@enterprisestandard/core 0.0.20 → 0.0.21-beta.20260725.1

package/dist/index.d.ts

@@ -162,7 +162,7 @@ interface IdTokenClaims {
 	picture?: string;
 	/**
 	* Enterprise Controlled ID claim (`ecid:<realm>:<opaque>`). When present it correlates this
-	* account to a single identity across systems. See https://enterprisestandard.com/llms-ecid.txt.
+	* account to a single identity across systems. See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	[key: string]: unknown;
@@ -300,7 +300,7 @@ type WorkloadIdentity = {
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
-	* root. See https://enterprisestandard.com/llms-ecid.txt.
+	* root. See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	/** Full JWT claims from the token. */
@@ -920,11 +920,11 @@ interface EnterpriseExtension {
 /**
 * SCIM URN for the Enterprise Standard User extension, carrying the ECID identity correlator and
 * the account purpose (`accountClass`). Hosted schema:
-* https://enterprisestandard.com/schemas/es-scim-user-extension.json
+* https://ionite.com/schemas/es-scim-user-extension.json
 */
 declare const ES_SCIM_USER_EXTENSION_URN = "urn:enterprisestandard:scim:schemas:extension:es:2.0:User";
 /**
-* Enterprise Standard SCIM User extension. See https://enterprisestandard.com/llms-ecid.txt.
+* Enterprise Standard SCIM User extension. See https://ionite.com/docs/llms-ecid.txt.
 */
 interface EsUserExtension {
 	/**
@@ -1180,7 +1180,7 @@ type BaseWorkloadIdentity<TExtended = object> = {
 	externalId?: string;
 	/**
 	* Optional Enterprise Controlled ID for this workload: `ecid:<realm>:<opaque>`. A workload is its
-	* own governance root, never folded into a human's ECID. See https://enterprisestandard.com/llms-ecid.txt.
+	* own governance root, never folded into a human's ECID. See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	/** Whether the workload is active. Set `false` to disable it without deleting the record. */
@@ -3431,7 +3431,7 @@ type RemoteConfig = {
 	* Globally unique app/tenant identifier for this ESA (e.g. from vault path or config).
 	* Required: every ESA must know its own identity. For a minting authority (SOR/ESI), this
 	* value is also the ECID realm it stamps into `ecid:<realm>:<opaque>` identifiers. See
-	* https://enterprisestandard.com/llms-ecid.txt.
+	* https://ionite.com/docs/llms-ecid.txt.
 	*/
 	id: string;
 	sso?: SSOConfig;
@@ -4189,7 +4189,7 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* `ecid:<realm>:<opaque>` (realm = the minting authority's id). Correlates this account to a
 	* single identity across systems. Minted by the enterprise SOR (via an ESI), never by the app;
 	* received on the SCIM ES extension or the `ecid` JWT claim. Never an authorization subject.
-	* See https://enterprisestandard.com/llms-ecid.txt.
+	* See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	/**
@@ -5130,7 +5130,7 @@ type ConfigSourceErrorInit = {
 * and retries it based on typed fields rather than message substrings. The vault source's typed errors
 * already carry `code`/`status`/`sourceType`; custom sources SHOULD throw this (or an error carrying
 * the same fields) for the initial-load retry policy to make the right call. See
-* https://enterprisestandard.com/llms-configuration.txt.
+* https://ionite.com/docs/llms-configuration.txt.
 */
 declare class ConfigSourceError extends Error {
 	readonly kind: RemoteConfigLoadErrorKind;
@@ -5158,7 +5158,7 @@ declare function isConfigSourceError(value: unknown): value is ConfigSourceError
 * This module is data-only and client-safe (no server imports), so it can be re-exported from the
 * main `@enterprisestandard/core` entry without pulling server code into client bundles.
 *
-* See https://enterprisestandard.com/llms-ecid.txt for the full contract.
+* See https://ionite.com/docs/llms-ecid.txt for the full contract.
 */
 /** The fixed ECID scheme prefix. */
 declare const ECID_SCHEME = "ecid";

package/dist/index.js

@@ -1 +1 @@
-import{A as K0,B as C0,C as W0,D as P0,E as D0,F as k0,G as v0,H as I0,I as N0,J as w0,K as R0,L as T0,M as b0,N as E0,Q as L0,R as O0,S as S0,T as y0,U as A0,V as _0,a as r,b as t,c as s,d as e,e as Q0,f as X0,l as $0,m as J0,n as V0,o as B0,p as x0,q as Z0,r as F0,s as H0,t as q0,u as G0,v as U0,w as j0,x as Y0,y as z0,z as M0}from"./shared/core-9dvscte3.js";var w="0.0.20";class j extends Error{kind;recoverable;code;status;path;sourceType;constructor($,J){super($,J.cause!==void 0?{cause:J.cause}:void 0);this.name="ConfigSourceError",this.kind=J.kind,this.recoverable=J.recoverable,this.code=J.code,this.status=J.status,this.path=J.path,this.sourceType=J.sourceType,Object.setPrototypeOf(this,j.prototype)}}function R($){return $ instanceof j}var T=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let J={};for(let[Q,X]of Object.entries($)){if(T.includes(Q)||Q==="validators"||Q==="setStores")continue;J[Q]=X!==null&&typeof X==="object"&&!Array.isArray(X)&&Object.getPrototypeOf(X)===Object.prototype?D(X):X}return J}function b($){return D($)}var Z=["workload"],Y={id:"es:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},z={id:"es:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},M={id:"es:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},K={id:"es:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},C={id:"es:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Z},W={id:"es:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ESI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},P={id:"es:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ESI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},E=[Y,z,M,K,C,W,P],L={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},O=k,S={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},y={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},A={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function _($,J){if(typeof J!=="number"||J<=0)return $;return new Promise((Q,X)=>{let B=setTimeout(()=>{X(Error(`Authz catalog entry did not become ready within ${J}ms`))},J);$.then(()=>{clearTimeout(B),Q()},(x)=>{clearTimeout(B),X(x)})})}function f($,J){let Q=!1,X,B=J.then(()=>{Q=!0},(F)=>{Q=!1,X=F}),x=$;return Object.defineProperty(x,"ready",{enumerable:!1,configurable:!0,value:(F)=>_(B.then(()=>{if(!Q)throw X}),F)}),Object.defineProperty(x,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),x}var h={beforeTenantSegments:["ui"]},p={beforeTenantSegments:["api"]};function v($){return($??[]).map((J)=>J.trim()).filter(Boolean)}function g($){let J=$.trim();if(!J)return"/";let Q=J.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function I($){return g($).split("/").filter(Boolean)}function U($){return{beforeTenantSegments:v($?.beforeTenantSegments),afterTenantSegments:v($?.afterTenantSegments)}}function d($){return{type:"path",ui:U($?.ui),api:U($?.api)}}function c($,J){let Q=U(J),X=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],x=I($),F=X.length+1+B.length;if(x.length<F)return null;for(let H=0;H<X.length;H++)if(x[H]!==X[H])return null;let q=X.length,V=x[q];if(!V)return null;for(let H=0;H<B.length;H++)if(x[q+1+H]!==B[H])return null;let G=x.slice(q+1+B.length);return{id:decodeURIComponent(V),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function m($,J="/",Q){let X=U(Q),B=X.beforeTenantSegments??[],x=X.afterTenantSegments??[],F=I(J),q=[...B,encodeURIComponent($),...x,...F];return q.length>0?`/${q.join("/")}`:"/"}function u($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={...Q},x=["iss","sub"];for(let V of x)if(V in Q){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))X.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((G)=>typeof G==="string"))X.push({message:"aud array must contain only strings",path:["aud"]})}let F=["jti","scope"];for(let V of F)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}let q=["exp","iat"];for(let V of q)if(V in Q){if(typeof Q[V]!=="number")X.push({message:`${V} must be a number`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if(X.length>0)return{issues:X};return{value:B}}}}}function l($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={};if("access_token"in Q)if(typeof Q.access_token==="string")B.access_token=Q.access_token;else X.push({message:"access_token must be a string",path:["access_token"]});else X.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")B.token_type=Q.token_type;else X.push({message:"token_type must be a string",path:["token_type"]});else X.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)B.scope=Q.scope;else X.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)B.refresh_token=Q.refresh_token;else X.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)B.expires=Q.expires;else X.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)B.expires_in=Q.expires_in;else X.push({message:"expires_in must be a number",path:["expires_in"]});if(X.length>0)return{issues:X};return{value:B}}}}}function n($){let J=new Uint8Array($);return crypto.getRandomValues(J),J}function a($){let J="",Q=n($);for(let X=0;X<$;X++){let B=Q[X]%32;J+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)}return J}function o($,J){let Q="";for(let X=J;X>0;X--){let B=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)+Q,$=Math.floor($/32)}return Q}function i($){let J=Date.now(),Q=o(J,10),X=a(16);return`${$??""}${Q}${X}`}export{l as workloadTokenResponseSchema,z0 as withValidate,A as warnLogger,I0 as waitOn,w as version,K0 as validationFailureResponse,A0 as userSchema,B0 as unionCatalogRead,r as trustedClientPermissionsForPrincipal,D0 as trimTrailingSlash,j0 as tokenResponseSchema,J0 as toCodeCatalog,W0 as stripJsonComments,v0 as stableConfigHash,k as silentLogger,b as serializeESConfig,f as readyCatalogEntry,P0 as parseJsonc,q0 as parseEcid,U0 as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,M0 as must,C0 as mergeConfig,c as matchTenantPath,e as listGenerator,s as list,u as jwtAssertionClaimsSchema,T0 as isStoreConflictError,F0 as isEcid,R as isConfigSourceError,E0 as isConfigLocator,$0 as isCodeCatalog,y as infoLogger,Y0 as idTokenClaimsSchema,_0 as groupResourceSchema,i as generateULID,H0 as formatEcid,V0 as defineCatalog,O as defaultLogger,k0 as deepEqualPlain,w0 as decodeUser,S as debugLogger,t as configTrustedClientGrants,N0 as claimsToUser,m as buildTenantPath,S0 as assertValidSubjectTypeScoping,G0 as assertEcid,X0 as accessRootId,Q0 as accessRefId,R0 as StoreConflictError,O0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,Z0 as EcidFormatError,P as ES_TENANT_MANAGE,E as ES_SDK_PERMISSIONS,y0 as ES_SCIM_USER_EXTENSION_URN,z as ES_IAM_USERS_WRITE,Y as ES_IAM_READ,M as ES_IAM_GROUPS_WRITE,L as ES_ENDPOINT_PERMISSIONS,C as ES_CIAM_MAGIC_LINK_CREATE,K as ES_CAPABILITIEZ_READ,W as ES_AUTHZ_OAA_SYNC,b0 as ESError,L0 as ENTERPRISE_AUTHZ_GROUP_SCHEMA,x0 as ECID_SCHEME,h as DEFAULT_TENANT_UI_NAMESPACE,p as DEFAULT_TENANT_API_NAMESPACE,j as ConfigSourceError};
+import{A as K0,B as C0,C as W0,D as P0,E as D0,F as k0,G as v0,H as I0,I as N0,J as w0,K as R0,L as T0,M as b0,N as E0,Q as L0,R as O0,S as S0,T as y0,U as A0,V as _0,a as r,b as t,c as s,d as e,e as Q0,f as X0,l as $0,m as J0,n as V0,o as B0,p as x0,q as Z0,r as F0,s as H0,t as q0,u as G0,v as U0,w as j0,x as Y0,y as z0,z as M0}from"./shared/core-9dvscte3.js";var w="0.0.21-beta.20260725.1";class j extends Error{kind;recoverable;code;status;path;sourceType;constructor($,J){super($,J.cause!==void 0?{cause:J.cause}:void 0);this.name="ConfigSourceError",this.kind=J.kind,this.recoverable=J.recoverable,this.code=J.code,this.status=J.status,this.path=J.path,this.sourceType=J.sourceType,Object.setPrototypeOf(this,j.prototype)}}function R($){return $ instanceof j}var T=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let J={};for(let[Q,X]of Object.entries($)){if(T.includes(Q)||Q==="validators"||Q==="setStores")continue;J[Q]=X!==null&&typeof X==="object"&&!Array.isArray(X)&&Object.getPrototypeOf(X)===Object.prototype?D(X):X}return J}function b($){return D($)}var Z=["workload"],Y={id:"es:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},z={id:"es:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},M={id:"es:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},K={id:"es:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},C={id:"es:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Z},W={id:"es:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ESI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},P={id:"es:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ESI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},E=[Y,z,M,K,C,W,P],L={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},O=k,S={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},y={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},A={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function _($,J){if(typeof J!=="number"||J<=0)return $;return new Promise((Q,X)=>{let B=setTimeout(()=>{X(Error(`Authz catalog entry did not become ready within ${J}ms`))},J);$.then(()=>{clearTimeout(B),Q()},(x)=>{clearTimeout(B),X(x)})})}function f($,J){let Q=!1,X,B=J.then(()=>{Q=!0},(F)=>{Q=!1,X=F}),x=$;return Object.defineProperty(x,"ready",{enumerable:!1,configurable:!0,value:(F)=>_(B.then(()=>{if(!Q)throw X}),F)}),Object.defineProperty(x,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),x}var h={beforeTenantSegments:["ui"]},p={beforeTenantSegments:["api"]};function v($){return($??[]).map((J)=>J.trim()).filter(Boolean)}function g($){let J=$.trim();if(!J)return"/";let Q=J.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function I($){return g($).split("/").filter(Boolean)}function U($){return{beforeTenantSegments:v($?.beforeTenantSegments),afterTenantSegments:v($?.afterTenantSegments)}}function d($){return{type:"path",ui:U($?.ui),api:U($?.api)}}function c($,J){let Q=U(J),X=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],x=I($),F=X.length+1+B.length;if(x.length<F)return null;for(let H=0;H<X.length;H++)if(x[H]!==X[H])return null;let q=X.length,V=x[q];if(!V)return null;for(let H=0;H<B.length;H++)if(x[q+1+H]!==B[H])return null;let G=x.slice(q+1+B.length);return{id:decodeURIComponent(V),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function m($,J="/",Q){let X=U(Q),B=X.beforeTenantSegments??[],x=X.afterTenantSegments??[],F=I(J),q=[...B,encodeURIComponent($),...x,...F];return q.length>0?`/${q.join("/")}`:"/"}function u($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={...Q},x=["iss","sub"];for(let V of x)if(V in Q){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))X.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((G)=>typeof G==="string"))X.push({message:"aud array must contain only strings",path:["aud"]})}let F=["jti","scope"];for(let V of F)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}let q=["exp","iat"];for(let V of q)if(V in Q){if(typeof Q[V]!=="number")X.push({message:`${V} must be a number`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if(X.length>0)return{issues:X};return{value:B}}}}}function l($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={};if("access_token"in Q)if(typeof Q.access_token==="string")B.access_token=Q.access_token;else X.push({message:"access_token must be a string",path:["access_token"]});else X.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")B.token_type=Q.token_type;else X.push({message:"token_type must be a string",path:["token_type"]});else X.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)B.scope=Q.scope;else X.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)B.refresh_token=Q.refresh_token;else X.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)B.expires=Q.expires;else X.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)B.expires_in=Q.expires_in;else X.push({message:"expires_in must be a number",path:["expires_in"]});if(X.length>0)return{issues:X};return{value:B}}}}}function n($){let J=new Uint8Array($);return crypto.getRandomValues(J),J}function a($){let J="",Q=n($);for(let X=0;X<$;X++){let B=Q[X]%32;J+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)}return J}function o($,J){let Q="";for(let X=J;X>0;X--){let B=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)+Q,$=Math.floor($/32)}return Q}function i($){let J=Date.now(),Q=o(J,10),X=a(16);return`${$??""}${Q}${X}`}export{l as workloadTokenResponseSchema,z0 as withValidate,A as warnLogger,I0 as waitOn,w as version,K0 as validationFailureResponse,A0 as userSchema,B0 as unionCatalogRead,r as trustedClientPermissionsForPrincipal,D0 as trimTrailingSlash,j0 as tokenResponseSchema,J0 as toCodeCatalog,W0 as stripJsonComments,v0 as stableConfigHash,k as silentLogger,b as serializeESConfig,f as readyCatalogEntry,P0 as parseJsonc,q0 as parseEcid,U0 as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,M0 as must,C0 as mergeConfig,c as matchTenantPath,e as listGenerator,s as list,u as jwtAssertionClaimsSchema,T0 as isStoreConflictError,F0 as isEcid,R as isConfigSourceError,E0 as isConfigLocator,$0 as isCodeCatalog,y as infoLogger,Y0 as idTokenClaimsSchema,_0 as groupResourceSchema,i as generateULID,H0 as formatEcid,V0 as defineCatalog,O as defaultLogger,k0 as deepEqualPlain,w0 as decodeUser,S as debugLogger,t as configTrustedClientGrants,N0 as claimsToUser,m as buildTenantPath,S0 as assertValidSubjectTypeScoping,G0 as assertEcid,X0 as accessRootId,Q0 as accessRefId,R0 as StoreConflictError,O0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,Z0 as EcidFormatError,P as ES_TENANT_MANAGE,E as ES_SDK_PERMISSIONS,y0 as ES_SCIM_USER_EXTENSION_URN,z as ES_IAM_USERS_WRITE,Y as ES_IAM_READ,M as ES_IAM_GROUPS_WRITE,L as ES_ENDPOINT_PERMISSIONS,C as ES_CIAM_MAGIC_LINK_CREATE,K as ES_CAPABILITIEZ_READ,W as ES_AUTHZ_OAA_SYNC,b0 as ESError,L0 as ENTERPRISE_AUTHZ_GROUP_SCHEMA,x0 as ECID_SCHEME,h as DEFAULT_TENANT_UI_NAMESPACE,p as DEFAULT_TENANT_API_NAMESPACE,j as ConfigSourceError};

package/dist/server.d.ts

@@ -148,7 +148,7 @@ interface IdTokenClaims {
 	picture?: string;
 	/**
 	* Enterprise Controlled ID claim (`ecid:<realm>:<opaque>`). When present it correlates this
-	* account to a single identity across systems. See https://enterprisestandard.com/llms-ecid.txt.
+	* account to a single identity across systems. See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	[key: string]: unknown;
@@ -267,7 +267,7 @@ type WorkloadIdentity = {
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
-	* root. See https://enterprisestandard.com/llms-ecid.txt.
+	* root. See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	/** Full JWT claims from the token. */
@@ -871,7 +871,7 @@ interface EnterpriseExtension {
 	};
 }
 /**
-* Enterprise Standard SCIM User extension. See https://enterprisestandard.com/llms-ecid.txt.
+* Enterprise Standard SCIM User extension. See https://ionite.com/docs/llms-ecid.txt.
 */
 interface EsUserExtension {
 	/**
@@ -1115,7 +1115,7 @@ type BaseWorkloadIdentity<TExtended = object> = {
 	externalId?: string;
 	/**
 	* Optional Enterprise Controlled ID for this workload: `ecid:<realm>:<opaque>`. A workload is its
-	* own governance root, never folded into a human's ECID. See https://enterprisestandard.com/llms-ecid.txt.
+	* own governance root, never folded into a human's ECID. See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	/** Whether the workload is active. Set `false` to disable it without deleting the record. */
@@ -3205,7 +3205,7 @@ type RemoteConfig = {
 	* Globally unique app/tenant identifier for this ESA (e.g. from vault path or config).
 	* Required: every ESA must know its own identity. For a minting authority (SOR/ESI), this
 	* value is also the ECID realm it stamps into `ecid:<realm>:<opaque>` identifiers. See
-	* https://enterprisestandard.com/llms-ecid.txt.
+	* https://ionite.com/docs/llms-ecid.txt.
 	*/
 	id: string;
 	sso?: SSOConfig;
@@ -3774,7 +3774,7 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* `ecid:<realm>:<opaque>` (realm = the minting authority's id). Correlates this account to a
 	* single identity across systems. Minted by the enterprise SOR (via an ESI), never by the app;
 	* received on the SCIM ES extension or the `ecid` JWT claim. Never an authorization subject.
-	* See https://enterprisestandard.com/llms-ecid.txt.
+	* See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;
 	/**

package/dist/server.js

@@ -1 +1 @@
-import{A as s9,E as z1,I as o9,K as L9,L as $9,O as a4,P as i4,Q as Y5,R as X9,T as I5,a as D9,d as l9,e as V5,f as W1,g as G1,h as Y9,i as B9,j as W9,k as n4,o as G9,u as A1,v as U9,w as k9,x as D1,y as c5,z as m}from"./shared/core-9dvscte3.js";var J2="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.",M9=["user","customer","workload"],Z2={user:async(J,Z)=>Z.sso?.getUser(J),customer:async(J,Z)=>Z.ciam?.getCustomer(J),workload:async(J,Z)=>{let $=await Z.workload?.getWorkloadIdentity?.(J);if(!$)return;let X=$.clientId??$.workloadId??$.claims.sub;return X?{...$,id:X}:void 0}};function $2(J){if(J==="any")return M9;let Z=Array.isArray(J)?J:[J];return M9.filter(($)=>Z.includes($))}function X2(J){let Z=J.headers.get("cookie");if(!Z)return[];return Z.split(";").map(($)=>$.slice(0,$.indexOf("=")===-1?$.length:$.indexOf("=")).trim()).filter(Boolean)}function Q2(J,Z){let $=J.headers.get("authorization")?.toLowerCase().startsWith("bearer ")??!1,X=X2(J),Q=new Set;for(let F of X){if(F.startsWith("es.sso"))Q.add("user");if(F.startsWith("es.ciam"))Q.add("customer")}let G=X.length>0&&!Q.has("user")&&!Q.has("customer");return Z.filter((F)=>{if(F==="workload")return $;if(X.length===0)return!1;return Q.has(F)||G})}function X5(J){return typeof J==="string"?J:J.id}function _9(J){let{subject:Z,subjectType:$}=J,X;if($==="user")X=Z.sso?.scope;else if($==="customer")X=Z.ciam?.scope;else if($==="workload")X=Z.scope;return new Set((X??"").split(/\s+/).filter(Boolean))}function b1(J,Z,$){let X=_9(J),Q=Z.filter((F)=>X.has(F));return{allow:$==="any"?Q.length>0:Z.length>0&&Q.length===Z.length,metadata:{reason:"scope",wantedScopes:Z,matchedScopes:Q}}}function l5(J,Z){return($)=>{if(J.length===0)return;let X=_9($),Q=J.filter((F)=>X.has(F));return(Z==="any"?Q.length>0:Q.length===J.length)?Q:void 0}}function H1(J,Z,$){return(X)=>{if(Z.length===0||X.subjectType!=="workload")return;let Q=D9(J.config?.authz,X.subject);if(!Q)return;let G=Z.filter((B)=>Q.has(B));return($==="any"?G.length>0:G.length===Z.length)?G:void 0}}function K2(J,Z){if(J.subjectType==="workload"){let $=J.subject.scopesAsEntitlements;if(typeof $==="boolean")return $}return Z.config?.authz?.scopesAsEntitlements===!0}function y1(J,Z,$,X,Q){return{allow:$==="ok",subject:Z?.subject,subjectType:Z?.subjectType,reason:$,decision:X,response(){if($==="ok")return new Response(null,{status:204});if($==="unauthenticated")return J.log.warn("authz.denied",{reason:$,...Q()}),Response.json({error:"Unauthorized"},{status:401});if($==="not_configured")return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"not_configured"},{status:503});return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"Forbidden"},{status:403})}}}function Y2(J,Z,$){return new Promise((X)=>{let Q=[],G=J.length,F=!1,B=()=>{if(G-=1,G===0&&!F)F=!0,X({outcomes:Q})};for(let W of J)Z(W).then((L)=>{if(Q.push({principal:W,decision:L}),!F&&L.allow){F=!0,X({matched:{principal:W,decision:L},outcomes:Q});return}B()},(L)=>{$?.(W,L),Q.push({principal:W,decision:{allow:!1,metadata:{reason:"error"}}}),B()})})}async function A5(J,Z,$,X,Q,G,F){m(Z,J2);let B=Q2(J,$2($)),L=(await Promise.all(B.map(async(c)=>{let l=await Z2[c](J,Z);return l?.id?{subject:l,subjectType:c,subjectId:l.id}:void 0}))).filter((c)=>c!==void 0);if(L.length===0)return y1(Z,void 0,"unauthenticated",void 0,Q);let f=async(c)=>{let l=Z.authz.accessIndex;if(!l?.isSubjectDisabled)return!1;return l.isSubjectDisabled(c.subjectId,c.subjectType)},u=async(c)=>{if(F){let l=F(c);if(l&&l.length>0){if(await f(c))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:l}}}}if(G&&K2(c,Z)){let l=G(c);if(l&&l.length>0){if(await f(c))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"scope",matchedScopes:l}}}}return X(c)},{matched:i,outcomes:J5}=await Y2(L,u,(c,l)=>{Z.log.warn("authz.check_error",{"es.operation":"authz.check","es.outcome":"error",subject:c.subjectId,subjectType:c.subjectType,error:l instanceof Error?l.message:String(l),...Q()})});if(i){if(i.decision.metadata?.reason==="scope")Z.log.info("authz.scope_honor",{"es.operation":"authz.scope_honor","es.outcome":"allow",subject:i.principal.subjectId,subjectType:i.principal.subjectType,matchedScopes:i.decision.metadata.matchedScopes,...Q()});return y1(Z,i.principal,"ok",i.decision,Q)}let r=J5.length>0&&J5.every((c)=>{let l=c.decision.metadata?.reason;return l==="access_index_not_configured"||l==="error"}),G5=J5[0],p=r?"not_configured":"forbidden";return y1(Z,G5?.principal,p,G5?.decision,Q)}async function B2(J,Z,$,X,Q,G="any"){return A5(J,Z,G,(F)=>Z.authz.has(F.subjectId,$,X,Q,F.subjectType),()=>({targetType:$,target:X5(X),resource:Q?X5(Q):void 0}),Q?void 0:l5([X5(X)],"any"),$==="permission"&&!Q?H1(Z,[X5(X)],"any"):void 0)}async function W2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasPermission(G.subjectId,$,X,G.subjectType),()=>({targetType:"permission",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"),X?void 0:H1(Z,[X5($)],"any"))}async function G2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasRole(G.subjectId,$,X,G.subjectType),()=>({targetType:"role",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"))}async function L2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasGroup(G.subjectId,$,X,G.subjectType),()=>({targetType:"group",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"))}async function F2(J,Z,$,X="any"){let Q=$.filter((F)=>!F.resource).map((F)=>X5(F.target)),G=$.filter((F)=>!F.resource&&F.targetType==="permission").map((F)=>X5(F.target));return A5(J,Z,X,(F)=>Z.authz.hasAny(F.subjectId,$,F.subjectType),()=>({targets:$.map((F)=>`${F.targetType}:${X5(F.target)}`)}),Q.length>0?l5(Q,"any"):void 0,G.length>0?H1(Z,G,"any"):void 0)}async function H2(J,Z,$,X="any"){let Q=$.length>0&&$.every((B)=>!B.resource),G=$.length>0&&$.every((B)=>!B.resource&&B.targetType==="permission"),F=$.map((B)=>X5(B.target));return A5(J,Z,X,(B)=>Z.authz.hasAll(B.subjectId,$,B.subjectType),()=>({targets:$.map((B)=>`${B.targetType}:${X5(B.target)}`)}),Q?l5(F,"all"):void 0,G?H1(Z,F,"all"):void 0)}async function V2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,[$],"any")),()=>({scope:$}))}async function N2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"any")),()=>({scopes:$}))}async function M2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"all")),()=>({scopes:$}))}function Q5(J){return typeof J==="string"&&J.length>0?J:void 0}function z9(J){let Z=Q5(J.email);return{sub:String(J.sub??""),email:Z,name:Q5(J.name),userName:Q5(J.preferred_username)??Z,avatar:Q5(J.picture)}}var P9={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:z9},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:z9},microsoft:{flow:"id_token",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(J)=>{let Z=Q5(J.email)??Q5(J.preferred_username);return{sub:String(J.sub??J.oid??""),email:Z,name:Q5(J.name),userName:Q5(J.preferred_username)??Z,avatar:Q5(J.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(J)=>{let Z=Q5(J.email);return{sub:String(J.sub??""),email:Z,name:Q5(J.name),userName:Z}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(J)=>({sub:String(J.id??J.node_id??""),email:Q5(J.email),name:Q5(J.name)??Q5(J.login),userName:Q5(J.login),avatar:Q5(J.avatar_url)})}};function q1(J){if(J==="magic-link")return;return P9[J]}function V1(J,Z){if(Z.type==="magic-link")return;let $=q1(Z.type);if(!$)return;return{name:J,type:Z.type,flow:$.flow,authorizationUrl:Z.authorizationUrl??$.authorizationUrl,tokenUrl:Z.tokenUrl??$.tokenUrl,jwksUri:Z.jwksUri??$.jwksUri,userInfoUrl:Z.userInfoUrl??$.userInfoUrl,scope:Z.scope??$.scope,clientId:Z.clientId,clientSecret:Z.clientSecret,extraAuthParams:$.extraAuthParams,branding:{...$.branding,...Z.branding},mapClaims:$.mapClaims,config:Z}}function C1(J){return{...q1(J.type)?.branding??{displayName:J.type},...J.branding}}function v1(J){if(!J)return[];return Object.entries(J).filter(([,Z])=>Z.enabled!==!1).map(([Z,$],X)=>({name:Z,config:$,index:X})).sort((Z,$)=>{let X=Z.config.order??Number.MAX_SAFE_INTEGER,Q=$.config.order??Number.MAX_SAFE_INTEGER;if(X!==Q)return X-Q;return Z.index-$.index}).map(({name:Z,config:$})=>({name:Z,config:$}))}var E9=600000,k1=256,W5=new Map;function D2(J){if(typeof J?.ttlMs==="number"&&Number.isFinite(J.ttlMs))E9=Math.min(Math.max(J.ttlMs,60000),86400000);if(typeof J?.maxEntries==="number"&&Number.isFinite(J.maxEntries)){k1=Math.max(1,Math.floor(J.maxEntries));while(W5.size>k1){let Z=W5.keys().next().value;if(Z===void 0)break;W5.delete(Z)}}}function O9(J,Z){W5.delete(J),W5.set(J,Z);while(W5.size>k1){let $=W5.keys().next().value;if($===void 0)break;W5.delete($)}}var o5=new Map,f1=()=>Date.now();function _2(J){f1=J??(()=>Date.now())}var h1={};function z2(J){h1=J??{}}function P2(J){if(!J)return;if(/\bno-store\b/i.test(J))return 60000;let Z=/max-age\s*=\s*(\d+)/i.exec(J);if(!Z)return;let $=Number(Z[1]);return Number.isFinite($)?$*1000:void 0}function O2(J){let $=P2(J)??E9;return Math.min(Math.max($,60000),86400000)}async function g1(J,Z=3,$=1000,X=30000,Q){let G=Error("Placeholder Error");for(let F=0;F<=Z;F++)try{return await J()}catch(B){if(G=B instanceof Error?B:Error(String(B)),B instanceof Error&&B.message.includes("400"))throw B;if(F===Z)throw G;let W=Math.min($*2**F,X),L=Math.random()*0.1*W;await new Promise((f)=>setTimeout(f,W+L)),Q?.warn(`Retry attempt ${F+1} after ${W+L}ms delay`)}throw G}async function r5(J,Z,$){let X=W5.get(J);if(!$?.forceRefresh&&X&&X.expiresAt>f1())return O9(J,X),X.jwks;let Q=o5.get(J);if(Q)return Q;let G=(async()=>{try{return await g1(async()=>{let F=await fetch(J);if(!F.ok)throw Error("Failed to fetch JWKS");let B=await F.json(),W=O2(F.headers.get("cache-control"));return O9(J,{jwks:B,expiresAt:f1()+W,importedKeys:new Map}),B},h1.maxRetries,h1.baseDelayMs,void 0,Z)}catch(F){let B=W5.get(J);if(B)return Z?.warn("JWKS refresh failed; serving last-known-good keys",{"es.operation":"jwks.refresh","es.outcome":"degraded"}),B.jwks;throw F}finally{o5.delete(J)}})();return o5.set(J,G),G}function E2(J){if(J){W5.delete(J),o5.delete(J);return}W5.clear(),o5.clear()}async function j2(J,Z,$){return(await j9(J,Z,$)).jwk}async function j9(J,Z,$){if(!Z?.trim())throw Error("JWT header missing kid");await r5(J,$);let X=W5.get(J),Q=X?.jwks.keys.find((G)=>G.kid===Z);if(!Q)await r5(J,$,{forceRefresh:!0}),X=W5.get(J),Q=X?.jwks.keys.find((G)=>G.kid===Z);if(!X||!Q)throw Error("Public key not found");return{jwk:Q,entry:X}}async function m1(J,Z,$,X,Q){let{jwk:G,entry:F}=await j9(J,Z,Q),B=`${Z}\x00${$}`,W=F.importedKeys.get(B);if(W)return W;let L=X(G);return L.catch(()=>{if(F.importedKeys.get(B)===L)F.importedKeys.delete(B)}),F.importedKeys.set(B,L),L}async function A2(J,Z){let $=J.keys.find((X)=>X.kid===Z);if(!$)throw Error("Public key not found");return A9($)}function A9(J){return crypto.subtle.importKey("jwk",{kty:J.kty,n:J.n,e:J.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function w2(J,Z,$){return m1(J,Z,"rs256",A9,$)}var U1={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function p1(J,Z,$,X){if(typeof $!=="string"||!($ in U1))throw Error(`Unsupported JWT alg "${String($)}" (allowed: ${Object.keys(U1).join(", ")})`);let Q=U1[$];return{key:await m1(J,Z,`oidc:${$}`,(F)=>{if(F.kty!==Q.kty)throw Error(`JWK type "${F.kty}" does not match token alg "${$}"`);if(Q.kty==="EC"){let B=F;if(B.crv!==Q.crv)throw Error(`JWK curve "${String(B.crv)}" does not match token alg "${$}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:B.crv,x:B.x,y:B.y},Q.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:F.kty,n:F.n,e:F.e},Q.importParams,!1,["verify"])},X),algorithm:Q.verifyParams}}function D5(J=32){let Z=new Uint8Array(J);return crypto.getRandomValues(Z),Array.from(Z,($)=>$.toString(16).padStart(2,"0")).join("").substring(0,J)}function N1(J){let Z="";return J.forEach(($)=>{Z+=String.fromCharCode($)}),btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T9(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.padEnd(Z.length+(4-Z.length%4)%4,"="),X=atob($),Q=new Uint8Array(X.length);for(let G=0;G<X.length;G++)Q[G]=X.charCodeAt(G);return Q}function w9(J){let Z=new TextDecoder().decode(T9(J));return JSON.parse(Z)}async function J1(J){let Z=new TextEncoder().encode(J),$=await crypto.subtle.digest("SHA-256",Z);return N1(new Uint8Array($))}function l1(J){let Z=new URL(J.authorizationUrl);if(Z.searchParams.set("client_id",J.clientId),Z.searchParams.set("redirect_uri",J.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("scope",J.scope),Z.searchParams.set("state",J.state),J.codeChallenge)Z.searchParams.set("code_challenge",J.codeChallenge),Z.searchParams.set("code_challenge_method","S256");if(J.nonce)Z.searchParams.set("nonce",J.nonce);for(let[$,X]of Object.entries(J.extraParams??{}))Z.searchParams.set($,X);return Z.toString()}async function c1(J){let Z=new URLSearchParams;if(Z.append("grant_type","authorization_code"),Z.append("code",J.code),Z.append("redirect_uri",J.redirectUri),Z.append("client_id",J.clientId),J.clientSecret)Z.append("client_secret",J.clientSecret);if(J.codeVerifier)Z.append("code_verifier",J.codeVerifier);let $=await fetch(J.tokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()}),X=await $.json();if(!$.ok){let Q=X;throw J.log?.error("OIDC authorization-code exchange failed",{"es.operation":"token.exchange","es.outcome":"failure","http.status_code":$.status,oidc_error:Q.error}),Error(`Token exchange failed: ${Q.error||$.statusText} - ${Q.error_description||""}`.trim())}if(typeof X.access_token!=="string")throw Error("Token exchange response missing access_token");return X}var S9=60;function e5(J){return J.trim().replace(/\/$/,"")}function R9(J){let{claims:Z,audience:$}=J,X=e5(J.issuer),Q=J.nowSec??Math.floor(Date.now()/1000),G=J.clockSkewSec??S9,F=Z.iss;if(typeof F!=="string"||e5(F)!==X)throw Error("ID token issuer mismatch");let B=Z.aud,W=Array.isArray(B)?B.includes($):typeof B==="string"&&B===$,L=typeof Z.azp==="string"&&Z.azp===$;if(!W&&!L)throw Error("ID token audience mismatch");if(typeof Z.exp!=="number")throw Error("ID token missing exp");if(Z.exp<Q-G)throw Error("ID token expired");if(J.expectedNonce!==void 0){if(Z.nonce!==J.expectedNonce)throw Error("ID token nonce mismatch")}}async function x9(J,Z,$){let X=J.split(".");if(X.length!==3)throw Error("Invalid JWT");let Q=w9(X[0]),G=w9(X[1]),F=T9(X[2]),{key:B,algorithm:W}=await p1(Z,Q.kid,Q.alg,$),L=new TextEncoder().encode(`${X[0]}.${X[1]}`);if(!await crypto.subtle.verify(W,B,F,L))throw Error("Invalid JWT signature");return{header:Q,payload:G}}async function R5(J){let{payload:Z}=await x9(J.idToken,J.jwksUri,J.log);return R9({claims:Z,issuer:J.issuer,audience:J.audience,clockSkewSec:J.clockSkewSec,expectedNonce:J.expectedNonce}),Z}var I2="http://schemas.openid.net/event/backchannel-logout";async function d1(J){let{payload:Z}=await x9(J.logoutToken,J.jwksUri,J.log),$=e5(J.issuer),X=Z.iss;if(typeof X!=="string"||e5(X)!==$)throw Error("Logout token issuer mismatch");let Q=Z.aud,G=Array.isArray(Q)?Q.includes(J.audience):typeof Q==="string"&&Q===J.audience,F=typeof Z.azp==="string"&&Z.azp===J.audience;if(!G&&!F)throw Error("Logout token audience mismatch");if(Z.nonce!=null)throw Error("Logout token must not contain a nonce");let B=Z.events;if(!(typeof B==="object"&&B!==null&&!Array.isArray(B)&&Object.hasOwn(B,I2)))throw Error("Logout token missing back-channel logout event");let L=typeof Z.sid==="string"&&Z.sid.length>0,f=typeof Z.sub==="string"&&Z.sub.length>0;if(!L&&!f)throw Error("Logout token missing sid and sub");if(typeof Z.exp==="number"){let u=Math.floor(Date.now()/1000),i=J.clockSkewSec??S9;if(Z.exp<u-i)throw Error("Logout token expired")}return Z}var T2=3600000,S2=60000,R2=86400000,x2=256,w5=new Map,s5=new Map;function I9(J,Z){w5.delete(J),w5.set(J,Z);while(w5.size>x2){let $=w5.keys().next().value;if($===void 0)break;w5.delete($)}}var u1=()=>Date.now();function y2(J){u1=J??(()=>Date.now())}function b2(J){if(J){w5.delete(J),s5.delete(J);return}w5.clear(),s5.clear()}function q2(J){let Z=J?/max-age\s*=\s*(\d+)/i.exec(J):null,$=Z?Number(Z[1]):Number.NaN,X=Number.isFinite($)?$*1000:T2;return Math.min(Math.max(X,S2),R2)}async function n1(J){let Z=w5.get(J);if(Z&&Z.expiresAt>u1())return I9(J,Z),Z.endpoints;let $=s5.get(J);if($)return $;let X=(async()=>{try{let Q=J.replace(/\/$/,""),G=await fetch(`${Q}/.well-known/openid-configuration`,{headers:{Accept:"application/json"}});if(!G.ok)throw Error(`OIDC discovery failed for ${J} with status ${G.status}`);let F=await G.json(),B={authorizationUrl:typeof F.authorization_endpoint==="string"?F.authorization_endpoint:void 0,tokenUrl:typeof F.token_endpoint==="string"?F.token_endpoint:void 0,jwksUri:typeof F.jwks_uri==="string"?F.jwks_uri:void 0,userInfoUrl:typeof F.userinfo_endpoint==="string"?F.userinfo_endpoint:void 0};return I9(J,{endpoints:B,expiresAt:u1()+q2(G.headers.get("cache-control"))}),B}catch(Q){let G=w5.get(J);if(G)return G.endpoints;throw Q}finally{s5.delete(J)}})();return s5.set(J,X),X}async function a1(J,Z){let $=await fetch(J,{headers:{Authorization:`Bearer ${Z}`,Accept:"application/json","User-Agent":"enterprise-standard-ciam"}});if(!$.ok)throw Error(`UserInfo request failed with status ${$.status}`);return await $.json()}function C2(J){let Z=J.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),$=atob(Z),X=new Uint8Array($.length);for(let Q=0;Q<$.length;Q++)X[Q]=$.charCodeAt(Q);return X}async function i1(J){let Z=Math.floor(Date.now()/1000),$={alg:"ES256",kid:J.keyId,typ:"JWT"},X={iss:J.teamId,iat:Z,exp:Z+(J.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:J.clientId},Q=N1(new TextEncoder().encode(JSON.stringify($))),G=N1(new TextEncoder().encode(JSON.stringify(X))),F=`${Q}.${G}`,B=await crypto.subtle.importKey("pkcs8",C2(J.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),W=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},B,new TextEncoder().encode(F));return`${F}.${N1(new Uint8Array(W))}`}function v2(J){for(let Z=0;Z<J.length;Z++){let $=J.charCodeAt(Z);if($<=31||$===127)return!0}return!1}function U2(J,Z){let $=null;try{$=new URL(J,Z)}catch{$=null}let X="";try{X=new URL(Z).origin}catch{X=""}return{candidate:J,url:$,requestOrigin:X}}function y9(J,Z,$){let X=U2(J,$),Q=!1;for(let G of Z){let F=G(X);if(F==="deny")return!1;if(F==="allow")Q=!0}return Q}function b9(){return({candidate:J,url:Z})=>{if(v2(J))return"deny";if(J.includes("\\"))return"deny";if(J.startsWith("//"))return"deny";if(!Z)return"deny";if(Z.protocol!=="http:"&&Z.protocol!=="https:")return"deny";if(Z.username||Z.password)return"deny";return"abstain"}}function q9(){return({candidate:J})=>J.startsWith("/")&&!J.startsWith("//")&&!J.startsWith("/\\")?"allow":"abstain"}function C9(){return({url:J,requestOrigin:Z})=>J&&Z&&J.origin===Z?"allow":"abstain"}function k2(...J){let Z=new Set(J.map(($)=>{try{return new URL($).origin}catch{return $}}));return({url:$})=>$&&Z.has($.origin)?"allow":"abstain"}function f2(...J){let Z=J.map(($)=>$.toLowerCase());return({url:$})=>{if(!$)return"abstain";let X=$.hostname.toLowerCase();for(let Q of Z)if(Q.startsWith(".")){if(X===Q.slice(1)||X.endsWith(Q))return"allow"}else if(X===Q)return"allow";return"abstain"}}function t1(){return[b9(),q9(),C9()]}function v9(J,Z,$){if(!J)return!1;return y9(J,Z,$)}function o1(J,Z){if(!J)return Z.fallback;return y9(J,Z.rules,Z.requestUrl)?J:Z.fallback}var h2={rules:t1(),fallback:"/"};function g2(J,Z,$="redirect"){let X=new URL(J.url).searchParams.get($)??void 0;return v9(X,Z.rules,J.url)?{redirect:X}:void 0}function m2(J,Z){let $=J.context;return o1($?.redirect,{rules:Z.rules,fallback:Z.fallback,requestUrl:J.request.url})}function x5(J,Z,$){if(J instanceof Response)return{response:J};if(typeof J==="string")return{location:o1(J,{rules:t1(),fallback:Z,requestUrl:$})};return{location:Z}}function U5(J,Z){if(Z.length===0)return J;let $=new Headers(J.headers);for(let X of Z)$.append("Set-Cookie",X);return new Response(J.body,{status:J.status,statusText:J.statusText,headers:$})}var M1="ciam",p2="id_token",u2="access_token";function l2(J,Z,$,X,Q,G){if(!$&&!X)return;let F=new WeakMap,B={...$,...X},W={...B,magicLinkTtl:B.magicLinkTtl??3600,sessionTtl:B.sessionTtl??86400,cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.ciamId?`es.ciam.${B.ciamId}`:"es.ciam"),cookiesPath:B.cookiesPath??"/"};function L(){if(!W.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return W.sessionStore}function f(){L()}let u=J.callbackParams??c5(U9("enterprisestandard.ciam")),i=J.idTokenClaims??c5(D1("enterprisestandard.ciam")),J5=J.tokenResponse??c5(k9("enterprisestandard.ciam"));function r(K=32){let H=new Uint8Array(K);return crypto.getRandomValues(H),Array.from(H,(N)=>N.toString(16).padStart(2,"0")).join("").substring(0,K)}function G5(K,H,N,z=W.cookiesSameSite??"Strict"){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");if(K=`${W.cookiesPrefix}.${K}`,typeof H!=="string")H=btoa(JSON.stringify(H));let j;if(N instanceof Date)j=`Expires=${N.toUTCString()}`;else if(typeof N==="number")j=`Max-Age=${N}`;else throw Error("Invalid expires type",N);if(H.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${H.length}`);return`${K}=${H}; ${j}; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${z};`}function p(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");return`${W.cookiesPrefix}.${K}=; Max-Age=0; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${W.cookiesSameSite};`}function c(K,H,N=!1){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");let z=H.headers.get("cookie");if(!z)return null;let j=`${W.cookiesPrefix}.${K}`,M=z.split(";").find((E)=>E.trim().startsWith(`${j}=`));if(!M)return null;let _=M.indexOf("="),D=M.substring(_+1).trim();if(!N)return D;try{let E=atob(D);return JSON.parse(E)}catch(E){return Z.error("[CIAM] Failed to parse cookie",{"es.operation":"cookie.parse","es.outcome":"failure",cookieName:j},E),null}}function l(K){return`cstate_${K}`}async function B5(K,H,N,z){let j=await W.afterLogin?.({...H,request:K,context:N}),M=x5(j,"/",K.url);if(M.response)return U5(M.response,z.map(([,_])=>_));return new Response(H.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",M.location],...z]})}function s(K,H){return["Set-Cookie",G5("session",K,H)]}function $5(K){if(!K)return;if(K instanceof Date)return K;let H=new Date(K);return Number.isNaN(H.getTime())?void 0:H}async function j5(K){let H=c("session",K);if(!H)return;let N=await L().get(H);if(N&&W.tenantId&&N.tenantId&&N.tenantId!==W.tenantId)return;if(N?.authType!=="ciam")return;let z=$5(N.expiresAt);if(z&&Date.now()>z.getTime()){await L().delete(H);return}return N}async function q5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H=F.get(K);if(H)return H;let N=i5(K);return F.set(K,N),N}async function i5(K){try{let H=await j5(K);if(!H?.claims?.sub)return{status:"unauthenticated"};return{status:"authenticated",value:N5(H.claims)}}catch(H){return Z.error("CIAM session resolution failed",{"es.operation":"ciam.session","es.outcome":"degraded"},H),{status:"degraded",error:H instanceof Error?H:void 0}}}async function g5(K){let H=await q5(K);return H.status==="authenticated"?H.value:void 0}async function m5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H;try{H=await g5(K)}catch{H=void 0}let N=await W.beforeLogout?.({request:K,user:H});try{let P=c("session",K);if(P)await L().delete(P)}catch(P){Z.warn("Failed to delete CIAM session",{"es.operation":"session.delete","es.outcome":"degraded"},P)}let z=[["Set-Cookie",p("session")]],j=await W.afterLogout?.({request:K,context:N}),M=x5(j,"/",K.url);if(M.response)return U5(M.response,z.map(([,P])=>P));let _=M.location??"/",D=K.headers.get("accept");if(D?.includes("application/json")||D?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...z]});return new Response("Logged out",{status:302,headers:[["Location",_],...z]})}function C5(K){return K.id||K.email||`ciam-${K.userName}`}function T5(K,H,N){return{sub:C5(K),iss:M1,aud:M1,typ:p2,exp:Math.floor(N.getTime()/1000),iat:Math.floor(Date.now()/1000),email:K.email,name:K.name,preferred_username:K.userName,picture:K.avatar,sid:H}}function p5(K,H,N){return{sub:K,iss:M1,aud:M1,typ:u2,exp:Math.floor(N.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:H,scope:"openid profile email"}}function N5(K){let H=K.exp?new Date(K.exp*1000):new Date;return{id:K.sub,userName:K.preferred_username??"",name:K.name??"",email:K.email??"",avatar:K.picture,userType:"customer",ciam:{profile:K,scope:"openid profile email",tokenType:"Bearer",expires:H}}}async function u5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");if(!Q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await Q.getWorkloadIdentity(K))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let N,z;try{if(!K.headers.get("content-type")?.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let v=await K.text(),y=JSON.parse(v);z=typeof y?.redirect==="string"&&y.redirect.length>0?y.redirect:void 0;let Y={userName:y.userName,name:y.name,email:y.email,avatar:y.avatar},O=await J.customer.validate(Y);if(O.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}});N=O.value}catch(R){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let M=new URL(K.url).searchParams.get("ttl"),_=M?parseInt(M,10):W.magicLinkTtl??3600;if(Number.isNaN(_)||_<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let D=r(32),E=new Date(Date.now()+_*1000);if(!W.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await W.magicLinkStore.create(D,N,E)}catch(R){return Z.error("Error creating magic link",{"es.operation":"magic_link.create","es.outcome":"failure"},R),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let P=new URL(K.url),w=W.magicLinkLoginUrl||"/magic-link/login",q=new URL(w,P.origin);if(q.searchParams.set("token",D),z)q.searchParams.set("redirect",z);return new Response(JSON.stringify({magicLink:q.toString(),expiresAt:E.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function S5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let N=new URL(K.url).searchParams.get("token");if(!N)return B5(K,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!W.magicLinkStore)return B5(K,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let z=await W.magicLinkStore.getAndDelete(N);if(!z)return B5(K,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let j=new Date(Date.now()+(W.sessionTtl??86400)*1000),M=r(32),_=C5(z.customer),D=T5(z.customer,M,j),E=p5(_,M,j),P=N5(D),w;try{let R={sid:M,sub:_,authType:"ciam",tenantId:W.tenantId,expiresAt:j,claims:D,accessClaims:E,createdAt:new Date};await L().create(R),w=R}catch(R){throw Z.warn("Failed to create session",{"es.operation":"session.create","es.outcome":"degraded"},R),R}if(W.customerStore)try{let R=P.id;if(R){let v=new Date,y=await W.customerStore.get(R);if(y||W.enableJitUserProvisioning){let Y={...y??{},...P,id:R,tenantId:y?.tenantId,createdAt:y?.createdAt??v,updatedAt:v,userType:y?.userType??"customer"};await W.customerStore.upsert(Y)}}}catch(R){Z.warn("Failed to store customer",{"es.operation":"customer.store","es.outcome":"degraded"},R)}let q=[s(M,j)];return B5(K,{ok:!0,user:P,session:w},void 0,q)}function L5(K,H=200,N=[]){return new Response(JSON.stringify(K),{status:H,headers:[["Content-Type","application/json"],...N]})}function M5(K,H){try{return new URL(K).toString()}catch{let N=new URL(H).origin,z=W.cookiesSecure?N.replace(/^http:\/\//,"https://"):N;return new URL(K,z).toString()}}function x(){let K=W.customerLoginUrl||"/auth/customer/login",H=K.includes("?")?"&":"?";return v1(W.providers).map(({name:N,config:z})=>{let j=C1(z);return{name:N,type:z.type,displayName:j.displayName,loginUrl:`${K}${H}provider=${encodeURIComponent(N)}`,iconUrl:j.iconUrl,colors:j.colors,url:j.url}})}async function U(K){if(!K)return{};let{authorizationUrl:H,tokenUrl:N,jwksUri:z,userInfoUrl:j}=K,M=K.config.authority;if(M&&(!H||!N||K.flow==="id_token"&&!z))try{let D=await n1(M);H=H??D.authorizationUrl,N=N??D.tokenUrl,z=z??D.jwksUri,j=j??D.userInfoUrl}catch(D){Z.error("CIAM provider OIDC discovery failed",{"es.operation":"ciam.oidc.discovery","es.outcome":"failure"},D)}return{authorizationUrl:H,tokenUrl:N,jwksUri:z,userInfoUrl:j}}async function h(K){if(K.type==="apple"){let{teamId:H,keyId:N,privateKey:z,clientId:j}=K.config;if(H&&N&&z&&j)return i1({teamId:H,keyId:N,privateKey:z,clientId:j})}return K.clientSecret}async function n(K){L();let N=new URL(K.url).searchParams.get("provider");if(!N)return L5({error:"Missing required query parameter: provider"},400);let z=W.providers?.[N];if(!z||z.enabled===!1||z.type==="magic-link")return L5({error:`Unknown or disabled CIAM provider: ${N}`},404);let j=V1(N,z);if(!j?.clientId)return L5({error:`CIAM provider ${N} is not fully configured`},500);let M=await U(j);if(!M.authorizationUrl)return L5({error:`CIAM provider ${N} is missing an authorization endpoint`},500);let _=W.customerCallbackUrl||"/auth/customer/callback",D=M5(_,K.url),E=D5(),P=D5(64),w=D5(),q=j.flow==="id_token",R=q?await J1(P):void 0,v=await W.beforeLogin?.({request:K}),y=l1({authorizationUrl:M.authorizationUrl,clientId:j.clientId,redirectUri:D,scope:j.scope,state:E,codeChallenge:R,nonce:w,extraParams:j.extraAuthParams}),Y={provider:N,state:E,codeVerifier:q?P:void 0,nonce:w,redirectUri:D,...v===void 0?{}:{context:v}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",y],["Set-Cookie",G5(l(E),Y,W.loginStateTtl??600,"Lax")]]})}async function e(K){if(K.method==="POST"){if((K.headers.get("content-type")??"").includes("application/x-www-form-urlencoded")){let N=await K.text();return Object.fromEntries(new URLSearchParams(N).entries())}}return Object.fromEntries(new URL(K.url).searchParams.entries())}async function t(K,H){let N=K.mapClaims(H);if(!N.sub)return{ok:!1};let z=`${K.name}:${N.sub}`,j={id:z,userName:N.userName||N.email||z,name:N.name||"",email:N.email||"",avatar:N.avatar,userType:"customer"},M=z;if(W.customerStore){let q=await W.customerStore.lookup(j)??await W.customerStore.get(z);if(M=q?.id??z,!q&&!W.enableJitUserProvisioning)return Z.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"es.operation":"customer.store","es.outcome":"skipped"}),{ok:!1};let R=new Date,v={...q??{},...j,id:M,tenantId:q?.tenantId,createdAt:q?.createdAt??R,updatedAt:R,userType:q?.userType??"customer"};await W.customerStore.upsert(v)}let _=new Date(Date.now()+(W.sessionTtl??86400)*1000),D=D5(32),E={sub:M,iss:K.name,aud:K.clientId,exp:Math.floor(_.getTime()/1000),iat:Math.floor(Date.now()/1000),email:N.email,name:N.name,preferred_username:N.userName??N.email,picture:N.avatar,sid:D},P={sid:D,sub:M,authType:"ciam",tenantId:W.tenantId,expiresAt:_,claims:E,accessClaims:{sub:M,sid:D,scope:K.scope},createdAt:new Date},w=L();try{await w.create(P)}catch(q){if(!await w.get(D))throw q;await w.update(D,P)}return{ok:!0,claims:E,sid:D,expires:_}}async function V(K){L();let H,N,z=(j)=>{let M=H?[["Set-Cookie",p(H)]]:[];return B5(K,{ok:!1,error:j},N,M)};try{let j=await e(K),M=await u.validate(j);if(M.issues||!M.value)return z(Error("Invalid CIAM callback parameters"));let{code:_,state:D}=M.value;if(!D)return z(Error("Missing CIAM callback state"));H=l(D);let E=c(H,K,!0);if(N=E?.context,!E?.provider||!E.state||E.state!==D)return Z.warn("CIAM callback state verification failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM callback state verification failed"));let P=W.providers?.[E.provider];if(!P)return z(Error("Unknown CIAM provider"));let w=V1(E.provider,P);if(!w?.clientId)return z(Error("CIAM provider not configured"));let q=await U(w);if(!q.tokenUrl)return z(Error("CIAM provider missing token endpoint"));let R=await h(w),v=await c1({tokenUrl:q.tokenUrl,clientId:w.clientId,clientSecret:R,redirectUri:E.redirectUri||M5(W.customerCallbackUrl||"/auth/customer/callback",K.url),code:_,codeVerifier:w.flow==="id_token"?E.codeVerifier:void 0,log:Z}),y;if(w.flow==="id_token"){let b=w.config.authority;if(!v.id_token||!q.jwksUri||!b)return z(Error("CIAM id_token flow misconfigured"));if(!E.nonce)return z(Error("CIAM callback state cookie missing nonce"));if((await J5.validate(v)).issues)return Z.warn("CIAM token response validation failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM token response validation failed"));y=await R5({idToken:v.id_token,jwksUri:q.jwksUri,issuer:b,audience:w.clientId,expectedNonce:E.nonce,log:Z});let C=await i.validate(y);if(!C.issues)y=C.value}else{if(!q.userInfoUrl)return z(Error("CIAM provider missing userinfo endpoint"));y=await a1(q.userInfoUrl,v.access_token);let b=w.config.authority;if(v.id_token&&q.jwksUri&&b){let S=await R5({idToken:v.id_token,jwksUri:q.jwksUri,issuer:b,audience:w.clientId,expectedNonce:E.nonce||void 0,log:Z}),C=typeof S.sub==="string"?S.sub:"";if(C){if(typeof y.sub==="string"&&y.sub.length>0&&y.sub!==C)return Z.warn("CIAM UserInfo sub does not match verified id_token sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM UserInfo sub mismatch"));y.sub=C}}if(typeof y.sub!=="string"||y.sub.length===0)return Z.warn("CIAM UserInfo response missing sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM UserInfo response missing sub"))}let Y=await t(w,y);if(!Y.ok)return z(Error("Failed to persist CIAM customer"));let O=N5(Y.claims);Z.info("CIAM third-party sign-in succeeded",{"es.operation":"ciam.oidc.callback","es.outcome":"success",provider:w.name});let T=[["Set-Cookie",p(H)],s(Y.sid,Y.expires)];return B5(K,{ok:!0,user:O,session:void 0},N,T)}catch(j){return Z.error("Error during CIAM third-party sign-in callback",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"},j),z(j)}}async function A(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H=W.magicLinkUrl||"/magic-link",N=W.magicLinkLoginUrl||"/magic-link/login",z=W.logoutUrl||"/auth/customer/logout",j=W.customerLoginUrl||"/auth/customer/login",M=W.customerCallbackUrl||"/auth/customer/callback",_=W.customerProvidersUrl||"/auth/customer/providers",D=new URL(K.url).pathname,E=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(E(H)===D&&K.method==="POST")return u5(K);if(E(N)===D&&K.method==="GET")return S5(K);if(E(z)===D&&K.method==="GET")return m5(K);if(E(_)===D&&K.method==="GET")return L5({providers:x()});if(E(j)===D&&K.method==="GET")return n(K);if(E(M)===D&&(K.method==="GET"||K.method==="POST"))return V(K);return new Response("Not Found",{status:404})}return{...W,getCustomer:g5,resolveCustomer:q5,logout:m5,handler:A,listCustomerProviders:x}}async function c2(J,Z){return m(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),Z.ciam?.getCustomer(J)}async function d2(J,Z){return m(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),await Z.ciam?.resolveCustomer(J)??{status:"unauthenticated"}}var Y1="application/scim+json",n2="urn:ietf:params:scim:api:messages:2.0:ListResponse",Q9="urn:ietf:params:scim:api:messages:2.0:Error",P1="urn:ietf:params:scim:schemas:core:2.0:User",h5="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",O1="urn:ietf:params:scim:schemas:core:2.0:Group",a2="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",f9="urn:ietf:params:scim:schemas:core:2.0:ResourceType",Z1="urn:ietf:params:scim:schemas:core:2.0:Schema",i2="00000000000000000000000000000000";function t2(J){let Z={timestamp:new Date().toISOString()};if(J)Z.actor=J;try{let Q=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),G=Q?.traceId;if(G&&G!==i2){if(Z.traceId=G,Q?.spanId)Z.spanId=Q.spanId}}catch{}return Z}class B1 extends Error{constructor(J){super(J);this.name="SubjectTypeNotAssignableError",Object.setPrototypeOf(this,B1.prototype)}}async function o2(J,Z,$,X,Q){let G=X.subjectType??"user";if(!X9.includes(G))throw new B1(`Cannot grant ${X.targetType} "${V5(X.target)}" to a "${G}" principal: only [${X9.join(", ")}] principals are assignable on this platform.`);let F=G9(Z,J);if(!F&&!Q)return;let B=V5(X.target),W;if(Q)W=await Q.getNode(X.targetType,B);else if(F){if(W=await(X.targetType==="group"?F.groups:X.targetType==="role"?F.roles:F.permissions).get(B),!W&&X.targetType==="group")W=await $?.entitlement?.(B)}let L=W?.assignableSubjectTypes;if(L&&L.length>0&&!L.includes(G))throw new B1(`Cannot grant ${X.targetType} "${B}" to a "${G}" principal: this entitlement restricts assignment to [${L.join(", ")}].`)}async function r2(J,Z,$,X){await o2(J.catalogStore,J.codeCatalog,J.resources,Z,X);let Q={...Z,status:Z.status??"active",provenance:Z.provenance??t2()};if(Q.id=W1(Q),await J.accessStore?.grant(Q),J.accessIndex&&(J.catalogStore||J.codeCatalog)){let G=await B9(Q,{catalog:J.catalogStore,code:J.codeCatalog,resources:J.resources,cache:X});await J.accessIndex.materialize(Q.id,G)}return $?.push({op:"add",change:Q}),Q}async function E1(J,Z,$){let X=Z.id??W1(Z);await J.accessStore?.revoke(Z),await J.accessIndex?.removeByRoot(X),$?.push({op:"delete",change:{...Z,id:X}})}async function K9(J,Z){let $=await s2(J,Z),X=await J4(J,Z);return{oaa:$,delta:X}}async function s2(J,Z){if(Z.length===0||!J.authz.oaa.isReady())return{status:"skipped"};return F9(J,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>J.authz.oaa.pushAccessChanges(Z),{count:Z.length})}async function F9(J,Z,$,X,Q){try{return await X(),{status:"ok"}}catch(G){return J.log?.warn($,{"es.operation":Z,"es.outcome":"degraded",...Q,error:b5(G)}),{status:"degraded",reason:b5(G)}}}var e2=6;async function J4(J,Z){let $=J.iamDelta;if(!$?.isReady()||Z.length===0)return{status:"skipped"};let X=new Map;for(let W of Z){let L=`${W.change.subjectType??"user"}:${V5(W.change.subject)}\x00${W.change.targetType}:${V5(W.change.target)}`;X.set(L,W)}let Q=[...X.values()],G=Q.map(({op:W,change:L})=>()=>W==="add"?$.onGrant(L):$.onRevoke(L)),B=(await Z4(G,e2)).filter((W)=>W.status==="rejected");if(B.length>0)return J.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"es.operation":"iam.delta.egress","es.outcome":"degraded",failed:B.length,total:Q.length,error:b5(B[0]?.reason)}),{status:"degraded",reason:b5(B[0]?.reason)};return{status:"ok"}}async function Z4(J,Z){let $=Array(J.length),X=0,Q=async()=>{while(!0){let F=X++;if(F>=J.length)return;let B=J[F];if(!B)continue;try{$[F]={status:"fulfilled",value:await B()}}catch(W){$[F]={status:"rejected",reason:W}}}},G=Array.from({length:Math.min(Z,J.length)},Q);return await Promise.all(G),$}class w1 extends Error{constructor(J){super(J);this.name="DerivedRevokeError",Object.setPrototypeOf(this,w1.prototype)}}class a5 extends Error{summary;clientError;constructor(J,Z,$=!1){super(J);this.name="ScimMutationError",this.summary=Z,this.clientError=$,Object.setPrototypeOf(this,a5.prototype)}}function k(J,Z,$){return new Response(JSON.stringify({schemas:[Q9],status:String(J),scimType:$,detail:Z}),{status:J,headers:{"Content-Type":Y1}})}function d5(J,Z){let $=Z?.totalResults??J.length,X=Z?.startIndex??1,Q=Z?.itemsPerPage??J.length;return new Response(JSON.stringify({schemas:[n2],totalResults:$,startIndex:X,itemsPerPage:Q,Resources:J}),{status:200,headers:{"Content-Type":Y1}})}function H5(J,Z=200){return new Response(JSON.stringify(J),{status:Z,headers:{"Content-Type":Y1}})}function h9(J){return k(J.clientError?409:500,`${J.message}; authz mutation summary: ${JSON.stringify(J.summary)}`,J.clientError?"mutability":"invalidValue")}function K1(J){return W1(J)}function r1(J,Z){return X1(g9(J),g9(Z))}function g9(J){let Z=new Map;if(!J?.id)return Z;for(let $ of J.groups??[]){let X={subject:J.id,targetType:"group",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type}:void 0};Z.set(K1(X),X)}for(let $ of J.roles??[]){let X={subject:J.id,targetType:"role",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}for(let $ of J.entitlements??[]){let X={subject:J.id,targetType:"permission",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}return Z}function $1(J,Z,$,X){let Q=new Map,G=X&&X.length>0?X:void 0;for(let F of J??[]){let B={subject:F.value,targetType:Z,target:$,resources:G,metadata:F.display||F.type?{display:F.display,type:F.type}:void 0};Q.set(K1(B),B)}return Q}function s1(J){let Z=J[Y5]?.resources;return Z&&Z.length>0?Z:void 0}function $4(J,Z,$){let X=J[Y5];if(J.displayName!==void 0&&J.displayName!==(Z.displayName??Z.name))return!0;if(J.externalId!==void 0&&J.externalId!==Z.externalId)return!0;if(X?.type!==void 0&&X.type!==$)return!0;if(X?.requestable!==void 0&&Boolean(X.requestable)!==Boolean(Z.requestable))return!0;if(X?.description!==void 0&&X.description!==Z.description)return!0;if(X?.resources!==void 0){let Q=[...X.resources].sort().join(","),G=[...j1(Z)??[]].sort().join(",");if(Q!==G)return!0}return!1}function m9(J){let Z=new Map;for(let $ of J)Z.set(K1($),$);return Z}async function O5(J,Z,$,X,Q,G,F){let B=[],W=new Set,L=F?F.get(`${X}:${Q}`)??[]:Z?(await Z.listByTarget(X,Q)).items:[];for(let f of L){let u=V5(f.subject);if(W.has(u))continue;W.add(u);let i=f.metadata,J5=f.subjectType==="workload"?"Workload":i?.type??"User";B.push({value:u,...i?.display?{display:i.display}:{},type:J5})}for(let f of G??[]){if(f.targetType!==X||V5(f.target)!==Q)continue;let u=V5(f.subject);if(W.has(u))continue;W.add(u),B.push({value:u,type:"Workload"})}if(X==="group"){let f=await J.groups.get(Q)??await $?.entitlement?.(Q);for(let u of f?.groups??[]){let i=V5(u);if(!i||W.has(i))continue;W.add(i),B.push({value:i,type:"Group"})}}return B.length>0?B:void 0}function X1(J,Z){let $=[];for(let[X,Q]of Z)if(!J.has(X))$.push({action:"grant",change:Q});for(let[X,Q]of J)if(!Z.has(X))$.push({action:"revoke",change:Q});return $}async function e1(J,Z){if(J.oaa.isReady())await J.oaa.pushUser(Z)}async function k5(J,Z,$,X){let Q={metadataApplied:!1,access:[]},G=[],F=new Y9(J.catalogStore,J.resources,J.codeCatalog);try{try{await Z(),Q.metadataApplied=!0}catch(B){for(let W of $)Q.access.push({change:W.change,status:"rolled_back"});throw Q.metadataApplied=!1,new a5(`SCIM metadata write failed: ${b5(B)}`,Q,!1)}if(X)await F9(J,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",X);for(let B=0;B<$.length;B++){let W=$[B];try{if(W.action==="grant")await r2(J,W.change,G,F);else await Y4(J,W.change,G);Q.access.push({change:W.change,status:"applied"})}catch(L){Q.access.push({change:W.change,status:"failed",error:L});for(let u=B+1;u<$.length;u++)Q.access.push({change:$[u].change,status:"rolled_back"});let f=L instanceof w1||L instanceof B1;if(!f)await Q4(J,W.change,F);throw new a5(f?b5(L):`SCIM access mutation failed: ${b5(L)}`,Q,f)}}return Q}finally{await X4(J),Q.egress=await K9(J,G),K4(J,Q)}}function b5(J){return J instanceof Error?J.message:String(J)}async function X4(J){try{await J.authz.settle?.()}catch{}}async function Q4(J,Z,$){if(!J.accessIndex||!J.catalogStore&&!J.codeCatalog||!J.accessStore)return;let X=V5(Z.subject);if(!X)return;let Q=Z.subjectType??"user";try{await W9(X,Q,{accessStore:J.accessStore,accessIndex:J.accessIndex,catalogStore:J.catalogStore,code:J.codeCatalog,resources:J.resources},$)}catch(G){J.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"es.operation":"authz.reconcile.subject.repair","es.outcome":"degraded",subject:X,subjectType:Q,error:b5(G)})}}function K4(J,Z){if(!J.onAccessMutation)return;try{J.onAccessMutation(Z)}catch{}}async function Y4(J,Z,$){if(J.accessStore){let X=Z.id??W1(Z);if(!await J.accessStore.get(X)){if((J.accessIndex?await J.accessIndex.has(Z.subject,Z.targetType,Z.target,Z.resources?.[0],Z.subjectType):{allow:!1}).allow)throw new w1(`Cannot revoke ${Z.targetType} "${V5(Z.target)}" for "${V5(Z.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await E1(J,Z,$);return}}await E1(J,Z,$)}function Q1(J){let Z=J[Y5]?.type??"group";if(Z==="group"||Z==="role"||Z==="permission")return Z;throw Error(`Unsupported Enterprise Standard SCIM Group authz type "${String(Z)}"`)}async function J9(J,Z,$){if(!J.oaa.isReady())return;if($==="role"){await J.oaa.pushRole(Z);return}if($==="permission"){await J.oaa.pushPermission(Z);return}await J.oaa.pushGroup(Z)}function j1(J){let Z=J.resources;if(!Z||Z.length===0)return;let $=Z.map((X)=>typeof X==="string"?X:X.id).filter(Boolean);return $.length>0?$:void 0}function E5(J,Z,$){return{schemas:[O1],id:J.id,externalId:J.externalId,displayName:J.displayName??J.name,members:$,[Y5]:{type:Z,requestable:J.requestable,description:J.description,resources:Z==="group"?j1(J):void 0,assignableSubjectTypes:J.assignableSubjectTypes,recommendedSubjectTypes:J.recommendedSubjectTypes}}}function B4(J,Z){let $=J[Y5],X={id:Z,name:J.displayName,displayName:J.displayName,description:$?.description??J.displayName,externalId:J.externalId,requestable:$?.requestable};if($?.resources!==void 0)X.resources=$.resources;return X}function W4(J){if(!J)return;let Z=J.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!Z)return;return{requestable:Z[1]?.toLowerCase()==="true"}}function p9(J){if(!J)return;let Z=J.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return Z?Z[1]:void 0}async function H9(J,Z){if(!J?.entitlements)return[];let $=J.entitlements.bind(J),X=[];for await(let Q of l9((G,F)=>J.list({start:G,limit:F})))for(let G of $(Q)){if(Z?.requestable!==void 0&&Boolean(G.requestable)!==Z.requestable)continue;X.push(G1(G))}return X}async function G4(J,Z,$,X,Q){let G=[{store:J.groups,type:"group"},{store:J.roles,type:"role"},{store:J.permissions,type:"permission"}],F;if(G.every(({store:W})=>typeof W.getByExternalId==="function"))F=(await Promise.all(G.map(async({store:L,type:f})=>{let u=await L.getByExternalId?.(X);return u?{entity:u,type:f}:void 0}))).filter((L)=>L!==void 0);else{let W={start:0},[L,f,u]=await Promise.all([J.groups.list(W),J.roles.list(W),J.permissions.list(W)]);F=[...L.items.map((J5)=>({entity:J5,type:"group"})),...f.items.map((J5)=>({entity:J5,type:"role"})),...u.items.map((J5)=>({entity:J5,type:"permission"}))].filter(({entity:J5})=>J5.externalId===X)}if($?.entitlements){let W=await H9($);for(let L of W)if(L.externalId===X)F.push({entity:L,type:"group"})}if(F.length>1)throw new L9(`Ambiguous externalId "${X}": ${F.length} entitlements share it (${F.map((W)=>`${W.type}:${W.entity.id}`).join(", ")})`,"unique_violation","externalId");let B=F[0];if(!B)return;return E5(B.entity,B.type,await O5(J,Z,$,B.type,B.entity.id,Q))}async function L4(J,Z,$,X,Q){let G=Math.max(0,X.start),F=X.limit!=null?G+X.limit:void 0,B={start:0,limit:F,filter:X.filter},[W,L,f]=await Promise.all([J.groups.list(B),J.roles.list(B),J.permissions.list(B)]),u=[...W.items.map((s)=>({entity:s,type:"group"})),...L.items.map((s)=>({entity:s,type:"role"})),...f.items.map((s)=>({entity:s,type:"permission"}))],i=W.total+L.total+f.total,J5=u.slice(G,F),r=0,G5=[];if($?.entitlements){let s=await H9($,X.filter);r=s.length;let $5=X.limit!=null?X.limit-J5.length:void 0;if($5===void 0||$5>0){let j5=Math.max(0,G-i);G5=$5===void 0?s.slice(j5):s.slice(j5,j5+$5)}}let p=[...J5,...G5.map((s)=>({entity:s,type:"group"}))],c=i+r,l=Z?.listByTargets?await Z.listByTargets(p.map(({entity:s,type:$5})=>({targetType:$5,target:s.id}))):void 0,B5=await Promise.all(p.map(async({entity:s,type:$5})=>E5(s,$5,await O5(J,Z,$,$5,s.id,Q,l))));return{resources:B5,total:c,count:B5.length}}async function _1(J,Z,$,X,Q){let[G,F,B]=await Promise.all([J.groups.get(X),J.roles.get(X),J.permissions.get(X)]);if(G)return E5(G,"group",await O5(J,Z,$,"group",X,Q));if(F)return E5(F,"role",await O5(J,Z,$,"role",X,Q));if(B)return E5(B,"permission",await O5(J,Z,$,"permission",X,Q));let W=G1(await $?.entitlement?.(X));if(W)return E5(W,"group",await O5(J,Z,$,"group",X,Q));return}async function Z9(J,Z,$){let X=Q1(Z),G={...(X==="role"?await J.roles.get($):X==="permission"?await J.permissions.get($):await J.groups.get($))??{},...B4(Z,$)},F=X==="role"?J.roles.set(G):X==="permission"?J.permissions.set(G):J.groups.set(G);return await F.ready(),F}async function F4(J,Z){await Promise.all([J.groups.delete(Z),J.roles.delete(Z),J.permissions.delete(Z)])}function u9(){return crypto.randomUUID()}function n5(J,Z){let $=J;if(typeof $.validate==="function")return $.validate(Z);return Promise.resolve(J["~standard"].validate(Z))}function H4(J){if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}}function f5(J){let Z=H4(J);return Z?z1(Z):void 0}function V4(J,Z){let $=f5(J);if($?.endsWith("/Users"))return $.slice(0,-6);let X=f5(Z);if(X?.endsWith("/Groups"))return X.slice(0,-7);return}function y5(J,Z){return new URL(Z,J.url).toString()}function I(J,Z,$,X){let{multiValued:Q=!1,...G}=X??{};return{name:J,type:Z,description:$,multiValued:Q,...G}}function N4(J,Z){return{schemas:[a2],documentationUri:Z?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an Enterprise Standard workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:y5(J.request,`${J.basePath}/ServiceProviderConfig`)}}}function M4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[f9],id:"User",name:"User",description:"User Account",endpoint:J.usersUrl,schema:P1,schemaExtensions:[{schema:h5,required:!1},{schema:I5,required:!1}],meta:{resourceType:"ResourceType",location:y5(J.request,`${J.basePath}/ResourceTypes/User`)}});if(J.supportsGroups)Z.push({schemas:[f9],id:"Group",name:"Group",description:"Group",endpoint:J.groupsUrl,schema:O1,schemaExtensions:[{schema:Y5,required:!1}],meta:{resourceType:"ResourceType",location:y5(J.request,`${J.basePath}/ResourceTypes/Group`)}});return Z}function D4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[Z1],id:P1,name:"User",description:"User Account",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(P1)}`)},attributes:[I("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),I("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),I("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),I("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[I("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),I("familyName","string","The family name of the User.",{multiValued:!1}),I("givenName","string","The given name of the User.",{multiValued:!1}),I("middleName","string","The middle name(s) of the User.",{multiValued:!1}),I("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),I("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),I("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),I("nickName","string","The casual way to address the user.",{multiValued:!1}),I("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),I("title","string","The user title, such as Vice President.",{multiValued:!1}),I("userType","string","The relationship between the organization and the User.",{multiValued:!1}),I("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),I("locale","string","Default location for localizing values.",{multiValued:!1}),I("timezone","string","The User time zone.",{multiValued:!1}),I("active","boolean","The User administrative status.",{multiValued:!1}),I("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[I("value","string","Email address value.",{multiValued:!1,required:!0}),I("display","string","Display label for the email.",{multiValued:!1}),I("type","string","Email type such as work or home.",{multiValued:!1}),I("primary","boolean","Primary email indicator.",{multiValued:!1})]}),I("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[I("value","string","Phone number value.",{multiValued:!1,required:!0}),I("display","string","Display label for the phone number.",{multiValued:!1}),I("type","string","Phone number type.",{multiValued:!1}),I("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),I("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[I("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),I("display","string","Display label for the photo.",{multiValued:!1}),I("type","string","Photo type.",{multiValued:!1}),I("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),I("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[I("formatted","string","Formatted mailing address.",{multiValued:!1}),I("streetAddress","string","Full street address component.",{multiValued:!1}),I("locality","string","City or locality.",{multiValued:!1}),I("region","string","State or region.",{multiValued:!1}),I("postalCode","string","Postal code.",{multiValued:!1}),I("country","string","Country.",{multiValued:!1}),I("type","string","Address type.",{multiValued:!1}),I("primary","boolean","Primary address indicator.",{multiValued:!1})]}),I("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[I("value","string","Group identifier.",{multiValued:!1,required:!0}),I("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),I("display","string","Display name of the group.",{multiValued:!1}),I("type","string","Relationship type.",{multiValued:!1})]}),I("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[I("value","string","Entitlement value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Entitlement type.",{multiValued:!1}),I("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),I("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[I("value","string","Role value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Role type.",{multiValued:!1}),I("primary","boolean","Primary role indicator.",{multiValued:!1})]}),I("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[I("value","string","Certificate value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Certificate type.",{multiValued:!1}),I("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:h5,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(h5)}`)},attributes:[I("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),I("costCenter","string","Name of a cost center.",{multiValued:!1}),I("organization","string","Name of an organization.",{multiValued:!1}),I("division","string","Name of a division.",{multiValued:!1}),I("department","string","Name of a department.",{multiValued:!1}),I("manager","complex","The User manager.",{multiValued:!1,subAttributes:[I("value","string","Identifier of the manager User resource.",{multiValued:!1}),I("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),I("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:I5,name:"EnterpriseStandardUser",description:"Enterprise Standard User extension carrying the Enterprise Controlled ID (ECID) identity correlator and the account purpose (accountClass). See https://enterprisestandard.com/llms-ecid.txt.",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(I5)}`)},attributes:[I("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),I("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1})]}),Z.push({schemas:[Z1],id:Y5,name:"EnterpriseStandardAuthzGroup",description:"Enterprise Standard authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(Y5)}`)},attributes:[I("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),I("requestable","boolean","Whether this catalog entry should be requestable access in IAM tooling.",{multiValued:!1,required:!1}),I("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),I("assignableSubjectTypes","string","AppDev-owned hard ceiling of principal kinds (user, workload) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]}),I("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]})]});if(J.supportsGroups)Z.push({schemas:[Z1],id:O1,name:"Group",description:"Group",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(O1)}`)},attributes:[I("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),I("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),I("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),I("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[I("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),I("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group"]}),I("display","string","Display name of the member.",{multiValued:!1}),I("type","string","Member type.",{multiValued:!1})]})]});return Z}function _4(J,Z,$,X,Q,G,F,B,W,L,f,u,i,J5){let r={authz:X,accessStore:Q,accessIndex:G,catalogStore:F,codeCatalog:B,resources:W,log:Z,iamDelta:u,onAccessMutation:i};if(!L&&!f)return;let p={...L,...f},c=p.users?.enabled!==!1,l=p.groups?.enabled!==!1;if(Boolean(p.url||p.userStore||F||B)&&!$)Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"});function s(){if(!$)throw Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return $}async function $5(x){let U=s(),h=x.headers.get("Authorization");if(!h?.startsWith("Bearer "))return!1;try{let n=h.substring(7);return(await U.validateToken(n)).valid}catch{return!1}}async function j5(){let x=s(),U=typeof x.getServerToken==="function"?await x.getServerToken():await x.getToken();return new Headers({"Content-Type":Y1,Accept:Y1,Authorization:`Bearer ${U}`})}async function q5(x,U,h,n){if(!p.url)throw Error("IAM URL not configured for outgoing requests");let e=`${p.url}${U}`;try{let t=await j5(),V=await fetch(e,{method:x,headers:t,body:h?JSON.stringify(h):void 0}),A=await V.json();if(!V.ok)return{success:!1,error:A,status:V.status};let K=await n["~standard"].validate(A);if(K.issues)return Z.error("SCIM response validation failed",{"es.operation":"scim.response.validate","es.outcome":"failure",validationIssues:K.issues}),{success:!1,error:{schemas:[Q9],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${K.issues.map((H)=>H.message).join("; ")}`},status:400};return{success:!0,data:K.value,status:V.status}}catch(t){return{success:!1,error:{schemas:[Q9],status:"500",detail:t instanceof Error?t.message:"Unknown error occurred"},status:500}}}function i5(){return p.url}function g5(x,U){let h=f5(U?.usersUrl??p.usersUrl??"/api/iam/Users")??"/api/iam/Users",n=f5(U?.groupsUrl??p.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",e=f5(U?.discovery?.basePath??p.discovery?.basePath)??V4(h,n);if(!e)return;return{request:x,basePath:e,usersUrl:h,groupsUrl:n,supportsUsers:c&&Boolean(p.userStore),supportsGroups:l&&Boolean(F||B)}}async function m5(x){let U=N4(x,p.discovery);return await p.discovery?.buildServiceProviderConfig?.(x,U)??U}async function C5(x){let U=M4(x);return await p.discovery?.buildResourceTypes?.(x,U)??U}async function T5(x){let U=D4(x);return await p.discovery?.buildSchemas?.(x,U)??U}async function p5(x,U){let h=g5(x,U);if(!h)return;let n=z1(new URL(x.url).pathname),{basePath:e}=h;if(n!==e&&!n.startsWith(`${e}/`))return;let t=z1(n.slice(e.length)||"/");if(!(t==="/ServiceProviderConfig"||t==="/ResourceTypes"||t.startsWith("/ResourceTypes/")||t==="/Schemas"||t.startsWith("/Schemas/")))return;if(x.method!=="GET")return k(405,"Method not allowed");if(!await $5(x))return k(401,"Authorization required");if(t==="/ServiceProviderConfig")return H5(await m5(h));if(t==="/ResourceTypes")return d5(await C5(h));if(t.startsWith("/ResourceTypes/")){let K=decodeURIComponent(t.slice(15)),H=(await C5(h)).find((N)=>N.id===K||N.name===K);return H?H5(H):k(404,"Resource not found")}if(t==="/Schemas")return d5(await T5(h));if(t.startsWith("/Schemas/")){let K=decodeURIComponent(t.slice(9)),H=(await T5(h)).find((N)=>N.id===K);return H?H5(H):k(404,"Resource not found")}return}let N5,u5;if(p.url)u5=async(U,h)=>{let n={...U,schemas:U.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return q5("POST","/Users",n,J.user)},N5={createGroup:async(U,h)=>{let n={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:U,externalId:h?.externalId,members:h?.members};return q5("POST","/Groups",n,J.group)}};let S5;if(F||B){let x=G9(B,F),U=async(M)=>{if(!W?.entitlement)return;let[_,D,E]=await Promise.all([x.groups.get(M),x.roles.get(M),x.permissions.get(M)]);if(_||D||E)return;return G1(await W.entitlement(M))},h=(M,_)=>k(403,`Entitlement "${M}" is derived from the application's resource data (ResourceProvider.entitlements); its definition cannot be ${_} through SCIM. Member add/remove is allowed; the definition changes only when the application's resources or derivation logic change.`,"mutability"),n=(M)=>{if(!B)return;let _=B.groups.get(M);if(_)return{entity:_,type:"group"};let D=B.roles.get(M);if(D)return{entity:D,type:"role"};let E=B.permissions.get(M);if(E)return{entity:E,type:"permission"};return},e=(M,_)=>k(403,`Entitlement "${M}" is declared in application code (authz.catalog); its definition cannot be ${_} through SCIM. Member add/remove is allowed; the definition changes only when the application code changes.`,"mutability"),t=(M)=>M.path==="members"||Boolean(M.path?.startsWith("members[")),V=async(M,_)=>{if(!await $5(M))return k(401,"Authorization required");let E=new URL(M.url),P=_?.basePath??"/Groups",w=E.pathname;if(w.startsWith(P))w=w.substring(P.length);let R=w.match(/^\/([^/]+)$/)?.[1],v=M.method;try{if(R)switch(v){case"GET":return await K(R);case"PUT":return await N(M,R);case"PATCH":return await z(M,R);case"DELETE":return await j(R);default:return k(405,"Method not allowed")}else if(w===""||w==="/")switch(v){case"GET":return await A(M);case"POST":return await H(M);default:return k(405,"Method not allowed")}return k(404,"Resource not found")}catch(y){if(y instanceof a5)return h9(y);if($9(y))return k(409,y.message,"uniqueness");return Z.error("Groups inbound handler error",{"es.operation":"scim.groups.handler","es.outcome":"failure"},y),k(500,y instanceof Error?y.message:"Internal server error")}},A=async(M)=>{let _=new URL(M.url),D=_.searchParams.get("startIndex"),E=_.searchParams.get("count"),P=D!=null?parseInt(D,10):void 0,w=E!=null?parseInt(E,10):void 0,q=P!=null&&!Number.isNaN(P)?Math.max(0,P-1):0,R=w!=null&&!Number.isNaN(w)?w:void 0,v=_.searchParams.get("filter"),y=p9(v);if(y!==void 0){let T=await G4(x,Q,W,y,J5),b=T?[T]:[];return d5(b,{totalResults:b.length,startIndex:1,itemsPerPage:b.length})}let Y=W4(v),O=await L4(x,Q,W,{start:q,limit:R,filter:Y},J5);return d5(O.resources,{totalResults:O.total,startIndex:q+1,itemsPerPage:O.count})},K=async(M)=>{let _=await _1(x,Q,W,M,J5);if(!_)return k(404,`Group ${M} not found`,"invalidValue");return H5(_)},H=async(M)=>{let _=await M.json(),D=await n5(J.group,_);if(D.issues)return Z.error("Group creation validation failed",{"es.operation":"scim.group.create","es.outcome":"failure",validationIssues:D.issues}),k(400,`Request validation failed: ${D.issues.map((Y)=>Y.message).join("; ")}`,"invalidValue");let E=D.value;if(!E.displayName)return k(400,"displayName is required","invalidValue");if(!F)return k(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");if(E.externalId){let Y=E.externalId,O=B&&(B.groups.getByExternalId(Y)??B.roles.getByExternalId(Y)??B.permissions.getByExternalId(Y)),T=!O&&W?.entitlements?(await H9(W)).find((S)=>S.externalId===Y):void 0,b=O||T;if(b)throw new L9(`externalId "${Y}" is already used by ${O?"code-declared":"resource-derived"} entitlement "${b.id}"`,"unique_violation","externalId")}let P=Q1(E),w=u9(),q=s1(E),R=X1(new Map,$1(E.members,P,w,q)),v;await k5(r,async()=>{v=await Z9(x,E,w)},R,()=>J9(X,v,P));let y=await O5(x,Q,W,P,w);return H5(E5(v,P,y),201)},N=async(M,_)=>{let D=await M.json(),E=await n5(J.group,D);if(E.issues)return Z.error("Group replacement validation failed",{"es.operation":"scim.group.replace","es.outcome":"failure",validationIssues:E.issues}),k(400,`Request validation failed: ${E.issues.map((C)=>C.message).join("; ")}`,"invalidValue");let P=E.value,w=Q1(P);if(!await _1(x,Q,W,_))return k(404,`Group ${_} not found`,"invalidValue");let R=n(_),v=R?void 0:await U(_),y=R??(v?{entity:v,type:"group"}:void 0);if(y){if($4(P,y.entity,y.type))return R?e(_,"replaced"):h(_,"replaced");let C=j1(y.entity),g=Q?(await Q.listByTarget(y.type,_)).items:[],d=X1(m9(g),$1(P.members,y.type,_,C));await k5(r,async()=>{},d);let a=await O5(x,Q,W,y.type,_);return H5(E5(y.entity,y.type,a))}let Y=s1(P),O=Q?(await Q.listByTarget(w,_)).items:[],T=X1(m9(O),$1(P.members,w,_,Y)),b;await k5(r,async()=>{b=await Z9(x,P,_)},T,()=>J9(X,b,w));let S=await O5(x,Q,W,w,_);return H5(E5(b,w,S))},z=async(M,_)=>{let D=await _1(x,Q,W,_);if(!D)return k(404,`Group ${_} not found`,"invalidValue");let E=n(_),P=E?void 0:await U(_),w=E??(P?{entity:P,type:"group"}:void 0),q=await M.json();if(w&&(q.Operations??[]).some((S)=>!t(S)))return E?e(_,"patched"):h(_,"patched");let R={...D};for(let S of q.Operations??[])if(S.op==="replace"&&S.path&&S.value!==void 0){if(S.path==="displayName")R.displayName=S.value;else if(S.path===`${Y5}.requestable`)R[Y5]={...R[Y5],requestable:Boolean(S.value)};else if(S.path===`${Y5}.description`)R[Y5]={...R[Y5],description:String(S.value)}}else if(S.op==="add"&&S.path==="members"&&S.value!==void 0){let C=S.value;R.members=[...R.members??[],...C]}else if(S.op==="remove"&&S.path?.startsWith("members[")){let C=S.path.match(/members\[value eq "([^"]+)"\]/);if(C)R.members=(R.members??[]).filter((g)=>g.value!==C[1])}let v=await n5(J.group,R);if(v.issues)return Z.error("Group patch validation failed",{"es.operation":"scim.group.patch","es.outcome":"failure",validationIssues:v.issues}),k(400,`Request validation failed: ${v.issues.map((S)=>S.message).join("; ")}`,"invalidValue");let y=Q1(R),Y=w?j1(w.entity):s1(R),O=X1($1(D.members,y,_,Y),$1(R.members,y,_,Y)),T;await k5(r,async()=>{if(!w)T=await Z9(x,R,_)},O,w?void 0:()=>J9(X,T,y));let b=await O5(x,Q,W,y,_);return H5(E5(w?.entity??T,y,b))},j=async(M)=>{let _=await _1(x,Q,W,M);if(!_)return k(404,`Group ${M} not found`,"invalidValue");if(n(M))return e(M,"deleted");if(await U(M))return h(M,"deleted");let D=Q1(_);if(Q){let E=await Q.listByTarget(D,M),P=[];for(let w of E.items)await E1(r,w,P);await K9(r,P)}return await F4(x,M),new Response(null,{status:204})};S5={handler:V}}let L5;if(p.userStore){let{userStore:x,inboundUsers:U}=p,h=(Y)=>Y?.find((O)=>O.primary)?.value||Y?.[0]?.value,n=(Y)=>{if(Y.scimName)return Y.scimName;if(!Y.name)return;let[O,...T]=Y.name.split(" ");return{givenName:O,familyName:T.join(" ")||void 0}},e=(Y)=>Object.keys(Y.scimSchemaExtensions??{}).filter((O)=>O.startsWith("urn:")&&Y.scimSchemaExtensions?.[O]!==void 0),t=(Y)=>{let O={};if(Y.ecid!==void 0)O.ecid=Y.ecid;if(Y.accountClass!==void 0)O.accountClass=Y.accountClass;return O.ecid!==void 0||O.accountClass!==void 0?O:void 0},V=(Y)=>{let O=new Set([P1]);if(Y.scimEnterprise!==void 0)O.add(h5);if(t(Y)!==void 0)O.add(I5);for(let T of e(Y))O.add(T);return Array.from(O)},A=(Y)=>{let O={};if(Y.scimEnterprise!==void 0)O[h5]=Y.scimEnterprise;let T=t(Y);if(T!==void 0)O[I5]=T;for(let[b,S]of Object.entries(Y.scimSchemaExtensions??{}))if(b.startsWith("urn:")&&b!==I5&&S!==void 0)O[b]=S;return O},K=(Y)=>{let O=Y.userName||Y.email||Y.id||"",T=Y.emails??(Y.email?[{value:Y.email,primary:!0}]:[]);return{schemas:V(Y),id:Y.id,externalId:Y.externalId,userName:O,displayName:Y.displayName??Y.name??O,name:n(Y),nickName:Y.nickName,profileUrl:Y.avatar,title:Y.title,userType:Y.userType,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active??!0,emails:T,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,meta:{resourceType:"User",created:(Y.createdAt??Y.updatedAt??new Date).toISOString(),lastModified:(Y.updatedAt??Y.createdAt??new Date).toISOString()},...A(Y)}},H=async(Y)=>{if(U?.mapBaseUserToScim)return await U.mapBaseUserToScim(Y);return K(Y)},N=async(Y,O)=>{if(U?.mapValidatedScimToBaseUser)return await U.mapValidatedScimToBaseUser(Y,O);let T=new Date,b=h(Y.emails),S=Y.name?.formatted||[Y.name?.givenName,Y.name?.middleName,Y.name?.familyName].filter(Boolean).join(" ").trim()||Y.displayName,C=Y.id||O.existing?.id||u9(),g=Y.userName||b||O.existing?.userName||C,d=S||Y.displayName||O.existing?.name||g,a=Object.fromEntries(Object.entries(Y).filter(([P5,v5])=>P5.startsWith("urn:")&&P5!==h5&&P5!==I5&&v5!==void 0)),Z5=Y[I5],t5=Z5?.ecid!==void 0&&Z5.ecid!==null?A1(Z5.ecid):O.existing?.ecid,z5=Z5?.accountClass??O.existing?.accountClass,o=O.existing?.sso;return{...O.existing??{},id:C,userName:g,name:d,email:b||O.existing?.email||g,avatar:Y.profileUrl,sso:{...o??{},profile:{...o?.profile??{},sub:C,iss:o?.profile.iss??"iam-provisioned",aud:o?.profile.aud??"iam-provisioned",exp:o?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:o?.profile.iat??Math.floor(Date.now()/1000),email:b||O.existing?.email||g,email_verified:!0,name:d,preferred_username:g},tenant:o?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:o?.scope??"openid profile email",tokenType:o?.tokenType??"Bearer",expires:o?.expires??new Date(Date.now()+3600000)},externalId:Y.externalId,ecid:t5,accountClass:z5,displayName:Y.displayName,scimName:Y.name,emails:Y.emails,nickName:Y.nickName,title:Y.title,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,scimEnterprise:Y[h5],scimSchemaExtensions:Object.keys(a).length>0?a:void 0,createdAt:O.existing?.createdAt??(Y.meta?.created?new Date(Y.meta.created):T),updatedAt:Y.meta?.lastModified?new Date(Y.meta.lastModified):T,userType:Y.userType}},z=(Y,O,T)=>{Y[O]=T},j=(Y,O,T)=>{let b=Y[O];if(Array.isArray(b)){Y[O]=[...b,...Array.isArray(T)?T:[T]];return}if(b&&typeof b==="object"&&!Array.isArray(b)&&T&&typeof T==="object"&&!Array.isArray(T)){Y[O]={...b,...T};return}Y[O]=T},M=(Y,O,T)=>{let b=O.match(/^(urn:.*:(?:User|Group))(?::(.+))?$/),S=b?[b[1],...b[2]?.split(":")??[]]:O.split("."),C=Y;for(let d of S.slice(0,-1)){let a=C[d];if(a===void 0){if(!T)return null;C[d]={}}else if(a===null||typeof a!=="object"||Array.isArray(a)){if(!T)return null;C[d]={}}C=C[d]}let g=S.at(-1);if(!g)return null;return{parent:C,key:g}},_=(Y,O)=>{let T=O.op.toLowerCase();if(!O.path){if(T!=="remove"&&O.value&&typeof O.value==="object"&&!Array.isArray(O.value))Object.assign(Y,O.value);return}let b=O.path.match(/^([A-Za-z0-9]+)\[value eq "([^"]+)"\]$/);if(b&&T==="remove"){let[,C,g]=b,d=Y[C];if(Array.isArray(d))Y[C]=d.filter((a)=>!(a&&typeof a==="object"&&("value"in a)&&a.value===g));return}let S=M(Y,O.path,T!=="remove");if(!S)return;if(T==="remove"){delete S.parent[S.key];return}if(T==="add"){j(S.parent,S.key,O.value);return}z(S.parent,S.key,O.value)},D=async(Y,O)=>{if(!await $5(Y))return k(401,"Authorization required");let b=new URL(Y.url),S=O?.basePath??"/Users",C=b.pathname;if(C.startsWith(S))C=C.substring(S.length);let d=C.match(/^\/([^/]+)$/)?.[1],a=Y.method;try{if(d)switch(a){case"GET":return await P(d);case"PUT":return await R(Y,d);case"PATCH":return await v(Y,d);case"DELETE":return await y(d);default:return k(405,"Method not allowed")}else if(C===""||C==="/")switch(a){case"GET":return await E(Y);case"POST":return await q(Y);default:return k(405,"Method not allowed")}return k(404,"Resource not found")}catch(Z5){if(Z5 instanceof a5)return h9(Z5);if($9(Z5))return k(409,Z5.message,"uniqueness");return Z.error("Users inbound handler error",{"es.operation":"scim.users.handler","es.outcome":"failure"},Z5),k(500,Z5 instanceof Error?Z5.message:"Internal server error")}},E=async(Y)=>{let O=new URL(Y.url),T=O.searchParams.get("startIndex"),b=O.searchParams.get("count"),S=T!=null?parseInt(T,10):void 0,C=b!=null?parseInt(b,10):void 0,g=S!=null&&!Number.isNaN(S)?Math.max(0,S-1):0,d=C!=null&&!Number.isNaN(C)?C:void 0,a=p9(O.searchParams.get("filter"));if(a!==void 0){let z5=await x.lookup({externalId:a}),o=z5?[await H(z5)]:[];return d5(o,{totalResults:o.length,startIndex:1,itemsPerPage:o.length})}let Z5=await x.list({start:g,limit:d}),t5=await Promise.all(Z5.items.map((z5)=>H(z5)));return d5(t5,{totalResults:Z5.total,startIndex:g+1,itemsPerPage:Z5.count})},P=async(Y)=>{let O=await x.get(Y);if(!O)return k(404,`User ${Y} not found`,"invalidValue");return H5(await H(O))},w=async(Y,O)=>{let T=r.accessIndex;if(!T?.setSubjectDisabled||!O.id)return;let b=Y?Y.active??!0:!0,S=O.active??!0;if(Y&&b===S)return;if(!Y&&S)return;await T.setSubjectDisabled(O.id,"user",!S)},q=async(Y)=>{let O=await Y.json(),T=await n5(J.user,O);if(T.issues)return Z.error("User creation validation failed",{"es.operation":"scim.user.create","es.outcome":"failure",validationIssues:T.issues}),k(400,`Request validation failed: ${T.issues.map((C)=>C.message).join("; ")}`,"invalidValue");let b=T.value;if(!b.userName&&!b.emails?.[0]?.value)return k(400,"userName or email is required","invalidValue");let S=await N(b,{mode:"create"});return await k5(r,async()=>{await x.upsert(S),await w(void 0,S)},r1(void 0,S),async()=>{await e1(X,S)}),H5(await H(S),201)},R=async(Y,O)=>{let T=await x.get(O);if(!T)return k(404,`User ${O} not found`,"invalidValue");let b=await Y.json(),S=await n5(J.user,b);if(S.issues)return Z.error("User replacement validation failed",{"es.operation":"scim.user.replace","es.outcome":"failure",validationIssues:S.issues}),k(400,`Request validation failed: ${S.issues.map((d)=>d.message).join("; ")}`,"invalidValue");let C=S.value,g=await N({...C,id:O},{existing:T,mode:"replace"});return g.createdAt=T.createdAt,g.updatedAt=new Date,await k5(r,async()=>{await x.upsert(g),await w(T,g)},r1(T,g),async()=>{await e1(X,g)}),H5(await H(g))},v=async(Y,O)=>{let T=await x.get(O);if(!T)return k(404,`User ${O} not found`,"invalidValue");let S=(await Y.json()).Operations??[],g={...await H(T)};for(let Z5 of S)_(g,Z5);let d=await n5(J.user,g);if(d.issues)return Z.error("User patch validation failed",{"es.operation":"scim.user.patch","es.outcome":"failure",validationIssues:d.issues}),k(400,`Request validation failed: ${d.issues.map((Z5)=>Z5.message).join("; ")}`,"invalidValue");let a=await N(d.value,{existing:T,mode:"patch"});return a.updatedAt=new Date,await k5(r,async()=>{await x.upsert(a),await w(T,a)},r1(T,a),async()=>{await e1(X,a)}),H5(await H(a))},y=async(Y)=>{if(!await x.get(Y))return k(404,`User ${Y} not found`,"invalidValue");if(Q){let T=await Q.listBySubject(Y,"user"),b=[];for(let S of T.items)await E1(r,S,b);await K9(r,b)}if(await x.delete(Y),await r.accessIndex?.setSubjectDisabled?.(Y,"user",!1),r.authz.oaa.isReady())await F9(r,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>r.authz.oaa.deleteUser(Y),{id:Y,kind:"user"});return new Response(null,{status:204})};L5={handler:D}}async function M5(x,U){s();let h=new URL(x.url).pathname,n=f5(U?.usersUrl??p.usersUrl??"/api/iam/Users")??"/api/iam/Users",e=f5(U?.groupsUrl??p.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",t=await p5(x,U);if(t)return t;let V=(A)=>h===A||h.startsWith(`${A}/`);if(V(n)){if(!c)return k(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!L5)return k(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return L5.handler(x,{basePath:n})}if(V(e)){if(!l)return k(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!S5)return k(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return S5.handler(x,{basePath:e})}return k(404,"Resource not found")}return{...p,createUser:u5,getBaseUrl:i5,groups_outbound:N5,groups_inbound:S5,users_inbound:L5,handler:M5,delta:u}}function V9(J,Z){let $=new TextEncoder().encode(J),X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Q=new Uint8Array($.length+1+X.length);return Q.set($,0),Q[$.length]=46,Q.set(X,$.length+1),Q}function z4(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.length%4===0?"":"=".repeat(4-Z.length%4),X=atob(Z+$),Q=new Uint8Array(X.length);for(let G=0;G<X.length;G++)Q[G]=X.charCodeAt(G);return Q}function P4(J){let Z="";for(let $ of J)Z+=String.fromCharCode($);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function c9(J){let Z=JSON.parse(J);if(!Z||typeof Z!=="object"||!Array.isArray(Z.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return Z}function O4(J){return JSON.stringify(J)}async function E4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x},{name:"Ed25519"},!0,["verify"])}async function j4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x,d:J.d},{name:"Ed25519"},!0,["sign"])}async function A4(J){let $=(typeof J.jwks==="string"?c9(J.jwks):J.jwks).keys.find((X)=>X.kid===J.kid&&X.kty==="OKP"&&X.crv==="Ed25519");if(!$?.x)return!1;try{let X=await E4($),Q=V9(J.requestId,J.rawBody),G=z4(J.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},X,G,Q)}catch{return!1}}async function w4(J){let Z=await j4(J.privateKeyJwk),$=V9(J.requestId,J.rawBody),X=await crypto.subtle.sign({name:"Ed25519"},Z,$);return P4(new Uint8Array(X))}async function I4(J){let Z=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),$=await crypto.subtle.exportKey("jwk",Z.privateKey),Q=(await crypto.subtle.exportKey("jwk",Z.publicKey)).x,G=$.d;if(!Q||!G)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:Q,d:G,kid:J,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:Q,kid:J,alg:"EdDSA",use:"sig"}]}}}var L1={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function I1(J,Z){if(typeof J!=="number"||!Number.isFinite(J))return Z.default;let $=Math.floor(J);if($<Z.min)return Z.min;if($>Z.max)return Z.max;return $}function d9(J){return{ttlMs:I1(J?.ttlSeconds,L1.jwksTtlSeconds)*1000,maxEntries:I1(J?.maxEntries,L1.jwksMaxEntries)}}function n9(J){let Z=J?.read;return{read:{enabled:Z?.enabled===!0,ttlMs:I1(Z?.ttlSeconds,L1.sessionReadTtlSeconds)*1000,maxEntries:I1(Z?.maxEntries,L1.sessionReadMaxEntries)}}}function T4(J){return{jwks:d9(J?.jwks),session:n9(J?.session)}}function S4(J){let Z={};if(!J)return Z;let $=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let G=Q.indexOf("=");if(G===-1)continue;Z[Q.slice(0,G).trim()]=Q.slice(G+1).trim()}return Z}function a9(J){if(!J.expiresAt)return!1;let Z=J.expiresAt instanceof Date?J.expiresAt:new Date(J.expiresAt);return!Number.isNaN(Z.getTime())&&Date.now()>Z.getTime()}function R4(J){if(!J||typeof J!=="object"||Array.isArray(J))return;let{access_token:Z,id_token:$,refresh_token:X,tokens:Q,...G}=J;return G}function _5(J,Z){let $=J[Z];return typeof $==="string"?$:""}function x4(J,Z){let $=J.exp;if(typeof $==="number")return new Date($*1000);if(typeof $==="string"&&$.trim()){let X=Number($);if(!Number.isNaN(X))return new Date(X*1000)}if(Z instanceof Date)return Z;if(Z){let X=new Date(Z);if(!Number.isNaN(X.getTime()))return X}return new Date}function y4(J){let Z=J.claims;if(!Z?.sub||typeof Z.sub!=="string")return;let $=x4(Z,J.expiresAt);if(J.authType==="sso")return{id:Z.sub,userName:_5(Z,"preferred_username"),name:_5(Z,"name"),email:_5(Z,"email"),avatar:_5(Z,"picture")||void 0,sso:{profile:Z,tenant:{id:_5(Z,"idp")||_5(Z,"iss"),name:_5(Z,"iss")},tokenType:"Bearer",expires:$}};return{id:Z.sub,userName:_5(Z,"preferred_username"),name:_5(Z,"name"),email:_5(Z,"email"),avatar:_5(Z,"picture")||void 0,userType:"customer",ciam:{profile:Z,scope:"openid profile email",tokenType:"Bearer",expires:$}}}function b4(J){if(J.authType!=="sso"&&J.authType!=="ciam")return;if(a9(J))return;return{sid:J.sid,authType:J.authType,tenantId:typeof J.tenantId==="string"?J.tenantId:void 0,sub:J.sub,expiresAt:J.expiresAt,createdAt:J.createdAt,claims:R4(J.claims)}}function q4(J,Z){if(!J.endsWith(".session"))return!1;if(!Z||Z.length===0)return!0;return Z.some(($)=>J===`${$}.session`)}function C4(J){if(J===void 0)return;let Z=(Array.isArray(J)?J:[J]).map(($)=>$.trim()).filter(($)=>$.length>0);return Z.length>0?Z:void 0}async function i9(J,Z,$){return(await t9(J,Z,$)).map(b4).filter((Q)=>Boolean(Q))}async function t9(J,Z,$){let X=S4(J.headers.get("cookie")),Q=C4($?.cookiesPrefix),G=[],F=new Set;for(let[B,W]of Object.entries(X)){if(!q4(B,Q)||!W)continue;if(F.has(W))continue;F.add(W);let L=await Z.get(W);if(!L)continue;if(L.authType!=="sso"&&L.authType!=="ciam")continue;if(a9(L))continue;G.push(L)}return G}async function v4(J,Z,$){return(await i9(J,Z,$)).map(y4).filter((Q)=>Boolean(Q))}var U4="@enterprisestandard/core",k4=c5(D1(U4));async function f4(J,Z){let $=await R5({idToken:J,jwksUri:Z.jwksUri,issuer:Z.issuer,audience:Z.audience}),X=await k4.validate($);if(X.issues)throw Error(`ID token claims validation failed: ${X.issues.map((F)=>F.message).join("; ")}`);let Q=X.value;if(Q===void 0)throw Error("ID token claims missing");return o9(Q)}function K5(J){return Date.now()-J}function N9(J){if(J instanceof Error)return{"error.name":J.name,"error.message":J.message};return{"error.name":typeof J,"error.message":String(J)}}function T1(J,Z){if(!J)return{};try{let $=new URL(J);return{[`${Z}.origin`]:$.origin,[`${Z}.path`]:$.pathname}}catch{return{[`${Z}.path`]:J.startsWith("/")?J:`/${J}`}}}function S1(J,Z=5){if(!Array.isArray(J))return[String(J)];return J.slice(0,Z).map(($)=>{if(!$||typeof $!=="object")return String($);let X=$,Q=Array.isArray(X.path)?X.path.join("."):String(X.path??""),G=typeof X.message==="string"?X.message:String(X.message??"validation failed");return Q?`${Q}: ${G}`:G})}function h4(J){if(!J||typeof J!=="object")return{};let Z=J;return{oidc_error:typeof Z.error==="string"?Z.error:void 0,oidc_error_description:typeof Z.error_description==="string"?Z.error_description:void 0,oidc_error_uri:typeof Z.error_uri==="string"?Z.error_uri:void 0}}function g4(J,Z={}){let $=typeof J==="string"?J:J?.headers.get("cookie")??void 0;if(!$)return[];let Q=`${Z.cookiePrefix??"es.sso"}.`,G=new Set;for(let F of Object.keys(p4($))){if(!F.startsWith(Q))continue;let B=F.slice(Q.length),W=B.lastIndexOf(".");if(W<=0)continue;let L=B.slice(0,W).trim();if(L)G.add(L)}return Array.from(G)}function m4(J,Z,$,X,Q){if(!$&&!X)return;let G=new WeakMap,F=new Map,B={...$,...X},W=!!(B.authority&&B.tokenUrl&&B.authorizationUrl&&B.clientId&&B.redirectUri&&B.scope),L={...B,authority:W?m(B.authority,"Missing 'authority' from SSO Config"):B.authority,tokenUrl:W?m(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"):B.tokenUrl,authorizationUrl:W?m(B.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):B.authorizationUrl,clientId:W?m(B.clientId,"Missing 'clientId' from SSO Config"):B.clientId,redirectUri:W?m(B.redirectUri,"Missing 'redirectUri' from SSO Config"):B.redirectUri,scope:W?m(B.scope,"Missing 'scope' from SSO Config"):B.scope,responseType:B.responseType??"code",cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.clientId?`es.sso.${B.clientId}`:"es.sso"),cookiesPath:B.cookiesPath??"/"},f=Math.min(600,Math.max(0,Math.floor(Number(L.rotationGraceSeconds??60))||0))*1000;function u(){let V=[];if(!L.authority)V.push("authority");if(!L.tokenUrl)V.push("tokenUrl");if(!L.authorizationUrl)V.push("authorizationUrl");if(!L.clientId)V.push("clientId");if(!L.redirectUri)V.push("redirectUri");if(!L.scope)V.push("scope");if(V.length>0)throw Error(`Missing OIDC configuration fields: ${V.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function i(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A=G.get(V);if(A)return A;let K=J5(V);return G.set(V,K),K}async function J5(V){try{let{tokens:A,session:K,refreshedUser:H}=await M5(V);if(!A)return{status:"unauthenticated"};if(H)return{status:"authenticated",value:H};if(K?.claims)return{status:"authenticated",value:$5(K.claims,A,N5(K.expiresAt))};return{status:"unauthenticated"}}catch(A){if(r9(A))return{status:"unauthenticated"};return Z.error("Error parsing user from cookies",{"es.operation":"cookie.parse","es.outcome":"degraded"},A),{status:"degraded",error:A instanceof Error?A:void 0}}}async function r(V){let A=await i(V);return A.status==="authenticated"?A.value:void 0}async function G5(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let A=m(L.redirectUri,"Missing 'redirectUri' from SSO Config"),K=m(L.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),H=m(L.clientId,"Missing 'clientId' from SSO Config"),N=m(L.scope,"Missing 'scope' from SSO Config"),z=L.cookiesSecure?V.url.replace(/^http:\/\//,"https://"):V.url,j=D5(),M=D5(64),_=D5(),D=A;try{new URL(D)}catch{if(z)try{let R=new URL(z),v=D.startsWith("//")?D.slice(1):D.startsWith("/")?D:`/${D}`;D=new URL(v,R.origin).toString()}catch{try{let R=new URL(K),v=D.startsWith("//")?D.slice(1):D.startsWith("/")?D:`/${D}`;D=new URL(v,R.origin).toString()}catch{throw Error(`Invalid redirectUri: "${A}". It must be a valid absolute URL.`)}}}let E=new URL(K);E.searchParams.append("client_id",H),E.searchParams.append("redirect_uri",D),E.searchParams.append("response_type","code"),E.searchParams.append("scope",N),E.searchParams.append("state",j),E.searchParams.append("nonce",_);let P=await J1(M);E.searchParams.append("code_challenge",P),E.searchParams.append("code_challenge_method","S256");let w=await L.beforeLogin?.({request:V}),q=w===void 0?{state:j,codeVerifier:M,nonce:_}:{state:j,codeVerifier:M,nonce:_,context:w};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:E.toString(),"Set-Cookie":U(e(j),q,L.loginStateTtl??600,"Lax")}})}async function p(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A;try{A=await r(V)}catch{A=void 0}let K=await L.beforeLogout?.({request:V,user:A}),H=n("session",V),N;try{N=await M5(V);let P=N.tokens?.refresh_token??n("refresh",V);if(P)await g5(P)}catch(P){Z.warn("Failed to revoke token",{"es.operation":"token.revoke","es.outcome":"degraded"},P)}if(L.sessionStore)try{let P=N?.sid??H;if(P)await L.sessionStore.delete(P)}catch(P){Z.warn("Failed to delete session",{"es.operation":"session.delete","es.outcome":"degraded"},P)}let z=[["Set-Cookie",h("session")]],j=await L.afterLogout?.({request:V,context:K}),M=x5(j,"/",V.url);if(M.response){let P=new Headers(M.response.headers);for(let[,w]of z)P.append("Set-Cookie",w);return new Response(M.response.body,{status:M.response.status,statusText:M.response.statusText,headers:P})}let _=M.location??"/",D=V.headers.get("accept");if(D?.includes("application/json")||D?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...z]});return new Response("Logged out",{status:302,headers:[["Location",_],...z]})}async function c(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(!L.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!V.headers.get("content-type")?.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let K=await V.text(),N=new URLSearchParams(K).get("logout_token");if(!N)return new Response("Missing logout_token parameter",{status:400});let z=m(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),j=m(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),M=L.jwksUri||`${z}/protocol/openid-connect/certs`,_=await d1({logoutToken:N,jwksUri:M,issuer:z,audience:j,log:Z}),D=typeof _.sid==="string"?_.sid:void 0;if(!D)return Z.warn("Back-Channel Logout: logout_token missing sid claim",{"es.operation":"backchannel_logout","es.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await L.sessionStore.delete(D),Z.info("Back-Channel Logout: successfully deleted session",{"es.module":"sso",sid:D}),new Response("OK",{status:200})}catch(A){return Z.error("Error during back-channel logout",{"es.operation":"backchannel_logout","es.outcome":"failure"},A),new Response("Internal Server Error",{status:500})}}async function l(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A=Date.now(),K=new URL(V.url),H=new URLSearchParams(K.search);Z.debug("SSO callback received",{"es.event":"es.sso.callback.received","es.module":"sso","es.operation":"sign_in.callback","http.method":V.method,"url.path":K.pathname,hasCode:H.has("code"),hasState:H.has("state"),hasError:H.has("error"),...T1(H.get("iss")??void 0,"oidc.issuer")});let N=Object.fromEntries(H.entries()),z=await J.callbackParams.validate(N);if(z.issues)return Z.warn("SSO callback parameter validation failed",{"es.event":"es.sso.callback.validation_failed","es.operation":"sign_in.callback","es.outcome":"failure","validation.issues":S1(z.issues)}),s9(z.issues,"OIDC callback parameters validation failed");let{code:j,state:M}=z.value,_;try{let D=m(M,'OIDC "state" was not present in the callback parameters'),E=n(e(D),V,!0),{codeVerifier:P,state:w,nonce:q,context:R}=E??{};_=R,Z.debug("SSO callback state cookie read",{"es.event":"es.sso.callback.state_cookie_read","es.module":"sso","es.operation":"sign_in.callback",hasStateCookie:Boolean(E),hasCodeVerifier:Boolean(P),hasStateVerifier:Boolean(w),hasNonce:Boolean(q),hasContext:R!==void 0});let v=m(P,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');m(w,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let y=m(q,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),Y=m(j,'OIDC "code" was not present in the callback parameters');if(M!==w)throw Z.warn("SSO callback state verification failed",{"es.event":"es.sso.callback.state_verification_failed","es.operation":"sign_in.callback","es.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');Z.debug("SSO callback state verified",{"es.event":"es.sso.callback.state_verified","es.module":"sso","es.operation":"sign_in.callback"});let O=L.cookiesSecure?V.url.replace(/^http:\/\//,"https://"):V.url,T=await q5(Y,v,O),{tokenExpiresAt:b,sessionExpiresAt:S}=B5(T);T.expires=b.toISOString();let C=Date.now();Z.debug("SSO ID token parsing started",{"es.event":"es.sso.id_token.parse_started","es.module":"sso","es.operation":"id_token.parse"});let g=await s(T,y,S);Z.debug("SSO ID token parsing completed",{"es.event":"es.sso.id_token.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":K5(C),"user.id":g.id});let d,a;{let o=T5("SSO requires sessionStore configuration for opaque session cookies."),P5=typeof g.sso.profile.sid==="string"?g.sso.profile.sid:void 0,v5=P5||D5(32),F5=g.id;if(Z.debug("SSO session creation evaluated",{"es.event":"es.sso.session.create_evaluated","es.module":"sso","es.operation":"session.create",hasSid:Boolean(v5),hasIdpSid:Boolean(P5),hasSub:Boolean(F5),"user.id":F5}),!F5)throw Error("Session creation failed: missing sub in ID token claims");let x1=Date.now(),F1={sid:v5,sub:F5,idpSid:P5,authType:"sso",tenantId:L.tenantId,tokens:T,claims:g.sso.profile,expiresAt:S,createdAt:new Date};await p5(o,F1),a=F1,d=["Set-Cookie",U("session",v5,S)],Z.info("SSO session created",{"es.event":"es.sso.session.created","es.operation":"session.create","es.outcome":"success","duration.ms":K5(x1),"user.id":F5})}if(L.userStore)try{let o=g.id;if(o){let P5=new Date,v5=Date.now();Z.debug("SSO user store lookup started",{"es.event":"es.sso.user.lookup_started","es.module":"sso","es.operation":"user.lookup","user.id":o});let F5=await L.userStore.get(o);if(Z.debug("SSO user store lookup completed",{"es.event":"es.sso.user.lookup_completed","es.module":"sso","es.operation":"user.lookup","duration.ms":K5(v5),"user.id":o,found:Boolean(F5)}),F5||L.enableJitUserProvisioning){let x1=Date.now(),F1={...F5??{},...g,id:o,tenantId:F5?.tenantId,createdAt:F5?.createdAt??P5,updatedAt:P5};await L.userStore.upsert(F1),Z.info("SSO user stored",{"es.event":"es.sso.user.stored","es.operation":"user.store","es.outcome":"success","duration.ms":K5(x1),"user.id":o,existing:Boolean(F5),jitProvisioning:Boolean(L.enableJitUserProvisioning)})}else Z.warn("JIT user provisioning disabled: user not found in store and will not be created",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped","user.id":o})}else Z.warn("User storage skipped: missing sub in ID token claims",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped"})}catch(o){Z.warn("Failed to store user",{"es.event":"es.sso.user.store_failed","es.operation":"user.store","es.outcome":"degraded",...N9(o)})}Z.info("SSO sign-in succeeded",{"es.event":"es.sso.sign_in.succeeded","es.operation":"sign_in.callback","es.outcome":"success","duration.ms":K5(A),"user.id":g.id});let Z5=[["Set-Cookie",h(e(D))],...d?[d]:[]],t5=await L.afterLogin?.({ok:!0,request:V,user:g,session:a,context:_}),z5=x5(t5,"/",V.url);if(z5.response)return U5(z5.response,Z5.map(([,o])=>o));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",z5.location],...Z5]})}catch(D){Z.error("Error during sign-in callback",{"es.event":"es.sso.sign_in.callback_failed","es.operation":"sign_in.callback","es.outcome":"failure","duration.ms":K5(A),...N9(D)});let E=M?[["Set-Cookie",h(e(M))]]:[],P=await L.afterLogin?.({ok:!1,request:V,error:D,context:_}),w=x5(P,"/",V.url);if(w.response)return U5(w.response,E.map(([,q])=>q));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",w.location],...E]})}}function B5(V){let A=Date.now(),K=Number(V.expires_in??3600)||3600,H=new Date(A+K*1000),N;if(V.refresh_expires_in!=null&&Number.isFinite(Number(V.refresh_expires_in)))N=Number(V.refresh_expires_in);else if(V.refresh_token)N=86400;else N=K;return{tokenExpiresAt:H,sessionExpiresAt:new Date(A+N*1000)}}async function s(V,A,K){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let H=Date.now(),N=await C5(V.id_token,A);return Z.debug("SSO user parsed from ID token",{"es.event":"es.sso.user.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":K5(H),"user.id":N.sub,hasEmail:Boolean(N.email),hasName:Boolean(N.name)}),$5(N,V,K)}function $5(V,A,K){let H=K??B5(A).sessionExpiresAt,N=V.ecid!==void 0&&V.ecid!==null?A1(V.ecid):void 0;return{id:V.sub,userName:V.preferred_username||"",name:V.name||"",email:V.email||"",emails:[{value:V.email||"",primary:!0}],...N?{ecid:N}:{},avatar:V.picture,sso:{profile:{...V},tenant:{id:V.idp||V.iss||"",name:V.iss||""},scope:A.scope,tokenType:A.token_type,sessionState:A.session_state,expires:H}}}async function j5(V){if(!L.userStore)return V;let A=await L.userStore.lookup(V);if(!A)return V;return{...V,...A,id:V.id,sso:V.sso}}async function q5(V,A,K){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let H=m(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),N=m(L.redirectUri,"Missing 'redirectUri' from SSO Config"),z=m(L.clientId,"Missing 'clientId' from SSO Config"),j=N;try{new URL(j)}catch{if(K)try{let _=new URL(K),D=j.startsWith("//")?j.slice(1):j.startsWith("/")?j:`/${j}`;j=new URL(D,_.origin).toString()}catch{try{let _=new URL(H),D=j.startsWith("//")?j.slice(1):j.startsWith("/")?j:`/${j}`;j=new URL(D,_.origin).toString()}catch{throw Error(`Invalid redirectUri: "${N}". It must be a valid absolute URL.`)}}}let M=new URLSearchParams;if(M.append("grant_type","authorization_code"),M.append("code",V),M.append("redirect_uri",j),M.append("client_id",z),L.clientSecret)M.append("client_secret",L.clientSecret);M.append("code_verifier",A);try{let _=Date.now();Z.debug("SSO token exchange started",{"es.event":"es.sso.token.exchange_started","es.module":"sso","es.operation":"token.exchange",...T1(H,"oidc.token_url"),...T1(j,"oidc.redirect_uri"),hasClientSecret:Boolean(L.clientSecret)});let D=await fetch(H,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:M.toString()});Z.debug("SSO token exchange response received",{"es.event":"es.sso.token.response_received","es.module":"sso","es.operation":"token.exchange","http.status_code":D.status,"duration.ms":K5(_)}),Z.debug("SSO token exchange response body read started",{"es.event":"es.sso.token.response_body_read_started","es.module":"sso","es.operation":"token.exchange"});let E=await D.json();if(Z.debug("SSO token exchange response body read completed",{"es.event":"es.sso.token.response_body_read_completed","es.module":"sso","es.operation":"token.exchange","duration.ms":K5(_)}),!D.ok){Z.error("Token exchange error",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure","http.status_code":D.status,"duration.ms":K5(_),...h4(E)});let w=E;throw Error(`Token exchange failed: ${w.error||D.statusText} - ${w.error_description||""}`.trim())}let P=await J.tokenResponse.validate(E);if(P.issues)throw Z.error("Token response validation failed",{"es.event":"es.sso.token.response_validation_failed","es.operation":"token.exchange","es.outcome":"failure","duration.ms":K5(_),"validation.issues":S1(P.issues)}),Error(`Token response validation failed: ${P.issues}`);return Z.debug("SSO token exchange completed",{"es.event":"es.sso.token.exchange_completed","es.module":"sso","es.operation":"token.exchange","es.outcome":"success","duration.ms":K5(_),tokenType:P.value.token_type,hasAccessToken:Boolean(P.value.access_token),hasIdToken:Boolean(P.value.id_token),hasRefreshToken:Boolean(P.value.refresh_token),expiresIn:P.value.expires_in}),P.value}catch(_){throw Z.error("Error during token exchange",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure",...N9(_)}),_}}async function i5(V){return g1(async()=>{if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let A=m(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),K=m(L.clientId,"Missing 'clientId' from SSO Config"),H=new URLSearchParams;H.append("grant_type","refresh_token"),H.append("refresh_token",V),H.append("client_id",K);let N=await fetch(A,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:H.toString()}),z=await N.json();if(!N.ok){Z.error("Token refresh error",{"es.operation":"token.refresh","es.outcome":"failure",response:z});let M=z;throw Error(`Token refresh failed: ${M.error||N.statusText} - ${M.error_description||""}`.trim())}let j=await J.tokenResponse.validate(z);if(j.issues)throw Z.error("Token refresh response validation failed",{"es.event":"es.sso.token.refresh_validation_failed","es.operation":"token.refresh","es.outcome":"failure","validation.issues":S1(j.issues)}),Error(`Token refresh response validation failed: ${j.issues}`);return j.value},void 0,void 0,void 0,Z)}async function g5(V){try{if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(!L.revocationEndpoint)return;let A=m(L.clientId,"Missing 'clientId' from SSO Config"),K=new URLSearchParams;K.append("token",V),K.append("token_type_hint","refresh_token"),K.append("client_id",A);let H=await fetch(L.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:K.toString()});if(!H.ok)Z.warn("Token revocation failed",{"es.operation":"token.revoke","es.outcome":"degraded",status:H.status,statusText:H.statusText});else Z.info("Token revoked successfully",{"es.module":"sso"})}catch(A){Z.warn("Error revoking token",{"es.operation":"token.revoke","es.outcome":"degraded"},A)}}async function m5(){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let V=L.authority;if(!L.jwksUri&&!V)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let A=L.jwksUri||`${V}/protocol/openid-connect/certs`;return r5(A,Z)}async function C5(V,A){let K=Date.now(),H=m(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),N=m(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),z=L.jwksUri||`${H}/protocol/openid-connect/certs`;Z.debug("SSO ID token verification started",{"es.event":"es.sso.id_token.verify_started","es.module":"sso","es.operation":"id_token.verify",...T1(z,"oidc.jwks_uri")});let j;try{j=await R5({idToken:V,jwksUri:z,issuer:H,audience:N,expectedNonce:A,log:Z})}catch(_){throw Z.error("SSO ID token verification failed",{"es.event":"es.sso.id_token.verify_failed","es.module":"sso","es.operation":"id_token.verify","es.outcome":"failure","duration.ms":K5(K)},_),_}Z.debug("SSO ID token signature verified",{"es.event":"es.sso.id_token.signature_verified","es.module":"sso","es.operation":"id_token.verify","duration.ms":K5(K)});let M=await J.idTokenClaims.validate(j);if(M.issues)throw Z.error("ID token claims validation failed",{"es.event":"es.sso.id_token.validation_failed","es.operation":"id_token.validate","es.outcome":"failure","duration.ms":K5(K),"validation.issues":S1(M.issues)}),Error(`ID token claims validation failed: ${M.issues}`);return Z.debug("SSO ID token claims validated",{"es.event":"es.sso.id_token.claims_validated","es.module":"sso","es.operation":"id_token.validate","es.outcome":"success","duration.ms":K5(K),"user.id":M.value.sub,hasIssuer:Boolean(M.value.iss),hasAudience:Boolean(M.value.aud)}),M.value}function T5(V="SSO sessionStore is required for opaque session cookies."){if(!L.sessionStore)throw Error(V);return L.sessionStore}async function p5(V,A){try{await V.create(A)}catch(K){if(!await V.get(A.sid))throw K;await V.update(A.sid,A)}}function N5(V){if(!V)return;if(V instanceof Date)return V;let A=new Date(V);return Number.isNaN(A.getTime())?void 0:A}function u5(V){let A=V.tokens;if(!A?.access_token||!A.id_token||!A.token_type)return;return A}async function S5(V,A=!1){let K=T5(),H=n("session",V);if(!H)return{tokens:void 0,refreshHeaders:[]};let N=await K.get(H);if(N&&L.tenantId&&N.tenantId&&N.tenantId!==L.tenantId)return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};if(N?.authType!=="sso")return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};let z=u5(N);if(!z)return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};let j=N5(N.expiresAt);if(j?Date.now()>j.getTime():!1)return await K.delete(H),{tokens:void 0,sid:H,refreshHeaders:[["Set-Cookie",h("session")]]};let _=N5(z.expires),D=_?Date.now()>_.getTime():!0;if((A||D)&&z.refresh_token)return L5(H,N,z);return{tokens:z,sid:H,session:N,refreshHeaders:[]}}function L5(V,A,K){let H=F.get(V);if(H)return H;let N=T5(),z=(async()=>{let j=await i5(K.refresh_token),{tokenExpiresAt:M,sessionExpiresAt:_}=B5(j);j.expires=M.toISOString();let D=await s(j,void 0,_),E=D.sso.profile,P=D5(32),w={...A,sid:P,tokens:j,claims:E,expiresAt:_,createdAt:new Date};await p5(N,w);try{if(f<=0)await N.delete(V);else{let{refresh_token:q,...R}=K;await N.update(V,{tokens:R,expiresAt:new Date(Date.now()+f)})}}catch(q){Z.warn("Failed to retire rotated SSO session record",{"es.operation":"session.rotate","es.outcome":"degraded"},q)}return{tokens:j,sid:P,session:w,refreshedUser:D,refreshHeaders:[["Set-Cookie",U("session",P,_)]]}})();return F.set(V,z),z.finally(()=>{F.delete(V)})}async function M5(V,A=!1){return S5(V,A)}async function x(V){let{tokens:A}=await M5(V);if(!A)return;return A.access_token}function U(V,A,K,H=L.cookiesSameSite??"Strict"){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(V=`${L.cookiesPrefix}.${V}`,typeof A!=="string")A=btoa(JSON.stringify(A));let N;if(K instanceof Date)N=`Expires=${K.toUTCString()}`;else if(typeof K==="number")N=`Max-Age=${K}`;else throw Error("Invalid expires type",K);if(A.length>4000)throw Error(`Error setting cookie: ${V}. Cookie length is: ${A.length}`);return`${V}=${A}; ${N}; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${H};`}function h(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");return`${L.cookiesPrefix}.${V}=; Max-Age=0; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${L.cookiesSameSite};`}function n(V,A,K=!1){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let H=A.headers.get("cookie");if(!H)return null;let N=`${L.cookiesPrefix}.${V}`,z=H.split(";").find((D)=>D.trim().startsWith(`${N}=`));if(!z)return null;let j=z.indexOf("="),M=z.slice(j+1).trim();if(!K)return M;let _=atob(M);return JSON.parse(_)}function e(V){return`state_${V}`}async function t(V,A){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:K,userUrl:H,tokenUrl:N,refreshUrl:z,logoutUrl:j,logoutBackChannelUrl:M,jwksUrl:_,redirectUri:D}={...L,...A},E=new URL(V.url).pathname;if(D){let P;try{P=new URL(D).pathname}catch{try{let w=new URL(V.url),q=D.startsWith("//")?D.slice(1):D;P=new URL(q,w.origin).pathname}catch{P=D.startsWith("/")?D:`/${D}`}}if(P===E)return l(V)}if(K===E)return G5(V);if(H===E)try{let{tokens:P,session:w,refreshedUser:q,refreshHeaders:R}=await M5(V);if(!P)return new Response("User not logged in",{status:401,headers:R});let v=q??(w?.claims?$5(w.claims,P,N5(w.expiresAt)):void 0);if(!v)return new Response("User not logged in",{status:401,headers:R});let y=await j5(v);return new Response(JSON.stringify(y),{headers:[["Content-Type","application/json"],...R]})}catch(P){if(r9(P))return new Response("User not logged in",{status:401});return Z.error("Error resolving SSO user",{"es.operation":"sso.user","es.outcome":"degraded"},P),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(N===E){let{tokens:P,refreshHeaders:w}=await M5(V);if(!P)return new Response("User not logged in",{status:401,headers:w});return new Response(JSON.stringify({token:P.access_token,expires:P.expires}),{headers:[["Content-Type","application/json"],...w]})}if(z===E){let{tokens:P,refreshHeaders:w}=await M5(V,!0);if(!P)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:w})}if(j===E)return p(V);if(M===E)return c(V);if(_===E){let P=await m5();return new Response(JSON.stringify(P),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...L,getUser:r,resolveUser:i,getJwt:x,initiateLogin:G5,logout:p,logoutBackChannel:c,callbackHandler:l,handler:t}}function p4(J){let Z={},$=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let G=Q.indexOf("=");if(G===-1)continue;let F=Q.slice(0,G).trim(),B=Q.slice(G+1).trim();Z[F]=B}return Z}function r9(J){if(!(J instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((Z)=>J.message.includes(Z))}function e9(J){return J=J??"SSO Unavailable",new Response(JSON.stringify({error:J}),{status:503,statusText:J,headers:{"Content-Type":"application/json"}})}var R1="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function u4(J,Z){return m(Z,R1),Z.sso?.getUser(J)}async function l4(J,Z){return m(Z,R1),await Z.sso?.resolveUser(J)??{status:"unauthenticated"}}async function c4(J,Z){m(Z,R1);let $=Z.sso;if(!$)return e9();return $.initiateLogin(J)}async function d4(J,Z){m(Z,R1);let $=Z.sso;if(!$)return e9();return $.callbackHandler(J)}export{U5 as withSetCookies,G1 as withDefaultExternalId,f4 as verifyUser,d1 as verifyLogoutToken,A4 as verifyLfvSignature,R5 as verifyIdToken,O4 as stringifyLfvJwks,m4 as sso,w4 as signLfvPayload,z2 as setJwksRetry,_2 as setJwksClock,y2 as setDiscoveryClock,i4 as sendTenantWebhook,t1 as sameOriginRedirectRules,l4 as resolveUser,n9 as resolveSessionCacheConfig,o1 as resolveRedirect,C1 as resolveProviderBranding,d9 as resolveJwksCacheConfig,j2 as resolveJwkForKid,d2 as resolveCustomer,V1 as resolveCiamProvider,m2 as resolveCapturedRedirect,T4 as resolveCacheConfig,x5 as resolveAfterRedirect,W9 as reconcileSubjectAccess,J1 as pkceChallengeFromVerifier,c9 as parseLfvJwks,v1 as orderedEnabledProviders,e5 as normalizeOidcIssuer,g4 as listSsoClientIdsFromCookies,v9 as isRedirectAllowed,c4 as initiateLogin,_4 as iam,V2 as hasScope,G2 as hasRole,W2 as hasPermission,L2 as hasGroup,N2 as hasAnyScope,F2 as hasAny,M2 as hasAllScope,H2 as hasAll,B2 as has,p1 as getVerificationKeyForKid,u4 as getUser,A2 as getPublicKeyFromJwks,w2 as getPublicKeyForKid,q1 as getProviderPreset,r5 as getJwks,v4 as getDiscoveredSessionUsers,c2 as getCustomer,m1 as getCachedVerificationKey,I4 as generateLfvEd25519KeyPair,i1 as generateAppleClientSecret,a1 as fetchUserInfo,B9 as expandRoot,c1 as exchangeAuthorizationCode,i9 as discoverSessions,t9 as discoverSessionRecords,n1 as discoverOidcEndpoints,h2 as defaultRedirectPolicies,D2 as configureJwksCache,n4 as collectReferencedDefinitions,E2 as clearJwksCache,b2 as clearDiscoveryCache,l2 as ciam,g2 as captureRedirect,d4 as callback,V9 as buildLfvSigningInput,l1 as buildAuthorizationUrl,b9 as blockDangerousUrls,R9 as assertTrustedIdTokenClaims,C9 as allowSameOrigin,q9 as allowRelativePaths,k2 as allowOrigins,f2 as allowHosts,a4 as InMemoryTenantStore,Y9 as CatalogAdjacencyCache,P9 as CIAM_PROVIDER_PRESETS,L1 as CACHE_BOUNDS};
+import{A as s9,E as z1,I as o9,K as L9,L as $9,O as a4,P as i4,Q as Y5,R as X9,T as I5,a as D9,d as l9,e as V5,f as W1,g as G1,h as Y9,i as B9,j as W9,k as n4,o as G9,u as A1,v as U9,w as k9,x as D1,y as c5,z as m}from"./shared/core-9dvscte3.js";var J2="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.",M9=["user","customer","workload"],Z2={user:async(J,Z)=>Z.sso?.getUser(J),customer:async(J,Z)=>Z.ciam?.getCustomer(J),workload:async(J,Z)=>{let $=await Z.workload?.getWorkloadIdentity?.(J);if(!$)return;let X=$.clientId??$.workloadId??$.claims.sub;return X?{...$,id:X}:void 0}};function $2(J){if(J==="any")return M9;let Z=Array.isArray(J)?J:[J];return M9.filter(($)=>Z.includes($))}function X2(J){let Z=J.headers.get("cookie");if(!Z)return[];return Z.split(";").map(($)=>$.slice(0,$.indexOf("=")===-1?$.length:$.indexOf("=")).trim()).filter(Boolean)}function Q2(J,Z){let $=J.headers.get("authorization")?.toLowerCase().startsWith("bearer ")??!1,X=X2(J),Q=new Set;for(let F of X){if(F.startsWith("es.sso"))Q.add("user");if(F.startsWith("es.ciam"))Q.add("customer")}let G=X.length>0&&!Q.has("user")&&!Q.has("customer");return Z.filter((F)=>{if(F==="workload")return $;if(X.length===0)return!1;return Q.has(F)||G})}function X5(J){return typeof J==="string"?J:J.id}function _9(J){let{subject:Z,subjectType:$}=J,X;if($==="user")X=Z.sso?.scope;else if($==="customer")X=Z.ciam?.scope;else if($==="workload")X=Z.scope;return new Set((X??"").split(/\s+/).filter(Boolean))}function b1(J,Z,$){let X=_9(J),Q=Z.filter((F)=>X.has(F));return{allow:$==="any"?Q.length>0:Z.length>0&&Q.length===Z.length,metadata:{reason:"scope",wantedScopes:Z,matchedScopes:Q}}}function l5(J,Z){return($)=>{if(J.length===0)return;let X=_9($),Q=J.filter((F)=>X.has(F));return(Z==="any"?Q.length>0:Q.length===J.length)?Q:void 0}}function H1(J,Z,$){return(X)=>{if(Z.length===0||X.subjectType!=="workload")return;let Q=D9(J.config?.authz,X.subject);if(!Q)return;let G=Z.filter((B)=>Q.has(B));return($==="any"?G.length>0:G.length===Z.length)?G:void 0}}function K2(J,Z){if(J.subjectType==="workload"){let $=J.subject.scopesAsEntitlements;if(typeof $==="boolean")return $}return Z.config?.authz?.scopesAsEntitlements===!0}function y1(J,Z,$,X,Q){return{allow:$==="ok",subject:Z?.subject,subjectType:Z?.subjectType,reason:$,decision:X,response(){if($==="ok")return new Response(null,{status:204});if($==="unauthenticated")return J.log.warn("authz.denied",{reason:$,...Q()}),Response.json({error:"Unauthorized"},{status:401});if($==="not_configured")return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"not_configured"},{status:503});return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"Forbidden"},{status:403})}}}function Y2(J,Z,$){return new Promise((X)=>{let Q=[],G=J.length,F=!1,B=()=>{if(G-=1,G===0&&!F)F=!0,X({outcomes:Q})};for(let W of J)Z(W).then((L)=>{if(Q.push({principal:W,decision:L}),!F&&L.allow){F=!0,X({matched:{principal:W,decision:L},outcomes:Q});return}B()},(L)=>{$?.(W,L),Q.push({principal:W,decision:{allow:!1,metadata:{reason:"error"}}}),B()})})}async function A5(J,Z,$,X,Q,G,F){m(Z,J2);let B=Q2(J,$2($)),L=(await Promise.all(B.map(async(c)=>{let l=await Z2[c](J,Z);return l?.id?{subject:l,subjectType:c,subjectId:l.id}:void 0}))).filter((c)=>c!==void 0);if(L.length===0)return y1(Z,void 0,"unauthenticated",void 0,Q);let f=async(c)=>{let l=Z.authz.accessIndex;if(!l?.isSubjectDisabled)return!1;return l.isSubjectDisabled(c.subjectId,c.subjectType)},u=async(c)=>{if(F){let l=F(c);if(l&&l.length>0){if(await f(c))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:l}}}}if(G&&K2(c,Z)){let l=G(c);if(l&&l.length>0){if(await f(c))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"scope",matchedScopes:l}}}}return X(c)},{matched:i,outcomes:J5}=await Y2(L,u,(c,l)=>{Z.log.warn("authz.check_error",{"es.operation":"authz.check","es.outcome":"error",subject:c.subjectId,subjectType:c.subjectType,error:l instanceof Error?l.message:String(l),...Q()})});if(i){if(i.decision.metadata?.reason==="scope")Z.log.info("authz.scope_honor",{"es.operation":"authz.scope_honor","es.outcome":"allow",subject:i.principal.subjectId,subjectType:i.principal.subjectType,matchedScopes:i.decision.metadata.matchedScopes,...Q()});return y1(Z,i.principal,"ok",i.decision,Q)}let r=J5.length>0&&J5.every((c)=>{let l=c.decision.metadata?.reason;return l==="access_index_not_configured"||l==="error"}),G5=J5[0],p=r?"not_configured":"forbidden";return y1(Z,G5?.principal,p,G5?.decision,Q)}async function B2(J,Z,$,X,Q,G="any"){return A5(J,Z,G,(F)=>Z.authz.has(F.subjectId,$,X,Q,F.subjectType),()=>({targetType:$,target:X5(X),resource:Q?X5(Q):void 0}),Q?void 0:l5([X5(X)],"any"),$==="permission"&&!Q?H1(Z,[X5(X)],"any"):void 0)}async function W2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasPermission(G.subjectId,$,X,G.subjectType),()=>({targetType:"permission",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"),X?void 0:H1(Z,[X5($)],"any"))}async function G2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasRole(G.subjectId,$,X,G.subjectType),()=>({targetType:"role",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"))}async function L2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(G)=>Z.authz.hasGroup(G.subjectId,$,X,G.subjectType),()=>({targetType:"group",target:X5($),resource:X?X5(X):void 0}),X?void 0:l5([X5($)],"any"))}async function F2(J,Z,$,X="any"){let Q=$.filter((F)=>!F.resource).map((F)=>X5(F.target)),G=$.filter((F)=>!F.resource&&F.targetType==="permission").map((F)=>X5(F.target));return A5(J,Z,X,(F)=>Z.authz.hasAny(F.subjectId,$,F.subjectType),()=>({targets:$.map((F)=>`${F.targetType}:${X5(F.target)}`)}),Q.length>0?l5(Q,"any"):void 0,G.length>0?H1(Z,G,"any"):void 0)}async function H2(J,Z,$,X="any"){let Q=$.length>0&&$.every((B)=>!B.resource),G=$.length>0&&$.every((B)=>!B.resource&&B.targetType==="permission"),F=$.map((B)=>X5(B.target));return A5(J,Z,X,(B)=>Z.authz.hasAll(B.subjectId,$,B.subjectType),()=>({targets:$.map((B)=>`${B.targetType}:${X5(B.target)}`)}),Q?l5(F,"all"):void 0,G?H1(Z,F,"all"):void 0)}async function V2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,[$],"any")),()=>({scope:$}))}async function N2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"any")),()=>({scopes:$}))}async function M2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"all")),()=>({scopes:$}))}function Q5(J){return typeof J==="string"&&J.length>0?J:void 0}function z9(J){let Z=Q5(J.email);return{sub:String(J.sub??""),email:Z,name:Q5(J.name),userName:Q5(J.preferred_username)??Z,avatar:Q5(J.picture)}}var P9={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:z9},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:z9},microsoft:{flow:"id_token",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(J)=>{let Z=Q5(J.email)??Q5(J.preferred_username);return{sub:String(J.sub??J.oid??""),email:Z,name:Q5(J.name),userName:Q5(J.preferred_username)??Z,avatar:Q5(J.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(J)=>{let Z=Q5(J.email);return{sub:String(J.sub??""),email:Z,name:Q5(J.name),userName:Z}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(J)=>({sub:String(J.id??J.node_id??""),email:Q5(J.email),name:Q5(J.name)??Q5(J.login),userName:Q5(J.login),avatar:Q5(J.avatar_url)})}};function q1(J){if(J==="magic-link")return;return P9[J]}function V1(J,Z){if(Z.type==="magic-link")return;let $=q1(Z.type);if(!$)return;return{name:J,type:Z.type,flow:$.flow,authorizationUrl:Z.authorizationUrl??$.authorizationUrl,tokenUrl:Z.tokenUrl??$.tokenUrl,jwksUri:Z.jwksUri??$.jwksUri,userInfoUrl:Z.userInfoUrl??$.userInfoUrl,scope:Z.scope??$.scope,clientId:Z.clientId,clientSecret:Z.clientSecret,extraAuthParams:$.extraAuthParams,branding:{...$.branding,...Z.branding},mapClaims:$.mapClaims,config:Z}}function C1(J){return{...q1(J.type)?.branding??{displayName:J.type},...J.branding}}function v1(J){if(!J)return[];return Object.entries(J).filter(([,Z])=>Z.enabled!==!1).map(([Z,$],X)=>({name:Z,config:$,index:X})).sort((Z,$)=>{let X=Z.config.order??Number.MAX_SAFE_INTEGER,Q=$.config.order??Number.MAX_SAFE_INTEGER;if(X!==Q)return X-Q;return Z.index-$.index}).map(({name:Z,config:$})=>({name:Z,config:$}))}var E9=600000,k1=256,W5=new Map;function D2(J){if(typeof J?.ttlMs==="number"&&Number.isFinite(J.ttlMs))E9=Math.min(Math.max(J.ttlMs,60000),86400000);if(typeof J?.maxEntries==="number"&&Number.isFinite(J.maxEntries)){k1=Math.max(1,Math.floor(J.maxEntries));while(W5.size>k1){let Z=W5.keys().next().value;if(Z===void 0)break;W5.delete(Z)}}}function O9(J,Z){W5.delete(J),W5.set(J,Z);while(W5.size>k1){let $=W5.keys().next().value;if($===void 0)break;W5.delete($)}}var o5=new Map,f1=()=>Date.now();function _2(J){f1=J??(()=>Date.now())}var h1={};function z2(J){h1=J??{}}function P2(J){if(!J)return;if(/\bno-store\b/i.test(J))return 60000;let Z=/max-age\s*=\s*(\d+)/i.exec(J);if(!Z)return;let $=Number(Z[1]);return Number.isFinite($)?$*1000:void 0}function O2(J){let $=P2(J)??E9;return Math.min(Math.max($,60000),86400000)}async function g1(J,Z=3,$=1000,X=30000,Q){let G=Error("Placeholder Error");for(let F=0;F<=Z;F++)try{return await J()}catch(B){if(G=B instanceof Error?B:Error(String(B)),B instanceof Error&&B.message.includes("400"))throw B;if(F===Z)throw G;let W=Math.min($*2**F,X),L=Math.random()*0.1*W;await new Promise((f)=>setTimeout(f,W+L)),Q?.warn(`Retry attempt ${F+1} after ${W+L}ms delay`)}throw G}async function r5(J,Z,$){let X=W5.get(J);if(!$?.forceRefresh&&X&&X.expiresAt>f1())return O9(J,X),X.jwks;let Q=o5.get(J);if(Q)return Q;let G=(async()=>{try{return await g1(async()=>{let F=await fetch(J);if(!F.ok)throw Error("Failed to fetch JWKS");let B=await F.json(),W=O2(F.headers.get("cache-control"));return O9(J,{jwks:B,expiresAt:f1()+W,importedKeys:new Map}),B},h1.maxRetries,h1.baseDelayMs,void 0,Z)}catch(F){let B=W5.get(J);if(B)return Z?.warn("JWKS refresh failed; serving last-known-good keys",{"es.operation":"jwks.refresh","es.outcome":"degraded"}),B.jwks;throw F}finally{o5.delete(J)}})();return o5.set(J,G),G}function E2(J){if(J){W5.delete(J),o5.delete(J);return}W5.clear(),o5.clear()}async function j2(J,Z,$){return(await j9(J,Z,$)).jwk}async function j9(J,Z,$){if(!Z?.trim())throw Error("JWT header missing kid");await r5(J,$);let X=W5.get(J),Q=X?.jwks.keys.find((G)=>G.kid===Z);if(!Q)await r5(J,$,{forceRefresh:!0}),X=W5.get(J),Q=X?.jwks.keys.find((G)=>G.kid===Z);if(!X||!Q)throw Error("Public key not found");return{jwk:Q,entry:X}}async function m1(J,Z,$,X,Q){let{jwk:G,entry:F}=await j9(J,Z,Q),B=`${Z}\x00${$}`,W=F.importedKeys.get(B);if(W)return W;let L=X(G);return L.catch(()=>{if(F.importedKeys.get(B)===L)F.importedKeys.delete(B)}),F.importedKeys.set(B,L),L}async function A2(J,Z){let $=J.keys.find((X)=>X.kid===Z);if(!$)throw Error("Public key not found");return A9($)}function A9(J){return crypto.subtle.importKey("jwk",{kty:J.kty,n:J.n,e:J.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function w2(J,Z,$){return m1(J,Z,"rs256",A9,$)}var U1={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function p1(J,Z,$,X){if(typeof $!=="string"||!($ in U1))throw Error(`Unsupported JWT alg "${String($)}" (allowed: ${Object.keys(U1).join(", ")})`);let Q=U1[$];return{key:await m1(J,Z,`oidc:${$}`,(F)=>{if(F.kty!==Q.kty)throw Error(`JWK type "${F.kty}" does not match token alg "${$}"`);if(Q.kty==="EC"){let B=F;if(B.crv!==Q.crv)throw Error(`JWK curve "${String(B.crv)}" does not match token alg "${$}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:B.crv,x:B.x,y:B.y},Q.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:F.kty,n:F.n,e:F.e},Q.importParams,!1,["verify"])},X),algorithm:Q.verifyParams}}function D5(J=32){let Z=new Uint8Array(J);return crypto.getRandomValues(Z),Array.from(Z,($)=>$.toString(16).padStart(2,"0")).join("").substring(0,J)}function N1(J){let Z="";return J.forEach(($)=>{Z+=String.fromCharCode($)}),btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T9(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.padEnd(Z.length+(4-Z.length%4)%4,"="),X=atob($),Q=new Uint8Array(X.length);for(let G=0;G<X.length;G++)Q[G]=X.charCodeAt(G);return Q}function w9(J){let Z=new TextDecoder().decode(T9(J));return JSON.parse(Z)}async function J1(J){let Z=new TextEncoder().encode(J),$=await crypto.subtle.digest("SHA-256",Z);return N1(new Uint8Array($))}function l1(J){let Z=new URL(J.authorizationUrl);if(Z.searchParams.set("client_id",J.clientId),Z.searchParams.set("redirect_uri",J.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("scope",J.scope),Z.searchParams.set("state",J.state),J.codeChallenge)Z.searchParams.set("code_challenge",J.codeChallenge),Z.searchParams.set("code_challenge_method","S256");if(J.nonce)Z.searchParams.set("nonce",J.nonce);for(let[$,X]of Object.entries(J.extraParams??{}))Z.searchParams.set($,X);return Z.toString()}async function c1(J){let Z=new URLSearchParams;if(Z.append("grant_type","authorization_code"),Z.append("code",J.code),Z.append("redirect_uri",J.redirectUri),Z.append("client_id",J.clientId),J.clientSecret)Z.append("client_secret",J.clientSecret);if(J.codeVerifier)Z.append("code_verifier",J.codeVerifier);let $=await fetch(J.tokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()}),X=await $.json();if(!$.ok){let Q=X;throw J.log?.error("OIDC authorization-code exchange failed",{"es.operation":"token.exchange","es.outcome":"failure","http.status_code":$.status,oidc_error:Q.error}),Error(`Token exchange failed: ${Q.error||$.statusText} - ${Q.error_description||""}`.trim())}if(typeof X.access_token!=="string")throw Error("Token exchange response missing access_token");return X}var S9=60;function e5(J){return J.trim().replace(/\/$/,"")}function R9(J){let{claims:Z,audience:$}=J,X=e5(J.issuer),Q=J.nowSec??Math.floor(Date.now()/1000),G=J.clockSkewSec??S9,F=Z.iss;if(typeof F!=="string"||e5(F)!==X)throw Error("ID token issuer mismatch");let B=Z.aud,W=Array.isArray(B)?B.includes($):typeof B==="string"&&B===$,L=typeof Z.azp==="string"&&Z.azp===$;if(!W&&!L)throw Error("ID token audience mismatch");if(typeof Z.exp!=="number")throw Error("ID token missing exp");if(Z.exp<Q-G)throw Error("ID token expired");if(J.expectedNonce!==void 0){if(Z.nonce!==J.expectedNonce)throw Error("ID token nonce mismatch")}}async function x9(J,Z,$){let X=J.split(".");if(X.length!==3)throw Error("Invalid JWT");let Q=w9(X[0]),G=w9(X[1]),F=T9(X[2]),{key:B,algorithm:W}=await p1(Z,Q.kid,Q.alg,$),L=new TextEncoder().encode(`${X[0]}.${X[1]}`);if(!await crypto.subtle.verify(W,B,F,L))throw Error("Invalid JWT signature");return{header:Q,payload:G}}async function R5(J){let{payload:Z}=await x9(J.idToken,J.jwksUri,J.log);return R9({claims:Z,issuer:J.issuer,audience:J.audience,clockSkewSec:J.clockSkewSec,expectedNonce:J.expectedNonce}),Z}var I2="http://schemas.openid.net/event/backchannel-logout";async function d1(J){let{payload:Z}=await x9(J.logoutToken,J.jwksUri,J.log),$=e5(J.issuer),X=Z.iss;if(typeof X!=="string"||e5(X)!==$)throw Error("Logout token issuer mismatch");let Q=Z.aud,G=Array.isArray(Q)?Q.includes(J.audience):typeof Q==="string"&&Q===J.audience,F=typeof Z.azp==="string"&&Z.azp===J.audience;if(!G&&!F)throw Error("Logout token audience mismatch");if(Z.nonce!=null)throw Error("Logout token must not contain a nonce");let B=Z.events;if(!(typeof B==="object"&&B!==null&&!Array.isArray(B)&&Object.hasOwn(B,I2)))throw Error("Logout token missing back-channel logout event");let L=typeof Z.sid==="string"&&Z.sid.length>0,f=typeof Z.sub==="string"&&Z.sub.length>0;if(!L&&!f)throw Error("Logout token missing sid and sub");if(typeof Z.exp==="number"){let u=Math.floor(Date.now()/1000),i=J.clockSkewSec??S9;if(Z.exp<u-i)throw Error("Logout token expired")}return Z}var T2=3600000,S2=60000,R2=86400000,x2=256,w5=new Map,s5=new Map;function I9(J,Z){w5.delete(J),w5.set(J,Z);while(w5.size>x2){let $=w5.keys().next().value;if($===void 0)break;w5.delete($)}}var u1=()=>Date.now();function y2(J){u1=J??(()=>Date.now())}function b2(J){if(J){w5.delete(J),s5.delete(J);return}w5.clear(),s5.clear()}function q2(J){let Z=J?/max-age\s*=\s*(\d+)/i.exec(J):null,$=Z?Number(Z[1]):Number.NaN,X=Number.isFinite($)?$*1000:T2;return Math.min(Math.max(X,S2),R2)}async function n1(J){let Z=w5.get(J);if(Z&&Z.expiresAt>u1())return I9(J,Z),Z.endpoints;let $=s5.get(J);if($)return $;let X=(async()=>{try{let Q=J.replace(/\/$/,""),G=await fetch(`${Q}/.well-known/openid-configuration`,{headers:{Accept:"application/json"}});if(!G.ok)throw Error(`OIDC discovery failed for ${J} with status ${G.status}`);let F=await G.json(),B={authorizationUrl:typeof F.authorization_endpoint==="string"?F.authorization_endpoint:void 0,tokenUrl:typeof F.token_endpoint==="string"?F.token_endpoint:void 0,jwksUri:typeof F.jwks_uri==="string"?F.jwks_uri:void 0,userInfoUrl:typeof F.userinfo_endpoint==="string"?F.userinfo_endpoint:void 0};return I9(J,{endpoints:B,expiresAt:u1()+q2(G.headers.get("cache-control"))}),B}catch(Q){let G=w5.get(J);if(G)return G.endpoints;throw Q}finally{s5.delete(J)}})();return s5.set(J,X),X}async function a1(J,Z){let $=await fetch(J,{headers:{Authorization:`Bearer ${Z}`,Accept:"application/json","User-Agent":"enterprise-standard-ciam"}});if(!$.ok)throw Error(`UserInfo request failed with status ${$.status}`);return await $.json()}function C2(J){let Z=J.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),$=atob(Z),X=new Uint8Array($.length);for(let Q=0;Q<$.length;Q++)X[Q]=$.charCodeAt(Q);return X}async function i1(J){let Z=Math.floor(Date.now()/1000),$={alg:"ES256",kid:J.keyId,typ:"JWT"},X={iss:J.teamId,iat:Z,exp:Z+(J.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:J.clientId},Q=N1(new TextEncoder().encode(JSON.stringify($))),G=N1(new TextEncoder().encode(JSON.stringify(X))),F=`${Q}.${G}`,B=await crypto.subtle.importKey("pkcs8",C2(J.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),W=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},B,new TextEncoder().encode(F));return`${F}.${N1(new Uint8Array(W))}`}function v2(J){for(let Z=0;Z<J.length;Z++){let $=J.charCodeAt(Z);if($<=31||$===127)return!0}return!1}function U2(J,Z){let $=null;try{$=new URL(J,Z)}catch{$=null}let X="";try{X=new URL(Z).origin}catch{X=""}return{candidate:J,url:$,requestOrigin:X}}function y9(J,Z,$){let X=U2(J,$),Q=!1;for(let G of Z){let F=G(X);if(F==="deny")return!1;if(F==="allow")Q=!0}return Q}function b9(){return({candidate:J,url:Z})=>{if(v2(J))return"deny";if(J.includes("\\"))return"deny";if(J.startsWith("//"))return"deny";if(!Z)return"deny";if(Z.protocol!=="http:"&&Z.protocol!=="https:")return"deny";if(Z.username||Z.password)return"deny";return"abstain"}}function q9(){return({candidate:J})=>J.startsWith("/")&&!J.startsWith("//")&&!J.startsWith("/\\")?"allow":"abstain"}function C9(){return({url:J,requestOrigin:Z})=>J&&Z&&J.origin===Z?"allow":"abstain"}function k2(...J){let Z=new Set(J.map(($)=>{try{return new URL($).origin}catch{return $}}));return({url:$})=>$&&Z.has($.origin)?"allow":"abstain"}function f2(...J){let Z=J.map(($)=>$.toLowerCase());return({url:$})=>{if(!$)return"abstain";let X=$.hostname.toLowerCase();for(let Q of Z)if(Q.startsWith(".")){if(X===Q.slice(1)||X.endsWith(Q))return"allow"}else if(X===Q)return"allow";return"abstain"}}function t1(){return[b9(),q9(),C9()]}function v9(J,Z,$){if(!J)return!1;return y9(J,Z,$)}function o1(J,Z){if(!J)return Z.fallback;return y9(J,Z.rules,Z.requestUrl)?J:Z.fallback}var h2={rules:t1(),fallback:"/"};function g2(J,Z,$="redirect"){let X=new URL(J.url).searchParams.get($)??void 0;return v9(X,Z.rules,J.url)?{redirect:X}:void 0}function m2(J,Z){let $=J.context;return o1($?.redirect,{rules:Z.rules,fallback:Z.fallback,requestUrl:J.request.url})}function x5(J,Z,$){if(J instanceof Response)return{response:J};if(typeof J==="string")return{location:o1(J,{rules:t1(),fallback:Z,requestUrl:$})};return{location:Z}}function U5(J,Z){if(Z.length===0)return J;let $=new Headers(J.headers);for(let X of Z)$.append("Set-Cookie",X);return new Response(J.body,{status:J.status,statusText:J.statusText,headers:$})}var M1="ciam",p2="id_token",u2="access_token";function l2(J,Z,$,X,Q,G){if(!$&&!X)return;let F=new WeakMap,B={...$,...X},W={...B,magicLinkTtl:B.magicLinkTtl??3600,sessionTtl:B.sessionTtl??86400,cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.ciamId?`es.ciam.${B.ciamId}`:"es.ciam"),cookiesPath:B.cookiesPath??"/"};function L(){if(!W.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return W.sessionStore}function f(){L()}let u=J.callbackParams??c5(U9("enterprisestandard.ciam")),i=J.idTokenClaims??c5(D1("enterprisestandard.ciam")),J5=J.tokenResponse??c5(k9("enterprisestandard.ciam"));function r(K=32){let H=new Uint8Array(K);return crypto.getRandomValues(H),Array.from(H,(N)=>N.toString(16).padStart(2,"0")).join("").substring(0,K)}function G5(K,H,N,z=W.cookiesSameSite??"Strict"){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");if(K=`${W.cookiesPrefix}.${K}`,typeof H!=="string")H=btoa(JSON.stringify(H));let j;if(N instanceof Date)j=`Expires=${N.toUTCString()}`;else if(typeof N==="number")j=`Max-Age=${N}`;else throw Error("Invalid expires type",N);if(H.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${H.length}`);return`${K}=${H}; ${j}; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${z};`}function p(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");return`${W.cookiesPrefix}.${K}=; Max-Age=0; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${W.cookiesSameSite};`}function c(K,H,N=!1){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");let z=H.headers.get("cookie");if(!z)return null;let j=`${W.cookiesPrefix}.${K}`,M=z.split(";").find((E)=>E.trim().startsWith(`${j}=`));if(!M)return null;let _=M.indexOf("="),D=M.substring(_+1).trim();if(!N)return D;try{let E=atob(D);return JSON.parse(E)}catch(E){return Z.error("[CIAM] Failed to parse cookie",{"es.operation":"cookie.parse","es.outcome":"failure",cookieName:j},E),null}}function l(K){return`cstate_${K}`}async function B5(K,H,N,z){let j=await W.afterLogin?.({...H,request:K,context:N}),M=x5(j,"/",K.url);if(M.response)return U5(M.response,z.map(([,_])=>_));return new Response(H.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",M.location],...z]})}function s(K,H){return["Set-Cookie",G5("session",K,H)]}function $5(K){if(!K)return;if(K instanceof Date)return K;let H=new Date(K);return Number.isNaN(H.getTime())?void 0:H}async function j5(K){let H=c("session",K);if(!H)return;let N=await L().get(H);if(N&&W.tenantId&&N.tenantId&&N.tenantId!==W.tenantId)return;if(N?.authType!=="ciam")return;let z=$5(N.expiresAt);if(z&&Date.now()>z.getTime()){await L().delete(H);return}return N}async function q5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H=F.get(K);if(H)return H;let N=i5(K);return F.set(K,N),N}async function i5(K){try{let H=await j5(K);if(!H?.claims?.sub)return{status:"unauthenticated"};return{status:"authenticated",value:N5(H.claims)}}catch(H){return Z.error("CIAM session resolution failed",{"es.operation":"ciam.session","es.outcome":"degraded"},H),{status:"degraded",error:H instanceof Error?H:void 0}}}async function g5(K){let H=await q5(K);return H.status==="authenticated"?H.value:void 0}async function m5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H;try{H=await g5(K)}catch{H=void 0}let N=await W.beforeLogout?.({request:K,user:H});try{let P=c("session",K);if(P)await L().delete(P)}catch(P){Z.warn("Failed to delete CIAM session",{"es.operation":"session.delete","es.outcome":"degraded"},P)}let z=[["Set-Cookie",p("session")]],j=await W.afterLogout?.({request:K,context:N}),M=x5(j,"/",K.url);if(M.response)return U5(M.response,z.map(([,P])=>P));let _=M.location??"/",D=K.headers.get("accept");if(D?.includes("application/json")||D?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...z]});return new Response("Logged out",{status:302,headers:[["Location",_],...z]})}function C5(K){return K.id||K.email||`ciam-${K.userName}`}function T5(K,H,N){return{sub:C5(K),iss:M1,aud:M1,typ:p2,exp:Math.floor(N.getTime()/1000),iat:Math.floor(Date.now()/1000),email:K.email,name:K.name,preferred_username:K.userName,picture:K.avatar,sid:H}}function p5(K,H,N){return{sub:K,iss:M1,aud:M1,typ:u2,exp:Math.floor(N.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:H,scope:"openid profile email"}}function N5(K){let H=K.exp?new Date(K.exp*1000):new Date;return{id:K.sub,userName:K.preferred_username??"",name:K.name??"",email:K.email??"",avatar:K.picture,userType:"customer",ciam:{profile:K,scope:"openid profile email",tokenType:"Bearer",expires:H}}}async function u5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");if(!Q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await Q.getWorkloadIdentity(K))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let N,z;try{if(!K.headers.get("content-type")?.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let v=await K.text(),y=JSON.parse(v);z=typeof y?.redirect==="string"&&y.redirect.length>0?y.redirect:void 0;let Y={userName:y.userName,name:y.name,email:y.email,avatar:y.avatar},O=await J.customer.validate(Y);if(O.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}});N=O.value}catch(R){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let M=new URL(K.url).searchParams.get("ttl"),_=M?parseInt(M,10):W.magicLinkTtl??3600;if(Number.isNaN(_)||_<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let D=r(32),E=new Date(Date.now()+_*1000);if(!W.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await W.magicLinkStore.create(D,N,E)}catch(R){return Z.error("Error creating magic link",{"es.operation":"magic_link.create","es.outcome":"failure"},R),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let P=new URL(K.url),w=W.magicLinkLoginUrl||"/magic-link/login",q=new URL(w,P.origin);if(q.searchParams.set("token",D),z)q.searchParams.set("redirect",z);return new Response(JSON.stringify({magicLink:q.toString(),expiresAt:E.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function S5(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let N=new URL(K.url).searchParams.get("token");if(!N)return B5(K,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!W.magicLinkStore)return B5(K,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let z=await W.magicLinkStore.getAndDelete(N);if(!z)return B5(K,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let j=new Date(Date.now()+(W.sessionTtl??86400)*1000),M=r(32),_=C5(z.customer),D=T5(z.customer,M,j),E=p5(_,M,j),P=N5(D),w;try{let R={sid:M,sub:_,authType:"ciam",tenantId:W.tenantId,expiresAt:j,claims:D,accessClaims:E,createdAt:new Date};await L().create(R),w=R}catch(R){throw Z.warn("Failed to create session",{"es.operation":"session.create","es.outcome":"degraded"},R),R}if(W.customerStore)try{let R=P.id;if(R){let v=new Date,y=await W.customerStore.get(R);if(y||W.enableJitUserProvisioning){let Y={...y??{},...P,id:R,tenantId:y?.tenantId,createdAt:y?.createdAt??v,updatedAt:v,userType:y?.userType??"customer"};await W.customerStore.upsert(Y)}}}catch(R){Z.warn("Failed to store customer",{"es.operation":"customer.store","es.outcome":"degraded"},R)}let q=[s(M,j)];return B5(K,{ok:!0,user:P,session:w},void 0,q)}function L5(K,H=200,N=[]){return new Response(JSON.stringify(K),{status:H,headers:[["Content-Type","application/json"],...N]})}function M5(K,H){try{return new URL(K).toString()}catch{let N=new URL(H).origin,z=W.cookiesSecure?N.replace(/^http:\/\//,"https://"):N;return new URL(K,z).toString()}}function x(){let K=W.customerLoginUrl||"/auth/customer/login",H=K.includes("?")?"&":"?";return v1(W.providers).map(({name:N,config:z})=>{let j=C1(z);return{name:N,type:z.type,displayName:j.displayName,loginUrl:`${K}${H}provider=${encodeURIComponent(N)}`,iconUrl:j.iconUrl,colors:j.colors,url:j.url}})}async function U(K){if(!K)return{};let{authorizationUrl:H,tokenUrl:N,jwksUri:z,userInfoUrl:j}=K,M=K.config.authority;if(M&&(!H||!N||K.flow==="id_token"&&!z))try{let D=await n1(M);H=H??D.authorizationUrl,N=N??D.tokenUrl,z=z??D.jwksUri,j=j??D.userInfoUrl}catch(D){Z.error("CIAM provider OIDC discovery failed",{"es.operation":"ciam.oidc.discovery","es.outcome":"failure"},D)}return{authorizationUrl:H,tokenUrl:N,jwksUri:z,userInfoUrl:j}}async function h(K){if(K.type==="apple"){let{teamId:H,keyId:N,privateKey:z,clientId:j}=K.config;if(H&&N&&z&&j)return i1({teamId:H,keyId:N,privateKey:z,clientId:j})}return K.clientSecret}async function n(K){L();let N=new URL(K.url).searchParams.get("provider");if(!N)return L5({error:"Missing required query parameter: provider"},400);let z=W.providers?.[N];if(!z||z.enabled===!1||z.type==="magic-link")return L5({error:`Unknown or disabled CIAM provider: ${N}`},404);let j=V1(N,z);if(!j?.clientId)return L5({error:`CIAM provider ${N} is not fully configured`},500);let M=await U(j);if(!M.authorizationUrl)return L5({error:`CIAM provider ${N} is missing an authorization endpoint`},500);let _=W.customerCallbackUrl||"/auth/customer/callback",D=M5(_,K.url),E=D5(),P=D5(64),w=D5(),q=j.flow==="id_token",R=q?await J1(P):void 0,v=await W.beforeLogin?.({request:K}),y=l1({authorizationUrl:M.authorizationUrl,clientId:j.clientId,redirectUri:D,scope:j.scope,state:E,codeChallenge:R,nonce:w,extraParams:j.extraAuthParams}),Y={provider:N,state:E,codeVerifier:q?P:void 0,nonce:w,redirectUri:D,...v===void 0?{}:{context:v}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",y],["Set-Cookie",G5(l(E),Y,W.loginStateTtl??600,"Lax")]]})}async function e(K){if(K.method==="POST"){if((K.headers.get("content-type")??"").includes("application/x-www-form-urlencoded")){let N=await K.text();return Object.fromEntries(new URLSearchParams(N).entries())}}return Object.fromEntries(new URL(K.url).searchParams.entries())}async function t(K,H){let N=K.mapClaims(H);if(!N.sub)return{ok:!1};let z=`${K.name}:${N.sub}`,j={id:z,userName:N.userName||N.email||z,name:N.name||"",email:N.email||"",avatar:N.avatar,userType:"customer"},M=z;if(W.customerStore){let q=await W.customerStore.lookup(j)??await W.customerStore.get(z);if(M=q?.id??z,!q&&!W.enableJitUserProvisioning)return Z.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"es.operation":"customer.store","es.outcome":"skipped"}),{ok:!1};let R=new Date,v={...q??{},...j,id:M,tenantId:q?.tenantId,createdAt:q?.createdAt??R,updatedAt:R,userType:q?.userType??"customer"};await W.customerStore.upsert(v)}let _=new Date(Date.now()+(W.sessionTtl??86400)*1000),D=D5(32),E={sub:M,iss:K.name,aud:K.clientId,exp:Math.floor(_.getTime()/1000),iat:Math.floor(Date.now()/1000),email:N.email,name:N.name,preferred_username:N.userName??N.email,picture:N.avatar,sid:D},P={sid:D,sub:M,authType:"ciam",tenantId:W.tenantId,expiresAt:_,claims:E,accessClaims:{sub:M,sid:D,scope:K.scope},createdAt:new Date},w=L();try{await w.create(P)}catch(q){if(!await w.get(D))throw q;await w.update(D,P)}return{ok:!0,claims:E,sid:D,expires:_}}async function V(K){L();let H,N,z=(j)=>{let M=H?[["Set-Cookie",p(H)]]:[];return B5(K,{ok:!1,error:j},N,M)};try{let j=await e(K),M=await u.validate(j);if(M.issues||!M.value)return z(Error("Invalid CIAM callback parameters"));let{code:_,state:D}=M.value;if(!D)return z(Error("Missing CIAM callback state"));H=l(D);let E=c(H,K,!0);if(N=E?.context,!E?.provider||!E.state||E.state!==D)return Z.warn("CIAM callback state verification failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM callback state verification failed"));let P=W.providers?.[E.provider];if(!P)return z(Error("Unknown CIAM provider"));let w=V1(E.provider,P);if(!w?.clientId)return z(Error("CIAM provider not configured"));let q=await U(w);if(!q.tokenUrl)return z(Error("CIAM provider missing token endpoint"));let R=await h(w),v=await c1({tokenUrl:q.tokenUrl,clientId:w.clientId,clientSecret:R,redirectUri:E.redirectUri||M5(W.customerCallbackUrl||"/auth/customer/callback",K.url),code:_,codeVerifier:w.flow==="id_token"?E.codeVerifier:void 0,log:Z}),y;if(w.flow==="id_token"){let b=w.config.authority;if(!v.id_token||!q.jwksUri||!b)return z(Error("CIAM id_token flow misconfigured"));if(!E.nonce)return z(Error("CIAM callback state cookie missing nonce"));if((await J5.validate(v)).issues)return Z.warn("CIAM token response validation failed",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM token response validation failed"));y=await R5({idToken:v.id_token,jwksUri:q.jwksUri,issuer:b,audience:w.clientId,expectedNonce:E.nonce,log:Z});let C=await i.validate(y);if(!C.issues)y=C.value}else{if(!q.userInfoUrl)return z(Error("CIAM provider missing userinfo endpoint"));y=await a1(q.userInfoUrl,v.access_token);let b=w.config.authority;if(v.id_token&&q.jwksUri&&b){let S=await R5({idToken:v.id_token,jwksUri:q.jwksUri,issuer:b,audience:w.clientId,expectedNonce:E.nonce||void 0,log:Z}),C=typeof S.sub==="string"?S.sub:"";if(C){if(typeof y.sub==="string"&&y.sub.length>0&&y.sub!==C)return Z.warn("CIAM UserInfo sub does not match verified id_token sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM UserInfo sub mismatch"));y.sub=C}}if(typeof y.sub!=="string"||y.sub.length===0)return Z.warn("CIAM UserInfo response missing sub",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"}),z(Error("CIAM UserInfo response missing sub"))}let Y=await t(w,y);if(!Y.ok)return z(Error("Failed to persist CIAM customer"));let O=N5(Y.claims);Z.info("CIAM third-party sign-in succeeded",{"es.operation":"ciam.oidc.callback","es.outcome":"success",provider:w.name});let T=[["Set-Cookie",p(H)],s(Y.sid,Y.expires)];return B5(K,{ok:!0,user:O,session:void 0},N,T)}catch(j){return Z.error("Error during CIAM third-party sign-in callback",{"es.operation":"ciam.oidc.callback","es.outcome":"failure"},j),z(j)}}async function A(K){if(!W)throw Error("Enterprise Standard CIAM Manager not initialized");f();let H=W.magicLinkUrl||"/magic-link",N=W.magicLinkLoginUrl||"/magic-link/login",z=W.logoutUrl||"/auth/customer/logout",j=W.customerLoginUrl||"/auth/customer/login",M=W.customerCallbackUrl||"/auth/customer/callback",_=W.customerProvidersUrl||"/auth/customer/providers",D=new URL(K.url).pathname,E=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(E(H)===D&&K.method==="POST")return u5(K);if(E(N)===D&&K.method==="GET")return S5(K);if(E(z)===D&&K.method==="GET")return m5(K);if(E(_)===D&&K.method==="GET")return L5({providers:x()});if(E(j)===D&&K.method==="GET")return n(K);if(E(M)===D&&(K.method==="GET"||K.method==="POST"))return V(K);return new Response("Not Found",{status:404})}return{...W,getCustomer:g5,resolveCustomer:q5,logout:m5,handler:A,listCustomerProviders:x}}async function c2(J,Z){return m(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),Z.ciam?.getCustomer(J)}async function d2(J,Z){return m(Z,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),await Z.ciam?.resolveCustomer(J)??{status:"unauthenticated"}}var Y1="application/scim+json",n2="urn:ietf:params:scim:api:messages:2.0:ListResponse",Q9="urn:ietf:params:scim:api:messages:2.0:Error",P1="urn:ietf:params:scim:schemas:core:2.0:User",h5="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",O1="urn:ietf:params:scim:schemas:core:2.0:Group",a2="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",f9="urn:ietf:params:scim:schemas:core:2.0:ResourceType",Z1="urn:ietf:params:scim:schemas:core:2.0:Schema",i2="00000000000000000000000000000000";function t2(J){let Z={timestamp:new Date().toISOString()};if(J)Z.actor=J;try{let Q=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),G=Q?.traceId;if(G&&G!==i2){if(Z.traceId=G,Q?.spanId)Z.spanId=Q.spanId}}catch{}return Z}class B1 extends Error{constructor(J){super(J);this.name="SubjectTypeNotAssignableError",Object.setPrototypeOf(this,B1.prototype)}}async function o2(J,Z,$,X,Q){let G=X.subjectType??"user";if(!X9.includes(G))throw new B1(`Cannot grant ${X.targetType} "${V5(X.target)}" to a "${G}" principal: only [${X9.join(", ")}] principals are assignable on this platform.`);let F=G9(Z,J);if(!F&&!Q)return;let B=V5(X.target),W;if(Q)W=await Q.getNode(X.targetType,B);else if(F){if(W=await(X.targetType==="group"?F.groups:X.targetType==="role"?F.roles:F.permissions).get(B),!W&&X.targetType==="group")W=await $?.entitlement?.(B)}let L=W?.assignableSubjectTypes;if(L&&L.length>0&&!L.includes(G))throw new B1(`Cannot grant ${X.targetType} "${B}" to a "${G}" principal: this entitlement restricts assignment to [${L.join(", ")}].`)}async function r2(J,Z,$,X){await o2(J.catalogStore,J.codeCatalog,J.resources,Z,X);let Q={...Z,status:Z.status??"active",provenance:Z.provenance??t2()};if(Q.id=W1(Q),await J.accessStore?.grant(Q),J.accessIndex&&(J.catalogStore||J.codeCatalog)){let G=await B9(Q,{catalog:J.catalogStore,code:J.codeCatalog,resources:J.resources,cache:X});await J.accessIndex.materialize(Q.id,G)}return $?.push({op:"add",change:Q}),Q}async function E1(J,Z,$){let X=Z.id??W1(Z);await J.accessStore?.revoke(Z),await J.accessIndex?.removeByRoot(X),$?.push({op:"delete",change:{...Z,id:X}})}async function K9(J,Z){let $=await s2(J,Z),X=await J4(J,Z);return{oaa:$,delta:X}}async function s2(J,Z){if(Z.length===0||!J.authz.oaa.isReady())return{status:"skipped"};return F9(J,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>J.authz.oaa.pushAccessChanges(Z),{count:Z.length})}async function F9(J,Z,$,X,Q){try{return await X(),{status:"ok"}}catch(G){return J.log?.warn($,{"es.operation":Z,"es.outcome":"degraded",...Q,error:b5(G)}),{status:"degraded",reason:b5(G)}}}var e2=6;async function J4(J,Z){let $=J.iamDelta;if(!$?.isReady()||Z.length===0)return{status:"skipped"};let X=new Map;for(let W of Z){let L=`${W.change.subjectType??"user"}:${V5(W.change.subject)}\x00${W.change.targetType}:${V5(W.change.target)}`;X.set(L,W)}let Q=[...X.values()],G=Q.map(({op:W,change:L})=>()=>W==="add"?$.onGrant(L):$.onRevoke(L)),B=(await Z4(G,e2)).filter((W)=>W.status==="rejected");if(B.length>0)return J.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"es.operation":"iam.delta.egress","es.outcome":"degraded",failed:B.length,total:Q.length,error:b5(B[0]?.reason)}),{status:"degraded",reason:b5(B[0]?.reason)};return{status:"ok"}}async function Z4(J,Z){let $=Array(J.length),X=0,Q=async()=>{while(!0){let F=X++;if(F>=J.length)return;let B=J[F];if(!B)continue;try{$[F]={status:"fulfilled",value:await B()}}catch(W){$[F]={status:"rejected",reason:W}}}},G=Array.from({length:Math.min(Z,J.length)},Q);return await Promise.all(G),$}class w1 extends Error{constructor(J){super(J);this.name="DerivedRevokeError",Object.setPrototypeOf(this,w1.prototype)}}class a5 extends Error{summary;clientError;constructor(J,Z,$=!1){super(J);this.name="ScimMutationError",this.summary=Z,this.clientError=$,Object.setPrototypeOf(this,a5.prototype)}}function k(J,Z,$){return new Response(JSON.stringify({schemas:[Q9],status:String(J),scimType:$,detail:Z}),{status:J,headers:{"Content-Type":Y1}})}function d5(J,Z){let $=Z?.totalResults??J.length,X=Z?.startIndex??1,Q=Z?.itemsPerPage??J.length;return new Response(JSON.stringify({schemas:[n2],totalResults:$,startIndex:X,itemsPerPage:Q,Resources:J}),{status:200,headers:{"Content-Type":Y1}})}function H5(J,Z=200){return new Response(JSON.stringify(J),{status:Z,headers:{"Content-Type":Y1}})}function h9(J){return k(J.clientError?409:500,`${J.message}; authz mutation summary: ${JSON.stringify(J.summary)}`,J.clientError?"mutability":"invalidValue")}function K1(J){return W1(J)}function r1(J,Z){return X1(g9(J),g9(Z))}function g9(J){let Z=new Map;if(!J?.id)return Z;for(let $ of J.groups??[]){let X={subject:J.id,targetType:"group",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type}:void 0};Z.set(K1(X),X)}for(let $ of J.roles??[]){let X={subject:J.id,targetType:"role",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}for(let $ of J.entitlements??[]){let X={subject:J.id,targetType:"permission",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}return Z}function $1(J,Z,$,X){let Q=new Map,G=X&&X.length>0?X:void 0;for(let F of J??[]){let B={subject:F.value,targetType:Z,target:$,resources:G,metadata:F.display||F.type?{display:F.display,type:F.type}:void 0};Q.set(K1(B),B)}return Q}function s1(J){let Z=J[Y5]?.resources;return Z&&Z.length>0?Z:void 0}function $4(J,Z,$){let X=J[Y5];if(J.displayName!==void 0&&J.displayName!==(Z.displayName??Z.name))return!0;if(J.externalId!==void 0&&J.externalId!==Z.externalId)return!0;if(X?.type!==void 0&&X.type!==$)return!0;if(X?.requestable!==void 0&&Boolean(X.requestable)!==Boolean(Z.requestable))return!0;if(X?.description!==void 0&&X.description!==Z.description)return!0;if(X?.resources!==void 0){let Q=[...X.resources].sort().join(","),G=[...j1(Z)??[]].sort().join(",");if(Q!==G)return!0}return!1}function m9(J){let Z=new Map;for(let $ of J)Z.set(K1($),$);return Z}async function O5(J,Z,$,X,Q,G,F){let B=[],W=new Set,L=F?F.get(`${X}:${Q}`)??[]:Z?(await Z.listByTarget(X,Q)).items:[];for(let f of L){let u=V5(f.subject);if(W.has(u))continue;W.add(u);let i=f.metadata,J5=f.subjectType==="workload"?"Workload":i?.type??"User";B.push({value:u,...i?.display?{display:i.display}:{},type:J5})}for(let f of G??[]){if(f.targetType!==X||V5(f.target)!==Q)continue;let u=V5(f.subject);if(W.has(u))continue;W.add(u),B.push({value:u,type:"Workload"})}if(X==="group"){let f=await J.groups.get(Q)??await $?.entitlement?.(Q);for(let u of f?.groups??[]){let i=V5(u);if(!i||W.has(i))continue;W.add(i),B.push({value:i,type:"Group"})}}return B.length>0?B:void 0}function X1(J,Z){let $=[];for(let[X,Q]of Z)if(!J.has(X))$.push({action:"grant",change:Q});for(let[X,Q]of J)if(!Z.has(X))$.push({action:"revoke",change:Q});return $}async function e1(J,Z){if(J.oaa.isReady())await J.oaa.pushUser(Z)}async function k5(J,Z,$,X){let Q={metadataApplied:!1,access:[]},G=[],F=new Y9(J.catalogStore,J.resources,J.codeCatalog);try{try{await Z(),Q.metadataApplied=!0}catch(B){for(let W of $)Q.access.push({change:W.change,status:"rolled_back"});throw Q.metadataApplied=!1,new a5(`SCIM metadata write failed: ${b5(B)}`,Q,!1)}if(X)await F9(J,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",X);for(let B=0;B<$.length;B++){let W=$[B];try{if(W.action==="grant")await r2(J,W.change,G,F);else await Y4(J,W.change,G);Q.access.push({change:W.change,status:"applied"})}catch(L){Q.access.push({change:W.change,status:"failed",error:L});for(let u=B+1;u<$.length;u++)Q.access.push({change:$[u].change,status:"rolled_back"});let f=L instanceof w1||L instanceof B1;if(!f)await Q4(J,W.change,F);throw new a5(f?b5(L):`SCIM access mutation failed: ${b5(L)}`,Q,f)}}return Q}finally{await X4(J),Q.egress=await K9(J,G),K4(J,Q)}}function b5(J){return J instanceof Error?J.message:String(J)}async function X4(J){try{await J.authz.settle?.()}catch{}}async function Q4(J,Z,$){if(!J.accessIndex||!J.catalogStore&&!J.codeCatalog||!J.accessStore)return;let X=V5(Z.subject);if(!X)return;let Q=Z.subjectType??"user";try{await W9(X,Q,{accessStore:J.accessStore,accessIndex:J.accessIndex,catalogStore:J.catalogStore,code:J.codeCatalog,resources:J.resources},$)}catch(G){J.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"es.operation":"authz.reconcile.subject.repair","es.outcome":"degraded",subject:X,subjectType:Q,error:b5(G)})}}function K4(J,Z){if(!J.onAccessMutation)return;try{J.onAccessMutation(Z)}catch{}}async function Y4(J,Z,$){if(J.accessStore){let X=Z.id??W1(Z);if(!await J.accessStore.get(X)){if((J.accessIndex?await J.accessIndex.has(Z.subject,Z.targetType,Z.target,Z.resources?.[0],Z.subjectType):{allow:!1}).allow)throw new w1(`Cannot revoke ${Z.targetType} "${V5(Z.target)}" for "${V5(Z.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await E1(J,Z,$);return}}await E1(J,Z,$)}function Q1(J){let Z=J[Y5]?.type??"group";if(Z==="group"||Z==="role"||Z==="permission")return Z;throw Error(`Unsupported Enterprise Standard SCIM Group authz type "${String(Z)}"`)}async function J9(J,Z,$){if(!J.oaa.isReady())return;if($==="role"){await J.oaa.pushRole(Z);return}if($==="permission"){await J.oaa.pushPermission(Z);return}await J.oaa.pushGroup(Z)}function j1(J){let Z=J.resources;if(!Z||Z.length===0)return;let $=Z.map((X)=>typeof X==="string"?X:X.id).filter(Boolean);return $.length>0?$:void 0}function E5(J,Z,$){return{schemas:[O1],id:J.id,externalId:J.externalId,displayName:J.displayName??J.name,members:$,[Y5]:{type:Z,requestable:J.requestable,description:J.description,resources:Z==="group"?j1(J):void 0,assignableSubjectTypes:J.assignableSubjectTypes,recommendedSubjectTypes:J.recommendedSubjectTypes}}}function B4(J,Z){let $=J[Y5],X={id:Z,name:J.displayName,displayName:J.displayName,description:$?.description??J.displayName,externalId:J.externalId,requestable:$?.requestable};if($?.resources!==void 0)X.resources=$.resources;return X}function W4(J){if(!J)return;let Z=J.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!Z)return;return{requestable:Z[1]?.toLowerCase()==="true"}}function p9(J){if(!J)return;let Z=J.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return Z?Z[1]:void 0}async function H9(J,Z){if(!J?.entitlements)return[];let $=J.entitlements.bind(J),X=[];for await(let Q of l9((G,F)=>J.list({start:G,limit:F})))for(let G of $(Q)){if(Z?.requestable!==void 0&&Boolean(G.requestable)!==Z.requestable)continue;X.push(G1(G))}return X}async function G4(J,Z,$,X,Q){let G=[{store:J.groups,type:"group"},{store:J.roles,type:"role"},{store:J.permissions,type:"permission"}],F;if(G.every(({store:W})=>typeof W.getByExternalId==="function"))F=(await Promise.all(G.map(async({store:L,type:f})=>{let u=await L.getByExternalId?.(X);return u?{entity:u,type:f}:void 0}))).filter((L)=>L!==void 0);else{let W={start:0},[L,f,u]=await Promise.all([J.groups.list(W),J.roles.list(W),J.permissions.list(W)]);F=[...L.items.map((J5)=>({entity:J5,type:"group"})),...f.items.map((J5)=>({entity:J5,type:"role"})),...u.items.map((J5)=>({entity:J5,type:"permission"}))].filter(({entity:J5})=>J5.externalId===X)}if($?.entitlements){let W=await H9($);for(let L of W)if(L.externalId===X)F.push({entity:L,type:"group"})}if(F.length>1)throw new L9(`Ambiguous externalId "${X}": ${F.length} entitlements share it (${F.map((W)=>`${W.type}:${W.entity.id}`).join(", ")})`,"unique_violation","externalId");let B=F[0];if(!B)return;return E5(B.entity,B.type,await O5(J,Z,$,B.type,B.entity.id,Q))}async function L4(J,Z,$,X,Q){let G=Math.max(0,X.start),F=X.limit!=null?G+X.limit:void 0,B={start:0,limit:F,filter:X.filter},[W,L,f]=await Promise.all([J.groups.list(B),J.roles.list(B),J.permissions.list(B)]),u=[...W.items.map((s)=>({entity:s,type:"group"})),...L.items.map((s)=>({entity:s,type:"role"})),...f.items.map((s)=>({entity:s,type:"permission"}))],i=W.total+L.total+f.total,J5=u.slice(G,F),r=0,G5=[];if($?.entitlements){let s=await H9($,X.filter);r=s.length;let $5=X.limit!=null?X.limit-J5.length:void 0;if($5===void 0||$5>0){let j5=Math.max(0,G-i);G5=$5===void 0?s.slice(j5):s.slice(j5,j5+$5)}}let p=[...J5,...G5.map((s)=>({entity:s,type:"group"}))],c=i+r,l=Z?.listByTargets?await Z.listByTargets(p.map(({entity:s,type:$5})=>({targetType:$5,target:s.id}))):void 0,B5=await Promise.all(p.map(async({entity:s,type:$5})=>E5(s,$5,await O5(J,Z,$,$5,s.id,Q,l))));return{resources:B5,total:c,count:B5.length}}async function _1(J,Z,$,X,Q){let[G,F,B]=await Promise.all([J.groups.get(X),J.roles.get(X),J.permissions.get(X)]);if(G)return E5(G,"group",await O5(J,Z,$,"group",X,Q));if(F)return E5(F,"role",await O5(J,Z,$,"role",X,Q));if(B)return E5(B,"permission",await O5(J,Z,$,"permission",X,Q));let W=G1(await $?.entitlement?.(X));if(W)return E5(W,"group",await O5(J,Z,$,"group",X,Q));return}async function Z9(J,Z,$){let X=Q1(Z),G={...(X==="role"?await J.roles.get($):X==="permission"?await J.permissions.get($):await J.groups.get($))??{},...B4(Z,$)},F=X==="role"?J.roles.set(G):X==="permission"?J.permissions.set(G):J.groups.set(G);return await F.ready(),F}async function F4(J,Z){await Promise.all([J.groups.delete(Z),J.roles.delete(Z),J.permissions.delete(Z)])}function u9(){return crypto.randomUUID()}function n5(J,Z){let $=J;if(typeof $.validate==="function")return $.validate(Z);return Promise.resolve(J["~standard"].validate(Z))}function H4(J){if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}}function f5(J){let Z=H4(J);return Z?z1(Z):void 0}function V4(J,Z){let $=f5(J);if($?.endsWith("/Users"))return $.slice(0,-6);let X=f5(Z);if(X?.endsWith("/Groups"))return X.slice(0,-7);return}function y5(J,Z){return new URL(Z,J.url).toString()}function I(J,Z,$,X){let{multiValued:Q=!1,...G}=X??{};return{name:J,type:Z,description:$,multiValued:Q,...G}}function N4(J,Z){return{schemas:[a2],documentationUri:Z?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an Enterprise Standard workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:y5(J.request,`${J.basePath}/ServiceProviderConfig`)}}}function M4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[f9],id:"User",name:"User",description:"User Account",endpoint:J.usersUrl,schema:P1,schemaExtensions:[{schema:h5,required:!1},{schema:I5,required:!1}],meta:{resourceType:"ResourceType",location:y5(J.request,`${J.basePath}/ResourceTypes/User`)}});if(J.supportsGroups)Z.push({schemas:[f9],id:"Group",name:"Group",description:"Group",endpoint:J.groupsUrl,schema:O1,schemaExtensions:[{schema:Y5,required:!1}],meta:{resourceType:"ResourceType",location:y5(J.request,`${J.basePath}/ResourceTypes/Group`)}});return Z}function D4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[Z1],id:P1,name:"User",description:"User Account",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(P1)}`)},attributes:[I("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),I("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),I("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),I("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[I("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),I("familyName","string","The family name of the User.",{multiValued:!1}),I("givenName","string","The given name of the User.",{multiValued:!1}),I("middleName","string","The middle name(s) of the User.",{multiValued:!1}),I("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),I("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),I("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),I("nickName","string","The casual way to address the user.",{multiValued:!1}),I("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),I("title","string","The user title, such as Vice President.",{multiValued:!1}),I("userType","string","The relationship between the organization and the User.",{multiValued:!1}),I("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),I("locale","string","Default location for localizing values.",{multiValued:!1}),I("timezone","string","The User time zone.",{multiValued:!1}),I("active","boolean","The User administrative status.",{multiValued:!1}),I("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[I("value","string","Email address value.",{multiValued:!1,required:!0}),I("display","string","Display label for the email.",{multiValued:!1}),I("type","string","Email type such as work or home.",{multiValued:!1}),I("primary","boolean","Primary email indicator.",{multiValued:!1})]}),I("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[I("value","string","Phone number value.",{multiValued:!1,required:!0}),I("display","string","Display label for the phone number.",{multiValued:!1}),I("type","string","Phone number type.",{multiValued:!1}),I("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),I("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[I("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),I("display","string","Display label for the photo.",{multiValued:!1}),I("type","string","Photo type.",{multiValued:!1}),I("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),I("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[I("formatted","string","Formatted mailing address.",{multiValued:!1}),I("streetAddress","string","Full street address component.",{multiValued:!1}),I("locality","string","City or locality.",{multiValued:!1}),I("region","string","State or region.",{multiValued:!1}),I("postalCode","string","Postal code.",{multiValued:!1}),I("country","string","Country.",{multiValued:!1}),I("type","string","Address type.",{multiValued:!1}),I("primary","boolean","Primary address indicator.",{multiValued:!1})]}),I("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[I("value","string","Group identifier.",{multiValued:!1,required:!0}),I("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),I("display","string","Display name of the group.",{multiValued:!1}),I("type","string","Relationship type.",{multiValued:!1})]}),I("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[I("value","string","Entitlement value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Entitlement type.",{multiValued:!1}),I("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),I("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[I("value","string","Role value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Role type.",{multiValued:!1}),I("primary","boolean","Primary role indicator.",{multiValued:!1})]}),I("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[I("value","string","Certificate value.",{multiValued:!1,required:!0}),I("display","string","Display value.",{multiValued:!1}),I("type","string","Certificate type.",{multiValued:!1}),I("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:h5,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(h5)}`)},attributes:[I("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),I("costCenter","string","Name of a cost center.",{multiValued:!1}),I("organization","string","Name of an organization.",{multiValued:!1}),I("division","string","Name of a division.",{multiValued:!1}),I("department","string","Name of a department.",{multiValued:!1}),I("manager","complex","The User manager.",{multiValued:!1,subAttributes:[I("value","string","Identifier of the manager User resource.",{multiValued:!1}),I("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),I("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:I5,name:"EnterpriseStandardUser",description:"Enterprise Standard User extension carrying the Enterprise Controlled ID (ECID) identity correlator and the account purpose (accountClass). See https://ionite.com/docs/llms-ecid.txt.",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(I5)}`)},attributes:[I("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),I("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1})]}),Z.push({schemas:[Z1],id:Y5,name:"EnterpriseStandardAuthzGroup",description:"Enterprise Standard authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(Y5)}`)},attributes:[I("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),I("requestable","boolean","Whether this catalog entry should be requestable access in IAM tooling.",{multiValued:!1,required:!1}),I("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),I("assignableSubjectTypes","string","AppDev-owned hard ceiling of principal kinds (user, workload) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]}),I("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]})]});if(J.supportsGroups)Z.push({schemas:[Z1],id:O1,name:"Group",description:"Group",meta:{resourceType:"Schema",location:y5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(O1)}`)},attributes:[I("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),I("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),I("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),I("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[I("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),I("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group"]}),I("display","string","Display name of the member.",{multiValued:!1}),I("type","string","Member type.",{multiValued:!1})]})]});return Z}function _4(J,Z,$,X,Q,G,F,B,W,L,f,u,i,J5){let r={authz:X,accessStore:Q,accessIndex:G,catalogStore:F,codeCatalog:B,resources:W,log:Z,iamDelta:u,onAccessMutation:i};if(!L&&!f)return;let p={...L,...f},c=p.users?.enabled!==!1,l=p.groups?.enabled!==!1;if(Boolean(p.url||p.userStore||F||B)&&!$)Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"});function s(){if(!$)throw Z.error("IAM requires workload identity for SCIM push/pull operations",{"es.operation":"workload.require","es.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return $}async function $5(x){let U=s(),h=x.headers.get("Authorization");if(!h?.startsWith("Bearer "))return!1;try{let n=h.substring(7);return(await U.validateToken(n)).valid}catch{return!1}}async function j5(){let x=s(),U=typeof x.getServerToken==="function"?await x.getServerToken():await x.getToken();return new Headers({"Content-Type":Y1,Accept:Y1,Authorization:`Bearer ${U}`})}async function q5(x,U,h,n){if(!p.url)throw Error("IAM URL not configured for outgoing requests");let e=`${p.url}${U}`;try{let t=await j5(),V=await fetch(e,{method:x,headers:t,body:h?JSON.stringify(h):void 0}),A=await V.json();if(!V.ok)return{success:!1,error:A,status:V.status};let K=await n["~standard"].validate(A);if(K.issues)return Z.error("SCIM response validation failed",{"es.operation":"scim.response.validate","es.outcome":"failure",validationIssues:K.issues}),{success:!1,error:{schemas:[Q9],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${K.issues.map((H)=>H.message).join("; ")}`},status:400};return{success:!0,data:K.value,status:V.status}}catch(t){return{success:!1,error:{schemas:[Q9],status:"500",detail:t instanceof Error?t.message:"Unknown error occurred"},status:500}}}function i5(){return p.url}function g5(x,U){let h=f5(U?.usersUrl??p.usersUrl??"/api/iam/Users")??"/api/iam/Users",n=f5(U?.groupsUrl??p.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",e=f5(U?.discovery?.basePath??p.discovery?.basePath)??V4(h,n);if(!e)return;return{request:x,basePath:e,usersUrl:h,groupsUrl:n,supportsUsers:c&&Boolean(p.userStore),supportsGroups:l&&Boolean(F||B)}}async function m5(x){let U=N4(x,p.discovery);return await p.discovery?.buildServiceProviderConfig?.(x,U)??U}async function C5(x){let U=M4(x);return await p.discovery?.buildResourceTypes?.(x,U)??U}async function T5(x){let U=D4(x);return await p.discovery?.buildSchemas?.(x,U)??U}async function p5(x,U){let h=g5(x,U);if(!h)return;let n=z1(new URL(x.url).pathname),{basePath:e}=h;if(n!==e&&!n.startsWith(`${e}/`))return;let t=z1(n.slice(e.length)||"/");if(!(t==="/ServiceProviderConfig"||t==="/ResourceTypes"||t.startsWith("/ResourceTypes/")||t==="/Schemas"||t.startsWith("/Schemas/")))return;if(x.method!=="GET")return k(405,"Method not allowed");if(!await $5(x))return k(401,"Authorization required");if(t==="/ServiceProviderConfig")return H5(await m5(h));if(t==="/ResourceTypes")return d5(await C5(h));if(t.startsWith("/ResourceTypes/")){let K=decodeURIComponent(t.slice(15)),H=(await C5(h)).find((N)=>N.id===K||N.name===K);return H?H5(H):k(404,"Resource not found")}if(t==="/Schemas")return d5(await T5(h));if(t.startsWith("/Schemas/")){let K=decodeURIComponent(t.slice(9)),H=(await T5(h)).find((N)=>N.id===K);return H?H5(H):k(404,"Resource not found")}return}let N5,u5;if(p.url)u5=async(U,h)=>{let n={...U,schemas:U.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return q5("POST","/Users",n,J.user)},N5={createGroup:async(U,h)=>{let n={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:U,externalId:h?.externalId,members:h?.members};return q5("POST","/Groups",n,J.group)}};let S5;if(F||B){let x=G9(B,F),U=async(M)=>{if(!W?.entitlement)return;let[_,D,E]=await Promise.all([x.groups.get(M),x.roles.get(M),x.permissions.get(M)]);if(_||D||E)return;return G1(await W.entitlement(M))},h=(M,_)=>k(403,`Entitlement "${M}" is derived from the application's resource data (ResourceProvider.entitlements); its definition cannot be ${_} through SCIM. Member add/remove is allowed; the definition changes only when the application's resources or derivation logic change.`,"mutability"),n=(M)=>{if(!B)return;let _=B.groups.get(M);if(_)return{entity:_,type:"group"};let D=B.roles.get(M);if(D)return{entity:D,type:"role"};let E=B.permissions.get(M);if(E)return{entity:E,type:"permission"};return},e=(M,_)=>k(403,`Entitlement "${M}" is declared in application code (authz.catalog); its definition cannot be ${_} through SCIM. Member add/remove is allowed; the definition changes only when the application code changes.`,"mutability"),t=(M)=>M.path==="members"||Boolean(M.path?.startsWith("members[")),V=async(M,_)=>{if(!await $5(M))return k(401,"Authorization required");let E=new URL(M.url),P=_?.basePath??"/Groups",w=E.pathname;if(w.startsWith(P))w=w.substring(P.length);let R=w.match(/^\/([^/]+)$/)?.[1],v=M.method;try{if(R)switch(v){case"GET":return await K(R);case"PUT":return await N(M,R);case"PATCH":return await z(M,R);case"DELETE":return await j(R);default:return k(405,"Method not allowed")}else if(w===""||w==="/")switch(v){case"GET":return await A(M);case"POST":return await H(M);default:return k(405,"Method not allowed")}return k(404,"Resource not found")}catch(y){if(y instanceof a5)return h9(y);if($9(y))return k(409,y.message,"uniqueness");return Z.error("Groups inbound handler error",{"es.operation":"scim.groups.handler","es.outcome":"failure"},y),k(500,y instanceof Error?y.message:"Internal server error")}},A=async(M)=>{let _=new URL(M.url),D=_.searchParams.get("startIndex"),E=_.searchParams.get("count"),P=D!=null?parseInt(D,10):void 0,w=E!=null?parseInt(E,10):void 0,q=P!=null&&!Number.isNaN(P)?Math.max(0,P-1):0,R=w!=null&&!Number.isNaN(w)?w:void 0,v=_.searchParams.get("filter"),y=p9(v);if(y!==void 0){let T=await G4(x,Q,W,y,J5),b=T?[T]:[];return d5(b,{totalResults:b.length,startIndex:1,itemsPerPage:b.length})}let Y=W4(v),O=await L4(x,Q,W,{start:q,limit:R,filter:Y},J5);return d5(O.resources,{totalResults:O.total,startIndex:q+1,itemsPerPage:O.count})},K=async(M)=>{let _=await _1(x,Q,W,M,J5);if(!_)return k(404,`Group ${M} not found`,"invalidValue");return H5(_)},H=async(M)=>{let _=await M.json(),D=await n5(J.group,_);if(D.issues)return Z.error("Group creation validation failed",{"es.operation":"scim.group.create","es.outcome":"failure",validationIssues:D.issues}),k(400,`Request validation failed: ${D.issues.map((Y)=>Y.message).join("; ")}`,"invalidValue");let E=D.value;if(!E.displayName)return k(400,"displayName is required","invalidValue");if(!F)return k(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");if(E.externalId){let Y=E.externalId,O=B&&(B.groups.getByExternalId(Y)??B.roles.getByExternalId(Y)??B.permissions.getByExternalId(Y)),T=!O&&W?.entitlements?(await H9(W)).find((S)=>S.externalId===Y):void 0,b=O||T;if(b)throw new L9(`externalId "${Y}" is already used by ${O?"code-declared":"resource-derived"} entitlement "${b.id}"`,"unique_violation","externalId")}let P=Q1(E),w=u9(),q=s1(E),R=X1(new Map,$1(E.members,P,w,q)),v;await k5(r,async()=>{v=await Z9(x,E,w)},R,()=>J9(X,v,P));let y=await O5(x,Q,W,P,w);return H5(E5(v,P,y),201)},N=async(M,_)=>{let D=await M.json(),E=await n5(J.group,D);if(E.issues)return Z.error("Group replacement validation failed",{"es.operation":"scim.group.replace","es.outcome":"failure",validationIssues:E.issues}),k(400,`Request validation failed: ${E.issues.map((C)=>C.message).join("; ")}`,"invalidValue");let P=E.value,w=Q1(P);if(!await _1(x,Q,W,_))return k(404,`Group ${_} not found`,"invalidValue");let R=n(_),v=R?void 0:await U(_),y=R??(v?{entity:v,type:"group"}:void 0);if(y){if($4(P,y.entity,y.type))return R?e(_,"replaced"):h(_,"replaced");let C=j1(y.entity),g=Q?(await Q.listByTarget(y.type,_)).items:[],d=X1(m9(g),$1(P.members,y.type,_,C));await k5(r,async()=>{},d);let a=await O5(x,Q,W,y.type,_);return H5(E5(y.entity,y.type,a))}let Y=s1(P),O=Q?(await Q.listByTarget(w,_)).items:[],T=X1(m9(O),$1(P.members,w,_,Y)),b;await k5(r,async()=>{b=await Z9(x,P,_)},T,()=>J9(X,b,w));let S=await O5(x,Q,W,w,_);return H5(E5(b,w,S))},z=async(M,_)=>{let D=await _1(x,Q,W,_);if(!D)return k(404,`Group ${_} not found`,"invalidValue");let E=n(_),P=E?void 0:await U(_),w=E??(P?{entity:P,type:"group"}:void 0),q=await M.json();if(w&&(q.Operations??[]).some((S)=>!t(S)))return E?e(_,"patched"):h(_,"patched");let R={...D};for(let S of q.Operations??[])if(S.op==="replace"&&S.path&&S.value!==void 0){if(S.path==="displayName")R.displayName=S.value;else if(S.path===`${Y5}.requestable`)R[Y5]={...R[Y5],requestable:Boolean(S.value)};else if(S.path===`${Y5}.description`)R[Y5]={...R[Y5],description:String(S.value)}}else if(S.op==="add"&&S.path==="members"&&S.value!==void 0){let C=S.value;R.members=[...R.members??[],...C]}else if(S.op==="remove"&&S.path?.startsWith("members[")){let C=S.path.match(/members\[value eq "([^"]+)"\]/);if(C)R.members=(R.members??[]).filter((g)=>g.value!==C[1])}let v=await n5(J.group,R);if(v.issues)return Z.error("Group patch validation failed",{"es.operation":"scim.group.patch","es.outcome":"failure",validationIssues:v.issues}),k(400,`Request validation failed: ${v.issues.map((S)=>S.message).join("; ")}`,"invalidValue");let y=Q1(R),Y=w?j1(w.entity):s1(R),O=X1($1(D.members,y,_,Y),$1(R.members,y,_,Y)),T;await k5(r,async()=>{if(!w)T=await Z9(x,R,_)},O,w?void 0:()=>J9(X,T,y));let b=await O5(x,Q,W,y,_);return H5(E5(w?.entity??T,y,b))},j=async(M)=>{let _=await _1(x,Q,W,M);if(!_)return k(404,`Group ${M} not found`,"invalidValue");if(n(M))return e(M,"deleted");if(await U(M))return h(M,"deleted");let D=Q1(_);if(Q){let E=await Q.listByTarget(D,M),P=[];for(let w of E.items)await E1(r,w,P);await K9(r,P)}return await F4(x,M),new Response(null,{status:204})};S5={handler:V}}let L5;if(p.userStore){let{userStore:x,inboundUsers:U}=p,h=(Y)=>Y?.find((O)=>O.primary)?.value||Y?.[0]?.value,n=(Y)=>{if(Y.scimName)return Y.scimName;if(!Y.name)return;let[O,...T]=Y.name.split(" ");return{givenName:O,familyName:T.join(" ")||void 0}},e=(Y)=>Object.keys(Y.scimSchemaExtensions??{}).filter((O)=>O.startsWith("urn:")&&Y.scimSchemaExtensions?.[O]!==void 0),t=(Y)=>{let O={};if(Y.ecid!==void 0)O.ecid=Y.ecid;if(Y.accountClass!==void 0)O.accountClass=Y.accountClass;return O.ecid!==void 0||O.accountClass!==void 0?O:void 0},V=(Y)=>{let O=new Set([P1]);if(Y.scimEnterprise!==void 0)O.add(h5);if(t(Y)!==void 0)O.add(I5);for(let T of e(Y))O.add(T);return Array.from(O)},A=(Y)=>{let O={};if(Y.scimEnterprise!==void 0)O[h5]=Y.scimEnterprise;let T=t(Y);if(T!==void 0)O[I5]=T;for(let[b,S]of Object.entries(Y.scimSchemaExtensions??{}))if(b.startsWith("urn:")&&b!==I5&&S!==void 0)O[b]=S;return O},K=(Y)=>{let O=Y.userName||Y.email||Y.id||"",T=Y.emails??(Y.email?[{value:Y.email,primary:!0}]:[]);return{schemas:V(Y),id:Y.id,externalId:Y.externalId,userName:O,displayName:Y.displayName??Y.name??O,name:n(Y),nickName:Y.nickName,profileUrl:Y.avatar,title:Y.title,userType:Y.userType,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active??!0,emails:T,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,meta:{resourceType:"User",created:(Y.createdAt??Y.updatedAt??new Date).toISOString(),lastModified:(Y.updatedAt??Y.createdAt??new Date).toISOString()},...A(Y)}},H=async(Y)=>{if(U?.mapBaseUserToScim)return await U.mapBaseUserToScim(Y);return K(Y)},N=async(Y,O)=>{if(U?.mapValidatedScimToBaseUser)return await U.mapValidatedScimToBaseUser(Y,O);let T=new Date,b=h(Y.emails),S=Y.name?.formatted||[Y.name?.givenName,Y.name?.middleName,Y.name?.familyName].filter(Boolean).join(" ").trim()||Y.displayName,C=Y.id||O.existing?.id||u9(),g=Y.userName||b||O.existing?.userName||C,d=S||Y.displayName||O.existing?.name||g,a=Object.fromEntries(Object.entries(Y).filter(([P5,v5])=>P5.startsWith("urn:")&&P5!==h5&&P5!==I5&&v5!==void 0)),Z5=Y[I5],t5=Z5?.ecid!==void 0&&Z5.ecid!==null?A1(Z5.ecid):O.existing?.ecid,z5=Z5?.accountClass??O.existing?.accountClass,o=O.existing?.sso;return{...O.existing??{},id:C,userName:g,name:d,email:b||O.existing?.email||g,avatar:Y.profileUrl,sso:{...o??{},profile:{...o?.profile??{},sub:C,iss:o?.profile.iss??"iam-provisioned",aud:o?.profile.aud??"iam-provisioned",exp:o?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:o?.profile.iat??Math.floor(Date.now()/1000),email:b||O.existing?.email||g,email_verified:!0,name:d,preferred_username:g},tenant:o?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:o?.scope??"openid profile email",tokenType:o?.tokenType??"Bearer",expires:o?.expires??new Date(Date.now()+3600000)},externalId:Y.externalId,ecid:t5,accountClass:z5,displayName:Y.displayName,scimName:Y.name,emails:Y.emails,nickName:Y.nickName,title:Y.title,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,scimEnterprise:Y[h5],scimSchemaExtensions:Object.keys(a).length>0?a:void 0,createdAt:O.existing?.createdAt??(Y.meta?.created?new Date(Y.meta.created):T),updatedAt:Y.meta?.lastModified?new Date(Y.meta.lastModified):T,userType:Y.userType}},z=(Y,O,T)=>{Y[O]=T},j=(Y,O,T)=>{let b=Y[O];if(Array.isArray(b)){Y[O]=[...b,...Array.isArray(T)?T:[T]];return}if(b&&typeof b==="object"&&!Array.isArray(b)&&T&&typeof T==="object"&&!Array.isArray(T)){Y[O]={...b,...T};return}Y[O]=T},M=(Y,O,T)=>{let b=O.match(/^(urn:.*:(?:User|Group))(?::(.+))?$/),S=b?[b[1],...b[2]?.split(":")??[]]:O.split("."),C=Y;for(let d of S.slice(0,-1)){let a=C[d];if(a===void 0){if(!T)return null;C[d]={}}else if(a===null||typeof a!=="object"||Array.isArray(a)){if(!T)return null;C[d]={}}C=C[d]}let g=S.at(-1);if(!g)return null;return{parent:C,key:g}},_=(Y,O)=>{let T=O.op.toLowerCase();if(!O.path){if(T!=="remove"&&O.value&&typeof O.value==="object"&&!Array.isArray(O.value))Object.assign(Y,O.value);return}let b=O.path.match(/^([A-Za-z0-9]+)\[value eq "([^"]+)"\]$/);if(b&&T==="remove"){let[,C,g]=b,d=Y[C];if(Array.isArray(d))Y[C]=d.filter((a)=>!(a&&typeof a==="object"&&("value"in a)&&a.value===g));return}let S=M(Y,O.path,T!=="remove");if(!S)return;if(T==="remove"){delete S.parent[S.key];return}if(T==="add"){j(S.parent,S.key,O.value);return}z(S.parent,S.key,O.value)},D=async(Y,O)=>{if(!await $5(Y))return k(401,"Authorization required");let b=new URL(Y.url),S=O?.basePath??"/Users",C=b.pathname;if(C.startsWith(S))C=C.substring(S.length);let d=C.match(/^\/([^/]+)$/)?.[1],a=Y.method;try{if(d)switch(a){case"GET":return await P(d);case"PUT":return await R(Y,d);case"PATCH":return await v(Y,d);case"DELETE":return await y(d);default:return k(405,"Method not allowed")}else if(C===""||C==="/")switch(a){case"GET":return await E(Y);case"POST":return await q(Y);default:return k(405,"Method not allowed")}return k(404,"Resource not found")}catch(Z5){if(Z5 instanceof a5)return h9(Z5);if($9(Z5))return k(409,Z5.message,"uniqueness");return Z.error("Users inbound handler error",{"es.operation":"scim.users.handler","es.outcome":"failure"},Z5),k(500,Z5 instanceof Error?Z5.message:"Internal server error")}},E=async(Y)=>{let O=new URL(Y.url),T=O.searchParams.get("startIndex"),b=O.searchParams.get("count"),S=T!=null?parseInt(T,10):void 0,C=b!=null?parseInt(b,10):void 0,g=S!=null&&!Number.isNaN(S)?Math.max(0,S-1):0,d=C!=null&&!Number.isNaN(C)?C:void 0,a=p9(O.searchParams.get("filter"));if(a!==void 0){let z5=await x.lookup({externalId:a}),o=z5?[await H(z5)]:[];return d5(o,{totalResults:o.length,startIndex:1,itemsPerPage:o.length})}let Z5=await x.list({start:g,limit:d}),t5=await Promise.all(Z5.items.map((z5)=>H(z5)));return d5(t5,{totalResults:Z5.total,startIndex:g+1,itemsPerPage:Z5.count})},P=async(Y)=>{let O=await x.get(Y);if(!O)return k(404,`User ${Y} not found`,"invalidValue");return H5(await H(O))},w=async(Y,O)=>{let T=r.accessIndex;if(!T?.setSubjectDisabled||!O.id)return;let b=Y?Y.active??!0:!0,S=O.active??!0;if(Y&&b===S)return;if(!Y&&S)return;await T.setSubjectDisabled(O.id,"user",!S)},q=async(Y)=>{let O=await Y.json(),T=await n5(J.user,O);if(T.issues)return Z.error("User creation validation failed",{"es.operation":"scim.user.create","es.outcome":"failure",validationIssues:T.issues}),k(400,`Request validation failed: ${T.issues.map((C)=>C.message).join("; ")}`,"invalidValue");let b=T.value;if(!b.userName&&!b.emails?.[0]?.value)return k(400,"userName or email is required","invalidValue");let S=await N(b,{mode:"create"});return await k5(r,async()=>{await x.upsert(S),await w(void 0,S)},r1(void 0,S),async()=>{await e1(X,S)}),H5(await H(S),201)},R=async(Y,O)=>{let T=await x.get(O);if(!T)return k(404,`User ${O} not found`,"invalidValue");let b=await Y.json(),S=await n5(J.user,b);if(S.issues)return Z.error("User replacement validation failed",{"es.operation":"scim.user.replace","es.outcome":"failure",validationIssues:S.issues}),k(400,`Request validation failed: ${S.issues.map((d)=>d.message).join("; ")}`,"invalidValue");let C=S.value,g=await N({...C,id:O},{existing:T,mode:"replace"});return g.createdAt=T.createdAt,g.updatedAt=new Date,await k5(r,async()=>{await x.upsert(g),await w(T,g)},r1(T,g),async()=>{await e1(X,g)}),H5(await H(g))},v=async(Y,O)=>{let T=await x.get(O);if(!T)return k(404,`User ${O} not found`,"invalidValue");let S=(await Y.json()).Operations??[],g={...await H(T)};for(let Z5 of S)_(g,Z5);let d=await n5(J.user,g);if(d.issues)return Z.error("User patch validation failed",{"es.operation":"scim.user.patch","es.outcome":"failure",validationIssues:d.issues}),k(400,`Request validation failed: ${d.issues.map((Z5)=>Z5.message).join("; ")}`,"invalidValue");let a=await N(d.value,{existing:T,mode:"patch"});return a.updatedAt=new Date,await k5(r,async()=>{await x.upsert(a),await w(T,a)},r1(T,a),async()=>{await e1(X,a)}),H5(await H(a))},y=async(Y)=>{if(!await x.get(Y))return k(404,`User ${Y} not found`,"invalidValue");if(Q){let T=await Q.listBySubject(Y,"user"),b=[];for(let S of T.items)await E1(r,S,b);await K9(r,b)}if(await x.delete(Y),await r.accessIndex?.setSubjectDisabled?.(Y,"user",!1),r.authz.oaa.isReady())await F9(r,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>r.authz.oaa.deleteUser(Y),{id:Y,kind:"user"});return new Response(null,{status:204})};L5={handler:D}}async function M5(x,U){s();let h=new URL(x.url).pathname,n=f5(U?.usersUrl??p.usersUrl??"/api/iam/Users")??"/api/iam/Users",e=f5(U?.groupsUrl??p.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",t=await p5(x,U);if(t)return t;let V=(A)=>h===A||h.startsWith(`${A}/`);if(V(n)){if(!c)return k(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!L5)return k(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return L5.handler(x,{basePath:n})}if(V(e)){if(!l)return k(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!S5)return k(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return S5.handler(x,{basePath:e})}return k(404,"Resource not found")}return{...p,createUser:u5,getBaseUrl:i5,groups_outbound:N5,groups_inbound:S5,users_inbound:L5,handler:M5,delta:u}}function V9(J,Z){let $=new TextEncoder().encode(J),X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Q=new Uint8Array($.length+1+X.length);return Q.set($,0),Q[$.length]=46,Q.set(X,$.length+1),Q}function z4(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.length%4===0?"":"=".repeat(4-Z.length%4),X=atob(Z+$),Q=new Uint8Array(X.length);for(let G=0;G<X.length;G++)Q[G]=X.charCodeAt(G);return Q}function P4(J){let Z="";for(let $ of J)Z+=String.fromCharCode($);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function c9(J){let Z=JSON.parse(J);if(!Z||typeof Z!=="object"||!Array.isArray(Z.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return Z}function O4(J){return JSON.stringify(J)}async function E4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x},{name:"Ed25519"},!0,["verify"])}async function j4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x,d:J.d},{name:"Ed25519"},!0,["sign"])}async function A4(J){let $=(typeof J.jwks==="string"?c9(J.jwks):J.jwks).keys.find((X)=>X.kid===J.kid&&X.kty==="OKP"&&X.crv==="Ed25519");if(!$?.x)return!1;try{let X=await E4($),Q=V9(J.requestId,J.rawBody),G=z4(J.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},X,G,Q)}catch{return!1}}async function w4(J){let Z=await j4(J.privateKeyJwk),$=V9(J.requestId,J.rawBody),X=await crypto.subtle.sign({name:"Ed25519"},Z,$);return P4(new Uint8Array(X))}async function I4(J){let Z=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),$=await crypto.subtle.exportKey("jwk",Z.privateKey),Q=(await crypto.subtle.exportKey("jwk",Z.publicKey)).x,G=$.d;if(!Q||!G)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:Q,d:G,kid:J,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:Q,kid:J,alg:"EdDSA",use:"sig"}]}}}var L1={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function I1(J,Z){if(typeof J!=="number"||!Number.isFinite(J))return Z.default;let $=Math.floor(J);if($<Z.min)return Z.min;if($>Z.max)return Z.max;return $}function d9(J){return{ttlMs:I1(J?.ttlSeconds,L1.jwksTtlSeconds)*1000,maxEntries:I1(J?.maxEntries,L1.jwksMaxEntries)}}function n9(J){let Z=J?.read;return{read:{enabled:Z?.enabled===!0,ttlMs:I1(Z?.ttlSeconds,L1.sessionReadTtlSeconds)*1000,maxEntries:I1(Z?.maxEntries,L1.sessionReadMaxEntries)}}}function T4(J){return{jwks:d9(J?.jwks),session:n9(J?.session)}}function S4(J){let Z={};if(!J)return Z;let $=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let G=Q.indexOf("=");if(G===-1)continue;Z[Q.slice(0,G).trim()]=Q.slice(G+1).trim()}return Z}function a9(J){if(!J.expiresAt)return!1;let Z=J.expiresAt instanceof Date?J.expiresAt:new Date(J.expiresAt);return!Number.isNaN(Z.getTime())&&Date.now()>Z.getTime()}function R4(J){if(!J||typeof J!=="object"||Array.isArray(J))return;let{access_token:Z,id_token:$,refresh_token:X,tokens:Q,...G}=J;return G}function _5(J,Z){let $=J[Z];return typeof $==="string"?$:""}function x4(J,Z){let $=J.exp;if(typeof $==="number")return new Date($*1000);if(typeof $==="string"&&$.trim()){let X=Number($);if(!Number.isNaN(X))return new Date(X*1000)}if(Z instanceof Date)return Z;if(Z){let X=new Date(Z);if(!Number.isNaN(X.getTime()))return X}return new Date}function y4(J){let Z=J.claims;if(!Z?.sub||typeof Z.sub!=="string")return;let $=x4(Z,J.expiresAt);if(J.authType==="sso")return{id:Z.sub,userName:_5(Z,"preferred_username"),name:_5(Z,"name"),email:_5(Z,"email"),avatar:_5(Z,"picture")||void 0,sso:{profile:Z,tenant:{id:_5(Z,"idp")||_5(Z,"iss"),name:_5(Z,"iss")},tokenType:"Bearer",expires:$}};return{id:Z.sub,userName:_5(Z,"preferred_username"),name:_5(Z,"name"),email:_5(Z,"email"),avatar:_5(Z,"picture")||void 0,userType:"customer",ciam:{profile:Z,scope:"openid profile email",tokenType:"Bearer",expires:$}}}function b4(J){if(J.authType!=="sso"&&J.authType!=="ciam")return;if(a9(J))return;return{sid:J.sid,authType:J.authType,tenantId:typeof J.tenantId==="string"?J.tenantId:void 0,sub:J.sub,expiresAt:J.expiresAt,createdAt:J.createdAt,claims:R4(J.claims)}}function q4(J,Z){if(!J.endsWith(".session"))return!1;if(!Z||Z.length===0)return!0;return Z.some(($)=>J===`${$}.session`)}function C4(J){if(J===void 0)return;let Z=(Array.isArray(J)?J:[J]).map(($)=>$.trim()).filter(($)=>$.length>0);return Z.length>0?Z:void 0}async function i9(J,Z,$){return(await t9(J,Z,$)).map(b4).filter((Q)=>Boolean(Q))}async function t9(J,Z,$){let X=S4(J.headers.get("cookie")),Q=C4($?.cookiesPrefix),G=[],F=new Set;for(let[B,W]of Object.entries(X)){if(!q4(B,Q)||!W)continue;if(F.has(W))continue;F.add(W);let L=await Z.get(W);if(!L)continue;if(L.authType!=="sso"&&L.authType!=="ciam")continue;if(a9(L))continue;G.push(L)}return G}async function v4(J,Z,$){return(await i9(J,Z,$)).map(y4).filter((Q)=>Boolean(Q))}var U4="@enterprisestandard/core",k4=c5(D1(U4));async function f4(J,Z){let $=await R5({idToken:J,jwksUri:Z.jwksUri,issuer:Z.issuer,audience:Z.audience}),X=await k4.validate($);if(X.issues)throw Error(`ID token claims validation failed: ${X.issues.map((F)=>F.message).join("; ")}`);let Q=X.value;if(Q===void 0)throw Error("ID token claims missing");return o9(Q)}function K5(J){return Date.now()-J}function N9(J){if(J instanceof Error)return{"error.name":J.name,"error.message":J.message};return{"error.name":typeof J,"error.message":String(J)}}function T1(J,Z){if(!J)return{};try{let $=new URL(J);return{[`${Z}.origin`]:$.origin,[`${Z}.path`]:$.pathname}}catch{return{[`${Z}.path`]:J.startsWith("/")?J:`/${J}`}}}function S1(J,Z=5){if(!Array.isArray(J))return[String(J)];return J.slice(0,Z).map(($)=>{if(!$||typeof $!=="object")return String($);let X=$,Q=Array.isArray(X.path)?X.path.join("."):String(X.path??""),G=typeof X.message==="string"?X.message:String(X.message??"validation failed");return Q?`${Q}: ${G}`:G})}function h4(J){if(!J||typeof J!=="object")return{};let Z=J;return{oidc_error:typeof Z.error==="string"?Z.error:void 0,oidc_error_description:typeof Z.error_description==="string"?Z.error_description:void 0,oidc_error_uri:typeof Z.error_uri==="string"?Z.error_uri:void 0}}function g4(J,Z={}){let $=typeof J==="string"?J:J?.headers.get("cookie")??void 0;if(!$)return[];let Q=`${Z.cookiePrefix??"es.sso"}.`,G=new Set;for(let F of Object.keys(p4($))){if(!F.startsWith(Q))continue;let B=F.slice(Q.length),W=B.lastIndexOf(".");if(W<=0)continue;let L=B.slice(0,W).trim();if(L)G.add(L)}return Array.from(G)}function m4(J,Z,$,X,Q){if(!$&&!X)return;let G=new WeakMap,F=new Map,B={...$,...X},W=!!(B.authority&&B.tokenUrl&&B.authorizationUrl&&B.clientId&&B.redirectUri&&B.scope),L={...B,authority:W?m(B.authority,"Missing 'authority' from SSO Config"):B.authority,tokenUrl:W?m(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"):B.tokenUrl,authorizationUrl:W?m(B.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):B.authorizationUrl,clientId:W?m(B.clientId,"Missing 'clientId' from SSO Config"):B.clientId,redirectUri:W?m(B.redirectUri,"Missing 'redirectUri' from SSO Config"):B.redirectUri,scope:W?m(B.scope,"Missing 'scope' from SSO Config"):B.scope,responseType:B.responseType??"code",cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.clientId?`es.sso.${B.clientId}`:"es.sso"),cookiesPath:B.cookiesPath??"/"},f=Math.min(600,Math.max(0,Math.floor(Number(L.rotationGraceSeconds??60))||0))*1000;function u(){let V=[];if(!L.authority)V.push("authority");if(!L.tokenUrl)V.push("tokenUrl");if(!L.authorizationUrl)V.push("authorizationUrl");if(!L.clientId)V.push("clientId");if(!L.redirectUri)V.push("redirectUri");if(!L.scope)V.push("scope");if(V.length>0)throw Error(`Missing OIDC configuration fields: ${V.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function i(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A=G.get(V);if(A)return A;let K=J5(V);return G.set(V,K),K}async function J5(V){try{let{tokens:A,session:K,refreshedUser:H}=await M5(V);if(!A)return{status:"unauthenticated"};if(H)return{status:"authenticated",value:H};if(K?.claims)return{status:"authenticated",value:$5(K.claims,A,N5(K.expiresAt))};return{status:"unauthenticated"}}catch(A){if(r9(A))return{status:"unauthenticated"};return Z.error("Error parsing user from cookies",{"es.operation":"cookie.parse","es.outcome":"degraded"},A),{status:"degraded",error:A instanceof Error?A:void 0}}}async function r(V){let A=await i(V);return A.status==="authenticated"?A.value:void 0}async function G5(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let A=m(L.redirectUri,"Missing 'redirectUri' from SSO Config"),K=m(L.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),H=m(L.clientId,"Missing 'clientId' from SSO Config"),N=m(L.scope,"Missing 'scope' from SSO Config"),z=L.cookiesSecure?V.url.replace(/^http:\/\//,"https://"):V.url,j=D5(),M=D5(64),_=D5(),D=A;try{new URL(D)}catch{if(z)try{let R=new URL(z),v=D.startsWith("//")?D.slice(1):D.startsWith("/")?D:`/${D}`;D=new URL(v,R.origin).toString()}catch{try{let R=new URL(K),v=D.startsWith("//")?D.slice(1):D.startsWith("/")?D:`/${D}`;D=new URL(v,R.origin).toString()}catch{throw Error(`Invalid redirectUri: "${A}". It must be a valid absolute URL.`)}}}let E=new URL(K);E.searchParams.append("client_id",H),E.searchParams.append("redirect_uri",D),E.searchParams.append("response_type","code"),E.searchParams.append("scope",N),E.searchParams.append("state",j),E.searchParams.append("nonce",_);let P=await J1(M);E.searchParams.append("code_challenge",P),E.searchParams.append("code_challenge_method","S256");let w=await L.beforeLogin?.({request:V}),q=w===void 0?{state:j,codeVerifier:M,nonce:_}:{state:j,codeVerifier:M,nonce:_,context:w};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:E.toString(),"Set-Cookie":U(e(j),q,L.loginStateTtl??600,"Lax")}})}async function p(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A;try{A=await r(V)}catch{A=void 0}let K=await L.beforeLogout?.({request:V,user:A}),H=n("session",V),N;try{N=await M5(V);let P=N.tokens?.refresh_token??n("refresh",V);if(P)await g5(P)}catch(P){Z.warn("Failed to revoke token",{"es.operation":"token.revoke","es.outcome":"degraded"},P)}if(L.sessionStore)try{let P=N?.sid??H;if(P)await L.sessionStore.delete(P)}catch(P){Z.warn("Failed to delete session",{"es.operation":"session.delete","es.outcome":"degraded"},P)}let z=[["Set-Cookie",h("session")]],j=await L.afterLogout?.({request:V,context:K}),M=x5(j,"/",V.url);if(M.response){let P=new Headers(M.response.headers);for(let[,w]of z)P.append("Set-Cookie",w);return new Response(M.response.body,{status:M.response.status,statusText:M.response.statusText,headers:P})}let _=M.location??"/",D=V.headers.get("accept");if(D?.includes("application/json")||D?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...z]});return new Response("Logged out",{status:302,headers:[["Location",_],...z]})}async function c(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(!L.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!V.headers.get("content-type")?.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let K=await V.text(),N=new URLSearchParams(K).get("logout_token");if(!N)return new Response("Missing logout_token parameter",{status:400});let z=m(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),j=m(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),M=L.jwksUri||`${z}/protocol/openid-connect/certs`,_=await d1({logoutToken:N,jwksUri:M,issuer:z,audience:j,log:Z}),D=typeof _.sid==="string"?_.sid:void 0;if(!D)return Z.warn("Back-Channel Logout: logout_token missing sid claim",{"es.operation":"backchannel_logout","es.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await L.sessionStore.delete(D),Z.info("Back-Channel Logout: successfully deleted session",{"es.module":"sso",sid:D}),new Response("OK",{status:200})}catch(A){return Z.error("Error during back-channel logout",{"es.operation":"backchannel_logout","es.outcome":"failure"},A),new Response("Internal Server Error",{status:500})}}async function l(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let A=Date.now(),K=new URL(V.url),H=new URLSearchParams(K.search);Z.debug("SSO callback received",{"es.event":"es.sso.callback.received","es.module":"sso","es.operation":"sign_in.callback","http.method":V.method,"url.path":K.pathname,hasCode:H.has("code"),hasState:H.has("state"),hasError:H.has("error"),...T1(H.get("iss")??void 0,"oidc.issuer")});let N=Object.fromEntries(H.entries()),z=await J.callbackParams.validate(N);if(z.issues)return Z.warn("SSO callback parameter validation failed",{"es.event":"es.sso.callback.validation_failed","es.operation":"sign_in.callback","es.outcome":"failure","validation.issues":S1(z.issues)}),s9(z.issues,"OIDC callback parameters validation failed");let{code:j,state:M}=z.value,_;try{let D=m(M,'OIDC "state" was not present in the callback parameters'),E=n(e(D),V,!0),{codeVerifier:P,state:w,nonce:q,context:R}=E??{};_=R,Z.debug("SSO callback state cookie read",{"es.event":"es.sso.callback.state_cookie_read","es.module":"sso","es.operation":"sign_in.callback",hasStateCookie:Boolean(E),hasCodeVerifier:Boolean(P),hasStateVerifier:Boolean(w),hasNonce:Boolean(q),hasContext:R!==void 0});let v=m(P,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');m(w,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let y=m(q,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),Y=m(j,'OIDC "code" was not present in the callback parameters');if(M!==w)throw Z.warn("SSO callback state verification failed",{"es.event":"es.sso.callback.state_verification_failed","es.operation":"sign_in.callback","es.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');Z.debug("SSO callback state verified",{"es.event":"es.sso.callback.state_verified","es.module":"sso","es.operation":"sign_in.callback"});let O=L.cookiesSecure?V.url.replace(/^http:\/\//,"https://"):V.url,T=await q5(Y,v,O),{tokenExpiresAt:b,sessionExpiresAt:S}=B5(T);T.expires=b.toISOString();let C=Date.now();Z.debug("SSO ID token parsing started",{"es.event":"es.sso.id_token.parse_started","es.module":"sso","es.operation":"id_token.parse"});let g=await s(T,y,S);Z.debug("SSO ID token parsing completed",{"es.event":"es.sso.id_token.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":K5(C),"user.id":g.id});let d,a;{let o=T5("SSO requires sessionStore configuration for opaque session cookies."),P5=typeof g.sso.profile.sid==="string"?g.sso.profile.sid:void 0,v5=P5||D5(32),F5=g.id;if(Z.debug("SSO session creation evaluated",{"es.event":"es.sso.session.create_evaluated","es.module":"sso","es.operation":"session.create",hasSid:Boolean(v5),hasIdpSid:Boolean(P5),hasSub:Boolean(F5),"user.id":F5}),!F5)throw Error("Session creation failed: missing sub in ID token claims");let x1=Date.now(),F1={sid:v5,sub:F5,idpSid:P5,authType:"sso",tenantId:L.tenantId,tokens:T,claims:g.sso.profile,expiresAt:S,createdAt:new Date};await p5(o,F1),a=F1,d=["Set-Cookie",U("session",v5,S)],Z.info("SSO session created",{"es.event":"es.sso.session.created","es.operation":"session.create","es.outcome":"success","duration.ms":K5(x1),"user.id":F5})}if(L.userStore)try{let o=g.id;if(o){let P5=new Date,v5=Date.now();Z.debug("SSO user store lookup started",{"es.event":"es.sso.user.lookup_started","es.module":"sso","es.operation":"user.lookup","user.id":o});let F5=await L.userStore.get(o);if(Z.debug("SSO user store lookup completed",{"es.event":"es.sso.user.lookup_completed","es.module":"sso","es.operation":"user.lookup","duration.ms":K5(v5),"user.id":o,found:Boolean(F5)}),F5||L.enableJitUserProvisioning){let x1=Date.now(),F1={...F5??{},...g,id:o,tenantId:F5?.tenantId,createdAt:F5?.createdAt??P5,updatedAt:P5};await L.userStore.upsert(F1),Z.info("SSO user stored",{"es.event":"es.sso.user.stored","es.operation":"user.store","es.outcome":"success","duration.ms":K5(x1),"user.id":o,existing:Boolean(F5),jitProvisioning:Boolean(L.enableJitUserProvisioning)})}else Z.warn("JIT user provisioning disabled: user not found in store and will not be created",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped","user.id":o})}else Z.warn("User storage skipped: missing sub in ID token claims",{"es.event":"es.sso.user.skipped","es.operation":"user.store","es.outcome":"skipped"})}catch(o){Z.warn("Failed to store user",{"es.event":"es.sso.user.store_failed","es.operation":"user.store","es.outcome":"degraded",...N9(o)})}Z.info("SSO sign-in succeeded",{"es.event":"es.sso.sign_in.succeeded","es.operation":"sign_in.callback","es.outcome":"success","duration.ms":K5(A),"user.id":g.id});let Z5=[["Set-Cookie",h(e(D))],...d?[d]:[]],t5=await L.afterLogin?.({ok:!0,request:V,user:g,session:a,context:_}),z5=x5(t5,"/",V.url);if(z5.response)return U5(z5.response,Z5.map(([,o])=>o));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",z5.location],...Z5]})}catch(D){Z.error("Error during sign-in callback",{"es.event":"es.sso.sign_in.callback_failed","es.operation":"sign_in.callback","es.outcome":"failure","duration.ms":K5(A),...N9(D)});let E=M?[["Set-Cookie",h(e(M))]]:[],P=await L.afterLogin?.({ok:!1,request:V,error:D,context:_}),w=x5(P,"/",V.url);if(w.response)return U5(w.response,E.map(([,q])=>q));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",w.location],...E]})}}function B5(V){let A=Date.now(),K=Number(V.expires_in??3600)||3600,H=new Date(A+K*1000),N;if(V.refresh_expires_in!=null&&Number.isFinite(Number(V.refresh_expires_in)))N=Number(V.refresh_expires_in);else if(V.refresh_token)N=86400;else N=K;return{tokenExpiresAt:H,sessionExpiresAt:new Date(A+N*1000)}}async function s(V,A,K){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let H=Date.now(),N=await C5(V.id_token,A);return Z.debug("SSO user parsed from ID token",{"es.event":"es.sso.user.parse_completed","es.module":"sso","es.operation":"id_token.parse","duration.ms":K5(H),"user.id":N.sub,hasEmail:Boolean(N.email),hasName:Boolean(N.name)}),$5(N,V,K)}function $5(V,A,K){let H=K??B5(A).sessionExpiresAt,N=V.ecid!==void 0&&V.ecid!==null?A1(V.ecid):void 0;return{id:V.sub,userName:V.preferred_username||"",name:V.name||"",email:V.email||"",emails:[{value:V.email||"",primary:!0}],...N?{ecid:N}:{},avatar:V.picture,sso:{profile:{...V},tenant:{id:V.idp||V.iss||"",name:V.iss||""},scope:A.scope,tokenType:A.token_type,sessionState:A.session_state,expires:H}}}async function j5(V){if(!L.userStore)return V;let A=await L.userStore.lookup(V);if(!A)return V;return{...V,...A,id:V.id,sso:V.sso}}async function q5(V,A,K){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let H=m(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),N=m(L.redirectUri,"Missing 'redirectUri' from SSO Config"),z=m(L.clientId,"Missing 'clientId' from SSO Config"),j=N;try{new URL(j)}catch{if(K)try{let _=new URL(K),D=j.startsWith("//")?j.slice(1):j.startsWith("/")?j:`/${j}`;j=new URL(D,_.origin).toString()}catch{try{let _=new URL(H),D=j.startsWith("//")?j.slice(1):j.startsWith("/")?j:`/${j}`;j=new URL(D,_.origin).toString()}catch{throw Error(`Invalid redirectUri: "${N}". It must be a valid absolute URL.`)}}}let M=new URLSearchParams;if(M.append("grant_type","authorization_code"),M.append("code",V),M.append("redirect_uri",j),M.append("client_id",z),L.clientSecret)M.append("client_secret",L.clientSecret);M.append("code_verifier",A);try{let _=Date.now();Z.debug("SSO token exchange started",{"es.event":"es.sso.token.exchange_started","es.module":"sso","es.operation":"token.exchange",...T1(H,"oidc.token_url"),...T1(j,"oidc.redirect_uri"),hasClientSecret:Boolean(L.clientSecret)});let D=await fetch(H,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:M.toString()});Z.debug("SSO token exchange response received",{"es.event":"es.sso.token.response_received","es.module":"sso","es.operation":"token.exchange","http.status_code":D.status,"duration.ms":K5(_)}),Z.debug("SSO token exchange response body read started",{"es.event":"es.sso.token.response_body_read_started","es.module":"sso","es.operation":"token.exchange"});let E=await D.json();if(Z.debug("SSO token exchange response body read completed",{"es.event":"es.sso.token.response_body_read_completed","es.module":"sso","es.operation":"token.exchange","duration.ms":K5(_)}),!D.ok){Z.error("Token exchange error",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure","http.status_code":D.status,"duration.ms":K5(_),...h4(E)});let w=E;throw Error(`Token exchange failed: ${w.error||D.statusText} - ${w.error_description||""}`.trim())}let P=await J.tokenResponse.validate(E);if(P.issues)throw Z.error("Token response validation failed",{"es.event":"es.sso.token.response_validation_failed","es.operation":"token.exchange","es.outcome":"failure","duration.ms":K5(_),"validation.issues":S1(P.issues)}),Error(`Token response validation failed: ${P.issues}`);return Z.debug("SSO token exchange completed",{"es.event":"es.sso.token.exchange_completed","es.module":"sso","es.operation":"token.exchange","es.outcome":"success","duration.ms":K5(_),tokenType:P.value.token_type,hasAccessToken:Boolean(P.value.access_token),hasIdToken:Boolean(P.value.id_token),hasRefreshToken:Boolean(P.value.refresh_token),expiresIn:P.value.expires_in}),P.value}catch(_){throw Z.error("Error during token exchange",{"es.event":"es.sso.token.exchange_failed","es.operation":"token.exchange","es.outcome":"failure",...N9(_)}),_}}async function i5(V){return g1(async()=>{if(!L)throw Error("Enterprise Standard SSO Manager not initialized");u();let A=m(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),K=m(L.clientId,"Missing 'clientId' from SSO Config"),H=new URLSearchParams;H.append("grant_type","refresh_token"),H.append("refresh_token",V),H.append("client_id",K);let N=await fetch(A,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:H.toString()}),z=await N.json();if(!N.ok){Z.error("Token refresh error",{"es.operation":"token.refresh","es.outcome":"failure",response:z});let M=z;throw Error(`Token refresh failed: ${M.error||N.statusText} - ${M.error_description||""}`.trim())}let j=await J.tokenResponse.validate(z);if(j.issues)throw Z.error("Token refresh response validation failed",{"es.event":"es.sso.token.refresh_validation_failed","es.operation":"token.refresh","es.outcome":"failure","validation.issues":S1(j.issues)}),Error(`Token refresh response validation failed: ${j.issues}`);return j.value},void 0,void 0,void 0,Z)}async function g5(V){try{if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(!L.revocationEndpoint)return;let A=m(L.clientId,"Missing 'clientId' from SSO Config"),K=new URLSearchParams;K.append("token",V),K.append("token_type_hint","refresh_token"),K.append("client_id",A);let H=await fetch(L.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:K.toString()});if(!H.ok)Z.warn("Token revocation failed",{"es.operation":"token.revoke","es.outcome":"degraded",status:H.status,statusText:H.statusText});else Z.info("Token revoked successfully",{"es.module":"sso"})}catch(A){Z.warn("Error revoking token",{"es.operation":"token.revoke","es.outcome":"degraded"},A)}}async function m5(){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let V=L.authority;if(!L.jwksUri&&!V)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let A=L.jwksUri||`${V}/protocol/openid-connect/certs`;return r5(A,Z)}async function C5(V,A){let K=Date.now(),H=m(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),N=m(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),z=L.jwksUri||`${H}/protocol/openid-connect/certs`;Z.debug("SSO ID token verification started",{"es.event":"es.sso.id_token.verify_started","es.module":"sso","es.operation":"id_token.verify",...T1(z,"oidc.jwks_uri")});let j;try{j=await R5({idToken:V,jwksUri:z,issuer:H,audience:N,expectedNonce:A,log:Z})}catch(_){throw Z.error("SSO ID token verification failed",{"es.event":"es.sso.id_token.verify_failed","es.module":"sso","es.operation":"id_token.verify","es.outcome":"failure","duration.ms":K5(K)},_),_}Z.debug("SSO ID token signature verified",{"es.event":"es.sso.id_token.signature_verified","es.module":"sso","es.operation":"id_token.verify","duration.ms":K5(K)});let M=await J.idTokenClaims.validate(j);if(M.issues)throw Z.error("ID token claims validation failed",{"es.event":"es.sso.id_token.validation_failed","es.operation":"id_token.validate","es.outcome":"failure","duration.ms":K5(K),"validation.issues":S1(M.issues)}),Error(`ID token claims validation failed: ${M.issues}`);return Z.debug("SSO ID token claims validated",{"es.event":"es.sso.id_token.claims_validated","es.module":"sso","es.operation":"id_token.validate","es.outcome":"success","duration.ms":K5(K),"user.id":M.value.sub,hasIssuer:Boolean(M.value.iss),hasAudience:Boolean(M.value.aud)}),M.value}function T5(V="SSO sessionStore is required for opaque session cookies."){if(!L.sessionStore)throw Error(V);return L.sessionStore}async function p5(V,A){try{await V.create(A)}catch(K){if(!await V.get(A.sid))throw K;await V.update(A.sid,A)}}function N5(V){if(!V)return;if(V instanceof Date)return V;let A=new Date(V);return Number.isNaN(A.getTime())?void 0:A}function u5(V){let A=V.tokens;if(!A?.access_token||!A.id_token||!A.token_type)return;return A}async function S5(V,A=!1){let K=T5(),H=n("session",V);if(!H)return{tokens:void 0,refreshHeaders:[]};let N=await K.get(H);if(N&&L.tenantId&&N.tenantId&&N.tenantId!==L.tenantId)return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};if(N?.authType!=="sso")return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};let z=u5(N);if(!z)return{tokens:void 0,refreshHeaders:[["Set-Cookie",h("session")]],sid:H};let j=N5(N.expiresAt);if(j?Date.now()>j.getTime():!1)return await K.delete(H),{tokens:void 0,sid:H,refreshHeaders:[["Set-Cookie",h("session")]]};let _=N5(z.expires),D=_?Date.now()>_.getTime():!0;if((A||D)&&z.refresh_token)return L5(H,N,z);return{tokens:z,sid:H,session:N,refreshHeaders:[]}}function L5(V,A,K){let H=F.get(V);if(H)return H;let N=T5(),z=(async()=>{let j=await i5(K.refresh_token),{tokenExpiresAt:M,sessionExpiresAt:_}=B5(j);j.expires=M.toISOString();let D=await s(j,void 0,_),E=D.sso.profile,P=D5(32),w={...A,sid:P,tokens:j,claims:E,expiresAt:_,createdAt:new Date};await p5(N,w);try{if(f<=0)await N.delete(V);else{let{refresh_token:q,...R}=K;await N.update(V,{tokens:R,expiresAt:new Date(Date.now()+f)})}}catch(q){Z.warn("Failed to retire rotated SSO session record",{"es.operation":"session.rotate","es.outcome":"degraded"},q)}return{tokens:j,sid:P,session:w,refreshedUser:D,refreshHeaders:[["Set-Cookie",U("session",P,_)]]}})();return F.set(V,z),z.finally(()=>{F.delete(V)})}async function M5(V,A=!1){return S5(V,A)}async function x(V){let{tokens:A}=await M5(V);if(!A)return;return A.access_token}function U(V,A,K,H=L.cookiesSameSite??"Strict"){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");if(V=`${L.cookiesPrefix}.${V}`,typeof A!=="string")A=btoa(JSON.stringify(A));let N;if(K instanceof Date)N=`Expires=${K.toUTCString()}`;else if(typeof K==="number")N=`Max-Age=${K}`;else throw Error("Invalid expires type",K);if(A.length>4000)throw Error(`Error setting cookie: ${V}. Cookie length is: ${A.length}`);return`${V}=${A}; ${N}; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${H};`}function h(V){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");return`${L.cookiesPrefix}.${V}=; Max-Age=0; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${L.cookiesSameSite};`}function n(V,A,K=!1){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let H=A.headers.get("cookie");if(!H)return null;let N=`${L.cookiesPrefix}.${V}`,z=H.split(";").find((D)=>D.trim().startsWith(`${N}=`));if(!z)return null;let j=z.indexOf("="),M=z.slice(j+1).trim();if(!K)return M;let _=atob(M);return JSON.parse(_)}function e(V){return`state_${V}`}async function t(V,A){if(!L)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:K,userUrl:H,tokenUrl:N,refreshUrl:z,logoutUrl:j,logoutBackChannelUrl:M,jwksUrl:_,redirectUri:D}={...L,...A},E=new URL(V.url).pathname;if(D){let P;try{P=new URL(D).pathname}catch{try{let w=new URL(V.url),q=D.startsWith("//")?D.slice(1):D;P=new URL(q,w.origin).pathname}catch{P=D.startsWith("/")?D:`/${D}`}}if(P===E)return l(V)}if(K===E)return G5(V);if(H===E)try{let{tokens:P,session:w,refreshedUser:q,refreshHeaders:R}=await M5(V);if(!P)return new Response("User not logged in",{status:401,headers:R});let v=q??(w?.claims?$5(w.claims,P,N5(w.expiresAt)):void 0);if(!v)return new Response("User not logged in",{status:401,headers:R});let y=await j5(v);return new Response(JSON.stringify(y),{headers:[["Content-Type","application/json"],...R]})}catch(P){if(r9(P))return new Response("User not logged in",{status:401});return Z.error("Error resolving SSO user",{"es.operation":"sso.user","es.outcome":"degraded"},P),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(N===E){let{tokens:P,refreshHeaders:w}=await M5(V);if(!P)return new Response("User not logged in",{status:401,headers:w});return new Response(JSON.stringify({token:P.access_token,expires:P.expires}),{headers:[["Content-Type","application/json"],...w]})}if(z===E){let{tokens:P,refreshHeaders:w}=await M5(V,!0);if(!P)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:w})}if(j===E)return p(V);if(M===E)return c(V);if(_===E){let P=await m5();return new Response(JSON.stringify(P),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...L,getUser:r,resolveUser:i,getJwt:x,initiateLogin:G5,logout:p,logoutBackChannel:c,callbackHandler:l,handler:t}}function p4(J){let Z={},$=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let G=Q.indexOf("=");if(G===-1)continue;let F=Q.slice(0,G).trim(),B=Q.slice(G+1).trim();Z[F]=B}return Z}function r9(J){if(!(J instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((Z)=>J.message.includes(Z))}function e9(J){return J=J??"SSO Unavailable",new Response(JSON.stringify({error:J}),{status:503,statusText:J,headers:{"Content-Type":"application/json"}})}var R1="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function u4(J,Z){return m(Z,R1),Z.sso?.getUser(J)}async function l4(J,Z){return m(Z,R1),await Z.sso?.resolveUser(J)??{status:"unauthenticated"}}async function c4(J,Z){m(Z,R1);let $=Z.sso;if(!$)return e9();return $.initiateLogin(J)}async function d4(J,Z){m(Z,R1);let $=Z.sso;if(!$)return e9();return $.callbackHandler(J)}export{U5 as withSetCookies,G1 as withDefaultExternalId,f4 as verifyUser,d1 as verifyLogoutToken,A4 as verifyLfvSignature,R5 as verifyIdToken,O4 as stringifyLfvJwks,m4 as sso,w4 as signLfvPayload,z2 as setJwksRetry,_2 as setJwksClock,y2 as setDiscoveryClock,i4 as sendTenantWebhook,t1 as sameOriginRedirectRules,l4 as resolveUser,n9 as resolveSessionCacheConfig,o1 as resolveRedirect,C1 as resolveProviderBranding,d9 as resolveJwksCacheConfig,j2 as resolveJwkForKid,d2 as resolveCustomer,V1 as resolveCiamProvider,m2 as resolveCapturedRedirect,T4 as resolveCacheConfig,x5 as resolveAfterRedirect,W9 as reconcileSubjectAccess,J1 as pkceChallengeFromVerifier,c9 as parseLfvJwks,v1 as orderedEnabledProviders,e5 as normalizeOidcIssuer,g4 as listSsoClientIdsFromCookies,v9 as isRedirectAllowed,c4 as initiateLogin,_4 as iam,V2 as hasScope,G2 as hasRole,W2 as hasPermission,L2 as hasGroup,N2 as hasAnyScope,F2 as hasAny,M2 as hasAllScope,H2 as hasAll,B2 as has,p1 as getVerificationKeyForKid,u4 as getUser,A2 as getPublicKeyFromJwks,w2 as getPublicKeyForKid,q1 as getProviderPreset,r5 as getJwks,v4 as getDiscoveredSessionUsers,c2 as getCustomer,m1 as getCachedVerificationKey,I4 as generateLfvEd25519KeyPair,i1 as generateAppleClientSecret,a1 as fetchUserInfo,B9 as expandRoot,c1 as exchangeAuthorizationCode,i9 as discoverSessions,t9 as discoverSessionRecords,n1 as discoverOidcEndpoints,h2 as defaultRedirectPolicies,D2 as configureJwksCache,n4 as collectReferencedDefinitions,E2 as clearJwksCache,b2 as clearDiscoveryCache,l2 as ciam,g2 as captureRedirect,d4 as callback,V9 as buildLfvSigningInput,l1 as buildAuthorizationUrl,b9 as blockDangerousUrls,R9 as assertTrustedIdTokenClaims,C9 as allowSameOrigin,q9 as allowRelativePaths,k2 as allowOrigins,f2 as allowHosts,a4 as InMemoryTenantStore,Y9 as CatalogAdjacencyCache,P9 as CIAM_PROVIDER_PRESETS,L1 as CACHE_BOUNDS};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enterprisestandard/core",
-  "version": "0.0.20",
+  "version": "0.0.21-beta.20260725.1",
   "description": "Enterprise Standard Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "enterprisestandard",