"division",!1,Z,[...X,"division"]),Q.department=_($.department,"department",!1,Z,[...X,"department"]),$.manager!==void 0&&$.manager!==null)if(typeof $.manager!=="object"||$.manager===null)Z.push({message:"manager must be an object",path:[...X,"manager"]});else{let G=$.manager;Q.manager={value:_(G.value,"value",!1,Z,[...X,"manager","value"]),$ref:_(G.$ref,"$ref",!1,Z,[...X,"manager","$ref"]),displayName:_(G.displayName,"displayName",!1,Z,[...X,"manager","displayName"])}}return Q}function _X(H){return{"~standard":{version:1,vendor:H,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,$=[],Q={},G=_(X.userName,"userName",!0,$,["userName"]);if(!G)return{issues:$};if(Q.userName=G,Q.id=_(X.id,"id",!1,$,["id"]),Q.externalId=_(X.externalId,"externalId",!1,$,["externalId"]),Q.displayName=_(X.displayName,"displayName",!1,$,["displayName"]),Q.nickName=_(X.nickName,"nickName",!1,$,["nickName"]),Q.profileUrl=_(X.profileUrl,"profileUrl",!1,$,["profileUrl"]),Q.title=_(X.title,"title",!1,$,["title"]),Q.userType=_(X.userType,"userType",!1,$,["userType"]),Q.preferredLanguage=_(X.preferredLanguage,"preferredLanguage",!1,$,["preferredLanguage"]),Q.locale=_(X.locale,"locale",!1,$,["locale"]),Q.timezone=_(X.timezone,"timezone",!1,$,["timezone"]),X.password!==void 0)$.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});Q.active=C(X.active,"active",$,["active"]),Q.name=UH(X.name,$,["name"]),Q.emails=qH(X.emails,$,["emails"]),Q.phoneNumbers=FH(X.phoneNumbers,$,["phoneNumbers"]),Q.addresses=KH(X.addresses,$,["addresses"]),Q.groups=VH(X.groups,$,["groups"]),Q.roles=AH(X.roles,$,["roles"]);let Y="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(X[Y]!==void 0)Q[Y]=zH(X[Y],$,[Y]);if(X.schemas!==void 0)if(Array.isArray(X.schemas))Q.schemas=X.schemas.filter((L)=>typeof L==="string");else $.push({message:"schemas must be an array",path:["schemas"]});if(X.meta!==void 0)if(typeof X.meta==="object"&&X.meta!==null){let L=X.meta;Q.meta={resourceType:typeof L.resourceType==="string"?L.resourceType:void 0,created:typeof L.created==="string"?L.created:void 0,lastModified:typeof L.lastModified==="string"?L.lastModified:void 0,location:typeof L.location==="string"?L.location:void 0,version:typeof L.version==="string"?L.version:void 0}}else $.push({message:"meta must be an object",path:["meta"]});if($.length>0)return{issues:$};return{value:Q}}}}}function NH(H,Z,X){if(H===void 0||H===null)return;if(!Array.isArray(H)){Z.push({message:"members must be an array",path:X});return}let $=[];for(let Q=0;Q<H.length;Q++){let G=H[Q],Y=[...X,Q];if(typeof G!=="object"||G===null){Z.push({message:"member must be an object",path:Y});continue}let L=G,D=_(L.value,"value",!0,Z,[...Y,"value"]);if(D){let J=_(L.type,"type",!1,Z,[...Y,"type"]);$.push({value:D,$ref:_(L.$ref,"$ref",!1,Z,[...Y,"$ref"]),display:_(L.display,"display",!1,Z,[...Y,"display"]),type:J==="User"||J==="Group"?J:void 0})}}return $.length>0?$:void 0}function JX(H){return{"~standard":{version:1,vendor:H,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,$=[],Q={},G=_(X.displayName,"displayName",!0,$,["displayName"]);if(!G)return{issues:$};if(Q.displayName=G,Q.id=_(X.id,"id",!1,$,["id"]),Q.externalId=_(X.externalId,"externalId",!1,$,["externalId"]),Q.members=NH(X.members,$,["members"]),X.schemas!==void 0)if(Array.isArray(X.schemas))Q.schemas=X.schemas.filter((Y)=>typeof Y==="string");else $.push({message:"schemas must be an array",path:["schemas"]});if(X.meta!==void 0)if(typeof X.meta==="object"&&X.meta!==null){let Y=X.meta;Q.meta={resourceType:typeof Y.resourceType==="string"?Y.resourceType:void 0,created:typeof Y.created==="string"?Y.created:void 0,lastModified:typeof Y.lastModified==="string"?Y.lastModified:void 0,location:typeof Y.location==="string"?Y.location:void 0,version:typeof Y.version==="string"?Y.version:void 0}}else $.push({message:"meta must be an object",path:["meta"]});if($.length>0)return{issues:$};return{value:Q}}}}}
+export{RH as a,OH as b,R as c,b as d,z as e,g as f,TH as g,e as h,HH as i,EH as j,kH as k,XH as l,PH as m,$H as n,SH as o,yH as p,x as q,GH as r,bH as s,hH as t,gH as u,vH as v,cH as w,l as x,o as y,dH as z,nH as A,lH as B,LH as C,uH as D,oH as E,u as F,rH as G,tH as H,MH as I,eH as J,P as K,XX as L,r as M,QX as N,JH as O,YX as P,LX as Q,i as R,WX as S,MX as T,_X as U,JX as V};