@enterprisestandard/core 0.0.20-beta.20260706.1 → 0.0.20

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@enterprisestandard/core",
-  "version": "0.0.20-beta.20260706.1",
+  "version": "0.0.20",
   "description": "Enterprise Standard Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "enterprisestandard",
   "license": "proprietary",
   "type": "module",
+  "engines": {
+    "node": ">=20.6"
+  },
   "files": [
     "dist"
   ],
@@ -25,5 +28,8 @@
         "default": "./dist/server.js"
       }
     }
+  },
+  "dependencies": {
+    "@standard-schema/spec": "^1.1.0"
   }
 }

package/dist/shared/core-51h35vdb.js

@@ -1,4 +0,0 @@
-function CZ(Z){if(Z===void 0||Z===null)return[];return Array.isArray(Z)?Z:[Z]}function yZ(Z){if(typeof Z!=="string")return;return Z.endsWith("/")?Z.slice(0,-1):Z}function A1(Z,X){if(yZ(X.issuer)!==yZ(Z.claims?.iss))return!1;let $=CZ(X.audience);if($.length>0){let Y=CZ(Z.claims?.aud),L=typeof Z.claims?.azp==="string"?Z.claims.azp:void 0;if(!($.some((G)=>Y.includes(G))||(L?$.includes(L):!1)))return!1}let Q=Z.clientId??Z.workloadId??Z.claims?.sub;return X.clientId===Q}function _4(Z,X){let $=Z?.trustedProvisioningClients;if(!$?.length)return;let Q=new Set;for(let Y of $){if(!A1(X,Y))continue;for(let L of Y.permissions??[])Q.add(L)}return Q.size>0?Q:void 0}function N4(Z){let X=Z?.trustedProvisioningClients;if(!X?.length)return[];let $=[];for(let Q of X)for(let Y of Q.permissions??[])$.push({subject:Q.clientId,subjectType:"workload",targetType:"permission",target:Y,status:"active",provenance:{source:"esi-trusted",actor:Q.clientId}});return $}function d(Z){if(typeof Z==="string")return Z.trim();if(Z&&typeof Z==="object"){let X=Z;for(let $ of["id","value","name","displayName"]){let Q=X[$];if(typeof Q==="string"&&Q.trim())return Q.trim()}}return""}function O1(Z){let X=d(Z.subject),$=d(Z.target);if(!X)throw Error("Access change subject must resolve to a non-empty id.");if(!Z.targetType)throw Error("Access change targetType is required.");if(!$)throw Error("Access change target must resolve to a non-empty id.");let Q=(Z.resources??[]).map((W)=>W.trim()).filter(Boolean),Y=!Z.applyToApplication&&Q.length>0?[...Q].sort().join(","):"app";return`${Z.subjectType??"user"}:${X}:${Z.targetType}:${$}:${Y}`}function j1(Z){let X=(Z.resources??[]).map(($)=>$.trim()).filter(Boolean);if(Z.applyToApplication||X.length===0)return[void 0];return X}class E1{catalog;nodes=new Map;subResources=new Map;constructor(Z){this.catalog=Z}getNode(Z,X){let $=`${Z}:${X}`,Q=this.nodes.get($);if(!Q)Q=(Z==="group"?this.catalog.groups:Z==="role"?this.catalog.roles:Z==="permission"?this.catalog.permissions:this.catalog.resources).get(X),this.nodes.set($,Q);return Q}resourceAndSubResourceIds(Z){let X=this.subResources.get(Z);if(!X)X=bZ(Z,this.catalog,this),this.subResources.set(Z,X);return X}invalidate(Z){this.clear()}clear(){this.nodes.clear(),this.subResources.clear()}}async function I1(Z,X,$){if(typeof Z!=="string")return Z;return $?$.getNode("resource",Z):X.resources.get(Z)}async function bZ(Z,X,$){let Q=[],Y=new Set,L=async(W)=>{let G=d(W);if(!G||Y.has(G))return;Y.add(G),Q.push(G);let M=await I1(W,X,$);for(let B of M?.resources??[])await L(B)};return await L(Z),Q}async function K4(Z,X,$){let Q=Z.id??O1(Z),Y=d(Z.subject);if(!Y)throw Error("Access change subject must resolve to a non-empty id.");let L=Z.subjectType??"user",W=j1(Z),G=[],M=new Set,B=new Set,S=(D,I,U)=>{if(!I)return;let y=`${D}:${I}:${U??""}`;if(M.has(y))return;M.add(y),G.push({subject:Y,subjectType:L,targetType:D,target:I,resource:U,rootId:Q})},w=async(D,I,U)=>{for(let y of W)if(D==="permission"&&U?.applyToSubResources&&y){let C=$?await $.resourceAndSubResourceIds(y):await bZ(y,X);for(let R of C)S("permission",I,R)}else S(D,I,y)},E=async(D,I)=>{let U=d(I);if(!U)return;let y=`${D}:${U}`;if(B.has(y))return;if(B.add(y),D==="group"){let R=typeof I==="string"?await($?$.getNode("group",U):X.groups.get(U)):I;await w("group",U,void 0);for(let k of R?.groups??[])await E("group",k);for(let k of R?.roles??[])await E("role",k);for(let k of R?.permissions??[])await E("permission",k);return}if(D==="role"){let R=typeof I==="string"?await($?$.getNode("role",U):X.roles.get(U)):I;await w("role",U,void 0);for(let k of R?.roles??[])await E("role",k);for(let k of R?.permissions??[])await E("permission",k);return}let C=typeof I==="string"?await($?$.getNode("permission",U):X.permissions.get(U)):I;await w("permission",U,C)};return await E(Z.targetType,Z.target),G}async function V4(Z,X,$,Q){let Y=new Map,L=new Map,W=new Map,G=new Map,M=new Set,B=(E,D)=>{if(Q)return Q.getNode(E,D);return(E==="group"?$.groups:E==="role"?$.roles:E==="permission"?$.permissions:$.resources).get(D)},S=async(E)=>{let D=d(E);if(!D||G.has(D))return;let I=typeof E==="string"?await B("resource",D):E;if(!I)return;G.set(D,I);for(let U of I.resources??[])await S(U)},w=async(E,D)=>{let I=d(D);if(!I)return;let U=`${E}:${I}`;if(M.has(U))return;if(M.add(U),E==="group"){let C=typeof D==="string"?await B("group",I):D;if(!C)return;Y.set(I,C);for(let R of C.groups??[])await w("group",R);for(let R of C.roles??[])await w("role",R);for(let R of C.permissions??[])await w("permission",R);for(let R of C.resources??[])await S(R);return}if(E==="role"){let C=typeof D==="string"?await B("role",I):D;if(!C)return;L.set(I,C);for(let R of C.roles??[])await w("role",R);for(let R of C.permissions??[])await w("permission",R);return}let y=typeof D==="string"?await B("permission",I):D;if(!y)return;W.set(I,y)};if(M.add(`${X}:${d(Z)}`),X==="group"){let E=Z;for(let D of E.groups??[])await w("group",D);for(let D of E.roles??[])await w("role",D);for(let D of E.permissions??[])await w("permission",D);for(let D of E.resources??[])await S(D)}else{let E=Z;for(let D of E.roles??[])await w("role",D);for(let D of E.permissions??[])await w("permission",D)}return{groups:[...Y.values()],roles:[...L.values()],permissions:[...W.values()],resources:[...G.values()]}}var A4="ecid",fZ=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,T1=/^[A-Za-z0-9._-]+$/,x1=/^[A-Za-z0-9_-]+$/;class o extends Error{constructor(Z){super(Z);this.name="EcidFormatError"}}function P1(Z){return typeof Z==="string"&&fZ.test(Z)}function O4(Z,X){if(!Z||!T1.test(Z))throw new o(`Invalid ECID realm ${JSON.stringify(Z)}: must be non-empty and match [A-Za-z0-9._-].`);if(!X||!x1.test(X))throw new o(`Invalid ECID opaque ${JSON.stringify(X)}: must be non-empty and match [A-Za-z0-9_-].`);return`ecid:${Z}:${X}`}function j4(Z){let X=typeof Z==="string"?Z.match(fZ):null;if(!X)throw new o(`Invalid ECID ${JSON.stringify(Z)}: expected "ecid:<realm>:<opaque>".`);return{realm:X[1],opaque:X[2]}}function kZ(Z){if(!P1(Z))throw new o(`Invalid ECID ${JSON.stringify(Z)}: expected "ecid:<realm>:<opaque>".`);return Z}function I4(Z){return{"~standard":{version:1,vendor:Z,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let $=X,Q=[],Y={};if("code"in $)if(typeof $.code==="string")Y.code=$.code;else Q.push({message:"code must be a string",path:["code"]});else if(!("error"in $))Q.push({message:"code is required",path:["code"]});if("state"in $)if(typeof $.state==="string"||$.state===void 0)Y.state=$.state;else Q.push({message:"state must be a string",path:["state"]});if("session_state"in $)if(typeof $.session_state==="string"||$.session_state===void 0)Y.session_state=$.session_state;else Q.push({message:"session_state must be a string",path:["session_state"]});if("error"in $){if(typeof $.error==="string")Y.error=$.error;else Q.push({message:"error must be a string",path:["error"]});if("error_description"in $)if(typeof $.error_description==="string"||$.error_description===void 0)Y.error_description=$.error_description;else Q.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in $)if(typeof $.error_uri==="string"||$.error_uri===void 0)Y.error_uri=$.error_uri;else Q.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in $)if(typeof $.iss==="string"||$.iss===void 0)Y.iss=$.iss;else Q.push({message:"iss must be a string",path:["iss"]});if(Q.length>0)return{issues:Q};return{value:Y}}}}}function T4(Z){return{"~standard":{version:1,vendor:Z,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let $=X,Q=[],Y={};if("access_token"in $)if(typeof $.access_token==="string")Y.access_token=$.access_token;else Q.push({message:"access_token must be a string",path:["access_token"]});else Q.push({message:"access_token is required",path:["access_token"]});if("id_token"in $)if(typeof $.id_token==="string")Y.id_token=$.id_token;else Q.push({message:"id_token must be a string",path:["id_token"]});else Q.push({message:"id_token is required",path:["id_token"]});if("token_type"in $)if(typeof $.token_type==="string")Y.token_type=$.token_type;else Q.push({message:"token_type must be a string",path:["token_type"]});else Q.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in $)if(typeof $.refresh_token==="string"||$.refresh_token===void 0)Y.refresh_token=$.refresh_token;else Q.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in $)if(typeof $.scope==="string"||$.scope===void 0)Y.scope=$.scope;else Q.push({message:"scope must be a string",path:["scope"]});if("session_state"in $)if(typeof $.session_state==="string"||$.session_state===void 0)Y.session_state=$.session_state;else Q.push({message:"session_state must be a string",path:["session_state"]});if("expires"in $)if(typeof $.expires==="string"||$.expires===void 0)Y.expires=$.expires;else Q.push({message:"expires must be a string",path:["expires"]});if("expires_in"in $)if(typeof $.expires_in==="number"||$.expires_in===void 0)Y.expires_in=$.expires_in;else Q.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in $)if(typeof $.refresh_expires_in==="number"||$.refresh_expires_in===void 0)Y.refresh_expires_in=$.refresh_expires_in;else Q.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(Q.length>0)return{issues:Q};return{value:Y}}}}}function hZ(Z){return{"~standard":{version:1,vendor:Z,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let $=X,Q=[],Y={...$},L=["iss","sub"];for(let B of L)if(typeof $[B]!=="string")Q.push({message:`${B} is required and must be a string`,path:[B]});let W=$.aud;if(!(typeof W==="string"||Array.isArray(W)&&W.length>0&&W.every((B)=>typeof B==="string")))Q.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof $.exp!=="number")Q.push({message:"exp is required and must be a number",path:["exp"]});let M=["sid","name","email","preferred_username","picture"];for(let B of M)if(B in $&&$[B]!==void 0){if(typeof $[B]!=="string")Q.push({message:`${B} must be a string`,path:[B]})}if("iat"in $&&$.iat!==void 0&&typeof $.iat!=="number")Q.push({message:"iat must be a number",path:["iat"]});if(Q.length>0)return{issues:Q};return{value:Y}}}}}function mZ(Z){let X=Z["~standard"];return Object.assign(Z,{validate($){return Promise.resolve(X.validate($))}})}function x(Z,X="Assertion failed. Required value is null or undefined."){if(Z===void 0||Z===null)throw Error(X);return Z}function gZ(Z,X){return Response.json({error:"validation_failed",message:X,issues:Z},{status:400,headers:{"Content-Type":"application/json"}})}function P4(Z,X,$=[]){let Q={...Z,...X};for(let Y of $)Q[Y]=Z?.[Y]??X?.[Y];return Q}function w1(Z){let X="",$=0,Q=Z.length;while($<Q){let Y=Z[$];if(Y==='"'||Y==="'"){let L=Y;X+=Y,$++;while($<Q){let W=Z[$];if(W==="\\"){if(X+=W,$+1<Q)X+=Z[$+1],$+=2;else $++;continue}if(W===L){X+=W,$++;break}X+=W,$++}continue}if(Y==="/"&&$+1<Q){let L=Z[$+1];if(L==="/"){$+=2;while($<Q&&Z[$]!==`
-`)$++;if($<Q)X+=`
-`;$++;continue}if(L==="*"){$+=2;while($+1<Q&&!(Z[$]==="*"&&Z[$+1]==="/"))$++;$+=2;continue}}X+=Y,$++}return X}function w4(Z){let X=w1(Z);return JSON.parse(X)}function R4(Z){return Z==="/"?Z:Z.replace(/\/+$/,"")}function KZ(Z){if(Z===null||typeof Z!=="object"||Array.isArray(Z))return!1;let X=Object.getPrototypeOf(Z);return X===Object.prototype||X===null}function VZ(Z){return Object.keys(Z).filter((X)=>Z[X]!==void 0).sort()}function vZ(Z,X){if(Object.is(Z,X))return!0;if(Z===null||X===null)return Z===X;if(Array.isArray(Z)||Array.isArray(X)){if(!Array.isArray(Z)||!Array.isArray(X)||Z.length!==X.length)return!1;for(let Y=0;Y<Z.length;Y+=1)if(!vZ(Z[Y],X[Y]))return!1;return!0}if(!KZ(Z)||!KZ(X))return!1;let $=VZ(Z),Q=VZ(X);if($.length!==Q.length)return!1;for(let Y=0;Y<$.length;Y+=1)if($[Y]!==Q[Y])return!1;for(let Y of $)if(!vZ(Z[Y],X[Y]))return!1;return!0}function zZ(Z,X){if(Z===null||Z===void 0){X.push("n");return}if(Array.isArray(Z)){X.push("[");for(let $ of Z)zZ($,X);X.push("]");return}if(KZ(Z)){X.push("{");for(let $ of VZ(Z))X.push(JSON.stringify($),":"),zZ(Z[$],X);X.push("}");return}X.push(JSON.stringify(Z))}function U4(Z){let X=[];zZ(Z,X);let $=X.join(""),Q=2166136261;for(let Y=0;Y<$.length;Y+=1)Q^=$.charCodeAt(Y),Q=Q*16777619%9007199254740992;return`${$.length.toString(36)}:${Q.toString(36)}`}async function q4(Z,X=async(W)=>W.status===200,$=1000,Q=1e4,Y,L){let W=Date.now(),G=`Awaiting Ping (${Z})`;return new Promise((M,B)=>{let S=null,w=null,E=async()=>{try{let D=await fetch(Z);if(D.ok)if(await X(D)){if(S)clearInterval(S);if(w)clearInterval(w);M()}else G=`Response test failed: ${D.status}: ${D.statusText} - ${Z}`;else try{let I=await D.json();G=`Response error: ${D.status}: ${D.statusText} - ${Z}: ${JSON.stringify(I)}`}catch(I){G=`Response error: ${D.status}: ${D.statusText} - ${Z}`}}catch(D){G=`${D instanceof Error?D.message:String(D)} - ${Z}`}};if(E(),S=setInterval(E,$),Q>0)w=setInterval(()=>{L?.warn(`${G}: ${Date.now()-W}ms`)},Q);if(Y)setTimeout(()=>{if(S)clearInterval(S);if(w)clearInterval(w);B(Error(`Timeout: ${Y}ms: ${G}`))},Y)})}var R1="@enterprisestandard/core",U1=mZ(hZ(R1));function q1(Z){let X=Z.exp!=null?new Date(Z.exp*1000):new Date,$=Z.iss??"";return{id:Z.sub??"",userName:Z.preferred_username??"",name:Z.name??"",email:Z.email??"",avatar:Z.picture,sso:{profile:{...Z,iss:Z.iss??$,aud:Z.aud},tenant:{id:Z.idp??$,name:$},tokenType:"Bearer",expires:X}}}function S1(Z){let X=Z.replace(/-/g,"+").replace(/_/g,"/");return atob(X)}async function b4(Z){let X=Z.split(".");if(X.length!==3)throw Error("Invalid JWT");let $=S1(X[1]),Q=JSON.parse($),Y=await U1.validate(Q);if(Y.issues)throw Error(`ID token claims validation failed: ${Y.issues.map((L)=>L.message).join("; ")}`);if(Y.value)return q1(Y.value);throw Error("ID token claims validation failed")}function C1(Z){for(let X=0;X<Z.length;X++){let $=Z.charCodeAt(X);if($<=31||$===127)return!0}return!1}function y1(Z,X){let $=null;try{$=new URL(Z,X)}catch{$=null}let Q="";try{Q=new URL(X).origin}catch{Q=""}return{candidate:Z,url:$,requestOrigin:Q}}function pZ(Z,X,$){let Q=y1(Z,$),Y=!1;for(let L of X){let W=L(Q);if(W==="deny")return!1;if(W==="allow")Y=!0}return Y}function b1(){return({candidate:Z,url:X})=>{if(C1(Z))return"deny";if(Z.includes("\\"))return"deny";if(Z.startsWith("//"))return"deny";if(!X)return"deny";if(X.protocol!=="http:"&&X.protocol!=="https:")return"deny";if(X.username||X.password)return"deny";return"abstain"}}function f1(){return({candidate:Z})=>Z.startsWith("/")&&!Z.startsWith("//")&&!Z.startsWith("/\\")?"allow":"abstain"}function k1(){return({url:Z,requestOrigin:X})=>Z&&X&&Z.origin===X?"allow":"abstain"}function k4(...Z){let X=new Set(Z.map(($)=>{try{return new URL($).origin}catch{return $}}));return({url:$})=>$&&X.has($.origin)?"allow":"abstain"}function h4(...Z){let X=Z.map(($)=>$.toLowerCase());return({url:$})=>{if(!$)return"abstain";let Q=$.hostname.toLowerCase();for(let Y of X)if(Y.startsWith(".")){if(Q===Y.slice(1)||Q.endsWith(Y))return"allow"}else if(Q===Y)return"allow";return"abstain"}}function cZ(){return[b1(),f1(),k1()]}function h1(Z,X,$){if(!Z)return!1;return pZ(Z,X,$)}function dZ(Z,X){if(!Z)return X.fallback;return pZ(Z,X.rules,X.requestUrl)?Z:X.fallback}var v4={rules:cZ(),fallback:"/"};function m4(Z,X,$="redirect"){let Q=new URL(Z.url).searchParams.get($)??void 0;return h1(Q,X.rules,Z.url)?{redirect:Q}:void 0}function g4(Z,X){let $=Z.context;return dZ($?.redirect,{rules:X.rules,fallback:X.fallback,requestUrl:Z.request.url})}function $Z(Z,X,$){if(Z instanceof Response)return{response:Z};if(typeof Z==="string")return{location:dZ(Z,{rules:cZ(),fallback:X,requestUrl:$})};return{location:X}}function AZ(Z,X){if(X.length===0)return Z;let $=new Headers(Z.headers);for(let Q of X)$.append("Set-Cookie",Q);return new Response(Z.body,{status:Z.status,statusText:Z.statusText,headers:$})}function v1(Z){let X={};if(!Z)return X;let $=Z.split(";");for(let Q of $){let Y=Q.trim();if(!Y)continue;let L=Y.indexOf("=");if(L===-1)continue;X[Y.slice(0,L).trim()]=Y.slice(L+1).trim()}return X}function uZ(Z){if(!Z.expiresAt)return!1;let X=Z.expiresAt instanceof Date?Z.expiresAt:new Date(Z.expiresAt);return!Number.isNaN(X.getTime())&&Date.now()>X.getTime()}function m1(Z){if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let{access_token:X,id_token:$,refresh_token:Q,tokens:Y,...L}=Z;return L}function p(Z,X){let $=Z[X];return typeof $==="string"?$:""}function g1(Z,X){let $=Z.exp;if(typeof $==="number")return new Date($*1000);if(typeof $==="string"&&$.trim()){let Q=Number($);if(!Number.isNaN(Q))return new Date(Q*1000)}if(X instanceof Date)return X;if(X){let Q=new Date(X);if(!Number.isNaN(Q.getTime()))return Q}return new Date}function p1(Z){let X=Z.claims;if(!X?.sub||typeof X.sub!=="string")return;let $=g1(X,Z.expiresAt);if(Z.authType==="sso")return{id:X.sub,userName:p(X,"preferred_username"),name:p(X,"name"),email:p(X,"email"),avatar:p(X,"picture")||void 0,sso:{profile:X,tenant:{id:p(X,"idp")||p(X,"iss"),name:p(X,"iss")},tokenType:"Bearer",expires:$}};return{id:X.sub,userName:p(X,"preferred_username"),name:p(X,"name"),email:p(X,"email"),avatar:p(X,"picture")||void 0,userType:"customer",ciam:{profile:X,scope:"openid profile email",tokenType:"Bearer",expires:$}}}function c1(Z){if(Z.authType!=="sso"&&Z.authType!=="ciam")return;if(uZ(Z))return;return{sid:Z.sid,authType:Z.authType,tenantId:typeof Z.tenantId==="string"?Z.tenantId:void 0,sub:Z.sub,expiresAt:Z.expiresAt,createdAt:Z.createdAt,lastActivityAt:Z.lastActivityAt,claims:m1(Z.claims)}}function d1(Z,X){if(!Z.endsWith(".session"))return!1;if(!X||X.length===0)return!0;return X.some(($)=>Z===`${$}.session`)}function u1(Z){if(Z===void 0)return;let X=(Array.isArray(Z)?Z:[Z]).map(($)=>$.trim()).filter(($)=>$.length>0);return X.length>0?X:void 0}async function n1(Z,X,$){return(await l1(Z,X,$)).map(c1).filter((Y)=>Boolean(Y))}async function l1(Z,X,$){let Q=v1(Z.headers.get("cookie")),Y=u1($?.cookiesPrefix),L=[],W=new Set;for(let[G,M]of Object.entries(Q)){if(!d1(G,Y)||!M)continue;if(W.has(M))continue;W.add(M);let B=await X.get(M);if(!B)continue;if(B.authType!=="sso"&&B.authType!=="ciam")continue;if(uZ(B))continue;L.push(B)}return L}async function c4(Z,X,$){return(await n1(Z,X,$)).map(p1).filter((Y)=>Boolean(Y))}var lZ=600000,OZ=256,f=new Map;function u4(Z){if(typeof Z?.ttlMs==="number"&&Number.isFinite(Z.ttlMs))lZ=Math.min(Math.max(Z.ttlMs,60000),86400000);if(typeof Z?.maxEntries==="number"&&Number.isFinite(Z.maxEntries)){OZ=Math.max(1,Math.floor(Z.maxEntries));while(f.size>OZ){let X=f.keys().next().value;if(X===void 0)break;f.delete(X)}}}function nZ(Z,X){f.delete(Z),f.set(Z,X);while(f.size>OZ){let $=f.keys().next().value;if($===void 0)break;f.delete($)}}var a=new Map,jZ=()=>Date.now();function n4(Z){jZ=Z??(()=>Date.now())}function t1(Z){if(!Z)return;if(/\bno-store\b/i.test(Z))return 60000;let X=/max-age\s*=\s*(\d+)/i.exec(Z);if(!X)return;let $=Number(X[1]);return Number.isFinite($)?$*1000:void 0}function o1(Z){let $=t1(Z)??lZ;return Math.min(Math.max($,60000),86400000)}async function EZ(Z,X=3,$=1000,Q=30000,Y){let L=Error("Placeholder Error");for(let W=0;W<=X;W++)try{return await Z()}catch(G){if(L=G instanceof Error?G:Error(String(G)),G instanceof Error&&G.message.includes("400"))throw G;if(W===X)throw L;let M=Math.min($*2**W,Q),B=Math.random()*0.1*M;await new Promise((S)=>setTimeout(S,M+B)),Y?.warn(`Retry attempt ${W+1} after ${M+B}ms delay`)}throw L}async function QZ(Z,X,$){let Q=f.get(Z);if(!$?.forceRefresh&&Q&&Q.expiresAt>jZ())return nZ(Z,Q),Q.jwks;let Y=a.get(Z);if(Y)return Y;let L=(async()=>{try{return await EZ(async()=>{let W=await fetch(Z);if(!W.ok)throw Error("Failed to fetch JWKS");let G=await W.json(),M=o1(W.headers.get("cache-control"));return nZ(Z,{jwks:G,expiresAt:jZ()+M,importedKeys:new Map}),G},void 0,void 0,void 0,X)}catch(W){let G=f.get(Z);if(G)return X?.warn("JWKS refresh failed; serving last-known-good keys",{"es.operation":"jwks.refresh","es.outcome":"degraded"}),G.jwks;throw W}finally{a.delete(Z)}})();return a.set(Z,L),L}function l4(Z){if(Z){f.delete(Z),a.delete(Z);return}f.clear(),a.clear()}async function t4(Z,X,$){return(await tZ(Z,X,$)).jwk}async function tZ(Z,X,$){if(!X?.trim())throw Error("JWT header missing kid");await QZ(Z,$);let Q=f.get(Z),Y=Q?.jwks.keys.find((L)=>L.kid===X);if(!Y)await QZ(Z,$,{forceRefresh:!0}),Q=f.get(Z),Y=Q?.jwks.keys.find((L)=>L.kid===X);if(!Q||!Y)throw Error("Public key not found");return{jwk:Y,entry:Q}}async function oZ(Z,X,$,Q,Y){let{jwk:L,entry:W}=await tZ(Z,X,Y),G=`${X}\x00${$}`,M=W.importedKeys.get(G);if(M)return M;let B=Q(L);return B.catch(()=>{if(W.importedKeys.get(G)===B)W.importedKeys.delete(G)}),W.importedKeys.set(G,B),B}async function o4(Z,X){let $=Z.keys.find((Q)=>Q.kid===X);if(!$)throw Error("Public key not found");return IZ($)}function IZ(Z){return crypto.subtle.importKey("jwk",{kty:Z.kty,n:Z.n,e:Z.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}function a1(Z){let X=Z;if(X.kty==="EC")return crypto.subtle.importKey("jwk",{kty:"EC",crv:X.crv,x:X.x,y:X.y},{name:"ECDSA",namedCurve:X.crv??"P-256"},!1,["verify"]);return IZ(Z)}async function a4(Z,X,$){return oZ(Z,X,"rs256",IZ,$)}async function aZ(Z,X,$){let Q=await oZ(Z,X,"oidc",a1,$),Y=Q.algorithm.name==="ECDSA"?{name:"ECDSA",hash:"SHA-256"}:{name:"RSASSA-PKCS1-v1_5"};return{key:Q,algorithm:Y}}function WZ(Z=32){let X=new Uint8Array(Z);return crypto.getRandomValues(X),Array.from(X,($)=>$.toString(16).padStart(2,"0")).join("").substring(0,Z)}function YZ(Z){let X="";return Z.forEach(($)=>{X+=String.fromCharCode($)}),btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function rZ(Z){let X=Z.replace(/-/g,"+").replace(/_/g,"/"),$=X.padEnd(X.length+(4-X.length%4)%4,"="),Q=atob($),Y=new Uint8Array(Q.length);for(let L=0;L<Q.length;L++)Y[L]=Q.charCodeAt(L);return Y}function iZ(Z){let X=new TextDecoder().decode(rZ(Z));return JSON.parse(X)}async function sZ(Z){let X=new TextEncoder().encode(Z),$=await crypto.subtle.digest("SHA-256",X);return YZ(new Uint8Array($))}function s4(Z){let X=new URL(Z.authorizationUrl);if(X.searchParams.set("client_id",Z.clientId),X.searchParams.set("redirect_uri",Z.redirectUri),X.searchParams.set("response_type","code"),X.searchParams.set("scope",Z.scope),X.searchParams.set("state",Z.state),Z.codeChallenge)X.searchParams.set("code_challenge",Z.codeChallenge),X.searchParams.set("code_challenge_method","S256");for(let[$,Q]of Object.entries(Z.extraParams??{}))X.searchParams.set($,Q);return X.toString()}async function e4(Z){let X=new URLSearchParams;if(X.append("grant_type","authorization_code"),X.append("code",Z.code),X.append("redirect_uri",Z.redirectUri),X.append("client_id",Z.clientId),Z.clientSecret)X.append("client_secret",Z.clientSecret);if(Z.codeVerifier)X.append("code_verifier",Z.codeVerifier);let $=await fetch(Z.tokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:X.toString()}),Q=await $.json();if(!$.ok){let Y=Q;throw Z.log?.error("OIDC authorization-code exchange failed",{"es.operation":"token.exchange","es.outcome":"failure","http.status_code":$.status,oidc_error:Y.error}),Error(`Token exchange failed: ${Y.error||$.statusText} - ${Y.error_description||""}`.trim())}if(typeof Q.access_token!=="string")throw Error("Token exchange response missing access_token");return Q}var eZ=60;function GZ(Z){return Z.trim().replace(/\/$/,"")}function i1(Z){let{claims:X,audience:$}=Z,Q=GZ(Z.issuer),Y=Z.nowSec??Math.floor(Date.now()/1000),L=Z.clockSkewSec??eZ,W=X.iss;if(typeof W!=="string"||GZ(W)!==Q)throw Error("ID token issuer mismatch");let G=X.aud,M=Array.isArray(G)?G.includes($):typeof G==="string"&&G===$,B=typeof X.azp==="string"&&X.azp===$;if(!M&&!B)throw Error("ID token audience mismatch");if(typeof X.exp!=="number")throw Error("ID token missing exp");if(X.exp<Y-L)throw Error("ID token expired")}async function Z1(Z,X,$){let Q=Z.split(".");if(Q.length!==3)throw Error("Invalid JWT");let Y=iZ(Q[0]),L=iZ(Q[1]),W=rZ(Q[2]),{key:G,algorithm:M}=await aZ(X,Y.kid,$),B=new TextEncoder().encode(`${Q[0]}.${Q[1]}`);if(!await crypto.subtle.verify(M,G,W,B))throw Error("Invalid JWT signature");return{header:Y,payload:L}}async function X1(Z){let{payload:X}=await Z1(Z.idToken,Z.jwksUri,Z.log);return i1({claims:X,issuer:Z.issuer,audience:Z.audience,clockSkewSec:Z.clockSkewSec}),X}var r1="http://schemas.openid.net/event/backchannel-logout";async function $1(Z){let{payload:X}=await Z1(Z.logoutToken,Z.jwksUri,Z.log),$=GZ(Z.issuer),Q=X.iss;if(typeof Q!=="string"||GZ(Q)!==$)throw Error("Logout token issuer mismatch");let Y=X.aud,L=Array.isArray(Y)?Y.includes(Z.audience):typeof Y==="string"&&Y===Z.audience,W=typeof X.azp==="string"&&X.azp===Z.audience;if(!L&&!W)throw Error("Logout token audience mismatch");if(X.nonce!=null)throw Error("Logout token must not contain a nonce");let G=X.events;if(!(typeof G==="object"&&G!==null&&!Array.isArray(G)&&Object.hasOwn(G,r1)))throw Error("Logout token missing back-channel logout event");let B=typeof X.sid==="string"&&X.sid.length>0,S=typeof X.sub==="string"&&X.sub.length>0;if(!B&&!S)throw Error("Logout token missing sid and sub");if(typeof X.exp==="number"){let w=Math.floor(Date.now()/1000),E=Z.clockSkewSec??eZ;if(X.exp<w-E)throw Error("Logout token expired")}return X}var s1=3600000,e1=60000,Z4=86400000,i=new Map,r=new Map,TZ=()=>Date.now();function Z8(Z){TZ=Z??(()=>Date.now())}function X8(Z){if(Z){i.delete(Z),r.delete(Z);return}i.clear(),r.clear()}function X4(Z){let X=Z?/max-age\s*=\s*(\d+)/i.exec(Z):null,$=X?Number(X[1]):Number.NaN,Q=Number.isFinite($)?$*1000:s1;return Math.min(Math.max(Q,e1),Z4)}async function $8(Z){let X=i.get(Z);if(X&&X.expiresAt>TZ())return X.endpoints;let $=r.get(Z);if($)return $;let Q=(async()=>{try{let Y=Z.replace(/\/$/,""),L=await fetch(`${Y}/.well-known/openid-configuration`,{headers:{Accept:"application/json"}});if(!L.ok)throw Error(`OIDC discovery failed for ${Z} with status ${L.status}`);let W=await L.json(),G={authorizationUrl:typeof W.authorization_endpoint==="string"?W.authorization_endpoint:void 0,tokenUrl:typeof W.token_endpoint==="string"?W.token_endpoint:void 0,jwksUri:typeof W.jwks_uri==="string"?W.jwks_uri:void 0,userInfoUrl:typeof W.userinfo_endpoint==="string"?W.userinfo_endpoint:void 0};return i.set(Z,{endpoints:G,expiresAt:TZ()+X4(L.headers.get("cache-control"))}),G}catch(Y){let L=i.get(Z);if(L)return L.endpoints;throw Y}finally{r.delete(Z)}})();return r.set(Z,Q),Q}async function Q8(Z,X){let $=await fetch(Z,{headers:{Authorization:`Bearer ${X}`,Accept:"application/json","User-Agent":"enterprise-standard-ciam"}});if(!$.ok)throw Error(`UserInfo request failed with status ${$.status}`);return await $.json()}function $4(Z){let X=Z.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),$=atob(X),Q=new Uint8Array($.length);for(let Y=0;Y<$.length;Y++)Q[Y]=$.charCodeAt(Y);return Q}async function Y8(Z){let X=Math.floor(Date.now()/1000),$={alg:"ES256",kid:Z.keyId,typ:"JWT"},Q={iss:Z.teamId,iat:X,exp:X+(Z.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:Z.clientId},Y=YZ(new TextEncoder().encode(JSON.stringify($))),L=YZ(new TextEncoder().encode(JSON.stringify(Q))),W=`${Y}.${L}`,G=await crypto.subtle.importKey("pkcs8",$4(Z.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),M=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},G,new TextEncoder().encode(W));return`${W}.${YZ(new Uint8Array(M))}`}function b(Z){return Date.now()-Z}function xZ(Z){if(Z instanceof Error)return{"error.name":Z.name,"error.message":Z.message};return{"error.name":typeof Z,"error.message":String(Z)}}function BZ(Z,X){if(!Z)return{};try{let $=new URL(Z);return{[`${X}.origin`]:$.origin,[`${X}.path`]:$.pathname}}catch{return{[`${X}.path`]:Z.startsWith("/")?Z:`/${Z}`}}}function LZ(Z,X=5){if(!Array.isArray(Z))return[String(Z)];return Z.slice(0,X).map(($)=>{if(!$||typeof $!=="object")return String($);let Q=$,Y=Array.isArray(Q.path)?Q.path.join("."):String(Q.path??""),L=typeof Q.message==="string"?Q.message:String(Q.message??"validation failed");return Y?`${Y}: ${L}`:L})}function Q4(Z){if(!Z||typeof Z!=="object")return{};let X=Z;return{oidc_error:typeof X.error==="string"?X.error:void 0,oidc_error_description:typeof X.error_description==="string"?X.error_description:void 0,oidc_error_uri:typeof X.error_uri==="string"?X.error_uri:void 0}}function M8(Z,X={}){let $=typeof Z==="string"?Z:Z?.headers.get("cookie")??void 0;if(!$)return[];let Y=`${X.cookiePrefix??"es.sso"}.`,L=new Set;for(let W of Object.keys(Y4($))){if(!W.startsWith(Y))continue;let G=W.slice(Y.length),M=G.lastIndexOf(".");if(M<=0)continue;let B=G.slice(0,M).trim();if(B)L.add(B)}return Array.from(L)}function D8(Z,X,$,Q,Y){if(!$&&!Q)return;let L=Y?.sessionCache?.activityUpdateMs??60000,W=new WeakMap,G={...$,...Q},M=!!(G.authority&&G.tokenUrl&&G.authorizationUrl&&G.clientId&&G.redirectUri&&G.scope),B={...G,authority:M?x(G.authority,"Missing 'authority' from SSO Config"):G.authority,tokenUrl:M?x(G.tokenUrl,"Missing 'tokenUrl' from SSO Config"):G.tokenUrl,authorizationUrl:M?x(G.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):G.authorizationUrl,clientId:M?x(G.clientId,"Missing 'clientId' from SSO Config"):G.clientId,redirectUri:M?x(G.redirectUri,"Missing 'redirectUri' from SSO Config"):G.redirectUri,scope:M?x(G.scope,"Missing 'scope' from SSO Config"):G.scope,responseType:G.responseType??"code",cookiesSecure:G.cookiesSecure!==void 0?G.cookiesSecure:!0,cookiesSameSite:G.cookiesSameSite!==void 0?G.cookiesSameSite:"Strict",cookiesPrefix:G.cookiesPrefix??(G.clientId?`es.sso.${G.clientId}`:"es.sso"),cookiesPath:G.cookiesPath??"/"};function S(){let H=[];if(!B.authority)H.push("authority");if(!B.tokenUrl)H.push("tokenUrl");if(!B.authorizationUrl)H.push("authorizationUrl");if(!B.clientId)H.push("clientId");if(!B.redirectUri)H.push("redirectUri");if(!B.scope)H.push("scope");if(H.length>0)throw Error(`Missing OIDC configuration fields: ${H.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function w(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let J=W.get(H);if(J)return J;let F=E(H);return W.set(H,F),F}async function E(H){try{let{tokens:J,session:F,refreshedUser:_}=await n(H);if(!J)return{status:"unauthenticated"};if(_)return{status:"authenticated",value:_};if(F?.claims)return{status:"authenticated",value:k(F.claims,J)};return{status:"authenticated",value:await R(J)}}catch(J){if(Q1(J))return{status:"unauthenticated"};return X.error("Error parsing user from cookies",{"es.operation":"cookie.parse","es.outcome":"degraded"},J),{status:"degraded",error:J instanceof Error?J:void 0}}}async function D(H){let J=await w(H);return J.status==="authenticated"?J.value:void 0}async function I(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");S();let J=x(B.redirectUri,"Missing 'redirectUri' from SSO Config"),F=x(B.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),_=x(B.clientId,"Missing 'clientId' from SSO Config"),j=x(B.scope,"Missing 'scope' from SSO Config"),T=B.cookiesSecure?H.url.replace(/^http:\/\//,"https://"):H.url,z=WZ(),O=WZ(64),A=J;try{new URL(A)}catch{if(T)try{let v=new URL(T),c=A.startsWith("//")?A.slice(1):A.startsWith("/")?A:`/${A}`;A=new URL(c,v.origin).toString()}catch{try{let v=new URL(F),c=A.startsWith("//")?A.slice(1):A.startsWith("/")?A:`/${A}`;A=new URL(c,v.origin).toString()}catch{throw Error(`Invalid redirectUri: "${J}". It must be a valid absolute URL.`)}}}let V=new URL(F);V.searchParams.append("client_id",_),V.searchParams.append("redirect_uri",A),V.searchParams.append("response_type","code"),V.searchParams.append("scope",j),V.searchParams.append("state",z);let P=await sZ(O);V.searchParams.append("code_challenge",P),V.searchParams.append("code_challenge_method","S256");let N=await B.beforeLogin?.({request:H}),q=N===void 0?{state:z,codeVerifier:O}:{state:z,codeVerifier:O,context:N};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:V.toString(),"Set-Cookie":JZ(ZZ(z),q,B.loginStateTtl??600)}})}async function U(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let J;try{J=await D(H)}catch{J=void 0}let F=await B.beforeLogout?.({request:H,user:J}),_=e("session",H),j;try{j=await n(H);let N=j.tokens?.refresh_token??e("refresh",H);if(N)await H1(N)}catch(N){X.warn("Failed to revoke token",{"es.operation":"token.revoke","es.outcome":"degraded"},N)}if(B.sessionStore)try{let N=j?.sid??_;if(N)await B.sessionStore.delete(N)}catch(N){X.warn("Failed to delete session",{"es.operation":"session.delete","es.outcome":"degraded"},N)}let T=[["Set-Cookie",u("session")]],z=await B.afterLogout?.({request:H,context:F}),O=$Z(z,"/",H.url);if(O.response){let N=new Headers(O.response.headers);for(let[,q]of T)N.append("Set-Cookie",q);return new Response(O.response.body,{status:O.response.status,statusText:O.response.statusText,headers:N})}let A=O.location??"/",V=H.headers.get("accept");if(V?.includes("application/json")||V?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:A}),{status:200,headers:[["Content-Type","application/json"],...T]});return new Response("Logged out",{status:302,headers:[["Location",A],...T]})}async function y(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");if(!B.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!H.headers.get("content-type")?.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let F=await H.text(),j=new URLSearchParams(F).get("logout_token");if(!j)return new Response("Missing logout_token parameter",{status:400});let T=x(B.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),z=x(B.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),O=B.jwksUri||`${T}/protocol/openid-connect/certs`,A=await $1({logoutToken:j,jwksUri:O,issuer:T,audience:z,log:X}),V=typeof A.sid==="string"?A.sid:void 0;if(!V)return X.warn("Back-Channel Logout: logout_token missing sid claim",{"es.operation":"backchannel_logout","es.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await B.sessionStore.delete(V),X.info("Back-Channel Logout: successfully deleted session",{"es.module":"sso",sid:V}),new Response("OK",{status:200})}catch(J){return X.error("Error during back-channel logout",{"es.operation":"backchannel_logout","es.outcome":"failure"},J),new Response("Internal Server Error",{status:500})}}async function C(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let J=Date.now(),F=new URL(H.url),_=new URLSearchParams(F.search);X.debug("SSO callback received",{"es.event":"es.sso.callback.received","es.module":"sso","es.operation":"sign_in.callback","http.method":H.method,"url.path":F.pathname,hasCode:_.has("code"),hasState:_.has("state"),hasError:_.has("error"),...BZ(_.get("iss")??void 0,"oidc.issuer")});let j=Object.fromEntries(_.entries()),T=await Z.callbackParams.validate(j);if(T.issues)return X.warn("SSO callback parameter validation failed",{"es.event":"es.sso.callback.validation_failed","es.operation":"sign_in.callback","es.outcome":"failure","validation.issues":LZ(T.issues)}),gZ(T.issues,"OIDC callback parameters validation failed");let{code:z,state:O}=T.value,A;try{let V=x(O,'OIDC "state" was not present in the callback parameters'),P=e(ZZ(V),H,!0),{codeVerifier:N,state:q,context:v}=P??{};A=v,X.debug("SSO callback state cookie read",{"es.event":"es.sso.callback.state_cookie_read","es.module":"sso","es.operation":"sign_in.callback",hasStateCookie:Boolean(P),hasCodeVerifier:Boolean(N),hasStateVerifier:Boolean(q),hasContext:v!==void 0});let c=x(N,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');x(q,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let MZ=x(z,'OIDC "code" was not present in the callback parameters');if(O!==q)throw X.warn("SSO callback state verification failed",{"es.event":"es.sso.callback.state_verification_failed","es.operation":"sign_in.callback","es.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');X.debug("SSO callback state verified",{"es.event":"es.sso.callback.state_verified","es.module":"sso","es.operation":"sign_in.callback"});let DZ=B.cookiesSecure?H.url.replace(/^http:\/\//,"https://"):H.url,UZ=await B1(MZ,c,DZ),V1=Date.now();X.debug("SSO ID token parsing started",{"es.event":"es.sso.id_token.parse_started","es.module":"sso","es.operation":"id_token.parse"});let g=await R(UZ);X.debug("SSO ID token parsing completed",{"es.event":"es.sso.id_token.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":b(V1),"user.id":g.id});let _Z,qZ;{let h=wZ("SSO requires sessionStore configuration for opaque session cookies."),l=typeof g.sso.profile.sid==="string"?g.sso.profile.sid:void 0,t=l||WZ(32),m=g.id;if(X.debug("SSO session creation evaluated",{"es.event":"es.sso.session.create_evaluated","es.module":"sso","es.operation":"session.create",hasSid:Boolean(t),hasIdpSid:Boolean(l),hasSub:Boolean(m),"user.id":m}),!m)throw Error("Session creation failed: missing sub in ID token claims");let FZ=Date.now(),XZ={sid:t,sub:m,idpSid:l,authType:"sso",tenantId:B.tenantId,tokens:UZ,claims:g.sso.profile,expiresAt:g.sso.expires,createdAt:new Date,lastActivityAt:new Date};await D1(h,XZ),qZ=XZ,_Z=["Set-Cookie",JZ("session",t,g.sso.expires)],X.info("SSO session created",{"es.event":"es.sso.session.created","es.operation":"session.create","es.outcome":"success","duration.ms":b(FZ),"user.id":m})}if(B.userStore)try{let h=g.id;if(h){let l=new Date,t=Date.now();X.debug("SSO user store lookup started",{"es.event":"es.sso.user.lookup_started","es.module":"sso","es.operation":"user.lookup","user.id":h});let m=await B.userStore.get(h);if(X.debug("SSO user store lookup completed",{"es.event":"es.sso.user.lookup_completed","es.module":"sso","es.operation":"user.lookup","duration.ms":b(t),"user.id":h,found:Boolean(m)}),m||B.enableJitUserProvisioning){let FZ=Date.now(),XZ={...m??{},...g,id:h,tenantId:m?.tenantId,createdAt:m?.createdAt??l,updatedAt:l};await B.userStore.upsert(XZ),X.info("SSO user stored",{"es.event":"es.sso.user.stored","es.operation":"user.store","es.outcome":"success","duration.ms":b(FZ),"user.id":h,existing:Boolean(m),jitProvisioning:Boolean(B.enableJitUserProvisioning)})}else X.warn("JIT user provisioning disabled: user not found in store and will not be created",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped","user.id":h})}else X.warn("User storage skipped: missing sub in ID token claims",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped"})}catch(h){X.warn("Failed to store user",{"es.event":"es.sso.user.store_failed","es.operation":"user.store","es.outcome":"degraded",...xZ(h)})}X.info("SSO sign-in succeeded",{"es.event":"es.sso.sign_in.succeeded","es.operation":"sign_in.callback","es.outcome":"success","duration.ms":b(J),"user.id":g.id});let SZ=[["Set-Cookie",u(ZZ(V))],..._Z?[_Z]:[]],z1=await B.afterLogin?.({ok:!0,request:H,user:g,session:qZ,context:A}),NZ=$Z(z1,"/",H.url);if(NZ.response)return AZ(NZ.response,SZ.map(([,h])=>h));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",NZ.location],...SZ]})}catch(V){X.error("Error during sign-in callback",{"es.event":"es.sso.sign_in.callback_failed","es.operation":"sign_in.callback","es.outcome":"failure","duration.ms":b(J),...xZ(V)});let P=O?[["Set-Cookie",u(ZZ(O))]]:[],N=await B.afterLogin?.({ok:!1,request:H,error:V,context:A}),q=$Z(N,"/",H.url);if(q.response)return AZ(q.response,P.map(([,v])=>v));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",q.location],...P]})}}async function R(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let J=Date.now(),F=await M1(H.id_token);return X.debug("SSO user parsed from ID token",{"es.event":"es.sso.user.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":b(J),"user.id":F.sub,hasEmail:Boolean(F.email),hasName:Boolean(F.name)}),k(F,H)}function k(H,J){let F=Number(J.refresh_expires_in??J.expires_in??3600),_=J.expires?new Date(J.expires):new Date(Date.now()+F*1000),j=H.ecid!==void 0&&H.ecid!==null?kZ(H.ecid):void 0;return{id:H.sub,userName:H.preferred_username||"",name:H.name||"",email:H.email||"",emails:[{value:H.email||"",primary:!0}],...j?{ecid:j}:{},avatar:H.picture,sso:{profile:{...H},tenant:{id:H.idp||H.iss||"",name:H.iss||""},scope:J.scope,tokenType:J.token_type,sessionState:J.session_state,expires:_}}}async function W1(H){if(!B.userStore)return H;let J=await B.userStore.lookup(H);if(!J)return H;return{...H,...J,id:H.id,sso:H.sso}}async function B1(H,J,F){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");S();let _=x(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"),j=x(B.redirectUri,"Missing 'redirectUri' from SSO Config"),T=x(B.clientId,"Missing 'clientId' from SSO Config"),z=j;try{new URL(z)}catch{if(F)try{let A=new URL(F),V=z.startsWith("//")?z.slice(1):z.startsWith("/")?z:`/${z}`;z=new URL(V,A.origin).toString()}catch{try{let A=new URL(_),V=z.startsWith("//")?z.slice(1):z.startsWith("/")?z:`/${z}`;z=new URL(V,A.origin).toString()}catch{throw Error(`Invalid redirectUri: "${j}". It must be a valid absolute URL.`)}}}let O=new URLSearchParams;if(O.append("grant_type","authorization_code"),O.append("code",H),O.append("redirect_uri",z),O.append("client_id",T),B.clientSecret)O.append("client_secret",B.clientSecret);O.append("code_verifier",J);try{let A=Date.now();X.debug("SSO token exchange started",{"es.event":"es.sso.token.exchange_started","es.module":"sso","es.operation":"token.exchange",...BZ(_,"oidc.token_url"),...BZ(z,"oidc.redirect_uri"),hasClientSecret:Boolean(B.clientSecret)});let V=await fetch(_,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:O.toString()});X.debug("SSO token exchange response received",{"es.event":"es.sso.token.response_received","es.module":"sso","es.operation":"token.exchange","http.status_code":V.status,"duration.ms":b(A)}),X.debug("SSO token exchange response body read started",{"es.event":"es.sso.token.response_body_read_started","es.module":"sso","es.operation":"token.exchange"});let P=await V.json();if(X.debug("SSO token exchange response body read completed",{"es.event":"es.sso.token.response_body_read_completed","es.module":"sso","es.operation":"token.exchange","duration.ms":b(A)}),!V.ok){X.error("Token exchange error",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure","http.status_code":V.status,"duration.ms":b(A),...Q4(P)});let q=P;throw Error(`Token exchange failed: ${q.error||V.statusText} - ${q.error_description||""}`.trim())}let N=await Z.tokenResponse.validate(P);if(N.issues)throw X.error("Token response validation failed",{"es.event":"es.sso.token.response_validation_failed","es.operation":"token.exchange","es.outcome":"failure","duration.ms":b(A),"validation.issues":LZ(N.issues)}),Error(`Token response validation failed: ${N.issues}`);return X.debug("SSO token exchange completed",{"es.event":"es.sso.token.exchange_completed","es.module":"sso","es.operation":"token.exchange","es.outcome":"success","duration.ms":b(A),tokenType:N.value.token_type,hasAccessToken:Boolean(N.value.access_token),hasIdToken:Boolean(N.value.id_token),hasRefreshToken:Boolean(N.value.refresh_token),expiresIn:N.value.expires_in}),N.value}catch(A){throw X.error("Error during token exchange",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure",...xZ(A)}),A}}async function L1(H){return EZ(async()=>{if(!B)throw Error("Enterprise Standard SSO Manager not initialized");S();let J=x(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"),F=x(B.clientId,"Missing 'clientId' from SSO Config"),_=new URLSearchParams;_.append("grant_type","refresh_token"),_.append("refresh_token",H),_.append("client_id",F);let j=await fetch(J,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:_.toString()}),T=await j.json();if(!j.ok){X.error("Token refresh error",{"es.operation":"token.refresh","es.outcome":"failure",response:T});let O=T;throw Error(`Token refresh failed: ${O.error||j.statusText} - ${O.error_description||""}`.trim())}let z=await Z.tokenResponse.validate(T);if(z.issues)throw X.error("Token refresh response validation failed",{"es.event":"es.sso.token.refresh_validation_failed","es.operation":"token.refresh","es.outcome":"failure","validation.issues":LZ(z.issues)}),Error(`Token refresh response validation failed: ${z.issues}`);return z.value},void 0,void 0,void 0,X)}async function H1(H){try{if(!B)throw Error("Enterprise Standard SSO Manager not initialized");if(!B.revocationEndpoint)return;let J=x(B.clientId,"Missing 'clientId' from SSO Config"),F=new URLSearchParams;F.append("token",H),F.append("token_type_hint","refresh_token"),F.append("client_id",J);let _=await fetch(B.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:F.toString()});if(!_.ok)X.warn("Token revocation failed",{"es.operation":"token.revoke","es.outcome":"degraded",status:_.status,statusText:_.statusText});else X.info("Token revoked successfully",{"es.module":"sso"})}catch(J){X.warn("Error revoking token",{"es.operation":"token.revoke","es.outcome":"degraded"},J)}}async function J1(){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let H=B.authority;if(!B.jwksUri&&!H)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let J=B.jwksUri||`${H}/protocol/openid-connect/certs`;return QZ(J,X)}async function M1(H){let J=Date.now(),F=x(B.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),_=x(B.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),j=B.jwksUri||`${F}/protocol/openid-connect/certs`;X.debug("SSO ID token verification started",{"es.event":"es.sso.id_token.verify_started","es.module":"sso","es.operation":"id_token.verify",...BZ(j,"oidc.jwks_uri")});let T;try{T=await X1({idToken:H,jwksUri:j,issuer:F,audience:_,log:X})}catch(O){throw X.error("SSO ID token verification failed",{"es.event":"es.sso.id_token.verify_failed","es.module":"sso","es.operation":"id_token.verify","es.outcome":"failure","duration.ms":b(J)},O),O}X.debug("SSO ID token signature verified",{"es.event":"es.sso.id_token.signature_verified","es.module":"sso","es.operation":"id_token.verify","duration.ms":b(J)});let z=await Z.idTokenClaims.validate(T);if(z.issues)throw X.error("ID token claims validation failed",{"es.event":"es.sso.id_token.validation_failed","es.operation":"id_token.validate","es.outcome":"failure","duration.ms":b(J),"validation.issues":LZ(z.issues)}),Error(`ID token claims validation failed: ${z.issues}`);return X.debug("SSO ID token claims validated",{"es.event":"es.sso.id_token.claims_validated","es.module":"sso","es.operation":"id_token.validate","es.outcome":"success","duration.ms":b(J),"user.id":z.value.sub,hasIssuer:Boolean(z.value.iss),hasAudience:Boolean(z.value.aud)}),z.value}function wZ(H="SSO sessionStore is required for opaque session cookies."){if(!B.sessionStore)throw Error(H);return B.sessionStore}async function D1(H,J){try{await H.create(J)}catch(F){if(!await H.get(J.sid))throw F;await H.update(J.sid,J)}}function RZ(H){if(!H)return;if(H instanceof Date)return H;let J=new Date(H);return Number.isNaN(J.getTime())?void 0:J}function _1(H){let J=H.tokens;if(!J?.access_token||!J.id_token||!J.token_type)return;return J}async function N1(H,J=!1){let F=wZ(),_=e("session",H);if(!_)return{tokens:void 0,refreshHeaders:[]};let j=await F.get(_);if(j&&B.tenantId&&j.tenantId&&j.tenantId!==B.tenantId)return{tokens:void 0,refreshHeaders:[["Set-Cookie",u("session")]],sid:_};if(j?.authType!=="sso")return{tokens:void 0,refreshHeaders:[["Set-Cookie",u("session")]],sid:_};let T=_1(j);if(!T)return{tokens:void 0,refreshHeaders:[["Set-Cookie",u("session")]],sid:_};let z=RZ(j.expiresAt),O=z?Date.now()>z.getTime():!1;if((J||O)&&T.refresh_token){let V=await L1(T.refresh_token),P=await R(V),N=P.sso.profile;return await F.update(_,{tokens:V,claims:N,expiresAt:P.sso.expires,lastActivityAt:new Date}),{tokens:V,sid:_,session:{...j,tokens:V,claims:N},refreshedUser:P,refreshHeaders:[["Set-Cookie",JZ("session",_,P.sso.expires)]]}}if(O)return await F.delete(_),{tokens:void 0,sid:_,refreshHeaders:[["Set-Cookie",u("session")]]};let A=RZ(j.lastActivityAt)?.getTime()??0;if(L===0||Date.now()-A>=L)await F.update(_,{lastActivityAt:new Date});return{tokens:T,sid:_,session:j,refreshHeaders:[]}}async function n(H,J=!1){return N1(H,J)}async function F1(H){let{tokens:J}=await n(H);if(!J)return;return J.access_token}function JZ(H,J,F){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");if(H=`${B.cookiesPrefix}.${H}`,typeof J!=="string")J=btoa(JSON.stringify(J));let _;if(F instanceof Date)_=`Expires=${F.toUTCString()}`;else if(typeof F==="number")_=`Max-Age=${F}`;else throw Error("Invalid expires type",F);if(J.length>4000)throw Error(`Error setting cookie: ${H}. Cookie length is: ${J.length}`);return`${H}=${J}; ${_}; Path=${B.cookiesPath}; HttpOnly;${B.cookiesSecure?" Secure;":""} SameSite=${B.cookiesSameSite};`}function u(H){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");return`${B.cookiesPrefix}.${H}=; Max-Age=0; Path=${B.cookiesPath}; HttpOnly;${B.cookiesSecure?" Secure;":""} SameSite=${B.cookiesSameSite};`}function e(H,J,F=!1){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let _=J.headers.get("cookie");if(!_)return null;let j=`${B.cookiesPrefix}.${H}`,T=_.split(";").find((V)=>V.trim().startsWith(`${j}=`));if(!T)return null;let z=T.indexOf("="),O=T.slice(z+1).trim();if(!F)return O;let A=atob(O);return JSON.parse(A)}function ZZ(H){return`state_${H}`}async function K1(H,J){if(!B)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:F,userUrl:_,tokenUrl:j,refreshUrl:T,logoutUrl:z,logoutBackChannelUrl:O,jwksUrl:A,redirectUri:V}={...B,...J},P=new URL(H.url).pathname;if(V){let N;try{N=new URL(V).pathname}catch{try{let q=new URL(H.url),v=V.startsWith("//")?V.slice(1):V;N=new URL(v,q.origin).pathname}catch{N=V.startsWith("/")?V:`/${V}`}}if(N===P)return C(H)}if(F===P)return I(H);if(_===P)try{let{tokens:N,session:q,refreshedUser:v,refreshHeaders:c}=await n(H);if(!N)return new Response("User not logged in",{status:401,headers:c});let MZ=v??(q?.claims?k(q.claims,N):await R(N)),DZ=await W1(MZ);return new Response(JSON.stringify(DZ),{headers:[["Content-Type","application/json"],...c]})}catch(N){if(Q1(N))return new Response("User not logged in",{status:401});return X.error("Error resolving SSO user",{"es.operation":"sso.user","es.outcome":"degraded"},N),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(j===P){let{tokens:N,refreshHeaders:q}=await n(H);if(!N)return new Response("User not logged in",{status:401,headers:q});return new Response(JSON.stringify({token:N.access_token,expires:N.expires}),{headers:[["Content-Type","application/json"],...q]})}if(T===P){let{tokens:N,refreshHeaders:q}=await n(H,!0);if(!N)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:q})}if(z===P)return U(H);if(O===P)return y(H);if(A===P){let N=await J1();return new Response(JSON.stringify(N),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...B,getUser:D,resolveUser:w,getJwt:F1,initiateLogin:I,logout:U,logoutBackChannel:y,callbackHandler:C,handler:K1}}function Y4(Z){let X={},$=Z.split(";");for(let Q of $){let Y=Q.trim();if(!Y)continue;let L=Y.indexOf("=");if(L===-1)continue;let W=Y.slice(0,L).trim(),G=Y.slice(L+1).trim();X[W]=G}return X}function Q1(Z){if(!(Z instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature"].some((X)=>Z.message.includes(X))}function Y1(Z){return Z=Z??"SSO Unavailable",new Response(JSON.stringify({error:Z}),{status:503,statusText:Z,headers:{"Content-Type":"application/json"}})}var HZ="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function _8(Z,X){return x(X,HZ),X.sso?.getUser(Z)}async function N8(Z,X){return x(X,HZ),await X.sso?.resolveUser(Z)??{status:"unauthenticated"}}async function F8(Z,X){x(X,HZ);let $=X.sso;if(!$)return Y1();return $.initiateLogin(Z)}async function K8(Z,X){x(X,HZ);let $=X.sso;if(!$)return Y1();return $.callbackHandler(Z)}class PZ extends Error{code="conflict";kind;field;constructor(Z,X,$){super(Z);this.name="StoreConflictError",this.kind=X,this.field=$,Object.setPrototypeOf(this,PZ.prototype)}}function z8(Z){return Z instanceof PZ||typeof Z==="object"&&Z!=null&&Z.code==="conflict"}var O8="urn:enterprisestandard:params:scim:schemas:extension:authz:2.0:Group",G1=["user","workload"];function j8(Z){let{assignableSubjectTypes:X,recommendedSubjectTypes:$}=Z,Q=Z.id?` for "${Z.id}"`:"";if(X){let Y=X.filter((L)=>!G1.includes(L));if(Y.length>0)throw Error(`assignableSubjectTypes${Q} contains values outside the platform ceiling [${G1.join(", ")}]: ${Y.join(", ")}`)}if($&&X){let Y=$.filter((L)=>!X.includes(L));if(Y.length>0)throw Error(`recommendedSubjectTypes${Q} must be a subset of assignableSubjectTypes; offending values: ${Y.join(", ")}`)}}var I8="urn:enterprisestandard:scim:schemas:extension:es:2.0:User";function K(Z,X,$,Q,Y){if(Z===void 0||Z===null){if($)Q.push({message:`${X} is required`,path:Y});return}if(typeof Z!=="string"){Q.push({message:`${X} must be a string`,path:Y});return}return Z}function s(Z,X,$,Q){if(Z===void 0||Z===null)return;if(typeof Z!=="boolean"){$.push({message:`${X} must be a boolean`,path:Q});return}return Z}function G4(Z,X,$){if(Z===void 0||Z===null)return;if(typeof Z!=="object"||Z===null){X.push({message:"name must be an object",path:$});return}let Q=Z,Y={};return Y.formatted=K(Q.formatted,"formatted",!1,X,[...$,"formatted"]),Y.familyName=K(Q.familyName,"familyName",!1,X,[...$,"familyName"]),Y.givenName=K(Q.givenName,"givenName",!1,X,[...$,"givenName"]),Y.middleName=K(Q.middleName,"middleName",!1,X,[...$,"middleName"]),Y.honorificPrefix=K(Q.honorificPrefix,"honorificPrefix",!1,X,[...$,"honorificPrefix"]),Y.honorificSuffix=K(Q.honorificSuffix,"honorificSuffix",!1,X,[...$,"honorificSuffix"]),Y}function W4(Z,X,$){if(Z===void 0||Z===null)return;if(!Array.isArray(Z)){X.push({message:"emails must be an array",path:$});return}let Q=[];for(let Y=0;Y<Z.length;Y++){let L=Z[Y],W=[...$,Y];if(typeof L!=="object"||L===null){X.push({message:"email must be an object",path:W});continue}let G=L,M=K(G.value,"value",!0,X,[...W,"value"]);if(M)Q.push({value:M,display:K(G.display,"display",!1,X,[...W,"display"]),type:K(G.type,"type",!1,X,[...W,"type"]),primary:s(G.primary,"primary",X,[...W,"primary"])})}return Q.length>0?Q:void 0}function B4(Z,X,$){if(Z===void 0||Z===null)return;if(!Array.isArray(Z)){X.push({message:"phoneNumbers must be an array",path:$});return}let Q=[];for(let Y=0;Y<Z.length;Y++){let L=Z[Y],W=[...$,Y];if(typeof L!=="object"||L===null){X.push({message:"phoneNumber must be an object",path:W});continue}let G=L,M=K(G.value,"value",!0,X,[...W,"value"]);if(M)Q.push({value:M,display:K(G.display,"display",!1,X,[...W,"display"]),type:K(G.type,"type",!1,X,[...W,"type"]),primary:s(G.primary,"primary",X,[...W,"primary"])})}return Q.length>0?Q:void 0}function L4(Z,X,$){if(Z===void 0||Z===null)return;if(!Array.isArray(Z)){X.push({message:"addresses must be an array",path:$});return}let Q=[];for(let Y=0;Y<Z.length;Y++){let L=Z[Y],W=[...$,Y];if(typeof L!=="object"||L===null){X.push({message:"address must be an object",path:W});continue}let G=L;Q.push({formatted:K(G.formatted,"formatted",!1,X,[...W,"formatted"]),streetAddress:K(G.streetAddress,"streetAddress",!1,X,[...W,"streetAddress"]),locality:K(G.locality,"locality",!1,X,[...W,"locality"]),region:K(G.region,"region",!1,X,[...W,"region"]),postalCode:K(G.postalCode,"postalCode",!1,X,[...W,"postalCode"]),country:K(G.country,"country",!1,X,[...W,"country"]),type:K(G.type,"type",!1,X,[...W,"type"]),primary:s(G.primary,"primary",X,[...W,"primary"])})}return Q.length>0?Q:void 0}function H4(Z,X,$){if(Z===void 0||Z===null)return;if(!Array.isArray(Z)){X.push({message:"groups must be an array",path:$});return}let Q=[];for(let Y=0;Y<Z.length;Y++){let L=Z[Y],W=[...$,Y];if(typeof L!=="object"||L===null){X.push({message:"group must be an object",path:W});continue}let G=L,M=K(G.value,"value",!0,X,[...W,"value"]);if(M)Q.push({value:M,$ref:K(G.$ref,"$ref",!1,X,[...W,"$ref"]),display:K(G.display,"display",!1,X,[...W,"display"]),type:K(G.type,"type",!1,X,[...W,"type"])})}return Q.length>0?Q:void 0}function J4(Z,X,$){if(Z===void 0||Z===null)return;if(!Array.isArray(Z)){X.push({message:"roles must be an array",path:$});return}let Q=[];for(let Y=0;Y<Z.length;Y++){let L=Z[Y],W=[...$,Y];if(typeof L!=="object"||L===null){X.push({message:"role must be an object",path:W});continue}let G=L,M=K(G.value,"value",!0,X,[...W,"value"]);if(M)Q.push({value:M,display:K(G.display,"display",!1,X,[...W,"display"]),type:K(G.type,"type",!1,X,[...W,"type"]),primary:s(G.primary,"primary",X,[...W,"primary"])})}return Q.length>0?Q:void 0}function M4(Z,X,$){if(Z===void 0||Z===null)return;if(typeof Z!=="object"||Z===null){X.push({message:"Enterprise User extension must be an object",path:$});return}let Q=Z,Y={};if(Y.employeeNumber=K(Q.employeeNumber,"employeeNumber",!1,X,[...$,"employeeNumber"]),Y.costCenter=K(Q.costCenter,"costCenter",!1,X,[...$,"costCenter"]),Y.organization=K(Q.organization,"organization",!1,X,[...$,"organization"]),Y.division=K(Q.division,"division",!1,X,[...$,"division"]),Y.department=K(Q.department,"department",!1,X,[...$,"department"]),Q.manager!==void 0&&Q.manager!==null)if(typeof Q.manager!=="object"||Q.manager===null)X.push({message:"manager must be an object",path:[...$,"manager"]});else{let L=Q.manager;Y.manager={value:K(L.value,"value",!1,X,[...$,"manager","value"]),$ref:K(L.$ref,"$ref",!1,X,[...$,"manager","$ref"]),displayName:K(L.displayName,"displayName",!1,X,[...$,"manager","displayName"])}}return Y}function T8(Z){return{"~standard":{version:1,vendor:Z,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let $=X,Q=[],Y={},L=K($.userName,"userName",!0,Q,["userName"]);if(!L)return{issues:Q};if(Y.userName=L,Y.id=K($.id,"id",!1,Q,["id"]),Y.externalId=K($.externalId,"externalId",!1,Q,["externalId"]),Y.displayName=K($.displayName,"displayName",!1,Q,["displayName"]),Y.nickName=K($.nickName,"nickName",!1,Q,["nickName"]),Y.profileUrl=K($.profileUrl,"profileUrl",!1,Q,["profileUrl"]),Y.title=K($.title,"title",!1,Q,["title"]),Y.userType=K($.userType,"userType",!1,Q,["userType"]),Y.preferredLanguage=K($.preferredLanguage,"preferredLanguage",!1,Q,["preferredLanguage"]),Y.locale=K($.locale,"locale",!1,Q,["locale"]),Y.timezone=K($.timezone,"timezone",!1,Q,["timezone"]),$.password!==void 0)Q.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});Y.active=s($.active,"active",Q,["active"]),Y.name=G4($.name,Q,["name"]),Y.emails=W4($.emails,Q,["emails"]),Y.phoneNumbers=B4($.phoneNumbers,Q,["phoneNumbers"]),Y.addresses=L4($.addresses,Q,["addresses"]),Y.groups=H4($.groups,Q,["groups"]),Y.roles=J4($.roles,Q,["roles"]);let W="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if($[W]!==void 0)Y[W]=M4($[W],Q,[W]);if($.schemas!==void 0)if(Array.isArray($.schemas))Y.schemas=$.schemas.filter((G)=>typeof G==="string");else Q.push({message:"schemas must be an array",path:["schemas"]});if($.meta!==void 0)if(typeof $.meta==="object"&&$.meta!==null){let G=$.meta;Y.meta={resourceType:typeof G.resourceType==="string"?G.resourceType:void 0,created:typeof G.created==="string"?G.created:void 0,lastModified:typeof G.lastModified==="string"?G.lastModified:void 0,location:typeof G.location==="string"?G.location:void 0,version:typeof G.version==="string"?G.version:void 0}}else Q.push({message:"meta must be an object",path:["meta"]});if(Q.length>0)return{issues:Q};return{value:Y}}}}}function D4(Z,X,$){if(Z===void 0||Z===null)return;if(!Array.isArray(Z)){X.push({message:"members must be an array",path:$});return}let Q=[];for(let Y=0;Y<Z.length;Y++){let L=Z[Y],W=[...$,Y];if(typeof L!=="object"||L===null){X.push({message:"member must be an object",path:W});continue}let G=L,M=K(G.value,"value",!0,X,[...W,"value"]);if(M){let B=K(G.type,"type",!1,X,[...W,"type"]);Q.push({value:M,$ref:K(G.$ref,"$ref",!1,X,[...W,"$ref"]),display:K(G.display,"display",!1,X,[...W,"display"]),type:B==="User"||B==="Group"?B:void 0})}}return Q.length>0?Q:void 0}function x8(Z){return{"~standard":{version:1,vendor:Z,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let $=X,Q=[],Y={},L=K($.displayName,"displayName",!0,Q,["displayName"]);if(!L)return{issues:Q};if(Y.displayName=L,Y.id=K($.id,"id",!1,Q,["id"]),Y.externalId=K($.externalId,"externalId",!1,Q,["externalId"]),Y.members=D4($.members,Q,["members"]),$.schemas!==void 0)if(Array.isArray($.schemas))Y.schemas=$.schemas.filter((W)=>typeof W==="string");else Q.push({message:"schemas must be an array",path:["schemas"]});if($.meta!==void 0)if(typeof $.meta==="object"&&$.meta!==null){let W=$.meta;Y.meta={resourceType:typeof W.resourceType==="string"?W.resourceType:void 0,created:typeof W.created==="string"?W.created:void 0,lastModified:typeof W.lastModified==="string"?W.lastModified:void 0,location:typeof W.location==="string"?W.location:void 0,version:typeof W.version==="string"?W.version:void 0}}else Q.push({message:"meta must be an object",path:["meta"]});if(Q.length>0)return{issues:Q};return{value:Y}}}}}
-export{_4 as a,N4 as b,d as c,O1 as d,E1 as e,K4 as f,V4 as g,A4 as h,o as i,P1 as j,O4 as k,j4 as l,kZ as m,I4 as n,T4 as o,hZ as p,mZ as q,x as r,gZ as s,P4 as t,w1 as u,w4 as v,R4 as w,vZ as x,U4 as y,q4 as z,q1 as A,b4 as B,b1 as C,f1 as D,k1 as E,k4 as F,h4 as G,cZ as H,h1 as I,dZ as J,v4 as K,m4 as L,g4 as M,$Z as N,AZ as O,n1 as P,l1 as Q,c4 as R,u4 as S,n4 as T,QZ as U,l4 as V,t4 as W,oZ as X,o4 as Y,a4 as Z,aZ as _,WZ as $,sZ as aa,s4 as ba,e4 as ca,GZ as da,i1 as ea,X1 as fa,$1 as ga,Z8 as ha,X8 as ia,$8 as ja,Q8 as ka,Y8 as la,M8 as ma,D8 as na,_8 as oa,N8 as pa,F8 as qa,K8 as ra,PZ as sa,z8 as ta,O8 as ua,G1 as va,j8 as wa,I8 as xa,T8 as ya,x8 as za};