@enterprisestandard/core 0.0.9-beta.20260303.2 → 0.0.9-beta.20260303.7

package/dist/index.d.ts

@@ -26,6 +26,7 @@ declare const silentLogger: Logger;
 declare const infoLogger: Logger;
 /**
 * Logger that logs debug, info, warn, and error to the console.
+* Debug uses console.log with [DEBUG] prefix so it is visible in normal terminal runs.
 */
 declare const debugLogger: Logger;
 declare const consoleLogger: Logger;
@@ -2506,6 +2507,16 @@ type ConfigSource = {
 	* @return an unsubscribe/cleanup function.
 	*/
 	subscribe(onConfig: (config: RemoteConfig) => void): undefined | (() => void);
+	/**
+	* Optional. If not set by the creator, the framework may set this before calling load/subscribe
+	* so the source can use the same logger.
+	*/
+	logger?: Logger;
+	/**
+	* Optional. If not set by the creator, the framework may set this before calling load/subscribe
+	* so the source can use the same validators.
+	*/
+	validators?: ESValidators2;
 };
 /**
 * Serializes a FrameworkConfig (or ESConfig) to a JSON-serializable object.

package/dist/index.js

@@ -1 +1 @@
-import{a as j,b as S,c,d as B,e as L0,f as x0,g as _0,h as A0,i as B0,j as W0,k as K0,l as z0,m as C0,n as D0,o as R0,p as w0,q as U0,t as q0,u as E0,v as T0}from"./shared/core-mawdwxm1.js";var r="0.0.9-beta.20260303.2";function J($,X,Q,Z,G){if($===void 0||$===null){if(Q)Z.push({message:`${X} is required`,path:G});return}if(typeof $!=="string"){Z.push({message:`${X} must be a string`,path:G});return}return $}function T($,X,Q,Z){if($===void 0||$===null)return;if(typeof $!=="boolean"){Q.push({message:`${X} must be a boolean`,path:Z});return}return $}function l($,X,Q){if($===void 0||$===null)return;if(typeof $!=="object"||$===null){X.push({message:"name must be an object",path:Q});return}let Z=$,G={};return G.formatted=J(Z.formatted,"formatted",!1,X,[...Q,"formatted"]),G.familyName=J(Z.familyName,"familyName",!1,X,[...Q,"familyName"]),G.givenName=J(Z.givenName,"givenName",!1,X,[...Q,"givenName"]),G.middleName=J(Z.middleName,"middleName",!1,X,[...Q,"middleName"]),G.honorificPrefix=J(Z.honorificPrefix,"honorificPrefix",!1,X,[...Q,"honorificPrefix"]),G.honorificSuffix=J(Z.honorificSuffix,"honorificSuffix",!1,X,[...Q,"honorificSuffix"]),G}function u($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"emails must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"email must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function i($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"phoneNumbers must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"phoneNumber must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function t($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"addresses must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"address must be an object",path:H});continue}let M=F;Z.push({formatted:J(M.formatted,"formatted",!1,X,[...H,"formatted"]),streetAddress:J(M.streetAddress,"streetAddress",!1,X,[...H,"streetAddress"]),locality:J(M.locality,"locality",!1,X,[...H,"locality"]),region:J(M.region,"region",!1,X,[...H,"region"]),postalCode:J(M.postalCode,"postalCode",!1,X,[...H,"postalCode"]),country:J(M.country,"country",!1,X,[...H,"country"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function a($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"groups must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"group must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,$ref:J(M.$ref,"$ref",!1,X,[...H,"$ref"]),display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"])})}return Z.length>0?Z:void 0}function s($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"roles must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"role must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function e($,X,Q){if($===void 0||$===null)return;if(typeof $!=="object"||$===null){X.push({message:"Enterprise User extension must be an object",path:Q});return}let Z=$,G={};if(G.employeeNumber=J(Z.employeeNumber,"employeeNumber",!1,X,[...Q,"employeeNumber"]),G.costCenter=J(Z.costCenter,"costCenter",!1,X,[...Q,"costCenter"]),G.organization=J(Z.organization,"organization",!1,X,[...Q,"organization"]),G.division=J(Z.division,"division",!1,X,[...Q,"division"]),G.department=J(Z.department,"department",!1,X,[...Q,"department"]),Z.manager!==void 0&&Z.manager!==null)if(typeof Z.manager!=="object"||Z.manager===null)X.push({message:"manager must be an object",path:[...Q,"manager"]});else{let F=Z.manager;G.manager={value:J(F.value,"value",!1,X,[...Q,"manager","value"]),$ref:J(F.$ref,"$ref",!1,X,[...Q,"manager","$ref"]),displayName:J(F.displayName,"displayName",!1,X,[...Q,"manager","displayName"])}}return G}function O($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={},F=J(Q.userName,"userName",!0,Z,["userName"]);if(!F)return{issues:Z};G.userName=F,G.id=J(Q.id,"id",!1,Z,["id"]),G.externalId=J(Q.externalId,"externalId",!1,Z,["externalId"]),G.displayName=J(Q.displayName,"displayName",!1,Z,["displayName"]),G.nickName=J(Q.nickName,"nickName",!1,Z,["nickName"]),G.profileUrl=J(Q.profileUrl,"profileUrl",!1,Z,["profileUrl"]),G.title=J(Q.title,"title",!1,Z,["title"]),G.userType=J(Q.userType,"userType",!1,Z,["userType"]),G.preferredLanguage=J(Q.preferredLanguage,"preferredLanguage",!1,Z,["preferredLanguage"]),G.locale=J(Q.locale,"locale",!1,Z,["locale"]),G.timezone=J(Q.timezone,"timezone",!1,Z,["timezone"]),G.password=J(Q.password,"password",!1,Z,["password"]),G.active=T(Q.active,"active",Z,["active"]),G.name=l(Q.name,Z,["name"]),G.emails=u(Q.emails,Z,["emails"]),G.phoneNumbers=i(Q.phoneNumbers,Z,["phoneNumbers"]),G.addresses=t(Q.addresses,Z,["addresses"]),G.groups=a(Q.groups,Z,["groups"]),G.roles=s(Q.roles,Z,["roles"]);let H="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(Q[H]!==void 0)G[H]=e(Q[H],Z,[H]);if(Q.schemas!==void 0)if(Array.isArray(Q.schemas))G.schemas=Q.schemas.filter((M)=>typeof M==="string");else Z.push({message:"schemas must be an array",path:["schemas"]});if(Q.meta!==void 0)if(typeof Q.meta==="object"&&Q.meta!==null){let M=Q.meta;G.meta={resourceType:typeof M.resourceType==="string"?M.resourceType:void 0,created:typeof M.created==="string"?M.created:void 0,lastModified:typeof M.lastModified==="string"?M.lastModified:void 0,location:typeof M.location==="string"?M.location:void 0,version:typeof M.version==="string"?M.version:void 0}}else Z.push({message:"meta must be an object",path:["meta"]});if(Z.length>0)return{issues:Z};return{value:G}}}}}function Q0($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"members must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"member must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y){let _=J(M.type,"type",!1,X,[...H,"type"]);Z.push({value:Y,$ref:J(M.$ref,"$ref",!1,X,[...H,"$ref"]),display:J(M.display,"display",!1,X,[...H,"display"]),type:_==="User"||_==="Group"?_:void 0})}}return Z.length>0?Z:void 0}function V($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={},F=J(Q.displayName,"displayName",!0,Z,["displayName"]);if(!F)return{issues:Z};if(G.displayName=F,G.id=J(Q.id,"id",!1,Z,["id"]),G.externalId=J(Q.externalId,"externalId",!1,Z,["externalId"]),G.members=Q0(Q.members,Z,["members"]),Q.schemas!==void 0)if(Array.isArray(Q.schemas))G.schemas=Q.schemas.filter((H)=>typeof H==="string");else Z.push({message:"schemas must be an array",path:["schemas"]});if(Q.meta!==void 0)if(typeof Q.meta==="object"&&Q.meta!==null){let H=Q.meta;G.meta={resourceType:typeof H.resourceType==="string"?H.resourceType:void 0,created:typeof H.created==="string"?H.created:void 0,lastModified:typeof H.lastModified==="string"?H.lastModified:void 0,location:typeof H.location==="string"?H.location:void 0,version:typeof H.version==="string"?H.version:void 0}}else Z.push({message:"meta must be an object",path:["meta"]});if(Z.length>0)return{issues:Z};return{value:G}}}}}function f($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={...Q},F=["iss","sub"];for(let Y of F)if(Y in Q){if(typeof Q[Y]!=="string")Z.push({message:`${Y} must be a string`,path:[Y]})}else Z.push({message:`${Y} is required`,path:[Y]});if("aud"in Q&&Q.aud!==void 0){let Y=Q.aud;if(typeof Y!=="string"&&!Array.isArray(Y))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(Y)&&!Y.every((_)=>typeof _==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let H=["jti","scope"];for(let Y of H)if(Y in Q&&Q[Y]!==void 0){if(typeof Q[Y]!=="string")Z.push({message:`${Y} must be a string`,path:[Y]})}let M=["exp","iat"];for(let Y of M)if(Y in Q){if(typeof Q[Y]!=="number")Z.push({message:`${Y} must be a number`,path:[Y]})}else Z.push({message:`${Y} is required`,path:[Y]});if(Z.length>0)return{issues:Z};return{value:G}}}}}function y($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={};if("access_token"in Q)if(typeof Q.access_token==="string")G.access_token=Q.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")G.token_type=Q.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)G.scope=Q.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)G.refresh_token=Q.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)G.expires=Q.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)G.expires_in=Q.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:G}}}}}var K="@enterprisestandard/core",g=["POC","DEV","QA","PROD"],h=["pending","processing","completed","failed","action_required"];function X0(){return{"~standard":{version:1,vendor:K,validate($){if(typeof $!=="object"||$===null)return{issues:[{message:"Expected object"}]};let X=$,Q=[],Z=(D,E)=>{if(typeof X[D]!=="string"){Q.push({message:`${D} must be a string`,path:E});return}return X[D]},G=Z("tenantId",["tenantId"]),F=Z("companyId",["companyId"]),H=Z("companyName",["companyName"]),M=Z("email",["email"]),Y=Z("webhookUrl",["webhookUrl"]),_=Z("callbackUrl",["callbackUrl"]),z=X.tenantUrl,C=X.environmentType;if(typeof C!=="string"||!g.includes(C))Q.push({message:`environmentType must be one of ${g.join(", ")}`,path:["environmentType"]});if(z!==void 0&&typeof z!=="string")Q.push({message:"tenantUrl must be a string",path:["tenantUrl"]});if(Q.length>0)return{issues:Q};if(G===void 0||F===void 0||H===void 0||M===void 0||Y===void 0||_===void 0)return{issues:[{message:"Missing required string fields"}]};return{value:{tenantId:G,companyId:F,companyName:H,environmentType:C,email:M,webhookUrl:Y,callbackUrl:_,tenantUrl:z}}}}}}function Z0(){return{"~standard":{version:1,vendor:K,validate($){if(typeof $!=="object"||$===null)return{issues:[{message:"Expected object"}]};let X=$,Q=[],Z=(Y,_)=>{if(typeof X[Y]!=="string"){Q.push({message:`${Y} must be a string`,path:_});return}return X[Y]},G=Z("userName",["userName"]),F=Z("name",["name"]),H=Z("email",["email"]);if(X.id!==void 0&&typeof X.id!=="string")Q.push({message:"id must be a string",path:["id"]});if(X.avatar!==void 0&&typeof X.avatar!=="string")Q.push({message:"avatar must be a string",path:["avatar"]});if(X.userType!==void 0&&typeof X.userType!=="string")Q.push({message:"userType must be a string",path:["userType"]});if(Q.length>0)return{issues:Q};if(G===void 0||F===void 0||H===void 0)return{issues:[{message:"Missing required fields: userName, name, email"}]};let M={userName:G,name:F,email:H};if(typeof X.id==="string")M.id=X.id;if(typeof X.avatar==="string")M.avatar=X.avatar;if(typeof X.userType==="string")M.userType=X.userType;return{value:M}}}}}function $0(){return{"~standard":{validate($){if(typeof $!=="object"||$===null)return{issues:[{message:"Expected object"}]};let X=$,Q=[],Z=X.status;if(typeof Z!=="string"||!h.includes(Z))Q.push({message:`status must be one of ${h.join(", ")}`,path:["status"]});if(Z==="action_required"){if(typeof X.actionUrl!=="string")Q.push({message:"actionUrl must be a string",path:["actionUrl"]});if(typeof X.requestToken!=="string")Q.push({message:"requestToken must be a string",path:["requestToken"]});if(typeof X.expiresAt!=="string")Q.push({message:"expiresAt must be a string",path:["expiresAt"]});if(Q.length>0)return{issues:Q};return{value:{status:"action_required",actionUrl:X.actionUrl,requestToken:X.requestToken,expiresAt:X.expiresAt}}}if(typeof X.tenantUrl!=="string")Q.push({message:"tenantUrl must be a string",path:["tenantUrl"]});if(Q.length>0)return{issues:Q};return{value:{tenantUrl:X.tenantUrl,status:Z}}}}}}function P(){return{sso:{callbackParams:B(j(K)),idTokenClaims:B(c(K)),tokenResponse:B(S(K))},iam:{user:B(O(K)),group:B(V(K))},workload:{jwtAssertionClaims:B(f(K)),tokenResponse:B(y(K))},tenant:{createTenantRequest:B(X0())},ciam:{baseUser:B(Z0())}}}var G0=["sessionStore","userStore","groupStore","tokenStore","magicLinkStore"];function p($){if($===null||typeof $!=="object")return $;let X={};for(let[Q,Z]of Object.entries($)){if(G0.includes(Q)||Q==="validators")continue;X[Q]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?p(Z):Z}return X}function H0($){return p($)}function N($,X,Q,Z){let G=X.length,F=Z??$,H=F>0?Math.floor(Q/F)+1:1,M=F>0?Math.ceil($/F):0;return{total:$,count:G,items:X,size:F,page:H,pages:M}}class q extends Error{constructor($,X){super($,X);this.name="TenantRequestError",Object.setPrototypeOf(this,q.prototype)}}function M0($,X,Q,Z){if(!Q&&!Z)return;let G={...Q,...Z},F={...G,signingKey:Q?.signingKey,requestTokenTtl:Q?.requestTokenTtl??G.requestTokenTtl??3600};function H(){if(!F.signingKey)throw Error("Missing tenant configuration field: signingKey. Tenant request tokens require a signingKey provided via Vault (tenant.signingKey).")}function M(L){let x=typeof L==="string"?new TextEncoder().encode(L):L,A="";return x.forEach((W)=>{A+=String.fromCharCode(W)}),btoa(A).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Y(L){let x=L.replace(/-/g,"+").replace(/_/g,"/"),A=x.padEnd(x.length+(4-x.length%4)%4,"=");return atob(A)}async function _(){H();let L=new TextEncoder().encode(F.signingKey??"");return crypto.subtle.importKey("raw",L,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function z(L){let A=M(JSON.stringify({alg:"HS256",typ:"JWT"})),W=M(JSON.stringify(L)),R=`${A}.${W}`,w=await _(),U=await crypto.subtle.sign("HMAC",w,new TextEncoder().encode(R)),k=M(new Uint8Array(U));return`${R}.${k}`}async function C(L){let x=L.split(".");if(x.length!==3)throw Error("Invalid JWT");let[A,W,R]=x,w=`${A}.${W}`,U=await _(),k=new Uint8Array(Y(R).split("").map((o)=>o.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",U,k,new TextEncoder().encode(w)))throw Error("Invalid JWT signature");let d=Y(W),I=JSON.parse(d);if(typeof I.exp==="number"&&I.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return I}async function D(L){if(L.method!=="POST")throw Error("Only POST method is supported");let x;try{x=await L.json()}catch(W){throw Error("Invalid JSON in request body")}if(typeof x!=="object"||x===null)throw Error("Request body must be an object");let A=await $.createTenantRequest["~standard"].validate(x);if(A.issues)return A;return A}async function E(L,x){return b(L,x,X)}return{...F,parseTenantRequest:D,sendTenantWebhook:E,async createRequestToken(L,x,A){let W=Math.floor(Date.now()/1000),R=A??F.requestTokenTtl??3600,w=W+R,U={tenantId:L,callbackUrl:x,iat:W,exp:w};return{token:await z(U),expiresAt:new Date(w*1000),payload:U}},async verifyRequestToken(L){return await C(L)}}}async function F0($){let X=P().tenant;if($.method!=="POST")throw new q("Only POST method is supported");let Q;try{Q=await $.json()}catch(Z){throw new q("Invalid JSON in request body")}if(typeof Q!=="object"||Q===null)throw new q("Request body must be an object");return X.createTenantRequest["~standard"].validate(Q)}function b($,X,Q){return(async()=>{try{let Z=await fetch($,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(X)});if(!Z.ok)Q.error(`Failed to send webhook update: ${Z.status} ${Z.statusText}`)}catch(Z){Q.error("Failed to send webhook update:",Z)}})()}async function J0($,X,Q){return b($,X,Q)}class v{tenants=new Map;companyIdIndex=new Map;async get($){return this.tenants.get($)??null}async getByCompanyId($,X){let Q=this.companyIdIndex.get($);if(!Q||Q.size===0)return N(0,[],Math.max(0,X?.start??0),X?.limit);let Z=[];for(let G of Q){let F=this.tenants.get(G);if(F)Z.push(F)}return m(Z,X)}async list($){let X=Array.from(this.tenants.values());return m(X,$)}async upsert($){let X=this.tenants.get($.tenantId);if(X&&X.companyId!==$.companyId){let Z=this.companyIdIndex.get(X.companyId);if(Z){if(Z.delete($.tenantId),Z.size===0)this.companyIdIndex.delete(X.companyId)}}this.tenants.set($.tenantId,$);let Q=this.companyIdIndex.get($.companyId);if(!Q)Q=new Set,this.companyIdIndex.set($.companyId,Q);return Q.add($.tenantId),$}async delete($){let X=this.tenants.get($);if(X){let Q=this.companyIdIndex.get(X.companyId);if(Q){if(Q.delete($),Q.size===0)this.companyIdIndex.delete(X.companyId)}}this.tenants.delete($)}}function m($,X){let Q=Math.max(0,X?.start??0),Z=X?.limit,G=$;if(X?.sort?.length)G=[...$].sort((Y,_)=>{for(let{field:z,direction:C}of X.sort){let D=Y[z],E=_[z],L=Y0(D,E);if(L!==0)return C==="desc"?-L:L}return 0});let F=G.length,H=Z!=null?Q+Z:void 0,M=G.slice(Q,H);return N(F,M,Q,Z)}function Y0($,X){let Q=$===void 0||$===null,Z=X===void 0||X===null;if(Q&&Z)return 0;if(Q)return 1;if(Z)return-1;if($ instanceof Date&&X instanceof Date)return $.getTime()-X.getTime();return String($).localeCompare(String(X))}export{y as workloadTokenResponseSchema,B as withValidate,W0 as waitOn,r as version,x0 as validationFailureResponse,O as userSchema,S as tokenResponseSchema,M0 as tenant,A0 as stripJsonComments,D0 as silentLogger,E0 as setActiveSession,H0 as serializeESConfig,J0 as sendTenantWebhook,F0 as parseTenantRequest,B0 as parseJsonc,j as oidcCallbackSchema,L0 as must,_0 as mergeConfig,N as list,f as jwtAssertionClaimsSchema,R0 as infoLogger,c as idTokenClaimsSchema,V as groupResourceSchema,q0 as getActiveSession,T0 as findTenantFromStateParam,C0 as defaultLogger,z0 as decodeUser,w0 as debugLogger,P as createValidators,$0 as createTenantResponseValidator,U0 as consoleLogger,K0 as claimsToUser,q as TenantRequestError,v as InMemoryTenantStore};
+import{a as j,b as S,c,d as B,e as L0,f as x0,g as _0,h as A0,i as B0,j as W0,k as K0,l as z0,m as C0,n as D0,o as R0,p as w0,q as U0,t as q0,u as E0,v as T0}from"./shared/core-5zzt9q6h.js";var r="0.0.9-beta.20260303.7";function J($,X,Q,Z,G){if($===void 0||$===null){if(Q)Z.push({message:`${X} is required`,path:G});return}if(typeof $!=="string"){Z.push({message:`${X} must be a string`,path:G});return}return $}function T($,X,Q,Z){if($===void 0||$===null)return;if(typeof $!=="boolean"){Q.push({message:`${X} must be a boolean`,path:Z});return}return $}function l($,X,Q){if($===void 0||$===null)return;if(typeof $!=="object"||$===null){X.push({message:"name must be an object",path:Q});return}let Z=$,G={};return G.formatted=J(Z.formatted,"formatted",!1,X,[...Q,"formatted"]),G.familyName=J(Z.familyName,"familyName",!1,X,[...Q,"familyName"]),G.givenName=J(Z.givenName,"givenName",!1,X,[...Q,"givenName"]),G.middleName=J(Z.middleName,"middleName",!1,X,[...Q,"middleName"]),G.honorificPrefix=J(Z.honorificPrefix,"honorificPrefix",!1,X,[...Q,"honorificPrefix"]),G.honorificSuffix=J(Z.honorificSuffix,"honorificSuffix",!1,X,[...Q,"honorificSuffix"]),G}function u($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"emails must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"email must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function i($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"phoneNumbers must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"phoneNumber must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function t($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"addresses must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"address must be an object",path:H});continue}let M=F;Z.push({formatted:J(M.formatted,"formatted",!1,X,[...H,"formatted"]),streetAddress:J(M.streetAddress,"streetAddress",!1,X,[...H,"streetAddress"]),locality:J(M.locality,"locality",!1,X,[...H,"locality"]),region:J(M.region,"region",!1,X,[...H,"region"]),postalCode:J(M.postalCode,"postalCode",!1,X,[...H,"postalCode"]),country:J(M.country,"country",!1,X,[...H,"country"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function a($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"groups must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"group must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,$ref:J(M.$ref,"$ref",!1,X,[...H,"$ref"]),display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"])})}return Z.length>0?Z:void 0}function s($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"roles must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"role must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y)Z.push({value:Y,display:J(M.display,"display",!1,X,[...H,"display"]),type:J(M.type,"type",!1,X,[...H,"type"]),primary:T(M.primary,"primary",X,[...H,"primary"])})}return Z.length>0?Z:void 0}function e($,X,Q){if($===void 0||$===null)return;if(typeof $!=="object"||$===null){X.push({message:"Enterprise User extension must be an object",path:Q});return}let Z=$,G={};if(G.employeeNumber=J(Z.employeeNumber,"employeeNumber",!1,X,[...Q,"employeeNumber"]),G.costCenter=J(Z.costCenter,"costCenter",!1,X,[...Q,"costCenter"]),G.organization=J(Z.organization,"organization",!1,X,[...Q,"organization"]),G.division=J(Z.division,"division",!1,X,[...Q,"division"]),G.department=J(Z.department,"department",!1,X,[...Q,"department"]),Z.manager!==void 0&&Z.manager!==null)if(typeof Z.manager!=="object"||Z.manager===null)X.push({message:"manager must be an object",path:[...Q,"manager"]});else{let F=Z.manager;G.manager={value:J(F.value,"value",!1,X,[...Q,"manager","value"]),$ref:J(F.$ref,"$ref",!1,X,[...Q,"manager","$ref"]),displayName:J(F.displayName,"displayName",!1,X,[...Q,"manager","displayName"])}}return G}function O($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={},F=J(Q.userName,"userName",!0,Z,["userName"]);if(!F)return{issues:Z};G.userName=F,G.id=J(Q.id,"id",!1,Z,["id"]),G.externalId=J(Q.externalId,"externalId",!1,Z,["externalId"]),G.displayName=J(Q.displayName,"displayName",!1,Z,["displayName"]),G.nickName=J(Q.nickName,"nickName",!1,Z,["nickName"]),G.profileUrl=J(Q.profileUrl,"profileUrl",!1,Z,["profileUrl"]),G.title=J(Q.title,"title",!1,Z,["title"]),G.userType=J(Q.userType,"userType",!1,Z,["userType"]),G.preferredLanguage=J(Q.preferredLanguage,"preferredLanguage",!1,Z,["preferredLanguage"]),G.locale=J(Q.locale,"locale",!1,Z,["locale"]),G.timezone=J(Q.timezone,"timezone",!1,Z,["timezone"]),G.password=J(Q.password,"password",!1,Z,["password"]),G.active=T(Q.active,"active",Z,["active"]),G.name=l(Q.name,Z,["name"]),G.emails=u(Q.emails,Z,["emails"]),G.phoneNumbers=i(Q.phoneNumbers,Z,["phoneNumbers"]),G.addresses=t(Q.addresses,Z,["addresses"]),G.groups=a(Q.groups,Z,["groups"]),G.roles=s(Q.roles,Z,["roles"]);let H="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(Q[H]!==void 0)G[H]=e(Q[H],Z,[H]);if(Q.schemas!==void 0)if(Array.isArray(Q.schemas))G.schemas=Q.schemas.filter((M)=>typeof M==="string");else Z.push({message:"schemas must be an array",path:["schemas"]});if(Q.meta!==void 0)if(typeof Q.meta==="object"&&Q.meta!==null){let M=Q.meta;G.meta={resourceType:typeof M.resourceType==="string"?M.resourceType:void 0,created:typeof M.created==="string"?M.created:void 0,lastModified:typeof M.lastModified==="string"?M.lastModified:void 0,location:typeof M.location==="string"?M.location:void 0,version:typeof M.version==="string"?M.version:void 0}}else Z.push({message:"meta must be an object",path:["meta"]});if(Z.length>0)return{issues:Z};return{value:G}}}}}function Q0($,X,Q){if($===void 0||$===null)return;if(!Array.isArray($)){X.push({message:"members must be an array",path:Q});return}let Z=[];for(let G=0;G<$.length;G++){let F=$[G],H=[...Q,G];if(typeof F!=="object"||F===null){X.push({message:"member must be an object",path:H});continue}let M=F,Y=J(M.value,"value",!0,X,[...H,"value"]);if(Y){let _=J(M.type,"type",!1,X,[...H,"type"]);Z.push({value:Y,$ref:J(M.$ref,"$ref",!1,X,[...H,"$ref"]),display:J(M.display,"display",!1,X,[...H,"display"]),type:_==="User"||_==="Group"?_:void 0})}}return Z.length>0?Z:void 0}function V($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={},F=J(Q.displayName,"displayName",!0,Z,["displayName"]);if(!F)return{issues:Z};if(G.displayName=F,G.id=J(Q.id,"id",!1,Z,["id"]),G.externalId=J(Q.externalId,"externalId",!1,Z,["externalId"]),G.members=Q0(Q.members,Z,["members"]),Q.schemas!==void 0)if(Array.isArray(Q.schemas))G.schemas=Q.schemas.filter((H)=>typeof H==="string");else Z.push({message:"schemas must be an array",path:["schemas"]});if(Q.meta!==void 0)if(typeof Q.meta==="object"&&Q.meta!==null){let H=Q.meta;G.meta={resourceType:typeof H.resourceType==="string"?H.resourceType:void 0,created:typeof H.created==="string"?H.created:void 0,lastModified:typeof H.lastModified==="string"?H.lastModified:void 0,location:typeof H.location==="string"?H.location:void 0,version:typeof H.version==="string"?H.version:void 0}}else Z.push({message:"meta must be an object",path:["meta"]});if(Z.length>0)return{issues:Z};return{value:G}}}}}function f($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={...Q},F=["iss","sub"];for(let Y of F)if(Y in Q){if(typeof Q[Y]!=="string")Z.push({message:`${Y} must be a string`,path:[Y]})}else Z.push({message:`${Y} is required`,path:[Y]});if("aud"in Q&&Q.aud!==void 0){let Y=Q.aud;if(typeof Y!=="string"&&!Array.isArray(Y))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(Y)&&!Y.every((_)=>typeof _==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let H=["jti","scope"];for(let Y of H)if(Y in Q&&Q[Y]!==void 0){if(typeof Q[Y]!=="string")Z.push({message:`${Y} must be a string`,path:[Y]})}let M=["exp","iat"];for(let Y of M)if(Y in Q){if(typeof Q[Y]!=="number")Z.push({message:`${Y} must be a number`,path:[Y]})}else Z.push({message:`${Y} is required`,path:[Y]});if(Z.length>0)return{issues:Z};return{value:G}}}}}function y($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,Z=[],G={};if("access_token"in Q)if(typeof Q.access_token==="string")G.access_token=Q.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")G.token_type=Q.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)G.scope=Q.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)G.refresh_token=Q.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)G.expires=Q.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)G.expires_in=Q.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:G}}}}}var K="@enterprisestandard/core",g=["POC","DEV","QA","PROD"],h=["pending","processing","completed","failed","action_required"];function X0(){return{"~standard":{version:1,vendor:K,validate($){if(typeof $!=="object"||$===null)return{issues:[{message:"Expected object"}]};let X=$,Q=[],Z=(D,E)=>{if(typeof X[D]!=="string"){Q.push({message:`${D} must be a string`,path:E});return}return X[D]},G=Z("tenantId",["tenantId"]),F=Z("companyId",["companyId"]),H=Z("companyName",["companyName"]),M=Z("email",["email"]),Y=Z("webhookUrl",["webhookUrl"]),_=Z("callbackUrl",["callbackUrl"]),z=X.tenantUrl,C=X.environmentType;if(typeof C!=="string"||!g.includes(C))Q.push({message:`environmentType must be one of ${g.join(", ")}`,path:["environmentType"]});if(z!==void 0&&typeof z!=="string")Q.push({message:"tenantUrl must be a string",path:["tenantUrl"]});if(Q.length>0)return{issues:Q};if(G===void 0||F===void 0||H===void 0||M===void 0||Y===void 0||_===void 0)return{issues:[{message:"Missing required string fields"}]};return{value:{tenantId:G,companyId:F,companyName:H,environmentType:C,email:M,webhookUrl:Y,callbackUrl:_,tenantUrl:z}}}}}}function Z0(){return{"~standard":{version:1,vendor:K,validate($){if(typeof $!=="object"||$===null)return{issues:[{message:"Expected object"}]};let X=$,Q=[],Z=(Y,_)=>{if(typeof X[Y]!=="string"){Q.push({message:`${Y} must be a string`,path:_});return}return X[Y]},G=Z("userName",["userName"]),F=Z("name",["name"]),H=Z("email",["email"]);if(X.id!==void 0&&typeof X.id!=="string")Q.push({message:"id must be a string",path:["id"]});if(X.avatar!==void 0&&typeof X.avatar!=="string")Q.push({message:"avatar must be a string",path:["avatar"]});if(X.userType!==void 0&&typeof X.userType!=="string")Q.push({message:"userType must be a string",path:["userType"]});if(Q.length>0)return{issues:Q};if(G===void 0||F===void 0||H===void 0)return{issues:[{message:"Missing required fields: userName, name, email"}]};let M={userName:G,name:F,email:H};if(typeof X.id==="string")M.id=X.id;if(typeof X.avatar==="string")M.avatar=X.avatar;if(typeof X.userType==="string")M.userType=X.userType;return{value:M}}}}}function $0(){return{"~standard":{validate($){if(typeof $!=="object"||$===null)return{issues:[{message:"Expected object"}]};let X=$,Q=[],Z=X.status;if(typeof Z!=="string"||!h.includes(Z))Q.push({message:`status must be one of ${h.join(", ")}`,path:["status"]});if(Z==="action_required"){if(typeof X.actionUrl!=="string")Q.push({message:"actionUrl must be a string",path:["actionUrl"]});if(typeof X.requestToken!=="string")Q.push({message:"requestToken must be a string",path:["requestToken"]});if(typeof X.expiresAt!=="string")Q.push({message:"expiresAt must be a string",path:["expiresAt"]});if(Q.length>0)return{issues:Q};return{value:{status:"action_required",actionUrl:X.actionUrl,requestToken:X.requestToken,expiresAt:X.expiresAt}}}if(typeof X.tenantUrl!=="string")Q.push({message:"tenantUrl must be a string",path:["tenantUrl"]});if(Q.length>0)return{issues:Q};return{value:{tenantUrl:X.tenantUrl,status:Z}}}}}}function P(){return{sso:{callbackParams:B(j(K)),idTokenClaims:B(c(K)),tokenResponse:B(S(K))},iam:{user:B(O(K)),group:B(V(K))},workload:{jwtAssertionClaims:B(f(K)),tokenResponse:B(y(K))},tenant:{createTenantRequest:B(X0())},ciam:{baseUser:B(Z0())}}}var G0=["sessionStore","userStore","groupStore","tokenStore","magicLinkStore"];function p($){if($===null||typeof $!=="object")return $;let X={};for(let[Q,Z]of Object.entries($)){if(G0.includes(Q)||Q==="validators")continue;X[Q]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?p(Z):Z}return X}function H0($){return p($)}function N($,X,Q,Z){let G=X.length,F=Z??$,H=F>0?Math.floor(Q/F)+1:1,M=F>0?Math.ceil($/F):0;return{total:$,count:G,items:X,size:F,page:H,pages:M}}class q extends Error{constructor($,X){super($,X);this.name="TenantRequestError",Object.setPrototypeOf(this,q.prototype)}}function M0($,X,Q,Z){if(!Q&&!Z)return;let G={...Q,...Z},F={...G,signingKey:Q?.signingKey,requestTokenTtl:Q?.requestTokenTtl??G.requestTokenTtl??3600};function H(){if(!F.signingKey)throw Error("Missing tenant configuration field: signingKey. Tenant request tokens require a signingKey provided via Vault (tenant.signingKey).")}function M(L){let x=typeof L==="string"?new TextEncoder().encode(L):L,A="";return x.forEach((W)=>{A+=String.fromCharCode(W)}),btoa(A).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Y(L){let x=L.replace(/-/g,"+").replace(/_/g,"/"),A=x.padEnd(x.length+(4-x.length%4)%4,"=");return atob(A)}async function _(){H();let L=new TextEncoder().encode(F.signingKey??"");return crypto.subtle.importKey("raw",L,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function z(L){let A=M(JSON.stringify({alg:"HS256",typ:"JWT"})),W=M(JSON.stringify(L)),R=`${A}.${W}`,w=await _(),U=await crypto.subtle.sign("HMAC",w,new TextEncoder().encode(R)),k=M(new Uint8Array(U));return`${R}.${k}`}async function C(L){let x=L.split(".");if(x.length!==3)throw Error("Invalid JWT");let[A,W,R]=x,w=`${A}.${W}`,U=await _(),k=new Uint8Array(Y(R).split("").map((o)=>o.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",U,k,new TextEncoder().encode(w)))throw Error("Invalid JWT signature");let d=Y(W),I=JSON.parse(d);if(typeof I.exp==="number"&&I.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return I}async function D(L){if(L.method!=="POST")throw Error("Only POST method is supported");let x;try{x=await L.json()}catch(W){throw Error("Invalid JSON in request body")}if(typeof x!=="object"||x===null)throw Error("Request body must be an object");let A=await $.createTenantRequest["~standard"].validate(x);if(A.issues)return A;return A}async function E(L,x){return b(L,x,X)}return{...F,parseTenantRequest:D,sendTenantWebhook:E,async createRequestToken(L,x,A){let W=Math.floor(Date.now()/1000),R=A??F.requestTokenTtl??3600,w=W+R,U={tenantId:L,callbackUrl:x,iat:W,exp:w};return{token:await z(U),expiresAt:new Date(w*1000),payload:U}},async verifyRequestToken(L){return await C(L)}}}async function F0($){let X=P().tenant;if($.method!=="POST")throw new q("Only POST method is supported");let Q;try{Q=await $.json()}catch(Z){throw new q("Invalid JSON in request body")}if(typeof Q!=="object"||Q===null)throw new q("Request body must be an object");return X.createTenantRequest["~standard"].validate(Q)}function b($,X,Q){return(async()=>{try{let Z=await fetch($,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(X)});if(!Z.ok)Q.error(`Failed to send webhook update: ${Z.status} ${Z.statusText}`)}catch(Z){Q.error("Failed to send webhook update:",Z)}})()}async function J0($,X,Q){return b($,X,Q)}class v{tenants=new Map;companyIdIndex=new Map;async get($){return this.tenants.get($)??null}async getByCompanyId($,X){let Q=this.companyIdIndex.get($);if(!Q||Q.size===0)return N(0,[],Math.max(0,X?.start??0),X?.limit);let Z=[];for(let G of Q){let F=this.tenants.get(G);if(F)Z.push(F)}return m(Z,X)}async list($){let X=Array.from(this.tenants.values());return m(X,$)}async upsert($){let X=this.tenants.get($.tenantId);if(X&&X.companyId!==$.companyId){let Z=this.companyIdIndex.get(X.companyId);if(Z){if(Z.delete($.tenantId),Z.size===0)this.companyIdIndex.delete(X.companyId)}}this.tenants.set($.tenantId,$);let Q=this.companyIdIndex.get($.companyId);if(!Q)Q=new Set,this.companyIdIndex.set($.companyId,Q);return Q.add($.tenantId),$}async delete($){let X=this.tenants.get($);if(X){let Q=this.companyIdIndex.get(X.companyId);if(Q){if(Q.delete($),Q.size===0)this.companyIdIndex.delete(X.companyId)}}this.tenants.delete($)}}function m($,X){let Q=Math.max(0,X?.start??0),Z=X?.limit,G=$;if(X?.sort?.length)G=[...$].sort((Y,_)=>{for(let{field:z,direction:C}of X.sort){let D=Y[z],E=_[z],L=Y0(D,E);if(L!==0)return C==="desc"?-L:L}return 0});let F=G.length,H=Z!=null?Q+Z:void 0,M=G.slice(Q,H);return N(F,M,Q,Z)}function Y0($,X){let Q=$===void 0||$===null,Z=X===void 0||X===null;if(Q&&Z)return 0;if(Q)return 1;if(Z)return-1;if($ instanceof Date&&X instanceof Date)return $.getTime()-X.getTime();return String($).localeCompare(String(X))}export{y as workloadTokenResponseSchema,B as withValidate,W0 as waitOn,r as version,x0 as validationFailureResponse,O as userSchema,S as tokenResponseSchema,M0 as tenant,A0 as stripJsonComments,D0 as silentLogger,E0 as setActiveSession,H0 as serializeESConfig,J0 as sendTenantWebhook,F0 as parseTenantRequest,B0 as parseJsonc,j as oidcCallbackSchema,L0 as must,_0 as mergeConfig,N as list,f as jwtAssertionClaimsSchema,R0 as infoLogger,c as idTokenClaimsSchema,V as groupResourceSchema,q0 as getActiveSession,T0 as findTenantFromStateParam,C0 as defaultLogger,z0 as decodeUser,w0 as debugLogger,P as createValidators,$0 as createTenantResponseValidator,U0 as consoleLogger,K0 as claimsToUser,q as TenantRequestError,v as InMemoryTenantStore};

package/dist/server.js

@@ -1 +1 @@
-import{A as JM,B as LM,C as DM,D as jM,c as XM,d as YM,e,k as ZM,r as $M,s as HM,w as NM,x as VM,y as _M,z as GM}from"./shared/core-mawdwxm1.js";function zM(O,L,D,h,q){if(!D&&!h)return;let E={...D,...h},Y={...E,signingKey:D?.signingKey,magicLinkTtl:E.magicLinkTtl??3600,sessionTtl:E.sessionTtl??86400,cookiesSecure:E.cookiesSecure!==void 0?E.cookiesSecure:!0,cookiesSameSite:E.cookiesSameSite!==void 0?E.cookiesSameSite:"Strict",cookiesPrefix:E.cookiesPrefix??(E.ciamId?`es.ciam.${E.ciamId}`:"es.ciam"),cookiesPath:E.cookiesPath??"/",sessionValidation:E.sessionValidation??"always"};function U(){if(!Y.signingKey)throw Error("Missing CIAM configuration field: signingKey. CIAM signingKey is required for JWT token signing and must be provided via Vault (ciam.signingKey).")}function g(){if(!Y.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and backchannel logout.");return Y.sessionStore}function m(){U(),g()}function i(M=32){let A=new Uint8Array(M);return crypto.getRandomValues(A),Array.from(A,(X)=>X.toString(16).padStart(2,"0")).join("").substring(0,M)}function l(M){let A=typeof M==="string"?new TextEncoder().encode(M):M,X="";return A.forEach((Z)=>{X+=String.fromCharCode(Z)}),btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function t(M){let A=M.replace(/-/g,"+").replace(/_/g,"/"),X=A.padEnd(A.length+(4-A.length%4)%4,"=");return atob(X)}async function x(){U();let M=new TextEncoder().encode(Y.signingKey??"");return crypto.subtle.importKey("raw",M,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function k(M){let X=l(JSON.stringify({alg:"HS256",typ:"JWT"})),Z=l(JSON.stringify(M)),W=`${X}.${Z}`,_=await x(),S=await crypto.subtle.sign("HMAC",_,new TextEncoder().encode(W)),I=l(new Uint8Array(S));return`${W}.${I}`}async function f(M){let A=M.split(".");if(A.length!==3)throw Error("Invalid JWT");let[X,Z,W]=A,_=`${X}.${Z}`,S=await x(),I=new Uint8Array(t(W).split("").map((T)=>T.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",S,I,new TextEncoder().encode(_)))throw Error("Invalid JWT signature");let u=t(Z),c=JSON.parse(u);if(typeof c.exp==="number"&&c.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return c}function B(M,A,X){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(M=`${Y.cookiesPrefix}.${M}`,typeof A!=="string")A=btoa(JSON.stringify(A));let Z;if(X instanceof Date)Z=`Expires=${X.toUTCString()}`;else if(typeof X==="number")Z=`Max-Age=${X}`;else throw Error("Invalid expires type",X);if(A.length>4000)throw Error(`Error setting cookie: ${M}. Cookie length is: ${A.length}`);return`${M}=${A}; ${Z}; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function j(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");return`${Y.cookiesPrefix}.${M}=; Max-Age=0; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function G(M,A,X=!1){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");let Z=A.headers.get("cookie");if(!Z)return null;let W=`${Y.cookiesPrefix}.${M}`,_=Z.split(";").find((C)=>C.trim().startsWith(`${W}=`));if(!_)return null;let S=_.indexOf("="),I=_.substring(S+1).trim();if(!X)return I;try{let C=atob(I);return JSON.parse(C)}catch(C){return console.error(`[CIAM] Failed to parse cookie '${W}':`,C),null}}function P(M,A,X){let Z={expires_in:Y.sessionTtl??86400,token_type:"Bearer",expires:X.toISOString()};return[["Set-Cookie",B("access",M,X)],["Set-Cookie",B("id",A,X)],["Set-Cookie",B("control",Z,X)]]}function v(M){let A=G("access",M),X=G("id",M),Z=G("control",M,!0);if(!A||!X||!Z)return;if(Z.expires&&Date.now()>new Date(Z.expires).getTime())return;return{access:A,id:X,control:Z}}async function w(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=v(M);if(!A)return;let X=await f(A.access),Z=await f(A.id);if(!X.sid||!Z.sub)return;if(Y.sessionValidation!=="disabled"){if(!await g().get(X.sid))return}return z(Z)}catch(A){return}}async function b(M){let A=await w(M);if(A)return A;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function p(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let S=v(M);if(S){let I=await f(S.access);if(I.sid)await g().delete(I.sid)}}catch(S){console.warn("Failed to delete CIAM session:",S)}let A=[["Set-Cookie",j("access")],["Set-Cookie",j("id")],["Set-Cookie",j("control")]],Z=new URL(M.url).searchParams.get("redirect");if(Z)return new Response("Logged out",{status:302,headers:[["Location",Z],...A]});let W=M.headers.get("accept");if(W?.includes("application/json")||W?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...A]});return new Response("Logout Complete",{status:200,headers:[["Content-Type","text/plain"],...A]})}async function y(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=M.headers.get("content-type");if(!A||!A.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let X=await M.text(),W=new URLSearchParams(X).get("logout_token");if(!W)return new Response("Missing logout_token parameter",{status:400});let S=(await f(W)).sid;if(!S)return new Response("Invalid logout_token: missing sid claim",{status:400});return await g().delete(S),new Response("OK",{status:200})}catch(A){return console.error("Error during CIAM back-channel logout:",A),new Response("Internal Server Error",{status:500})}}function K(M){return M.id||M.email||`ciam-${M.userName}`}function V(M,A,X){return{sub:K(M),iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),email:M.email,name:M.name,preferred_username:M.userName,picture:M.avatar,sid:A}}function Q(M,A,X){return{sub:M,iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:A,scope:"openid profile email"}}function z(M){let A=M.exp?new Date(M.exp*1000):new Date;return{id:M.sub,userName:M.preferred_username??"",name:M.name??"",email:M.email??"",avatar:M.picture,userType:"customer",sso:{profile:M,tenant:{id:"ciam",name:"CIAM"},scope:"openid profile email",tokenType:"Bearer",expires:A}}}async function F(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(!q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await q.getWorkloadIdentity(M))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let X,Z;try{let n=M.headers.get("content-type");if(!n||!n.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let a=await M.text(),R=JSON.parse(a);if(Z=typeof R?.redirect==="string"&&R.redirect.length>0?R.redirect:void 0,X={userName:R.userName,name:R.name,email:R.email,avatar:R.avatar},!X.userName||!X.name||!X.email)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}})}catch(n){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let _=new URL(M.url).searchParams.get("ttl"),S=_?parseInt(_,10):Y.magicLinkTtl??3600;if(Number.isNaN(S)||S<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let I=i(32),C=new Date(Date.now()+S*1000);if(!Y.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await Y.magicLinkStore.create(I,X,C)}catch(n){return console.error("Error creating magic link:",n),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let u=new URL(M.url),c=Y.magicLinkLoginUrl||"/magic-link/login",T=new URL(c,u.origin);if(T.searchParams.set("token",I),Z)T.searchParams.set("redirect",Z);return new Response(JSON.stringify({magicLink:T.toString(),expiresAt:C.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function H(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=new URL(M.url),X=A.searchParams.get("token");if(!X){let J=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:J}})}if(!Y.magicLinkStore){let J=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:J}})}let Z=await Y.magicLinkStore.get(X);if(!Z){let J=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:J}})}let W=new Date(Date.now()+(Y.sessionTtl??86400)*1000),_=i(32),S=K(Z.user),I=V(Z.user,_,W),C=Q(S,_,W),u=z(I);try{let J={sid:_,sub:S,createdAt:new Date,lastActivityAt:new Date};await g().create(J)}catch(J){console.warn("Failed to create session:",J)}if(Y.userStore)try{let J=u.id;if(J){let r=new Date,s=await Y.userStore.get(J);if(s||Y.enableJitUserProvisioning){let FM={...s??{},...u,id:J,createdAt:s?.createdAt??r,updatedAt:r,userType:s?.userType??"customer"};await Y.userStore.upsert(FM)}}}catch(J){console.warn("Failed to store user:",J)}try{await Y.magicLinkStore.delete(X)}catch(J){console.warn("Failed to delete magic link:",J)}let c=await k(C),T=await k(I),n=Y.landingUrl||"/",a=A.searchParams.get("redirect"),R=n;if(a)if(a.startsWith("/"))R=a;else try{if(new URL(a).origin===new URL(M.url).origin)R=a}catch{}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",R],...P(c,T,W)]})}async function $(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=Y.magicLinkUrl||"/magic-link",X=Y.magicLinkLoginUrl||"/magic-link/login",Z=Y.logoutUrl||"/auth/logout",W=Y.logoutBackChannelUrl||"/auth/logout/backchannel",_=new URL(M.url).pathname,S=(T)=>{if(!T)return;try{return new URL(T).pathname}catch{return T.startsWith("/")?T:`/${T}`}};if(S(A)===_&&M.method==="POST")return F(M);if(S(X)===_&&M.method==="GET")return H(M);if(S(Z)===_&&M.method==="GET")return p(M);if(S(W)===_&&M.method==="POST")return y(M);return new Response("Not Found",{status:404})}return{...Y,getUser:w,getRequiredUser:b,logout:p,logoutBackChannel:y,handler:$}}async function BM(O,L){return e(L,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),L.ciam?.getUser(O)}function N(O,L,D){return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:String(O),scimType:D,detail:L}),{status:O,headers:{"Content-Type":"application/scim+json"}})}function MM(O,L){let D=L?.totalResults??O.length,h=L?.startIndex??1,q=L?.itemsPerPage??O.length;return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:ListResponse"],totalResults:D,startIndex:h,itemsPerPage:q,Resources:O}),{status:200,headers:{"Content-Type":"application/scim+json"}})}function d(O,L=200){return new Response(JSON.stringify(O),{status:L,headers:{"Content-Type":"application/scim+json"}})}function o(O){return{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],id:O.id,externalId:O.externalId,displayName:O.displayName,members:O.members,meta:{resourceType:"Group",created:O.createdAt.toISOString(),lastModified:O.updatedAt.toISOString()}}}function AM(){return crypto.randomUUID()}function KM(O,L,D,h,q){if(!h&&!q)return;let Y={...h,...q};function U(){if(!D)throw L.error?.("IAM requires workload configuration before use"),Error("IAM requires workload configuration");return D}async function g(){let B=await U().getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${B}`})}async function m(B,j,G,P){if(!Y.url)throw Error("IAM URL not configured for outgoing requests");let v=`${Y.url}${j}`;try{let w=await g(),b=await fetch(v,{method:B,headers:w,body:G?JSON.stringify(G):void 0}),p=await b.json();if(!b.ok)return{success:!1,error:p,status:b.status};let y=await P["~standard"].validate(p);if(y.issues)return console.error("SCIM response validation failed:",y.issues),{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${y.issues.map((K)=>K.message).join("; ")}`},status:400};return{success:!0,data:y.value,status:b.status}}catch(w){return{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"500",detail:w instanceof Error?w.message:"Unknown error occurred"},status:500}}}function i(){return Y.url}let l,t;if(Y.url)t=async(j,G)=>{let P={...j,schemas:j.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return m("POST","/Users",P,O.user)},l={createGroup:async(j,G)=>{let P={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:j,externalId:G?.externalId,members:G?.members};return m("POST","/Groups",P,O.group)}};let x;if(Y.groupStore){let B=Y.groupStore,j=async(K)=>{let V=U(),Q=K.headers.get("Authorization");if(!Q||!Q.startsWith("Bearer "))return!1;try{let z=Q.substring(7);return(await V.validateToken(z)).valid}catch{return!1}},G=async(K,V)=>{if(!await j(K))return N(401,"Authorization required");let z=new URL(K.url),F=V?.basePath??"/Groups",H=z.pathname;if(H.startsWith(F))H=H.substring(F.length);let M=H.match(/^\/([^/]+)$/)?.[1],A=K.method;try{if(M)switch(A){case"GET":return await v(M);case"PUT":return await b(K,M);case"PATCH":return await p(K,M);case"DELETE":return await y(M);default:return N(405,"Method not allowed")}else if(H===""||H==="/")switch(A){case"GET":return await P(K);case"POST":return await w(K);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(X){return console.error("Groups inbound handler error:",X),N(500,X instanceof Error?X.message:"Internal server error")}},P=async(K)=>{let V=new URL(K.url),Q=V.searchParams.get("startIndex"),z=V.searchParams.get("count"),F=Q!=null?parseInt(Q,10):void 0,H=z!=null?parseInt(z,10):void 0,$=F!=null&&!Number.isNaN(F)?Math.max(0,F-1):0,M=H!=null&&!Number.isNaN(H)?H:void 0,A=await B.list({start:$,limit:M}),X=A.items.map(o);return MM(X,{totalResults:A.total,startIndex:$+1,itemsPerPage:A.count})},v=async(K)=>{let V=await B.get(K);if(!V)return N(404,`Group ${K} not found`,"invalidValue");return d(o(V))},w=async(K)=>{let V=await K.json(),Q=await O.group["~standard"].validate(V);if(Q.issues)return console.error("Group creation validation failed:",Q.issues),N(400,`Request validation failed: ${Q.issues.map(($)=>$.message).join("; ")}`,"invalidValue");let z=Q.value;if(!z.displayName)return N(400,"displayName is required","invalidValue");let F=new Date,H={id:AM(),displayName:z.displayName,externalId:z.externalId,members:z.members,createdAt:F,updatedAt:F};return await B.upsert(H),d(o(H),201)},b=async(K,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let z=await K.json(),F=await O.group["~standard"].validate(z);if(F.issues)return console.error("Group replacement validation failed:",F.issues),N(400,`Request validation failed: ${F.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let H=F.value,$={...Q,displayName:H.displayName??Q.displayName,externalId:H.externalId,members:H.members,updatedAt:new Date};return await B.upsert($),d(o($))},p=async(K,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let F=(await K.json()).Operations??[],H={...Q};for(let $ of F)if($.op==="replace"&&$.path&&$.value!==void 0){if($.path==="displayName")H.displayName=$.value}else if($.op==="add"&&$.path&&$.value!==void 0){if($.path==="members"){let M=$.value;H.members=[...H.members??[],...M]}}else if($.op==="remove"&&$.path){if($.path.startsWith("members[")){let M=$.path.match(/members\[value eq "([^"]+)"\]/);if(M)H.members=(H.members??[]).filter((A)=>A.value!==M[1])}}return H.updatedAt=new Date,await B.upsert(H),d(o(H))},y=async(K)=>{if(!await B.get(K))return N(404,`Group ${K} not found`,"invalidValue");return await B.delete(K),new Response(null,{status:204})};x={handler:G}}let k;if(Y.userStore){let B=Y.userStore,j=async(Q)=>{let z=U(),F=Q.headers.get("Authorization");if(!F||!F.startsWith("Bearer "))return!1;try{let H=F.substring(7);return(await z.validateToken(H)).valid}catch{return!1}},G=(Q)=>{return{schemas:["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],id:Q.id,userName:Q.userName||Q.email||Q.id,displayName:Q.name||Q.userName||Q.email,name:Q.name?{givenName:Q.name.split(" ")[0],familyName:Q.name.split(" ").slice(1).join(" ")||void 0}:void 0,emails:Q.email?[{value:Q.email,primary:!0}]:[],active:!0,...Q.userType!=null&&{userType:Q.userType},meta:{resourceType:"User",created:Q.createdAt.toISOString(),lastModified:Q.updatedAt.toISOString()}}},P=(Q)=>{let z=new Date,F=Q.emails?.find((A)=>A.primary)?.value||Q.emails?.[0]?.value,H=Q.name?`${Q.name.givenName||""} ${Q.name.familyName||""}`.trim():Q.displayName,$=Q.id||AM(),M=Q.userName||F||$;return{id:$,userName:M,name:H||Q.displayName||M,email:F||M,avatar:Q.profileUrl,sso:{profile:{sub:$,iss:"iam-provisioned",aud:"iam-provisioned",exp:Math.floor(Date.now()/1000)+3600,iat:Math.floor(Date.now()/1000),email:F||M,email_verified:!0,name:H||Q.displayName||M,preferred_username:M},tenant:{id:"iam-provisioned",name:"IAM Provisioned"},scope:"openid profile email",tokenType:"Bearer",expires:new Date(Date.now()+3600000)},createdAt:Q.meta?.created?new Date(Q.meta.created):z,updatedAt:Q.meta?.lastModified?new Date(Q.meta.lastModified):z,...Q.userType!=null&&{userType:Q.userType}}},v=async(Q,z)=>{if(!await j(Q))return N(401,"Authorization required");let H=new URL(Q.url),$=z?.basePath??"/Users",M=H.pathname;if(M.startsWith($))M=M.substring($.length);let X=M.match(/^\/([^/]+)$/)?.[1],Z=Q.method;try{if(X)switch(Z){case"GET":return await b(X);case"PUT":return await y(Q,X);case"PATCH":return await K(Q,X);case"DELETE":return await V(X);default:return N(405,"Method not allowed")}else if(M===""||M==="/")switch(Z){case"GET":return await w(Q);case"POST":return await p(Q);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(W){return console.error("Users inbound handler error:",W),N(500,W instanceof Error?W.message:"Internal server error")}},w=async(Q)=>{let z=new URL(Q.url),F=z.searchParams.get("startIndex"),H=z.searchParams.get("count"),$=F!=null?parseInt(F,10):void 0,M=H!=null?parseInt(H,10):void 0,A=$!=null&&!Number.isNaN($)?Math.max(0,$-1):0,X=M!=null&&!Number.isNaN(M)?M:void 0,Z=await B.list({start:A,limit:X}),W=Z.items.map(G);return MM(W,{totalResults:Z.total,startIndex:A+1,itemsPerPage:Z.count})},b=async(Q)=>{let z=await B.get(Q);if(!z)return N(404,`User ${Q} not found`,"invalidValue");return d(G(z))},p=async(Q)=>{let z=await Q.json(),F=await O.user["~standard"].validate(z);if(F.issues)return console.error("User creation validation failed:",F.issues),N(400,`Request validation failed: ${F.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let H=F.value;if(!H.userName&&!H.emails?.[0]?.value)return N(400,"userName or email is required","invalidValue");let $=P(H);return await B.upsert($),d(G($),201)},y=async(Q,z)=>{let F=await B.get(z);if(!F)return N(404,`User ${z} not found`,"invalidValue");let H=await Q.json(),$=await O.user["~standard"].validate(H);if($.issues)return console.error("User replacement validation failed:",$.issues),N(400,`Request validation failed: ${$.issues.map((X)=>X.message).join("; ")}`,"invalidValue");let M=$.value,A=P({...M,id:z});return A.createdAt=F.createdAt,A.updatedAt=new Date,await B.upsert(A),d(G(A))},K=async(Q,z)=>{let F=await B.get(z);if(!F)return N(404,`User ${z} not found`,"invalidValue");let $=(await Q.json()).Operations??[],M={...F};for(let A of $)if(A.op==="replace"&&A.path&&A.value!==void 0){if(A.path==="displayName")M.name=A.value;else if(A.path==="userName")M.userName=A.value;else if(A.path.startsWith("name.")){let X=A.path.split(".")[1];if(!M.name)M.name="";if(X==="givenName")M.name=`${A.value} ${M.name.split(" ").slice(1).join(" ")}`.trim();else if(X==="familyName")M.name=`${M.name.split(" ")[0]} ${A.value}`.trim()}else if(A.path==="emails"){let X=A.value,Z=X?.find((W)=>W.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="add"&&A.path&&A.value!==void 0){if(A.path==="emails"){let X=A.value,Z=X?.find((W)=>W.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="remove"&&A.path){if(A.path==="displayName")M.name=""}return M.updatedAt=new Date,await B.upsert(M),d(G(M))},V=async(Q)=>{if(!await B.get(Q))return N(404,`User ${Q} not found`,"invalidValue");return await B.delete(Q),new Response(null,{status:204})};k={handler:v}}async function f(B,j){U();let P=new URL(B.url).pathname,v=j?.usersUrl??Y.usersUrl??"/api/iam/Users",w=j?.groupsUrl??Y.groupsUrl??"/api/iam/Groups";if(P.startsWith(v)&&k)return k.handler(B,{basePath:v});if(P.startsWith(w)&&x)return x.handler(B,{basePath:w});return N(404,"Resource not found")}return{...Y,createUser:t,getBaseUrl:i,groups_outbound:l,groups_inbound:x,users_inbound:k,handler:f}}var WM="@enterprisestandard/core",OM=YM(XM(WM));function QM(O){let L=O.replace(/-/g,"+").replace(/_/g,"/");return atob(L)}async function SM(O,L){let D=O.split(".");if(D.length!==3)throw Error("Invalid JWT");let h=JSON.parse(QM(D[0])),q=JSON.parse(QM(D[1])),E=D[2].replace(/-/g,"+").replace(/_/g,"/"),Y=h.kid;if(!Y)throw Error("JWT header missing kid");let U=await $M(L),g=await HM(U,Y),i=new TextEncoder().encode(`${D[0]}.${D[1]}`),l=Uint8Array.from(atob(E),(B)=>B.charCodeAt(0));if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",g,l,i))throw Error("Invalid JWT signature");let x=await OM.validate(q);if(x.issues)throw Error(`ID token claims validation failed: ${x.issues.map((B)=>B.message).join("; ")}`);let k=x.value;if(k===void 0)throw Error("ID token claims missing");let f=k;if(typeof f.exp==="number"&&f.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return ZM(f)}export{SM as verifyUser,NM as sso,jM as logoutBackChannel,DM as logout,JM as initiateLogin,KM as iam,_M as getSSOorCIAMUser,VM as getSSOUser,GM as getRequiredSSOorCIAMUser,BM as getCIAMUser,zM as ciam,LM as callback};
+import{A as JM,B as LM,C as DM,D as jM,c as XM,d as YM,e,k as ZM,r as $M,s as HM,w as NM,x as VM,y as _M,z as GM}from"./shared/core-5zzt9q6h.js";function zM(O,L,D,h,q){if(!D&&!h)return;let E={...D,...h},Y={...E,signingKey:D?.signingKey,magicLinkTtl:E.magicLinkTtl??3600,sessionTtl:E.sessionTtl??86400,cookiesSecure:E.cookiesSecure!==void 0?E.cookiesSecure:!0,cookiesSameSite:E.cookiesSameSite!==void 0?E.cookiesSameSite:"Strict",cookiesPrefix:E.cookiesPrefix??(E.ciamId?`es.ciam.${E.ciamId}`:"es.ciam"),cookiesPath:E.cookiesPath??"/",sessionValidation:E.sessionValidation??"always"};function U(){if(!Y.signingKey)throw Error("Missing CIAM configuration field: signingKey. CIAM signingKey is required for JWT token signing and must be provided via Vault (ciam.signingKey).")}function g(){if(!Y.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and backchannel logout.");return Y.sessionStore}function m(){U(),g()}function i(M=32){let A=new Uint8Array(M);return crypto.getRandomValues(A),Array.from(A,(X)=>X.toString(16).padStart(2,"0")).join("").substring(0,M)}function l(M){let A=typeof M==="string"?new TextEncoder().encode(M):M,X="";return A.forEach((Z)=>{X+=String.fromCharCode(Z)}),btoa(X).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function t(M){let A=M.replace(/-/g,"+").replace(/_/g,"/"),X=A.padEnd(A.length+(4-A.length%4)%4,"=");return atob(X)}async function x(){U();let M=new TextEncoder().encode(Y.signingKey??"");return crypto.subtle.importKey("raw",M,{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}async function k(M){let X=l(JSON.stringify({alg:"HS256",typ:"JWT"})),Z=l(JSON.stringify(M)),W=`${X}.${Z}`,_=await x(),S=await crypto.subtle.sign("HMAC",_,new TextEncoder().encode(W)),I=l(new Uint8Array(S));return`${W}.${I}`}async function f(M){let A=M.split(".");if(A.length!==3)throw Error("Invalid JWT");let[X,Z,W]=A,_=`${X}.${Z}`,S=await x(),I=new Uint8Array(t(W).split("").map((T)=>T.charCodeAt(0)));if(!await crypto.subtle.verify("HMAC",S,I,new TextEncoder().encode(_)))throw Error("Invalid JWT signature");let u=t(Z),c=JSON.parse(u);if(typeof c.exp==="number"&&c.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return c}function B(M,A,X){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(M=`${Y.cookiesPrefix}.${M}`,typeof A!=="string")A=btoa(JSON.stringify(A));let Z;if(X instanceof Date)Z=`Expires=${X.toUTCString()}`;else if(typeof X==="number")Z=`Max-Age=${X}`;else throw Error("Invalid expires type",X);if(A.length>4000)throw Error(`Error setting cookie: ${M}. Cookie length is: ${A.length}`);return`${M}=${A}; ${Z}; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function j(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");return`${Y.cookiesPrefix}.${M}=; Max-Age=0; Path=${Y.cookiesPath}; HttpOnly;${Y.cookiesSecure?" Secure;":""} SameSite=${Y.cookiesSameSite};`}function G(M,A,X=!1){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");let Z=A.headers.get("cookie");if(!Z)return null;let W=`${Y.cookiesPrefix}.${M}`,_=Z.split(";").find((C)=>C.trim().startsWith(`${W}=`));if(!_)return null;let S=_.indexOf("="),I=_.substring(S+1).trim();if(!X)return I;try{let C=atob(I);return JSON.parse(C)}catch(C){return console.error(`[CIAM] Failed to parse cookie '${W}':`,C),null}}function P(M,A,X){let Z={expires_in:Y.sessionTtl??86400,token_type:"Bearer",expires:X.toISOString()};return[["Set-Cookie",B("access",M,X)],["Set-Cookie",B("id",A,X)],["Set-Cookie",B("control",Z,X)]]}function v(M){let A=G("access",M),X=G("id",M),Z=G("control",M,!0);if(!A||!X||!Z)return;if(Z.expires&&Date.now()>new Date(Z.expires).getTime())return;return{access:A,id:X,control:Z}}async function w(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=v(M);if(!A)return;let X=await f(A.access),Z=await f(A.id);if(!X.sid||!Z.sub)return;if(Y.sessionValidation!=="disabled"){if(!await g().get(X.sid))return}return z(Z)}catch(A){return}}async function b(M){let A=await w(M);if(A)return A;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function p(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let S=v(M);if(S){let I=await f(S.access);if(I.sid)await g().delete(I.sid)}}catch(S){console.warn("Failed to delete CIAM session:",S)}let A=[["Set-Cookie",j("access")],["Set-Cookie",j("id")],["Set-Cookie",j("control")]],Z=new URL(M.url).searchParams.get("redirect");if(Z)return new Response("Logged out",{status:302,headers:[["Location",Z],...A]});let W=M.headers.get("accept");if(W?.includes("application/json")||W?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...A]});return new Response("Logout Complete",{status:200,headers:[["Content-Type","text/plain"],...A]})}async function y(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();try{let A=M.headers.get("content-type");if(!A||!A.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let X=await M.text(),W=new URLSearchParams(X).get("logout_token");if(!W)return new Response("Missing logout_token parameter",{status:400});let S=(await f(W)).sid;if(!S)return new Response("Invalid logout_token: missing sid claim",{status:400});return await g().delete(S),new Response("OK",{status:200})}catch(A){return console.error("Error during CIAM back-channel logout:",A),new Response("Internal Server Error",{status:500})}}function K(M){return M.id||M.email||`ciam-${M.userName}`}function V(M,A,X){return{sub:K(M),iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),email:M.email,name:M.name,preferred_username:M.userName,picture:M.avatar,sid:A}}function Q(M,A,X){return{sub:M,iss:"ciam",aud:"ciam",exp:Math.floor(X.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:A,scope:"openid profile email"}}function z(M){let A=M.exp?new Date(M.exp*1000):new Date;return{id:M.sub,userName:M.preferred_username??"",name:M.name??"",email:M.email??"",avatar:M.picture,userType:"customer",sso:{profile:M,tenant:{id:"ciam",name:"CIAM"},scope:"openid profile email",tokenType:"Bearer",expires:A}}}async function F(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");if(!q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await q.getWorkloadIdentity(M))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let X,Z;try{let n=M.headers.get("content-type");if(!n||!n.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let a=await M.text(),R=JSON.parse(a);if(Z=typeof R?.redirect==="string"&&R.redirect.length>0?R.redirect:void 0,X={userName:R.userName,name:R.name,email:R.email,avatar:R.avatar},!X.userName||!X.name||!X.email)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}})}catch(n){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let _=new URL(M.url).searchParams.get("ttl"),S=_?parseInt(_,10):Y.magicLinkTtl??3600;if(Number.isNaN(S)||S<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let I=i(32),C=new Date(Date.now()+S*1000);if(!Y.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await Y.magicLinkStore.create(I,X,C)}catch(n){return console.error("Error creating magic link:",n),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let u=new URL(M.url),c=Y.magicLinkLoginUrl||"/magic-link/login",T=new URL(c,u.origin);if(T.searchParams.set("token",I),Z)T.searchParams.set("redirect",Z);return new Response(JSON.stringify({magicLink:T.toString(),expiresAt:C.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function H(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=new URL(M.url),X=A.searchParams.get("token");if(!X){let J=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:J}})}if(!Y.magicLinkStore){let J=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:J}})}let Z=await Y.magicLinkStore.get(X);if(!Z){let J=Y.errorUrl||"/";return new Response("Redirecting to error URL",{status:302,headers:{Location:J}})}let W=new Date(Date.now()+(Y.sessionTtl??86400)*1000),_=i(32),S=K(Z.user),I=V(Z.user,_,W),C=Q(S,_,W),u=z(I);try{let J={sid:_,sub:S,createdAt:new Date,lastActivityAt:new Date};await g().create(J)}catch(J){console.warn("Failed to create session:",J)}if(Y.userStore)try{let J=u.id;if(J){let r=new Date,s=await Y.userStore.get(J);if(s||Y.enableJitUserProvisioning){let FM={...s??{},...u,id:J,createdAt:s?.createdAt??r,updatedAt:r,userType:s?.userType??"customer"};await Y.userStore.upsert(FM)}}}catch(J){console.warn("Failed to store user:",J)}try{await Y.magicLinkStore.delete(X)}catch(J){console.warn("Failed to delete magic link:",J)}let c=await k(C),T=await k(I),n=Y.landingUrl||"/",a=A.searchParams.get("redirect"),R=n;if(a)if(a.startsWith("/"))R=a;else try{if(new URL(a).origin===new URL(M.url).origin)R=a}catch{}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",R],...P(c,T,W)]})}async function $(M){if(!Y)throw Error("Enterprise Standard CIAM Manager not initialized");m();let A=Y.magicLinkUrl||"/magic-link",X=Y.magicLinkLoginUrl||"/magic-link/login",Z=Y.logoutUrl||"/auth/logout",W=Y.logoutBackChannelUrl||"/auth/logout/backchannel",_=new URL(M.url).pathname,S=(T)=>{if(!T)return;try{return new URL(T).pathname}catch{return T.startsWith("/")?T:`/${T}`}};if(S(A)===_&&M.method==="POST")return F(M);if(S(X)===_&&M.method==="GET")return H(M);if(S(Z)===_&&M.method==="GET")return p(M);if(S(W)===_&&M.method==="POST")return y(M);return new Response("Not Found",{status:404})}return{...Y,getUser:w,getRequiredUser:b,logout:p,logoutBackChannel:y,handler:$}}async function BM(O,L){return e(L,"EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function."),L.ciam?.getUser(O)}function N(O,L,D){return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:String(O),scimType:D,detail:L}),{status:O,headers:{"Content-Type":"application/scim+json"}})}function MM(O,L){let D=L?.totalResults??O.length,h=L?.startIndex??1,q=L?.itemsPerPage??O.length;return new Response(JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:ListResponse"],totalResults:D,startIndex:h,itemsPerPage:q,Resources:O}),{status:200,headers:{"Content-Type":"application/scim+json"}})}function d(O,L=200){return new Response(JSON.stringify(O),{status:L,headers:{"Content-Type":"application/scim+json"}})}function o(O){return{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],id:O.id,externalId:O.externalId,displayName:O.displayName,members:O.members,meta:{resourceType:"Group",created:O.createdAt.toISOString(),lastModified:O.updatedAt.toISOString()}}}function AM(){return crypto.randomUUID()}function KM(O,L,D,h,q){if(!h&&!q)return;let Y={...h,...q};function U(){if(!D)throw L.error?.("IAM requires workload configuration before use"),Error("IAM requires workload configuration");return D}async function g(){let B=await U().getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${B}`})}async function m(B,j,G,P){if(!Y.url)throw Error("IAM URL not configured for outgoing requests");let v=`${Y.url}${j}`;try{let w=await g(),b=await fetch(v,{method:B,headers:w,body:G?JSON.stringify(G):void 0}),p=await b.json();if(!b.ok)return{success:!1,error:p,status:b.status};let y=await P["~standard"].validate(p);if(y.issues)return console.error("SCIM response validation failed:",y.issues),{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${y.issues.map((K)=>K.message).join("; ")}`},status:400};return{success:!0,data:y.value,status:b.status}}catch(w){return{success:!1,error:{schemas:["urn:ietf:params:scim:api:messages:2.0:Error"],status:"500",detail:w instanceof Error?w.message:"Unknown error occurred"},status:500}}}function i(){return Y.url}let l,t;if(Y.url)t=async(j,G)=>{let P={...j,schemas:j.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return m("POST","/Users",P,O.user)},l={createGroup:async(j,G)=>{let P={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:j,externalId:G?.externalId,members:G?.members};return m("POST","/Groups",P,O.group)}};let x;if(Y.groupStore){let B=Y.groupStore,j=async(K)=>{let V=U(),Q=K.headers.get("Authorization");if(!Q||!Q.startsWith("Bearer "))return!1;try{let z=Q.substring(7);return(await V.validateToken(z)).valid}catch{return!1}},G=async(K,V)=>{if(!await j(K))return N(401,"Authorization required");let z=new URL(K.url),F=V?.basePath??"/Groups",H=z.pathname;if(H.startsWith(F))H=H.substring(F.length);let M=H.match(/^\/([^/]+)$/)?.[1],A=K.method;try{if(M)switch(A){case"GET":return await v(M);case"PUT":return await b(K,M);case"PATCH":return await p(K,M);case"DELETE":return await y(M);default:return N(405,"Method not allowed")}else if(H===""||H==="/")switch(A){case"GET":return await P(K);case"POST":return await w(K);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(X){return console.error("Groups inbound handler error:",X),N(500,X instanceof Error?X.message:"Internal server error")}},P=async(K)=>{let V=new URL(K.url),Q=V.searchParams.get("startIndex"),z=V.searchParams.get("count"),F=Q!=null?parseInt(Q,10):void 0,H=z!=null?parseInt(z,10):void 0,$=F!=null&&!Number.isNaN(F)?Math.max(0,F-1):0,M=H!=null&&!Number.isNaN(H)?H:void 0,A=await B.list({start:$,limit:M}),X=A.items.map(o);return MM(X,{totalResults:A.total,startIndex:$+1,itemsPerPage:A.count})},v=async(K)=>{let V=await B.get(K);if(!V)return N(404,`Group ${K} not found`,"invalidValue");return d(o(V))},w=async(K)=>{let V=await K.json(),Q=await O.group["~standard"].validate(V);if(Q.issues)return console.error("Group creation validation failed:",Q.issues),N(400,`Request validation failed: ${Q.issues.map(($)=>$.message).join("; ")}`,"invalidValue");let z=Q.value;if(!z.displayName)return N(400,"displayName is required","invalidValue");let F=new Date,H={id:AM(),displayName:z.displayName,externalId:z.externalId,members:z.members,createdAt:F,updatedAt:F};return await B.upsert(H),d(o(H),201)},b=async(K,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let z=await K.json(),F=await O.group["~standard"].validate(z);if(F.issues)return console.error("Group replacement validation failed:",F.issues),N(400,`Request validation failed: ${F.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let H=F.value,$={...Q,displayName:H.displayName??Q.displayName,externalId:H.externalId,members:H.members,updatedAt:new Date};return await B.upsert($),d(o($))},p=async(K,V)=>{let Q=await B.get(V);if(!Q)return N(404,`Group ${V} not found`,"invalidValue");let F=(await K.json()).Operations??[],H={...Q};for(let $ of F)if($.op==="replace"&&$.path&&$.value!==void 0){if($.path==="displayName")H.displayName=$.value}else if($.op==="add"&&$.path&&$.value!==void 0){if($.path==="members"){let M=$.value;H.members=[...H.members??[],...M]}}else if($.op==="remove"&&$.path){if($.path.startsWith("members[")){let M=$.path.match(/members\[value eq "([^"]+)"\]/);if(M)H.members=(H.members??[]).filter((A)=>A.value!==M[1])}}return H.updatedAt=new Date,await B.upsert(H),d(o(H))},y=async(K)=>{if(!await B.get(K))return N(404,`Group ${K} not found`,"invalidValue");return await B.delete(K),new Response(null,{status:204})};x={handler:G}}let k;if(Y.userStore){let B=Y.userStore,j=async(Q)=>{let z=U(),F=Q.headers.get("Authorization");if(!F||!F.startsWith("Bearer "))return!1;try{let H=F.substring(7);return(await z.validateToken(H)).valid}catch{return!1}},G=(Q)=>{return{schemas:["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],id:Q.id,userName:Q.userName||Q.email||Q.id,displayName:Q.name||Q.userName||Q.email,name:Q.name?{givenName:Q.name.split(" ")[0],familyName:Q.name.split(" ").slice(1).join(" ")||void 0}:void 0,emails:Q.email?[{value:Q.email,primary:!0}]:[],active:!0,...Q.userType!=null&&{userType:Q.userType},meta:{resourceType:"User",created:Q.createdAt.toISOString(),lastModified:Q.updatedAt.toISOString()}}},P=(Q)=>{let z=new Date,F=Q.emails?.find((A)=>A.primary)?.value||Q.emails?.[0]?.value,H=Q.name?`${Q.name.givenName||""} ${Q.name.familyName||""}`.trim():Q.displayName,$=Q.id||AM(),M=Q.userName||F||$;return{id:$,userName:M,name:H||Q.displayName||M,email:F||M,avatar:Q.profileUrl,sso:{profile:{sub:$,iss:"iam-provisioned",aud:"iam-provisioned",exp:Math.floor(Date.now()/1000)+3600,iat:Math.floor(Date.now()/1000),email:F||M,email_verified:!0,name:H||Q.displayName||M,preferred_username:M},tenant:{id:"iam-provisioned",name:"IAM Provisioned"},scope:"openid profile email",tokenType:"Bearer",expires:new Date(Date.now()+3600000)},createdAt:Q.meta?.created?new Date(Q.meta.created):z,updatedAt:Q.meta?.lastModified?new Date(Q.meta.lastModified):z,...Q.userType!=null&&{userType:Q.userType}}},v=async(Q,z)=>{if(!await j(Q))return N(401,"Authorization required");let H=new URL(Q.url),$=z?.basePath??"/Users",M=H.pathname;if(M.startsWith($))M=M.substring($.length);let X=M.match(/^\/([^/]+)$/)?.[1],Z=Q.method;try{if(X)switch(Z){case"GET":return await b(X);case"PUT":return await y(Q,X);case"PATCH":return await K(Q,X);case"DELETE":return await V(X);default:return N(405,"Method not allowed")}else if(M===""||M==="/")switch(Z){case"GET":return await w(Q);case"POST":return await p(Q);default:return N(405,"Method not allowed")}return N(404,"Resource not found")}catch(W){return console.error("Users inbound handler error:",W),N(500,W instanceof Error?W.message:"Internal server error")}},w=async(Q)=>{let z=new URL(Q.url),F=z.searchParams.get("startIndex"),H=z.searchParams.get("count"),$=F!=null?parseInt(F,10):void 0,M=H!=null?parseInt(H,10):void 0,A=$!=null&&!Number.isNaN($)?Math.max(0,$-1):0,X=M!=null&&!Number.isNaN(M)?M:void 0,Z=await B.list({start:A,limit:X}),W=Z.items.map(G);return MM(W,{totalResults:Z.total,startIndex:A+1,itemsPerPage:Z.count})},b=async(Q)=>{let z=await B.get(Q);if(!z)return N(404,`User ${Q} not found`,"invalidValue");return d(G(z))},p=async(Q)=>{let z=await Q.json(),F=await O.user["~standard"].validate(z);if(F.issues)return console.error("User creation validation failed:",F.issues),N(400,`Request validation failed: ${F.issues.map((M)=>M.message).join("; ")}`,"invalidValue");let H=F.value;if(!H.userName&&!H.emails?.[0]?.value)return N(400,"userName or email is required","invalidValue");let $=P(H);return await B.upsert($),d(G($),201)},y=async(Q,z)=>{let F=await B.get(z);if(!F)return N(404,`User ${z} not found`,"invalidValue");let H=await Q.json(),$=await O.user["~standard"].validate(H);if($.issues)return console.error("User replacement validation failed:",$.issues),N(400,`Request validation failed: ${$.issues.map((X)=>X.message).join("; ")}`,"invalidValue");let M=$.value,A=P({...M,id:z});return A.createdAt=F.createdAt,A.updatedAt=new Date,await B.upsert(A),d(G(A))},K=async(Q,z)=>{let F=await B.get(z);if(!F)return N(404,`User ${z} not found`,"invalidValue");let $=(await Q.json()).Operations??[],M={...F};for(let A of $)if(A.op==="replace"&&A.path&&A.value!==void 0){if(A.path==="displayName")M.name=A.value;else if(A.path==="userName")M.userName=A.value;else if(A.path.startsWith("name.")){let X=A.path.split(".")[1];if(!M.name)M.name="";if(X==="givenName")M.name=`${A.value} ${M.name.split(" ").slice(1).join(" ")}`.trim();else if(X==="familyName")M.name=`${M.name.split(" ")[0]} ${A.value}`.trim()}else if(A.path==="emails"){let X=A.value,Z=X?.find((W)=>W.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="add"&&A.path&&A.value!==void 0){if(A.path==="emails"){let X=A.value,Z=X?.find((W)=>W.primary)?.value||X?.[0]?.value;if(Z)M.email=Z}}else if(A.op==="remove"&&A.path){if(A.path==="displayName")M.name=""}return M.updatedAt=new Date,await B.upsert(M),d(G(M))},V=async(Q)=>{if(!await B.get(Q))return N(404,`User ${Q} not found`,"invalidValue");return await B.delete(Q),new Response(null,{status:204})};k={handler:v}}async function f(B,j){U();let P=new URL(B.url).pathname,v=j?.usersUrl??Y.usersUrl??"/api/iam/Users",w=j?.groupsUrl??Y.groupsUrl??"/api/iam/Groups";if(P.startsWith(v)&&k)return k.handler(B,{basePath:v});if(P.startsWith(w)&&x)return x.handler(B,{basePath:w});return N(404,"Resource not found")}return{...Y,createUser:t,getBaseUrl:i,groups_outbound:l,groups_inbound:x,users_inbound:k,handler:f}}var WM="@enterprisestandard/core",OM=YM(XM(WM));function QM(O){let L=O.replace(/-/g,"+").replace(/_/g,"/");return atob(L)}async function SM(O,L){let D=O.split(".");if(D.length!==3)throw Error("Invalid JWT");let h=JSON.parse(QM(D[0])),q=JSON.parse(QM(D[1])),E=D[2].replace(/-/g,"+").replace(/_/g,"/"),Y=h.kid;if(!Y)throw Error("JWT header missing kid");let U=await $M(L),g=await HM(U,Y),i=new TextEncoder().encode(`${D[0]}.${D[1]}`),l=Uint8Array.from(atob(E),(B)=>B.charCodeAt(0));if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",g,l,i))throw Error("Invalid JWT signature");let x=await OM.validate(q);if(x.issues)throw Error(`ID token claims validation failed: ${x.issues.map((B)=>B.message).join("; ")}`);let k=x.value;if(k===void 0)throw Error("ID token claims missing");let f=k;if(typeof f.exp==="number"&&f.exp<Math.floor(Date.now()/1000))throw Error("Token expired");return ZM(f)}export{SM as verifyUser,NM as sso,jM as logoutBackChannel,DM as logout,JM as initiateLogin,KM as iam,_M as getSSOorCIAMUser,VM as getSSOUser,GM as getRequiredSSOorCIAMUser,BM as getCIAMUser,zM as ciam,LM as callback};

package/dist/shared/{core-mawdwxm1.js → core-5zzt9q6h.js}

@@ -1,6 +1,6 @@
-function HX(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,A=[],N={};if("code"in X)if(typeof X.code==="string")N.code=X.code;else A.push({message:"code must be a string",path:["code"]});else if(!("error"in X))A.push({message:"code is required",path:["code"]});if("state"in X)if(typeof X.state==="string"||X.state===void 0)N.state=X.state;else A.push({message:"state must be a string",path:["state"]});if("session_state"in X)if(typeof X.session_state==="string"||X.session_state===void 0)N.session_state=X.session_state;else A.push({message:"session_state must be a string",path:["session_state"]});if("error"in X){if(typeof X.error==="string")N.error=X.error;else A.push({message:"error must be a string",path:["error"]});if("error_description"in X)if(typeof X.error_description==="string"||X.error_description===void 0)N.error_description=X.error_description;else A.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in X)if(typeof X.error_uri==="string"||X.error_uri===void 0)N.error_uri=X.error_uri;else A.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in X)if(typeof X.iss==="string"||X.iss===void 0)N.iss=X.iss;else A.push({message:"iss must be a string",path:["iss"]});if(A.length>0)return{issues:A};return{value:N}}}}}function JX(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,A=[],N={};if("access_token"in X)if(typeof X.access_token==="string")N.access_token=X.access_token;else A.push({message:"access_token must be a string",path:["access_token"]});else A.push({message:"access_token is required",path:["access_token"]});if("id_token"in X)if(typeof X.id_token==="string")N.id_token=X.id_token;else A.push({message:"id_token must be a string",path:["id_token"]});else A.push({message:"id_token is required",path:["id_token"]});if("token_type"in X)if(typeof X.token_type==="string")N.token_type=X.token_type;else A.push({message:"token_type must be a string",path:["token_type"]});else A.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)N.refresh_token=X.refresh_token;else A.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)N.scope=X.scope;else A.push({message:"scope must be a string",path:["scope"]});if("session_state"in X)if(typeof X.session_state==="string"||X.session_state===void 0)N.session_state=X.session_state;else A.push({message:"session_state must be a string",path:["session_state"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)N.expires=X.expires;else A.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)N.expires_in=X.expires_in;else A.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in X)if(typeof X.refresh_expires_in==="number"||X.refresh_expires_in===void 0)N.refresh_expires_in=X.refresh_expires_in;else A.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(A.length>0)return{issues:A};return{value:N}}}}}function n(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,A=[],N={...X},M=["iss","aud","sub","sid","name","email","preferred_username","picture"];for(let H of M)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="string")A.push({message:`${H} must be a string`,path:[H]})}let $=["exp","iat"];for(let H of $)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="number")A.push({message:`${H} must be a number`,path:[H]})}if(A.length>0)return{issues:A};return{value:N}}}}}function t(Y){let Z=Y["~standard"];return Object.assign({},Y,{validate(X){return Promise.resolve(Z.validate(X))}})}function D(Y,Z="Assertion failed. Required value is null or undefined."){if(Y===void 0||Y===null)throw Error(Z);return Y}function a(Y,Z){return Response.json({error:"validation_failed",message:Z,issues:Y},{status:400,headers:{"Content-Type":"application/json"}})}function VX(Y,Z,X=[]){let A={...Y,...Z};for(let N of X)A[N]=Y?.[N]??Z?.[N];return A}function GX(Y){let Z="",X=0,A=Y.length;while(X<A){let N=Y[X];if(N==='"'||N==="'"){let M=N;Z+=N,X++;while(X<A){let $=Y[X];if($==="\\"){if(Z+=$,X+1<A)Z+=Y[X+1],X+=2;else X++;continue}if($===M){Z+=$,X++;break}Z+=$,X++}continue}if(N==="/"&&X+1<A){let M=Y[X+1];if(M==="/"){X+=2;while(X<A&&Y[X]!==`
+function JX(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,A=[],N={};if("code"in X)if(typeof X.code==="string")N.code=X.code;else A.push({message:"code must be a string",path:["code"]});else if(!("error"in X))A.push({message:"code is required",path:["code"]});if("state"in X)if(typeof X.state==="string"||X.state===void 0)N.state=X.state;else A.push({message:"state must be a string",path:["state"]});if("session_state"in X)if(typeof X.session_state==="string"||X.session_state===void 0)N.session_state=X.session_state;else A.push({message:"session_state must be a string",path:["session_state"]});if("error"in X){if(typeof X.error==="string")N.error=X.error;else A.push({message:"error must be a string",path:["error"]});if("error_description"in X)if(typeof X.error_description==="string"||X.error_description===void 0)N.error_description=X.error_description;else A.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in X)if(typeof X.error_uri==="string"||X.error_uri===void 0)N.error_uri=X.error_uri;else A.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in X)if(typeof X.iss==="string"||X.iss===void 0)N.iss=X.iss;else A.push({message:"iss must be a string",path:["iss"]});if(A.length>0)return{issues:A};return{value:N}}}}}function FX(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,A=[],N={};if("access_token"in X)if(typeof X.access_token==="string")N.access_token=X.access_token;else A.push({message:"access_token must be a string",path:["access_token"]});else A.push({message:"access_token is required",path:["access_token"]});if("id_token"in X)if(typeof X.id_token==="string")N.id_token=X.id_token;else A.push({message:"id_token must be a string",path:["id_token"]});else A.push({message:"id_token is required",path:["id_token"]});if("token_type"in X)if(typeof X.token_type==="string")N.token_type=X.token_type;else A.push({message:"token_type must be a string",path:["token_type"]});else A.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)N.refresh_token=X.refresh_token;else A.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)N.scope=X.scope;else A.push({message:"scope must be a string",path:["scope"]});if("session_state"in X)if(typeof X.session_state==="string"||X.session_state===void 0)N.session_state=X.session_state;else A.push({message:"session_state must be a string",path:["session_state"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)N.expires=X.expires;else A.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)N.expires_in=X.expires_in;else A.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in X)if(typeof X.refresh_expires_in==="number"||X.refresh_expires_in===void 0)N.refresh_expires_in=X.refresh_expires_in;else A.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(A.length>0)return{issues:A};return{value:N}}}}}function n(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let X=Z,A=[],N={...X},M=["iss","aud","sub","sid","name","email","preferred_username","picture"];for(let H of M)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="string")A.push({message:`${H} must be a string`,path:[H]})}let $=["exp","iat"];for(let H of $)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="number")A.push({message:`${H} must be a number`,path:[H]})}if(A.length>0)return{issues:A};return{value:N}}}}}function t(Y){let Z=Y["~standard"];return Object.assign({},Y,{validate(X){return Promise.resolve(Z.validate(X))}})}function D(Y,Z="Assertion failed. Required value is null or undefined."){if(Y===void 0||Y===null)throw Error(Z);return Y}function i(Y,Z){return Response.json({error:"validation_failed",message:Z,issues:Y},{status:400,headers:{"Content-Type":"application/json"}})}function jX(Y,Z,X=[]){let A={...Y,...Z};for(let N of X)A[N]=Y?.[N]??Z?.[N];return A}function QX(Y){let Z="",X=0,A=Y.length;while(X<A){let N=Y[X];if(N==='"'||N==="'"){let M=N;Z+=N,X++;while(X<A){let $=Y[X];if($==="\\"){if(Z+=$,X+1<A)Z+=Y[X+1],X+=2;else X++;continue}if($===M){Z+=$,X++;break}Z+=$,X++}continue}if(N==="/"&&X+1<A){let M=Y[X+1];if(M==="/"){X+=2;while(X<A&&Y[X]!==`
 `)X++;if(X<A)Z+=`
-`;X++;continue}if(M==="*"){X+=2;while(X+1<A&&!(Y[X]==="*"&&Y[X+1]==="/"))X++;X+=2;continue}}Z+=N,X++}return Z}function jX(Y){let Z=GX(Y);return JSON.parse(Z)}async function DX(Y,Z=1000,X=1e4,A){let N=Date.now(),M="Awaiting Ping";return new Promise(($,H)=>{let z=null,w=null,C=async()=>{try{let I=await fetch(Y);if(I.ok){if(z)clearInterval(z);if(w)clearInterval(w);$()}else M=`Response error: ${I.status}: ${I.statusText}`}catch(I){M=I instanceof Error?I.message:String(I)}};if(C(),z=setInterval(C,Z),X>0)w=setInterval(()=>{console.warn(`${M}: ${Date.now()-N}ms`)},X);if(A)setTimeout(()=>{if(z)clearInterval(z);if(w)clearInterval(w);H(Error(`Timeout: ${A}ms: ${M}`))},A)})}var QX="@enterprisestandard/core",BX=t(n(QX));function WX(Y){let Z=Y.exp!=null?new Date(Y.exp*1000):new Date,X=Y.iss??"";return{id:Y.sub??"",userName:Y.preferred_username??"",name:Y.name??"",email:Y.email??"",avatar:Y.picture,sso:{profile:{...Y,iss:Y.iss??X,aud:Y.aud},tenant:{id:Y.idp??X,name:X},tokenType:"Bearer",expires:Z}}}function MX(Y){let Z=Y.replace(/-/g,"+").replace(/_/g,"/");return atob(Z)}async function zX(Y){let Z=Y.split(".");if(Z.length!==3)throw Error("Invalid JWT");let X=MX(Z[1]),A=JSON.parse(X),N=await BX.validate(A);if(N.issues)throw Error(`ID token claims validation failed: ${N.issues.map((M)=>M.message).join("; ")}`);if(N.value)return WX(N.value);throw Error("ID token claims validation failed")}var S=(Y,Z,...X)=>{if(X.length>0)console[Y](`[${Y.toUpperCase()}]`,Z,...X);else console[Y](`[${Y.toUpperCase()}]`,Z)},i={debug:()=>{},info:()=>{},warn(Y,...Z){S("warn",Y,...Z)},error(Y,...Z){S("error",Y,...Z)}},xX={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},IX={debug:()=>{},info:S.bind(console,"info"),warn:S.bind(console,"warn"),error:S.bind(console,"error")},TX={debug:S.bind(console,"debug"),info:S.bind(console,"info"),warn:S.bind(console,"warn"),error:S.bind(console,"error")},wX={debug:S.bind(console,"debug"),info:S.bind(console,"info"),warn:S.bind(console,"warn"),error:S.bind(console,"error")};var o=new Map;async function p(Y,Z=3,X=1000,A=30000){let N=Error("Placeholder Error");for(let M=0;M<=Z;M++)try{return await Y()}catch($){if(N=$ instanceof Error?$:Error(String($)),$ instanceof Error&&$.message.includes("400"))throw $;if(M===Z)throw N;let H=Math.min(X*2**M,A),z=Math.random()*0.1*H;await new Promise((w)=>setTimeout(w,H+z)),console.warn(`Retry attempt ${M+1} after ${H+z}ms delay`)}throw N}async function r(Y){let Z=o.get(Y);if(Z)return Z;return p(async()=>{let X=await fetch(Y);if(!X.ok)throw Error("Failed to fetch JWKS");let A=await X.json();return o.set(Y,A),A})}async function s(Y,Z){let X=Y.keys.find((A)=>A.kid===Z);if(!X)throw Error("Public key not found");return crypto.subtle.importKey("jwk",{kty:X.kty,n:X.n,e:X.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}function vX(Y,Z={}){let X=Z.cookieName??"es.active_session",A=Y.headers.get("cookie");if(!A)return;return XX(A)[X]}function UX(Y,Z={}){let X=Z.cookieName??"es.active_session",A=Z.path??"/",N=Z.secure??!1,M=Z.sameSite??"Lax",$=Z.maxAge,H=[`${X}=${Y}`,`Path=${A}`,"HttpOnly",`SameSite=${M}`];if(N)H.push("Secure");if(typeof $==="number")H.push(`Max-Age=${$}`);return H.join("; ")}function hX(Y,Z){if(!Y)return;let X=XX(Y);for(let[A,N]of Object.entries(X)){if(!A.startsWith("es.sso.")||!A.endsWith(".state"))continue;try{let M=JSON.parse(atob(N));if(M?.state===Z)return{clientId:A.slice(7,-6),stateCookie:M}}catch{}}return}function fX(Y,Z,X,A){if(!X&&!A)return;let N={...X,...A},M=!!(N.authority&&N.tokenUrl&&N.authorizationUrl&&N.clientId&&N.redirectUri&&N.scope),$={...N,authority:M?D(N.authority,"Missing 'authority' from SSO Config"):N.authority,tokenUrl:M?D(N.tokenUrl,"Missing 'tokenUrl' from SSO Config"):N.tokenUrl,authorizationUrl:M?D(N.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):N.authorizationUrl,clientId:M?D(N.clientId,"Missing 'clientId' from SSO Config"):N.clientId,redirectUri:M?D(N.redirectUri,"Missing 'redirectUri' from SSO Config"):N.redirectUri,scope:M?D(N.scope,"Missing 'scope' from SSO Config"):N.scope,responseType:N.responseType??"code",cookiesSecure:N.cookiesSecure!==void 0?N.cookiesSecure:!0,cookiesSameSite:N.cookiesSameSite!==void 0?N.cookiesSameSite:"Strict",cookiesPrefix:N.cookiesPrefix??(N.clientId?`es.sso.${N.clientId}`:"es.sso"),cookiesPath:N.cookiesPath??"/"};function H(){let K=[];if(!$.authority)K.push("authority");if(!$.tokenUrl)K.push("tokenUrl");if(!$.authorizationUrl)K.push("authorizationUrl");if(!$.clientId)K.push("clientId");if(!$.redirectUri)K.push("redirectUri");if(!$.scope)K.push("scope");if(K.length>0)throw Error(`Missing OIDC configuration fields: ${K.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function z(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");try{let{tokens:G}=await h(K);if(!G)return;return await v(G)}catch(G){console.error("Error parsing user from cookies:",G);return}}async function w(K){let G=await z(K);if(G)return G;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function C({landingUrl:K,errorUrl:G},B){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");H();let L=l(),W=l(64),Q=$.redirectUri;try{new URL(Q)}catch{if(B)try{let V=new URL(B),T=Q.startsWith("//")?Q.slice(1):Q.startsWith("/")?Q:`/${Q}`;Q=new URL(T,V.origin).toString()}catch{try{let V=new URL($.authorizationUrl),T=Q.startsWith("//")?Q.slice(1):Q.startsWith("/")?Q:`/${Q}`;Q=new URL(T,V.origin).toString()}catch{throw Error(`Invalid redirectUri: "${$.redirectUri}". It must be a valid absolute URL.`)}}}let O=new URL($.authorizationUrl);O.searchParams.append("client_id",$.clientId),O.searchParams.append("redirect_uri",Q),O.searchParams.append("response_type","code"),O.searchParams.append("scope",$.scope),O.searchParams.append("state",L);let J=await $X(W);O.searchParams.append("code_challenge",J),O.searchParams.append("code_challenge_method","S256");let j={state:L,codeVerifier:W,landingUrl:K,errorUrl:G};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:O.toString(),"Set-Cookie":U("state",j,86400)}})}async function I(K,G){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");try{let J=y("refresh",K);if(J)await ZX(J)}catch(J){console.warn("Failed to revoke token:",J)}if($.sessionStore)try{let J=await z(K);if(J?.sso?.profile.sid){let j=J.sso.profile.sid;await $.sessionStore.delete(j)}}catch(J){console.warn("Failed to delete session:",J)}let B=[["Set-Cookie",R("access")],["Set-Cookie",R("id")],["Set-Cookie",R("refresh")],["Set-Cookie",R("control")],["Set-Cookie",R("state")]],W=new URL(K.url).searchParams.get("redirect");if(W)return new Response("Logged out",{status:302,headers:[["Location",W],...B]});let Q=K.headers.get("accept");if(Q?.includes("application/json")||Q?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...B]});else return new Response(`
+`;X++;continue}if(M==="*"){X+=2;while(X+1<A&&!(Y[X]==="*"&&Y[X+1]==="/"))X++;X+=2;continue}}Z+=N,X++}return Z}function DX(Y){let Z=QX(Y);return JSON.parse(Z)}async function EX(Y,Z=1000,X=1e4,A){let N=Date.now(),M="Awaiting Ping";return new Promise(($,H)=>{let P=null,w=null,C=async()=>{try{let I=await fetch(Y);if(I.ok){if(P)clearInterval(P);if(w)clearInterval(w);$()}else M=`Response error: ${I.status}: ${I.statusText}`}catch(I){M=I instanceof Error?I.message:String(I)}};if(C(),P=setInterval(C,Z),X>0)w=setInterval(()=>{console.warn(`${M}: ${Date.now()-N}ms`)},X);if(A)setTimeout(()=>{if(P)clearInterval(P);if(w)clearInterval(w);H(Error(`Timeout: ${A}ms: ${M}`))},A)})}var BX="@enterprisestandard/core",WX=t(n(BX));function MX(Y){let Z=Y.exp!=null?new Date(Y.exp*1000):new Date,X=Y.iss??"";return{id:Y.sub??"",userName:Y.preferred_username??"",name:Y.name??"",email:Y.email??"",avatar:Y.picture,sso:{profile:{...Y,iss:Y.iss??X,aud:Y.aud},tenant:{id:Y.idp??X,name:X},tokenType:"Bearer",expires:Z}}}function LX(Y){let Z=Y.replace(/-/g,"+").replace(/_/g,"/");return atob(Z)}async function _X(Y){let Z=Y.split(".");if(Z.length!==3)throw Error("Invalid JWT");let X=LX(Z[1]),A=JSON.parse(X),N=await WX.validate(A);if(N.issues)throw Error(`ID token claims validation failed: ${N.issues.map((M)=>M.message).join("; ")}`);if(N.value)return MX(N.value);throw Error("ID token claims validation failed")}var x=(Y,Z,...X)=>{if(X.length>0)console[Y](`[${Y.toUpperCase()}]`,Z,...X);else console[Y](`[${Y.toUpperCase()}]`,Z)},a={debug:()=>{},info:()=>{},warn(Y,...Z){x("warn",Y,...Z)},error(Y,...Z){x("error",Y,...Z)}},IX={debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},TX={debug:()=>{},info:x.bind(console,"info"),warn:x.bind(console,"warn"),error:x.bind(console,"error")},o=(Y,...Z)=>{if(Z.length>0)console.log("[DEBUG]",Y,...Z);else console.log("[DEBUG]",Y)},wX={debug:o,info:x.bind(console,"info"),warn:x.bind(console,"warn"),error:x.bind(console,"error")},yX={debug:o,info:x.bind(console,"info"),warn:x.bind(console,"warn"),error:x.bind(console,"error")};var r=new Map;async function p(Y,Z=3,X=1000,A=30000){let N=Error("Placeholder Error");for(let M=0;M<=Z;M++)try{return await Y()}catch($){if(N=$ instanceof Error?$:Error(String($)),$ instanceof Error&&$.message.includes("400"))throw $;if(M===Z)throw N;let H=Math.min(X*2**M,A),P=Math.random()*0.1*H;await new Promise((w)=>setTimeout(w,H+P)),console.warn(`Retry attempt ${M+1} after ${H+P}ms delay`)}throw N}async function s(Y){let Z=r.get(Y);if(Z)return Z;return p(async()=>{let X=await fetch(Y);if(!X.ok)throw Error("Failed to fetch JWKS");let A=await X.json();return r.set(Y,A),A})}async function e(Y,Z){let X=Y.keys.find((A)=>A.kid===Z);if(!X)throw Error("Public key not found");return crypto.subtle.importKey("jwk",{kty:X.kty,n:X.n,e:X.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}function UX(Y,Z={}){let X=Z.cookieName??"es.active_session",A=Y.headers.get("cookie");if(!A)return;return YX(A)[X]}function hX(Y,Z={}){let X=Z.cookieName??"es.active_session",A=Z.path??"/",N=Z.secure??!1,M=Z.sameSite??"Lax",$=Z.maxAge,H=[`${X}=${Y}`,`Path=${A}`,"HttpOnly",`SameSite=${M}`];if(N)H.push("Secure");if(typeof $==="number")H.push(`Max-Age=${$}`);return H.join("; ")}function fX(Y,Z){if(!Y)return;let X=YX(Y);for(let[A,N]of Object.entries(X)){if(!A.startsWith("es.sso.")||!A.endsWith(".state"))continue;try{let M=JSON.parse(atob(N));if(M?.state===Z)return{clientId:A.slice(7,-6),stateCookie:M}}catch{}}return}function kX(Y,Z,X,A){if(!X&&!A)return;let N={...X,...A},M=!!(N.authority&&N.tokenUrl&&N.authorizationUrl&&N.clientId&&N.redirectUri&&N.scope),$={...N,authority:M?D(N.authority,"Missing 'authority' from SSO Config"):N.authority,tokenUrl:M?D(N.tokenUrl,"Missing 'tokenUrl' from SSO Config"):N.tokenUrl,authorizationUrl:M?D(N.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):N.authorizationUrl,clientId:M?D(N.clientId,"Missing 'clientId' from SSO Config"):N.clientId,redirectUri:M?D(N.redirectUri,"Missing 'redirectUri' from SSO Config"):N.redirectUri,scope:M?D(N.scope,"Missing 'scope' from SSO Config"):N.scope,responseType:N.responseType??"code",cookiesSecure:N.cookiesSecure!==void 0?N.cookiesSecure:!0,cookiesSameSite:N.cookiesSameSite!==void 0?N.cookiesSameSite:"Strict",cookiesPrefix:N.cookiesPrefix??(N.clientId?`es.sso.${N.clientId}`:"es.sso"),cookiesPath:N.cookiesPath??"/"};function H(){let K=[];if(!$.authority)K.push("authority");if(!$.tokenUrl)K.push("tokenUrl");if(!$.authorizationUrl)K.push("authorizationUrl");if(!$.clientId)K.push("clientId");if(!$.redirectUri)K.push("redirectUri");if(!$.scope)K.push("scope");if(K.length>0)throw Error(`Missing OIDC configuration fields: ${K.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing enterpriseStandard.`)}async function P(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");try{let{tokens:G}=await h(K);if(!G)return;return await v(G)}catch(G){console.error("Error parsing user from cookies:",G);return}}async function w(K){let G=await P(K);if(G)return G;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function C({landingUrl:K,errorUrl:G},B){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");H();let L=l(),W=l(64),Q=$.redirectUri;try{new URL(Q)}catch{if(B)try{let V=new URL(B),T=Q.startsWith("//")?Q.slice(1):Q.startsWith("/")?Q:`/${Q}`;Q=new URL(T,V.origin).toString()}catch{try{let V=new URL($.authorizationUrl),T=Q.startsWith("//")?Q.slice(1):Q.startsWith("/")?Q:`/${Q}`;Q=new URL(T,V.origin).toString()}catch{throw Error(`Invalid redirectUri: "${$.redirectUri}". It must be a valid absolute URL.`)}}}let O=new URL($.authorizationUrl);O.searchParams.append("client_id",$.clientId),O.searchParams.append("redirect_uri",Q),O.searchParams.append("response_type","code"),O.searchParams.append("scope",$.scope),O.searchParams.append("state",L);let J=await NX(W);O.searchParams.append("code_challenge",J),O.searchParams.append("code_challenge_method","S256");let j={state:L,codeVerifier:W,landingUrl:K,errorUrl:G};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:O.toString(),"Set-Cookie":U("state",j,86400)}})}async function I(K,G){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");try{let J=y("refresh",K);if(J)await $X(J)}catch(J){console.warn("Failed to revoke token:",J)}if($.sessionStore)try{let J=await P(K);if(J?.sso?.profile.sid){let j=J.sso.profile.sid;await $.sessionStore.delete(j)}}catch(J){console.warn("Failed to delete session:",J)}let B=[["Set-Cookie",R("access")],["Set-Cookie",R("id")],["Set-Cookie",R("refresh")],["Set-Cookie",R("control")],["Set-Cookie",R("state")]],W=new URL(K.url).searchParams.get("redirect");if(W)return new Response("Logged out",{status:302,headers:[["Location",W],...B]});let Q=K.headers.get("accept");if(Q?.includes("application/json")||Q?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out"}),{status:200,headers:[["Content-Type","application/json"],...B]});else return new Response(`
           <!DOCTYPE html><html lang="en"><body>
             <h1>Logout Complete</h1>
             <div style="display: none">
@@ -8,5 +8,5 @@ function HX(Y){return{"~standard":{version:1,vendor:Y,validate:(Z)=>{if(typeof Z
               Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
             </div>
           </body></html>
-        `,{status:200,headers:[["Content-Type","text/html"],...B]})}async function g(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(!$.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{let G=K.headers.get("content-type");if(!G||!G.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let B=await K.text(),W=new URLSearchParams(B).get("logout_token");if(!W)return new Response("Missing logout_token parameter",{status:400});let O=(await c(W)).sid;if(!O)return console.warn("Back-Channel Logout: logout_token missing sid claim"),new Response("Invalid logout_token: missing sid claim",{status:400});return await $.sessionStore.delete(O),console.log(`Back-Channel Logout: successfully deleted session ${O}`),new Response("OK",{status:200})}catch(G){return console.error("Error during back-channel logout:",G),new Response("Internal Server Error",{status:500})}}async function m(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let G=new URL(K.url),B=new URLSearchParams(G.search),L=Object.fromEntries(B.entries()),W=await Y.callbackParams["~standard"].validate(L);if(W.issues)return a(W.issues,"OIDC callback parameters validation failed");let{code:Q,state:O}=W.value;try{let J=y("state",K,!0),{codeVerifier:j,state:V,landingUrl:T}=J??{};if(D(j,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),D(V,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),D(T,'OIDC "landingUrl" was not present in cookies'),O!==V)throw Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');let _=await YX(Q,j,K.url),E=await v(_);if($.sessionStore)try{let F=E.sso.profile.sid,P=E.id;if(F&&P){let x={sid:F,sub:P,createdAt:new Date,lastActivityAt:new Date};await $.sessionStore.create(x)}else console.warn("Session creation skipped: missing sid or sub in ID token claims")}catch(F){console.warn("Failed to create session:",F)}if($.userStore)try{let F=E.id;if(F){let P=new Date,x=await $.userStore.get(F);if(x||$.enableJitUserProvisioning){let k={...x??{},...E,id:F,createdAt:x?.createdAt??P,updatedAt:P};await $.userStore.upsert(k)}else console.warn("JIT user provisioning disabled: user not found in store and will not be created")}else console.warn("User storage skipped: missing sub in ID token claims")}catch(F){console.warn("Failed to store user:",F)}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",T],["Set-Cookie",R("state")],...f(_,E.sso.expires)]})}catch(J){console.error("Error during sign-in callback:",J);try{let j=y("state",K,!0),{errorUrl:V}=j??{};if(V)return new Response("Redirecting to error url",{status:302,headers:[["Location",V]]})}catch(j){console.warn("Error parsing the errorUrl from the OIDC cookie")}return console.warn("No error page was found in the cookies. The user will be shown a default error page."),new Response("An error occurred during authentication, please return to the application homepage and try again.",{status:500})}}async function v(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let G=await c(K.id_token),B=Number(K.refresh_expires_in??K.expires_in??3600),L=K.expires?new Date(K.expires):new Date(Date.now()+B*1000);return{id:G.sub,userName:G.preferred_username||"",name:G.name||"",email:G.email||"",emails:[{value:G.email||"",primary:!0}],avatar:G.picture,sso:{profile:{...G,iss:G.iss||$.authority,aud:G.aud||$.clientId},tenant:{id:G.idp||G.iss||$.authority||"",name:G.iss||$.authority||""},scope:K.scope,tokenType:K.token_type,sessionState:K.session_state,expires:L}}}async function YX(K,G,B){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");H();let{tokenUrl:L,redirectUri:W}=$;try{new URL(W)}catch{if(B)try{let O=new URL(B),J=W.startsWith("//")?W.slice(1):W.startsWith("/")?W:`/${W}`;W=new URL(J,O.origin).toString()}catch{try{let O=new URL(L),J=W.startsWith("//")?W.slice(1):W.startsWith("/")?W:`/${W}`;W=new URL(J,O.origin).toString()}catch{throw Error(`Invalid redirectUri: "${$.redirectUri}". It must be a valid absolute URL.`)}}}let Q=new URLSearchParams;if(Q.append("grant_type","authorization_code"),Q.append("code",K),Q.append("redirect_uri",W),Q.append("client_id",$.clientId),$.clientSecret)Q.append("client_secret",$.clientSecret);Q.append("code_verifier",G);try{let O=await fetch(L,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Q.toString()}),J=await O.json();if(!O.ok){console.error("Token exchange error:",J);let V=J;throw Error(`Token exchange failed: ${V.error||O.statusText} - ${V.error_description||""}`.trim())}let j=await Y.tokenResponse["~standard"].validate(J);if(j.issues)throw console.error("Token response validation failed:",j.issues),Error(`Token response validation failed: ${j.issues}`);return j.value}catch(O){throw console.error("Error during token exchange:",O),O}}async function d(K){return p(async()=>{if(!$)throw Error("Enterprise Standard SSO Manager not initialized");H();let G=$.tokenUrl,B=new URLSearchParams;B.append("grant_type","refresh_token"),B.append("refresh_token",K),B.append("client_id",$.clientId);let L=await fetch(G,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:B.toString()}),W=await L.json();if(!L.ok){console.error("Token refresh error:",W);let Q=W;throw Error(`Token refresh failed: ${Q.error||L.statusText} - ${Q.error_description||""}`.trim())}return W})}async function ZX(K){try{if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(!$.revocationEndpoint)return;let G=new URLSearchParams;G.append("token",K),G.append("token_type_hint","refresh_token"),G.append("client_id",$.clientId);let B=await fetch($.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:G.toString()});if(!B.ok)console.warn("Token revocation failed:",B.status,B.statusText);else console.log("Token revoked successfully")}catch(G){console.warn("Error revoking token:",G)}}async function u(){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(!$.jwksUri&&!$.authority)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let K=$.jwksUri||`${$.authority}/protocol/openid-connect/certs`;return r(K)}async function c(K){try{let G=K.split(".");if(G.length!==3)throw Error("Invalid JWT");let B=JSON.parse(atob(G[0].replace(/-/g,"+").replace(/_/g,"/"))),L=JSON.parse(atob(G[1].replace(/-/g,"+").replace(/_/g,"/"))),W=G[2].replace(/-/g,"+").replace(/_/g,"/"),Q=await NX(B.kid),J=new TextEncoder().encode(`${G[0]}.${G[1]}`);if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",Q,Uint8Array.from(atob(W),(T)=>T.charCodeAt(0)),J))throw Error("Invalid JWT signature");let V=await Y.idTokenClaims["~standard"].validate(L);if(V.issues)throw console.error("ID token claims validation failed:",V.issues),Error(`ID token claims validation failed: ${V.issues}`);return V.value}catch(G){throw console.error("Error verifying JWT:",G),G}}function l(K=32){let G=new Uint8Array(K);return crypto.getRandomValues(G),Array.from(G,(B)=>B.toString(16).padStart(2,"0")).join("").substring(0,K)}async function $X(K){let B=new TextEncoder().encode(K),L=await crypto.subtle.digest("SHA-256",B),W=Array.from(new Uint8Array(L));return btoa(String.fromCharCode(...W)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function NX(K){let G=await u();return s(G,K)}function f(K,G){let B={expires_in:K.expires_in,refresh_expires_in:K.refresh_expires_in,scope:K.scope,session_state:K.session_state,token_type:K.token_type,expires:G.toISOString()};return[["Set-Cookie",U("access",K.access_token,G)],["Set-Cookie",U("id",K.id_token,G)],["Set-Cookie",U("refresh",K.refresh_token??"",G)],["Set-Cookie",U("control",B,G)]]}async function h(K){let G=y("access",K),B=y("id",K),L=y("refresh",K),W=y("control",K,!0);if(!G||!B||!L||!W)return{tokens:void 0,refreshHeaders:[]};let Q={access_token:G,id_token:B,refresh_token:L,...W};if(W.expires&&L&&Date.now()>new Date(W.expires).getTime()){Q=await d(L);let O=await v(Q),J=f(Q,O.sso.expires);return{tokens:Q,refreshHeaders:J}}return{tokens:Q,refreshHeaders:[]}}async function KX(K){let{tokens:G}=await h(K);if(!G)return;return G.access_token}function U(K,G,B){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(K=`${$.cookiesPrefix}.${K}`,typeof G!=="string")G=btoa(JSON.stringify(G));let L;if(B instanceof Date)L=`Expires=${B.toUTCString()}`;else if(typeof B==="number")L=`Max-Age=${B}`;else throw Error("Invalid expires type",B);if(G.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${G.length}`);return`${K}=${G}; ${L}; Path=${$.cookiesPath}; HttpOnly;${$.cookiesSecure?" Secure;":""} SameSite=${$.cookiesSameSite};`}function R(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");return`${$.cookiesPrefix}.${K}=; Max-Age=0; Path=${$.cookiesPath}; HttpOnly;${$.cookiesSecure?" Secure;":""} SameSite=${$.cookiesSameSite};`}function y(K,G,B=!1){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let L=G.headers.get("cookie");if(!L)return null;let W=L.split(";").find((J)=>J.trim().startsWith(`${$.cookiesPrefix}.${K}=`));if(!W)return null;let Q=W.split("=")[1].trim();if(!B)return Q;let O=atob(Q);return JSON.parse(O)}async function AX(K,G){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:B,userUrl:L,errorUrl:W,landingUrl:Q,tokenUrl:O,refreshUrl:J,logoutUrl:j,logoutBackChannelUrl:V,jwksUrl:T,redirectUri:_}={...$,...G},E=new URL(K.url).pathname;if(_){let F;try{F=new URL(_).pathname}catch{try{let P=new URL(K.url),x=_.startsWith("//")?_.slice(1):_;F=new URL(x,P.origin).pathname}catch{F=_.startsWith("/")?_:`/${_}`}}if(F===E)return m(K)}if(B===E)return C({landingUrl:Q||"/",errorUrl:W},K.url);if(L===E){let{tokens:F,refreshHeaders:P}=await h(K);if(!F)return new Response("User not logged in",{status:401});let x=await v(F);return new Response(JSON.stringify(x),{headers:[["Content-Type","application/json"],...P]})}if(O===E){let{tokens:F,refreshHeaders:P}=await h(K);if(!F)return new Response("User not logged in",{status:401});return new Response(JSON.stringify({token:F.access_token,expires:F.expires}),{headers:[["Content-Type","application/json"],...P]})}if(J===E){let F=y("refresh",K);if(!F)return new Response("User not logged in",{status:401});let P=await d(F),x=await v(P),k=f(P,x.sso.expires);return new Response("Refresh Complete",{status:200,headers:k})}if(j===E)return I(K,{landingUrl:Q||"/"});if(V===E)return g(K);if(T===E){let F=await u();return new Response(JSON.stringify(F),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...$,getUser:z,getRequiredUser:w,getJwt:KX,initiateLogin:C,logout:I,logoutBackChannel:g,callbackHandler:m,handler:AX}}function XX(Y){let Z={},X=Y.split(";");for(let A of X){let N=A.trim();if(!N)continue;let M=N.indexOf("=");if(M===-1)continue;let $=N.slice(0,M).trim(),H=N.slice(M+1).trim();Z[$]=H}return Z}function b(Y){return Y=Y??"SSO Unavailable",new Response(JSON.stringify({error:Y}),{status:503,statusText:Y,headers:{"Content-Type":"application/json"}})}function e(Y){if(!Y)return[];let Z=Y.headers;if(Z.getSetCookie)return Z.getSetCookie();let X=Y.headers.get("set-cookie");return X?[X]:[]}function LX(Y,Z){let X=new Headers;for(let[A,N]of Y.headers)if(A.toLowerCase()!=="set-cookie")X.set(A,N);for(let A of Z)X.append("Set-Cookie",A);return new Response(Y.body,{status:Y.status,statusText:Y.statusText,headers:X})}var q="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function kX(Y,Z){return D(Z,q),Z.sso?.getUser(Y)}async function OX(Y,Z){D(Z,q);let X=Z.logger??i;X.debug?.("getUser called",{hasInstance:!0,hasSso:!!Z.sso,hasCiam:!!Z.ciam});let A=await Z.sso?.getUser(Y);if(A)return X.debug?.("Found SSO user",{email:A.email}),A;X.debug?.("No SSO user, trying CIAM");let N=await Z.ciam?.getUser(Y);return X.debug?.("CIAM user result",{email:N?.email??void 0}),N}async function pX(Y,Z){let X=await OX(Y,Z);if(X)return X;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function gX(Y,Z){D(Z,q);let X=Z.sso;if(!X)return b();return X.initiateLogin(Y)}async function mX(Y,Z){D(Z,q);let X=Z.sso;if(!X)return b();return X.callbackHandler(Y)}async function dX(Y,Z){D(Z,q);let{sso:X,ciam:A}=Z;if(!X&&!A)return b("Logout Unavailable");let N=X?await X.logout(Y,{landingUrl:"/"}):void 0,M=A?await A.logout(Y):void 0,$=N??M;if(!$)return b("Logout Unavailable");let H=[...e(N),...e(M)];return LX($,H)}async function uX(Y,Z){D(Z,q);let{sso:X,ciam:A}=Z;if(!X&&!A)return b("Back-Channel Logout Unavailable");let N=Y.clone(),M=Y.clone(),$=X?await X.logoutBackChannel(N):void 0;if($?.status===200)return $;let H=A?await A.logoutBackChannel(M):void 0;if(H)return H;return $??b("Back-Channel Logout Unavailable")}
-export{HX as a,JX as b,n as c,t as d,D as e,a as f,VX as g,GX as h,jX as i,DX as j,WX as k,zX as l,i as m,xX as n,IX as o,TX as p,wX as q,r,s,vX as t,UX as u,hX as v,fX as w,kX as x,OX as y,pX as z,gX as A,mX as B,dX as C,uX as D};
+        `,{status:200,headers:[["Content-Type","text/html"],...B]})}async function g(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(!$.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{let G=K.headers.get("content-type");if(!G||!G.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let B=await K.text(),W=new URLSearchParams(B).get("logout_token");if(!W)return new Response("Missing logout_token parameter",{status:400});let O=(await c(W)).sid;if(!O)return console.warn("Back-Channel Logout: logout_token missing sid claim"),new Response("Invalid logout_token: missing sid claim",{status:400});return await $.sessionStore.delete(O),console.log(`Back-Channel Logout: successfully deleted session ${O}`),new Response("OK",{status:200})}catch(G){return console.error("Error during back-channel logout:",G),new Response("Internal Server Error",{status:500})}}async function m(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let G=new URL(K.url),B=new URLSearchParams(G.search),L=Object.fromEntries(B.entries()),W=await Y.callbackParams["~standard"].validate(L);if(W.issues)return i(W.issues,"OIDC callback parameters validation failed");let{code:Q,state:O}=W.value;try{let J=y("state",K,!0),{codeVerifier:j,state:V,landingUrl:T}=J??{};if(D(j,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),D(V,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'),D(T,'OIDC "landingUrl" was not present in cookies'),O!==V)throw Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');let z=await ZX(Q,j,K.url),E=await v(z);if($.sessionStore)try{let F=E.sso.profile.sid,S=E.id;if(F&&S){let _={sid:F,sub:S,createdAt:new Date,lastActivityAt:new Date};await $.sessionStore.create(_)}else console.warn("Session creation skipped: missing sid or sub in ID token claims")}catch(F){console.warn("Failed to create session:",F)}if($.userStore)try{let F=E.id;if(F){let S=new Date,_=await $.userStore.get(F);if(_||$.enableJitUserProvisioning){let k={..._??{},...E,id:F,createdAt:_?.createdAt??S,updatedAt:S};await $.userStore.upsert(k)}else console.warn("JIT user provisioning disabled: user not found in store and will not be created")}else console.warn("User storage skipped: missing sub in ID token claims")}catch(F){console.warn("Failed to store user:",F)}return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",T],["Set-Cookie",R("state")],...f(z,E.sso.expires)]})}catch(J){console.error("Error during sign-in callback:",J);try{let j=y("state",K,!0),{errorUrl:V}=j??{};if(V)return new Response("Redirecting to error url",{status:302,headers:[["Location",V]]})}catch(j){console.warn("Error parsing the errorUrl from the OIDC cookie")}return console.warn("No error page was found in the cookies. The user will be shown a default error page."),new Response("An error occurred during authentication, please return to the application homepage and try again.",{status:500})}}async function v(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let G=await c(K.id_token),B=Number(K.refresh_expires_in??K.expires_in??3600),L=K.expires?new Date(K.expires):new Date(Date.now()+B*1000);return{id:G.sub,userName:G.preferred_username||"",name:G.name||"",email:G.email||"",emails:[{value:G.email||"",primary:!0}],avatar:G.picture,sso:{profile:{...G,iss:G.iss||$.authority,aud:G.aud||$.clientId},tenant:{id:G.idp||G.iss||$.authority||"",name:G.iss||$.authority||""},scope:K.scope,tokenType:K.token_type,sessionState:K.session_state,expires:L}}}async function ZX(K,G,B){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");H();let{tokenUrl:L,redirectUri:W}=$;try{new URL(W)}catch{if(B)try{let O=new URL(B),J=W.startsWith("//")?W.slice(1):W.startsWith("/")?W:`/${W}`;W=new URL(J,O.origin).toString()}catch{try{let O=new URL(L),J=W.startsWith("//")?W.slice(1):W.startsWith("/")?W:`/${W}`;W=new URL(J,O.origin).toString()}catch{throw Error(`Invalid redirectUri: "${$.redirectUri}". It must be a valid absolute URL.`)}}}let Q=new URLSearchParams;if(Q.append("grant_type","authorization_code"),Q.append("code",K),Q.append("redirect_uri",W),Q.append("client_id",$.clientId),$.clientSecret)Q.append("client_secret",$.clientSecret);Q.append("code_verifier",G);try{let O=await fetch(L,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Q.toString()}),J=await O.json();if(!O.ok){console.error("Token exchange error:",J);let V=J;throw Error(`Token exchange failed: ${V.error||O.statusText} - ${V.error_description||""}`.trim())}let j=await Y.tokenResponse["~standard"].validate(J);if(j.issues)throw console.error("Token response validation failed:",j.issues),Error(`Token response validation failed: ${j.issues}`);return j.value}catch(O){throw console.error("Error during token exchange:",O),O}}async function d(K){return p(async()=>{if(!$)throw Error("Enterprise Standard SSO Manager not initialized");H();let G=$.tokenUrl,B=new URLSearchParams;B.append("grant_type","refresh_token"),B.append("refresh_token",K),B.append("client_id",$.clientId);let L=await fetch(G,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:B.toString()}),W=await L.json();if(!L.ok){console.error("Token refresh error:",W);let Q=W;throw Error(`Token refresh failed: ${Q.error||L.statusText} - ${Q.error_description||""}`.trim())}return W})}async function $X(K){try{if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(!$.revocationEndpoint)return;let G=new URLSearchParams;G.append("token",K),G.append("token_type_hint","refresh_token"),G.append("client_id",$.clientId);let B=await fetch($.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:G.toString()});if(!B.ok)console.warn("Token revocation failed:",B.status,B.statusText);else console.log("Token revoked successfully")}catch(G){console.warn("Error revoking token:",G)}}async function u(){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(!$.jwksUri&&!$.authority)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let K=$.jwksUri||`${$.authority}/protocol/openid-connect/certs`;return s(K)}async function c(K){try{let G=K.split(".");if(G.length!==3)throw Error("Invalid JWT");let B=JSON.parse(atob(G[0].replace(/-/g,"+").replace(/_/g,"/"))),L=JSON.parse(atob(G[1].replace(/-/g,"+").replace(/_/g,"/"))),W=G[2].replace(/-/g,"+").replace(/_/g,"/"),Q=await KX(B.kid),J=new TextEncoder().encode(`${G[0]}.${G[1]}`);if(!await crypto.subtle.verify("RSASSA-PKCS1-v1_5",Q,Uint8Array.from(atob(W),(T)=>T.charCodeAt(0)),J))throw Error("Invalid JWT signature");let V=await Y.idTokenClaims["~standard"].validate(L);if(V.issues)throw console.error("ID token claims validation failed:",V.issues),Error(`ID token claims validation failed: ${V.issues}`);return V.value}catch(G){throw console.error("Error verifying JWT:",G),G}}function l(K=32){let G=new Uint8Array(K);return crypto.getRandomValues(G),Array.from(G,(B)=>B.toString(16).padStart(2,"0")).join("").substring(0,K)}async function NX(K){let B=new TextEncoder().encode(K),L=await crypto.subtle.digest("SHA-256",B),W=Array.from(new Uint8Array(L));return btoa(String.fromCharCode(...W)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function KX(K){let G=await u();return e(G,K)}function f(K,G){let B={expires_in:K.expires_in,refresh_expires_in:K.refresh_expires_in,scope:K.scope,session_state:K.session_state,token_type:K.token_type,expires:G.toISOString()};return[["Set-Cookie",U("access",K.access_token,G)],["Set-Cookie",U("id",K.id_token,G)],["Set-Cookie",U("refresh",K.refresh_token??"",G)],["Set-Cookie",U("control",B,G)]]}async function h(K){let G=y("access",K),B=y("id",K),L=y("refresh",K),W=y("control",K,!0);if(!G||!B||!L||!W)return{tokens:void 0,refreshHeaders:[]};let Q={access_token:G,id_token:B,refresh_token:L,...W};if(W.expires&&L&&Date.now()>new Date(W.expires).getTime()){Q=await d(L);let O=await v(Q),J=f(Q,O.sso.expires);return{tokens:Q,refreshHeaders:J}}return{tokens:Q,refreshHeaders:[]}}async function AX(K){let{tokens:G}=await h(K);if(!G)return;return G.access_token}function U(K,G,B){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");if(K=`${$.cookiesPrefix}.${K}`,typeof G!=="string")G=btoa(JSON.stringify(G));let L;if(B instanceof Date)L=`Expires=${B.toUTCString()}`;else if(typeof B==="number")L=`Max-Age=${B}`;else throw Error("Invalid expires type",B);if(G.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${G.length}`);return`${K}=${G}; ${L}; Path=${$.cookiesPath}; HttpOnly;${$.cookiesSecure?" Secure;":""} SameSite=${$.cookiesSameSite};`}function R(K){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");return`${$.cookiesPrefix}.${K}=; Max-Age=0; Path=${$.cookiesPath}; HttpOnly;${$.cookiesSecure?" Secure;":""} SameSite=${$.cookiesSameSite};`}function y(K,G,B=!1){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let L=G.headers.get("cookie");if(!L)return null;let W=L.split(";").find((J)=>J.trim().startsWith(`${$.cookiesPrefix}.${K}=`));if(!W)return null;let Q=W.split("=")[1].trim();if(!B)return Q;let O=atob(Q);return JSON.parse(O)}async function GX(K,G){if(!$)throw Error("Enterprise Standard SSO Manager not initialized");let{loginUrl:B,userUrl:L,errorUrl:W,landingUrl:Q,tokenUrl:O,refreshUrl:J,logoutUrl:j,logoutBackChannelUrl:V,jwksUrl:T,redirectUri:z}={...$,...G},E=new URL(K.url).pathname;if(z){let F;try{F=new URL(z).pathname}catch{try{let S=new URL(K.url),_=z.startsWith("//")?z.slice(1):z;F=new URL(_,S.origin).pathname}catch{F=z.startsWith("/")?z:`/${z}`}}if(F===E)return m(K)}if(B===E)return C({landingUrl:Q||"/",errorUrl:W},K.url);if(L===E){let{tokens:F,refreshHeaders:S}=await h(K);if(!F)return new Response("User not logged in",{status:401});let _=await v(F);return new Response(JSON.stringify(_),{headers:[["Content-Type","application/json"],...S]})}if(O===E){let{tokens:F,refreshHeaders:S}=await h(K);if(!F)return new Response("User not logged in",{status:401});return new Response(JSON.stringify({token:F.access_token,expires:F.expires}),{headers:[["Content-Type","application/json"],...S]})}if(J===E){let F=y("refresh",K);if(!F)return new Response("User not logged in",{status:401});let S=await d(F),_=await v(S),k=f(S,_.sso.expires);return new Response("Refresh Complete",{status:200,headers:k})}if(j===E)return I(K,{landingUrl:Q||"/"});if(V===E)return g(K);if(T===E){let F=await u();return new Response(JSON.stringify(F),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...$,getUser:P,getRequiredUser:w,getJwt:AX,initiateLogin:C,logout:I,logoutBackChannel:g,callbackHandler:m,handler:GX}}function YX(Y){let Z={},X=Y.split(";");for(let A of X){let N=A.trim();if(!N)continue;let M=N.indexOf("=");if(M===-1)continue;let $=N.slice(0,M).trim(),H=N.slice(M+1).trim();Z[$]=H}return Z}function q(Y){return Y=Y??"SSO Unavailable",new Response(JSON.stringify({error:Y}),{status:503,statusText:Y,headers:{"Content-Type":"application/json"}})}function XX(Y){if(!Y)return[];let Z=Y.headers;if(Z.getSetCookie)return Z.getSetCookie();let X=Y.headers.get("set-cookie");return X?[X]:[]}function OX(Y,Z){let X=new Headers;for(let[A,N]of Y.headers)if(A.toLowerCase()!=="set-cookie")X.set(A,N);for(let A of Z)X.append("Set-Cookie",A);return new Response(Y.body,{status:Y.status,statusText:Y.statusText,headers:X})}var b="EnterpriseStandard instance is required. Create one with enterpriseStandard(source, config) and pass it to this function.";async function pX(Y,Z){return D(Z,b),Z.sso?.getUser(Y)}async function HX(Y,Z){D(Z,b);let X=Z.logger??a;X.debug?.("getUser called",{hasInstance:!0,hasSso:!!Z.sso,hasCiam:!!Z.ciam});let A=await Z.sso?.getUser(Y);if(A)return X.debug?.("Found SSO user",{email:A.email}),A;X.debug?.("No SSO user, trying CIAM");let N=await Z.ciam?.getUser(Y);return X.debug?.("CIAM user result",{email:N?.email??void 0}),N}async function gX(Y,Z){let X=await HX(Y,Z);if(X)return X;throw new Response("Unauthorized",{status:401,statusText:"Unauthorized"})}async function mX(Y,Z){D(Z,b);let X=Z.sso;if(!X)return q();return X.initiateLogin(Y)}async function dX(Y,Z){D(Z,b);let X=Z.sso;if(!X)return q();return X.callbackHandler(Y)}async function uX(Y,Z){D(Z,b);let{sso:X,ciam:A}=Z;if(!X&&!A)return q("Logout Unavailable");let N=X?await X.logout(Y,{landingUrl:"/"}):void 0,M=A?await A.logout(Y):void 0,$=N??M;if(!$)return q("Logout Unavailable");let H=[...XX(N),...XX(M)];return OX($,H)}async function cX(Y,Z){D(Z,b);let{sso:X,ciam:A}=Z;if(!X&&!A)return q("Back-Channel Logout Unavailable");let N=Y.clone(),M=Y.clone(),$=X?await X.logoutBackChannel(N):void 0;if($?.status===200)return $;let H=A?await A.logoutBackChannel(M):void 0;if(H)return H;return $??q("Back-Channel Logout Unavailable")}
+export{JX as a,FX as b,n as c,t as d,D as e,i as f,jX as g,QX as h,DX as i,EX as j,MX as k,_X as l,a as m,IX as n,TX as o,wX as p,yX as q,s as r,e as s,UX as t,hX as u,fX as v,kX as w,pX as x,HX as y,gX as z,mX as A,dX as B,uX as C,cX as D};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enterprisestandard/core",
-  "version": "0.0.9-beta.20260303.2",
+  "version": "0.0.9-beta.20260303.7",
   "description": "Enterprise Standard Core (Server-only)",
   "private": false,
   "author": "enterprisestandard",
@@ -27,7 +27,7 @@
     }
   },
   "peerDependencies": {
-    "@enterprisestandard/zod": "0.0.9-beta.20260303.2",
-    "@enterprisestandard/valibot": "0.0.9-beta.20260303.2"
+    "@enterprisestandard/zod": "0.0.9-beta.20260303.7",
+    "@enterprisestandard/valibot": "0.0.9-beta.20260303.7"
   }
 }