@enterprisestandard/react 0.0.5-beta.20251125.1 → 0.0.5-beta.20260114.2

package/dist/index.js

@@ -1,10 +1,288 @@
-// packages/react/src/iam.ts
-async function iam(config) {
-  return {};
+// packages/react/src/types/scim-schema.ts
+function validateString(value, fieldName, required, issues, path) {
+  if (value === undefined || value === null) {
+    if (required) {
+      issues.push({
+        message: `${fieldName} is required`,
+        path
+      });
+    }
+    return;
+  }
+  if (typeof value !== "string") {
+    issues.push({
+      message: `${fieldName} must be a string`,
+      path
+    });
+    return;
+  }
+  return value;
 }
-
-// packages/react/src/oidc-schema.ts
-function oidcCallbackSchema(vendor) {
+function validateBoolean(value, fieldName, issues, path) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value !== "boolean") {
+    issues.push({
+      message: `${fieldName} must be a boolean`,
+      path
+    });
+    return;
+  }
+  return value;
+}
+function validateName(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value !== "object" || value === null) {
+    issues.push({
+      message: "name must be an object",
+      path: basePath
+    });
+    return;
+  }
+  const name = value;
+  const result = {};
+  result.formatted = validateString(name.formatted, "formatted", false, issues, [...basePath, "formatted"]);
+  result.familyName = validateString(name.familyName, "familyName", false, issues, [...basePath, "familyName"]);
+  result.givenName = validateString(name.givenName, "givenName", false, issues, [...basePath, "givenName"]);
+  result.middleName = validateString(name.middleName, "middleName", false, issues, [...basePath, "middleName"]);
+  result.honorificPrefix = validateString(name.honorificPrefix, "honorificPrefix", false, issues, [
+    ...basePath,
+    "honorificPrefix"
+  ]);
+  result.honorificSuffix = validateString(name.honorificSuffix, "honorificSuffix", false, issues, [
+    ...basePath,
+    "honorificSuffix"
+  ]);
+  return result;
+}
+function validateEmails(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push({
+      message: "emails must be an array",
+      path: basePath
+    });
+    return;
+  }
+  const emails = [];
+  for (let i = 0;i < value.length; i++) {
+    const email = value[i];
+    const emailPath = [...basePath, i];
+    if (typeof email !== "object" || email === null) {
+      issues.push({
+        message: "email must be an object",
+        path: emailPath
+      });
+      continue;
+    }
+    const emailObj = email;
+    const emailValue = validateString(emailObj.value, "value", true, issues, [...emailPath, "value"]);
+    if (emailValue) {
+      emails.push({
+        value: emailValue,
+        display: validateString(emailObj.display, "display", false, issues, [...emailPath, "display"]),
+        type: validateString(emailObj.type, "type", false, issues, [...emailPath, "type"]),
+        primary: validateBoolean(emailObj.primary, "primary", issues, [...emailPath, "primary"])
+      });
+    }
+  }
+  return emails.length > 0 ? emails : undefined;
+}
+function validatePhoneNumbers(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push({
+      message: "phoneNumbers must be an array",
+      path: basePath
+    });
+    return;
+  }
+  const phoneNumbers = [];
+  for (let i = 0;i < value.length; i++) {
+    const phone = value[i];
+    const phonePath = [...basePath, i];
+    if (typeof phone !== "object" || phone === null) {
+      issues.push({
+        message: "phoneNumber must be an object",
+        path: phonePath
+      });
+      continue;
+    }
+    const phoneObj = phone;
+    const phoneValue = validateString(phoneObj.value, "value", true, issues, [...phonePath, "value"]);
+    if (phoneValue) {
+      phoneNumbers.push({
+        value: phoneValue,
+        display: validateString(phoneObj.display, "display", false, issues, [...phonePath, "display"]),
+        type: validateString(phoneObj.type, "type", false, issues, [...phonePath, "type"]),
+        primary: validateBoolean(phoneObj.primary, "primary", issues, [...phonePath, "primary"])
+      });
+    }
+  }
+  return phoneNumbers.length > 0 ? phoneNumbers : undefined;
+}
+function validateAddresses(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push({
+      message: "addresses must be an array",
+      path: basePath
+    });
+    return;
+  }
+  const addresses = [];
+  for (let i = 0;i < value.length; i++) {
+    const address = value[i];
+    const addressPath = [...basePath, i];
+    if (typeof address !== "object" || address === null) {
+      issues.push({
+        message: "address must be an object",
+        path: addressPath
+      });
+      continue;
+    }
+    const addressObj = address;
+    addresses.push({
+      formatted: validateString(addressObj.formatted, "formatted", false, issues, [...addressPath, "formatted"]),
+      streetAddress: validateString(addressObj.streetAddress, "streetAddress", false, issues, [
+        ...addressPath,
+        "streetAddress"
+      ]),
+      locality: validateString(addressObj.locality, "locality", false, issues, [...addressPath, "locality"]),
+      region: validateString(addressObj.region, "region", false, issues, [...addressPath, "region"]),
+      postalCode: validateString(addressObj.postalCode, "postalCode", false, issues, [...addressPath, "postalCode"]),
+      country: validateString(addressObj.country, "country", false, issues, [...addressPath, "country"]),
+      type: validateString(addressObj.type, "type", false, issues, [...addressPath, "type"]),
+      primary: validateBoolean(addressObj.primary, "primary", issues, [...addressPath, "primary"])
+    });
+  }
+  return addresses.length > 0 ? addresses : undefined;
+}
+function validateGroups(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push({
+      message: "groups must be an array",
+      path: basePath
+    });
+    return;
+  }
+  const groups = [];
+  for (let i = 0;i < value.length; i++) {
+    const group = value[i];
+    const groupPath = [...basePath, i];
+    if (typeof group !== "object" || group === null) {
+      issues.push({
+        message: "group must be an object",
+        path: groupPath
+      });
+      continue;
+    }
+    const groupObj = group;
+    const groupValue = validateString(groupObj.value, "value", true, issues, [...groupPath, "value"]);
+    if (groupValue) {
+      groups.push({
+        value: groupValue,
+        $ref: validateString(groupObj.$ref, "$ref", false, issues, [...groupPath, "$ref"]),
+        display: validateString(groupObj.display, "display", false, issues, [...groupPath, "display"]),
+        type: validateString(groupObj.type, "type", false, issues, [...groupPath, "type"])
+      });
+    }
+  }
+  return groups.length > 0 ? groups : undefined;
+}
+function validateRoles(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push({
+      message: "roles must be an array",
+      path: basePath
+    });
+    return;
+  }
+  const roles = [];
+  for (let i = 0;i < value.length; i++) {
+    const role = value[i];
+    const rolePath = [...basePath, i];
+    if (typeof role !== "object" || role === null) {
+      issues.push({
+        message: "role must be an object",
+        path: rolePath
+      });
+      continue;
+    }
+    const roleObj = role;
+    const roleValue = validateString(roleObj.value, "value", true, issues, [...rolePath, "value"]);
+    if (roleValue) {
+      roles.push({
+        value: roleValue,
+        display: validateString(roleObj.display, "display", false, issues, [...rolePath, "display"]),
+        type: validateString(roleObj.type, "type", false, issues, [...rolePath, "type"]),
+        primary: validateBoolean(roleObj.primary, "primary", issues, [...rolePath, "primary"])
+      });
+    }
+  }
+  return roles.length > 0 ? roles : undefined;
+}
+function validateEnterpriseUser(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value !== "object" || value === null) {
+    issues.push({
+      message: "Enterprise User extension must be an object",
+      path: basePath
+    });
+    return;
+  }
+  const enterprise = value;
+  const result = {};
+  result.employeeNumber = validateString(enterprise.employeeNumber, "employeeNumber", false, issues, [
+    ...basePath,
+    "employeeNumber"
+  ]);
+  result.costCenter = validateString(enterprise.costCenter, "costCenter", false, issues, [...basePath, "costCenter"]);
+  result.organization = validateString(enterprise.organization, "organization", false, issues, [
+    ...basePath,
+    "organization"
+  ]);
+  result.division = validateString(enterprise.division, "division", false, issues, [...basePath, "division"]);
+  result.department = validateString(enterprise.department, "department", false, issues, [...basePath, "department"]);
+  if (enterprise.manager !== undefined && enterprise.manager !== null) {
+    if (typeof enterprise.manager !== "object" || enterprise.manager === null) {
+      issues.push({
+        message: "manager must be an object",
+        path: [...basePath, "manager"]
+      });
+    } else {
+      const manager = enterprise.manager;
+      result.manager = {
+        value: validateString(manager.value, "value", false, issues, [...basePath, "manager", "value"]),
+        $ref: validateString(manager.$ref, "$ref", false, issues, [...basePath, "manager", "$ref"]),
+        displayName: validateString(manager.displayName, "displayName", false, issues, [
+          ...basePath,
+          "manager",
+          "displayName"
+        ])
+      };
+    }
+  }
+  return result;
+}
+function userSchema(vendor) {
   return {
     "~standard": {
       version: 1,
@@ -19,81 +297,62 @@ function oidcCallbackSchema(vendor) {
             ]
           };
         }
-        const params = value;
+        const user = value;
         const issues = [];
         const result = {};
-        if ("code" in params) {
-          if (typeof params.code === "string") {
-            result.code = params.code;
-          } else {
-            issues.push({
-              message: "code must be a string",
-              path: ["code"]
-            });
-          }
-        } else if (!("error" in params)) {
-          issues.push({
-            message: "code is required",
-            path: ["code"]
-          });
-        }
-        if ("state" in params) {
-          if (typeof params.state === "string" || params.state === undefined) {
-            result.state = params.state;
-          } else {
-            issues.push({
-              message: "state must be a string",
-              path: ["state"]
-            });
-          }
+        const userName = validateString(user.userName, "userName", true, issues, ["userName"]);
+        if (!userName) {
+          return { issues };
         }
-        if ("session_state" in params) {
-          if (typeof params.session_state === "string" || params.session_state === undefined) {
-            result.session_state = params.session_state;
-          } else {
-            issues.push({
-              message: "session_state must be a string",
-              path: ["session_state"]
-            });
-          }
+        result.userName = userName;
+        result.id = validateString(user.id, "id", false, issues, ["id"]);
+        result.externalId = validateString(user.externalId, "externalId", false, issues, ["externalId"]);
+        result.displayName = validateString(user.displayName, "displayName", false, issues, ["displayName"]);
+        result.nickName = validateString(user.nickName, "nickName", false, issues, ["nickName"]);
+        result.profileUrl = validateString(user.profileUrl, "profileUrl", false, issues, ["profileUrl"]);
+        result.title = validateString(user.title, "title", false, issues, ["title"]);
+        result.userType = validateString(user.userType, "userType", false, issues, ["userType"]);
+        result.preferredLanguage = validateString(user.preferredLanguage, "preferredLanguage", false, issues, [
+          "preferredLanguage"
+        ]);
+        result.locale = validateString(user.locale, "locale", false, issues, ["locale"]);
+        result.timezone = validateString(user.timezone, "timezone", false, issues, ["timezone"]);
+        result.password = validateString(user.password, "password", false, issues, ["password"]);
+        result.active = validateBoolean(user.active, "active", issues, ["active"]);
+        result.name = validateName(user.name, issues, ["name"]);
+        result.emails = validateEmails(user.emails, issues, ["emails"]);
+        result.phoneNumbers = validatePhoneNumbers(user.phoneNumbers, issues, ["phoneNumbers"]);
+        result.addresses = validateAddresses(user.addresses, issues, ["addresses"]);
+        result.groups = validateGroups(user.groups, issues, ["groups"]);
+        result.roles = validateRoles(user.roles, issues, ["roles"]);
+        const enterpriseKey = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+        if (user[enterpriseKey] !== undefined) {
+          result[enterpriseKey] = validateEnterpriseUser(user[enterpriseKey], issues, [enterpriseKey]);
         }
-        if ("error" in params) {
-          if (typeof params.error === "string") {
-            result.error = params.error;
+        if (user.schemas !== undefined) {
+          if (Array.isArray(user.schemas)) {
+            result.schemas = user.schemas.filter((s) => typeof s === "string");
           } else {
             issues.push({
-              message: "error must be a string",
-              path: ["error"]
+              message: "schemas must be an array",
+              path: ["schemas"]
             });
           }
-          if ("error_description" in params) {
-            if (typeof params.error_description === "string" || params.error_description === undefined) {
-              result.error_description = params.error_description;
-            } else {
-              issues.push({
-                message: "error_description must be a string",
-                path: ["error_description"]
-              });
-            }
-          }
-          if ("error_uri" in params) {
-            if (typeof params.error_uri === "string" || params.error_uri === undefined) {
-              result.error_uri = params.error_uri;
-            } else {
-              issues.push({
-                message: "error_uri must be a string",
-                path: ["error_uri"]
-              });
-            }
-          }
         }
-        if ("iss" in params) {
-          if (typeof params.iss === "string" || params.iss === undefined) {
-            result.iss = params.iss;
+        if (user.meta !== undefined) {
+          if (typeof user.meta === "object" && user.meta !== null) {
+            const meta = user.meta;
+            result.meta = {
+              resourceType: typeof meta.resourceType === "string" ? meta.resourceType : undefined,
+              created: typeof meta.created === "string" ? meta.created : undefined,
+              lastModified: typeof meta.lastModified === "string" ? meta.lastModified : undefined,
+              location: typeof meta.location === "string" ? meta.location : undefined,
+              version: typeof meta.version === "string" ? meta.version : undefined
+            };
           } else {
             issues.push({
-              message: "iss must be a string",
-              path: ["iss"]
+              message: "meta must be an object",
+              path: ["meta"]
             });
           }
         }
@@ -105,7 +364,43 @@ function oidcCallbackSchema(vendor) {
     }
   };
 }
-function tokenResponseSchema(vendor) {
+function validateMembers(value, issues, basePath) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push({
+      message: "members must be an array",
+      path: basePath
+    });
+    return;
+  }
+  const members = [];
+  for (let i = 0;i < value.length; i++) {
+    const member = value[i];
+    const memberPath = [...basePath, i];
+    if (typeof member !== "object" || member === null) {
+      issues.push({
+        message: "member must be an object",
+        path: memberPath
+      });
+      continue;
+    }
+    const memberObj = member;
+    const memberValue = validateString(memberObj.value, "value", true, issues, [...memberPath, "value"]);
+    if (memberValue) {
+      const memberType = validateString(memberObj.type, "type", false, issues, [...memberPath, "type"]);
+      members.push({
+        value: memberValue,
+        $ref: validateString(memberObj.$ref, "$ref", false, issues, [...memberPath, "$ref"]),
+        display: validateString(memberObj.display, "display", false, issues, [...memberPath, "display"]),
+        type: memberType === "User" || memberType === "Group" ? memberType : undefined
+      });
+    }
+  }
+  return members.length > 0 ? members : undefined;
+}
+function groupResourceSchema(vendor) {
   return {
     "~standard": {
       version: 1,
@@ -120,123 +415,588 @@ function tokenResponseSchema(vendor) {
             ]
           };
         }
-        const response = value;
+        const group = value;
         const issues = [];
         const result = {};
-        if ("access_token" in response) {
-          if (typeof response.access_token === "string") {
-            result.access_token = response.access_token;
-          } else {
-            issues.push({
-              message: "access_token must be a string",
-              path: ["access_token"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "access_token is required",
-            path: ["access_token"]
-          });
-        }
-        if ("id_token" in response) {
-          if (typeof response.id_token === "string") {
-            result.id_token = response.id_token;
-          } else {
-            issues.push({
-              message: "id_token must be a string",
-              path: ["id_token"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "id_token is required",
-            path: ["id_token"]
-          });
-        }
-        if ("token_type" in response) {
-          if (typeof response.token_type === "string") {
-            result.token_type = response.token_type;
-          } else {
-            issues.push({
-              message: "token_type must be a string",
-              path: ["token_type"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "token_type is required",
-            path: ["token_type"]
-          });
-        }
-        if ("refresh_token" in response) {
-          if (typeof response.refresh_token === "string" || response.refresh_token === undefined) {
-            result.refresh_token = response.refresh_token;
-          } else {
-            issues.push({
-              message: "refresh_token must be a string",
-              path: ["refresh_token"]
-            });
-          }
+        const displayName = validateString(group.displayName, "displayName", true, issues, ["displayName"]);
+        if (!displayName) {
+          return { issues };
         }
-        if ("scope" in response) {
-          if (typeof response.scope === "string" || response.scope === undefined) {
-            result.scope = response.scope;
+        result.displayName = displayName;
+        result.id = validateString(group.id, "id", false, issues, ["id"]);
+        result.externalId = validateString(group.externalId, "externalId", false, issues, ["externalId"]);
+        result.members = validateMembers(group.members, issues, ["members"]);
+        if (group.schemas !== undefined) {
+          if (Array.isArray(group.schemas)) {
+            result.schemas = group.schemas.filter((s) => typeof s === "string");
           } else {
             issues.push({
-              message: "scope must be a string",
-              path: ["scope"]
+              message: "schemas must be an array",
+              path: ["schemas"]
             });
           }
         }
-        if ("session_state" in response) {
-          if (typeof response.session_state === "string" || response.session_state === undefined) {
-            result.session_state = response.session_state;
+        if (group.meta !== undefined) {
+          if (typeof group.meta === "object" && group.meta !== null) {
+            const meta = group.meta;
+            result.meta = {
+              resourceType: typeof meta.resourceType === "string" ? meta.resourceType : undefined,
+              created: typeof meta.created === "string" ? meta.created : undefined,
+              lastModified: typeof meta.lastModified === "string" ? meta.lastModified : undefined,
+              location: typeof meta.location === "string" ? meta.location : undefined,
+              version: typeof meta.version === "string" ? meta.version : undefined
+            };
           } else {
             issues.push({
-              message: "session_state must be a string",
-              path: ["session_state"]
+              message: "meta must be an object",
+              path: ["meta"]
             });
           }
         }
-        if ("expires" in response) {
-          if (typeof response.expires === "string" || response.expires === undefined) {
-            result.expires = response.expires;
-          } else {
-            issues.push({
-              message: "expires must be a string",
-              path: ["expires"]
-            });
-          }
+        if (issues.length > 0) {
+          return { issues };
         }
-        if ("expires_in" in response) {
-          if (typeof response.expires_in === "number" || response.expires_in === undefined) {
-            result.expires_in = response.expires_in;
-          } else {
-            issues.push({
-              message: "expires_in must be a number",
-              path: ["expires_in"]
-            });
+        return { value: result };
+      }
+    }
+  };
+}
+
+// packages/react/src/iam.ts
+var SCIM_CONTENT_TYPE = "application/scim+json";
+function scimErrorResponse(status, detail, scimType) {
+  return new Response(JSON.stringify({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+    status: String(status),
+    scimType,
+    detail
+  }), {
+    status,
+    headers: { "Content-Type": SCIM_CONTENT_TYPE }
+  });
+}
+function scimListResponse(resources) {
+  return new Response(JSON.stringify({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources
+  }), {
+    status: 200,
+    headers: { "Content-Type": SCIM_CONTENT_TYPE }
+  });
+}
+function scimResourceResponse(resource, status = 200) {
+  return new Response(JSON.stringify(resource), {
+    status,
+    headers: { "Content-Type": SCIM_CONTENT_TYPE }
+  });
+}
+function storedGroupToResource(group) {
+  return {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
+    id: group.id,
+    externalId: group.externalId,
+    displayName: group.displayName,
+    members: group.members,
+    meta: {
+      resourceType: "Group",
+      created: group.createdAt.toISOString(),
+      lastModified: group.updatedAt.toISOString()
+    }
+  };
+}
+function generateId() {
+  return crypto.randomUUID();
+}
+function iam(config, workload) {
+  const { url, group_store } = config;
+  async function buildHeaders() {
+    const token = await workload.getToken();
+    return new Headers({
+      "Content-Type": SCIM_CONTENT_TYPE,
+      Accept: SCIM_CONTENT_TYPE,
+      Authorization: `Bearer ${token}`
+    });
+  }
+  async function scimRequest(method, endpoint, body, validator) {
+    if (!url) {
+      return {
+        success: false,
+        error: {
+          schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+          status: "500",
+          detail: "IAM URL not configured for outgoing requests"
+        },
+        status: 500
+      };
+    }
+    const requestUrl = `${url}${endpoint}`;
+    try {
+      const headers = await buildHeaders();
+      const response = await fetch(requestUrl, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : undefined
+      });
+      const responseData = await response.json();
+      if (!response.ok) {
+        return {
+          success: false,
+          error: responseData,
+          status: response.status
+        };
+      }
+      if (validator) {
+        const validationResult = await validator["~standard"].validate(responseData);
+        if ("issues" in validationResult) {
+          return {
+            success: false,
+            error: {
+              schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+              status: "400",
+              scimType: "invalidValue",
+              detail: `Response validation failed: ${validationResult.issues?.map((i) => i.message).join("; ")}`
+            },
+            status: 400
+          };
+        }
+        return {
+          success: true,
+          data: validationResult.value,
+          status: response.status
+        };
+      }
+      return {
+        success: true,
+        data: responseData,
+        status: response.status
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: {
+          schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+          status: "500",
+          detail: error instanceof Error ? error.message : "Unknown error occurred"
+        },
+        status: 500
+      };
+    }
+  }
+  function getBaseUrl() {
+    return url;
+  }
+  let groups_outbound;
+  let createUser;
+  if (url) {
+    createUser = async (user, options) => {
+      const userPayload = {
+        ...user,
+        schemas: user.schemas ?? [
+          "urn:ietf:params:scim:schemas:core:2.0:User",
+          "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
+        ]
+      };
+      const validator = options?.validation ?? userSchema("es-iam");
+      return scimRequest("POST", "/Users", userPayload, validator);
+    };
+    async function createGroup(displayName, options) {
+      const groupPayload = {
+        schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
+        displayName,
+        externalId: options?.externalId,
+        members: options?.members
+      };
+      const validator = options?.validation ?? groupResourceSchema("es-iam");
+      return scimRequest("POST", "/Groups", groupPayload, validator);
+    }
+    groups_outbound = {
+      createGroup
+    };
+  }
+  let groups_inbound;
+  if (group_store) {
+    const store = group_store;
+    const validateAuth = async (request) => {
+      const auth = request.headers.get("Authorization");
+      if (!auth || !auth.startsWith("Bearer ")) {
+        return false;
+      }
+      try {
+        const token = auth.substring(7);
+        const result = await workload.validateToken(token);
+        return result.valid;
+      } catch {
+        return false;
+      }
+    };
+    const handler = async (request, handlerConfig) => {
+      const isAuthorized = await validateAuth(request);
+      if (!isAuthorized) {
+        return scimErrorResponse(401, "Authorization required");
+      }
+      const urlObj = new URL(request.url);
+      const basePath = handlerConfig?.basePath ?? "/Groups";
+      let path = urlObj.pathname;
+      if (path.startsWith(basePath)) {
+        path = path.substring(basePath.length);
+      }
+      const groupIdMatch = path.match(/^\/([^/]+)$/);
+      const groupId = groupIdMatch?.[1];
+      const method = request.method;
+      try {
+        if (groupId) {
+          switch (method) {
+            case "GET":
+              return await handleGetGroup(groupId);
+            case "PUT":
+              return await handleReplaceGroup(request, groupId);
+            case "PATCH":
+              return await handlePatchGroup(request, groupId);
+            case "DELETE":
+              return await handleDeleteGroup(groupId);
+            default:
+              return scimErrorResponse(405, "Method not allowed");
+          }
+        } else if (path === "" || path === "/") {
+          switch (method) {
+            case "GET":
+              return await handleListGroups();
+            case "POST":
+              return await handleCreateGroup(request);
+            default:
+              return scimErrorResponse(405, "Method not allowed");
           }
         }
-        if ("refresh_expires_in" in response) {
-          if (typeof response.refresh_expires_in === "number" || response.refresh_expires_in === undefined) {
-            result.refresh_expires_in = response.refresh_expires_in;
-          } else {
-            issues.push({
-              message: "refresh_expires_in must be a number",
-              path: ["refresh_expires_in"]
-            });
+        return scimErrorResponse(404, "Resource not found");
+      } catch (error) {
+        console.error("Groups inbound handler error:", error);
+        return scimErrorResponse(500, error instanceof Error ? error.message : "Internal server error");
+      }
+    };
+    const handleListGroups = async () => {
+      const groups = await store.list();
+      const resources = groups.map(storedGroupToResource);
+      return scimListResponse(resources);
+    };
+    const handleGetGroup = async (id) => {
+      const group = await store.get(id);
+      if (!group) {
+        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
+      }
+      return scimResourceResponse(storedGroupToResource(group));
+    };
+    const handleCreateGroup = async (request) => {
+      const body = await request.json();
+      if (!body.displayName) {
+        return scimErrorResponse(400, "displayName is required", "invalidValue");
+      }
+      const now = new Date;
+      const storedGroup = {
+        id: generateId(),
+        displayName: body.displayName,
+        externalId: body.externalId,
+        members: body.members,
+        createdAt: now,
+        updatedAt: now
+      };
+      await store.upsert(storedGroup);
+      return scimResourceResponse(storedGroupToResource(storedGroup), 201);
+    };
+    const handleReplaceGroup = async (request, id) => {
+      const existing = await store.get(id);
+      if (!existing) {
+        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
+      }
+      const body = await request.json();
+      const updatedGroup = {
+        ...existing,
+        displayName: body.displayName ?? existing.displayName,
+        externalId: body.externalId,
+        members: body.members,
+        updatedAt: new Date
+      };
+      await store.upsert(updatedGroup);
+      return scimResourceResponse(storedGroupToResource(updatedGroup));
+    };
+    const handlePatchGroup = async (request, id) => {
+      const existing = await store.get(id);
+      if (!existing) {
+        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
+      }
+      const body = await request.json();
+      const operations = body.Operations ?? [];
+      const updated = { ...existing };
+      for (const op of operations) {
+        if (op.op === "replace" && op.path && op.value !== undefined) {
+          if (op.path === "displayName") {
+            updated.displayName = op.value;
+          }
+        } else if (op.op === "add" && op.path && op.value !== undefined) {
+          if (op.path === "members") {
+            const newMembers = op.value;
+            updated.members = [...updated.members ?? [], ...newMembers];
+          }
+        } else if (op.op === "remove" && op.path) {
+          if (op.path.startsWith("members[")) {
+            const match = op.path.match(/members\[value eq "([^"]+)"\]/);
+            if (match) {
+              updated.members = (updated.members ?? []).filter((m) => m.value !== match[1]);
+            }
           }
         }
-        if (issues.length > 0) {
-          return { issues };
+      }
+      updated.updatedAt = new Date;
+      await store.upsert(updated);
+      return scimResourceResponse(storedGroupToResource(updated));
+    };
+    const handleDeleteGroup = async (id) => {
+      const existing = await store.get(id);
+      if (!existing) {
+        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
+      }
+      await store.delete(id);
+      return new Response(null, { status: 204 });
+    };
+    groups_inbound = {
+      handler
+    };
+  }
+  let users_inbound;
+  if (config.user_store) {
+    const store = config.user_store;
+    async function validateAuth(request) {
+      const auth = request.headers.get("Authorization");
+      if (!auth || !auth.startsWith("Bearer ")) {
+        return false;
+      }
+      try {
+        const token = auth.substring(7);
+        const result = await workload.validateToken(token);
+        return result.valid;
+      } catch {
+        return false;
+      }
+    }
+    const storedUserToScimUser = (storedUser) => {
+      return {
+        schemas: [
+          "urn:ietf:params:scim:schemas:core:2.0:User",
+          "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
+        ],
+        id: storedUser.id,
+        userName: storedUser.userName || storedUser.email || storedUser.id,
+        displayName: storedUser.name || storedUser.userName || storedUser.email,
+        name: storedUser.name ? {
+          givenName: storedUser.name.split(" ")[0],
+          familyName: storedUser.name.split(" ").slice(1).join(" ") || undefined
+        } : undefined,
+        emails: storedUser.email ? [{ value: storedUser.email, primary: true }] : [],
+        active: true,
+        meta: {
+          resourceType: "User",
+          created: storedUser.createdAt.toISOString(),
+          lastModified: storedUser.updatedAt.toISOString()
         }
-        return { value: result };
+      };
+    };
+    const scimUserToStoredUser = (scimUser) => {
+      const now = new Date;
+      const primaryEmail = scimUser.emails?.find((e) => e.primary)?.value || scimUser.emails?.[0]?.value;
+      const name = scimUser.name ? `${scimUser.name.givenName || ""} ${scimUser.name.familyName || ""}`.trim() : scimUser.displayName;
+      const userId = scimUser.id || generateId();
+      const userName = scimUser.userName || primaryEmail || userId;
+      return {
+        id: userId,
+        userName,
+        name: name || scimUser.displayName || userName,
+        email: primaryEmail || userName,
+        avatarUrl: scimUser.profileUrl,
+        sso: {
+          profile: {
+            sub: userId,
+            iss: "iam-provisioned",
+            aud: "iam-provisioned",
+            exp: Math.floor(Date.now() / 1000) + 3600,
+            iat: Math.floor(Date.now() / 1000),
+            email: primaryEmail || userName,
+            email_verified: true,
+            name: name || scimUser.displayName || userName,
+            preferred_username: userName
+          },
+          tenant: {
+            id: "iam-provisioned",
+            name: "IAM Provisioned"
+          },
+          scope: "openid profile email",
+          tokenType: "Bearer",
+          expires: new Date(Date.now() + 3600 * 1000)
+        },
+        createdAt: scimUser.meta?.created ? new Date(scimUser.meta.created) : now,
+        updatedAt: scimUser.meta?.lastModified ? new Date(scimUser.meta.lastModified) : now
+      };
+    };
+    const handler = async (request, handlerConfig) => {
+      const isAuthorized = await validateAuth(request);
+      if (!isAuthorized) {
+        return scimErrorResponse(401, "Authorization required");
+      }
+      const urlObj = new URL(request.url);
+      const basePath = handlerConfig?.basePath ?? "/Users";
+      let path = urlObj.pathname;
+      if (path.startsWith(basePath)) {
+        path = path.substring(basePath.length);
+      }
+      const userIdMatch = path.match(/^\/([^/]+)$/);
+      const userId = userIdMatch?.[1];
+      const method = request.method;
+      try {
+        if (userId) {
+          switch (method) {
+            case "GET":
+              return await handleGetUser(userId);
+            case "PUT":
+              return await handleReplaceUser(request, userId);
+            case "PATCH":
+              return await handlePatchUser(request, userId);
+            case "DELETE":
+              return await handleDeleteUser(userId);
+            default:
+              return scimErrorResponse(405, "Method not allowed");
+          }
+        } else if (path === "" || path === "/") {
+          switch (method) {
+            case "GET":
+              return await handleListUsers();
+            case "POST":
+              return await handleCreateUser(request);
+            default:
+              return scimErrorResponse(405, "Method not allowed");
+          }
+        }
+        return scimErrorResponse(404, "Resource not found");
+      } catch (error) {
+        console.error("Users inbound handler error:", error);
+        return scimErrorResponse(500, error instanceof Error ? error.message : "Internal server error");
+      }
+    };
+    const handleListUsers = async () => {
+      return scimListResponse([]);
+    };
+    const handleGetUser = async (id) => {
+      const user = await store.get(id);
+      if (!user) {
+        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
+      }
+      return scimResourceResponse(storedUserToScimUser(user));
+    };
+    const handleCreateUser = async (request) => {
+      const body = await request.json();
+      if (!body.userName && !body.emails?.[0]?.value) {
+        return scimErrorResponse(400, "userName or email is required", "invalidValue");
+      }
+      const storedUser = scimUserToStoredUser(body);
+      await store.upsert(storedUser);
+      return scimResourceResponse(storedUserToScimUser(storedUser), 201);
+    };
+    const handleReplaceUser = async (request, id) => {
+      const existing = await store.get(id);
+      if (!existing) {
+        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
+      }
+      const body = await request.json();
+      const updatedUser = scimUserToStoredUser({ ...body, id });
+      updatedUser.createdAt = existing.createdAt;
+      updatedUser.updatedAt = new Date;
+      await store.upsert(updatedUser);
+      return scimResourceResponse(storedUserToScimUser(updatedUser));
+    };
+    const handlePatchUser = async (request, id) => {
+      const existing = await store.get(id);
+      if (!existing) {
+        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
+      }
+      const body = await request.json();
+      const operations = body.Operations ?? [];
+      const updated = { ...existing };
+      for (const op of operations) {
+        if (op.op === "replace" && op.path && op.value !== undefined) {
+          if (op.path === "displayName") {
+            updated.name = op.value;
+          } else if (op.path === "userName") {
+            updated.userName = op.value;
+          } else if (op.path.startsWith("name.")) {
+            const namePart = op.path.split(".")[1];
+            if (!updated.name)
+              updated.name = "";
+            if (namePart === "givenName") {
+              updated.name = `${op.value} ${updated.name.split(" ").slice(1).join(" ")}`.trim();
+            } else if (namePart === "familyName") {
+              updated.name = `${updated.name.split(" ")[0]} ${op.value}`.trim();
+            }
+          } else if (op.path === "emails") {
+            const emails = op.value;
+            const primaryEmail = emails?.find((e) => e.primary)?.value || emails?.[0]?.value;
+            if (primaryEmail)
+              updated.email = primaryEmail;
+          }
+        } else if (op.op === "add" && op.path && op.value !== undefined) {
+          if (op.path === "emails") {
+            const newEmails = op.value;
+            const primaryEmail = newEmails?.find((e) => e.primary)?.value || newEmails?.[0]?.value;
+            if (primaryEmail)
+              updated.email = primaryEmail;
+          }
+        } else if (op.op === "remove" && op.path) {
+          if (op.path === "displayName") {
+            updated.name = "";
+          }
+        }
+      }
+      updated.updatedAt = new Date;
+      await store.upsert(updated);
+      return scimResourceResponse(storedUserToScimUser(updated));
+    };
+    const handleDeleteUser = async (id) => {
+      const existing = await store.get(id);
+      if (!existing) {
+        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
       }
+      await store.delete(id);
+      return new Response(null, { status: 204 });
+    };
+    users_inbound = {
+      handler
+    };
+  }
+  async function topLevelHandler(request, handlerConfig) {
+    const urlObj = new URL(request.url);
+    const path = urlObj.pathname;
+    const usersUrl = handlerConfig?.usersUrl ?? config.usersUrl ?? "/api/iam/Users";
+    const groupsUrl = handlerConfig?.groupsUrl ?? config.groupsUrl ?? "/api/iam/Groups";
+    if (path.startsWith(usersUrl) && users_inbound) {
+      return users_inbound.handler(request, { basePath: usersUrl });
     }
+    if (path.startsWith(groupsUrl) && groups_inbound) {
+      return groups_inbound.handler(request, { basePath: groupsUrl });
+    }
+    return scimErrorResponse(404, "Resource not found");
+  }
+  return {
+    ...config,
+    createUser,
+    getBaseUrl,
+    groups_outbound,
+    groups_inbound,
+    users_inbound,
+    handler: topLevelHandler
   };
 }
-function idTokenClaimsSchema(vendor) {
+
+// packages/react/src/types/oidc-schema.ts
+function oidcCallbackSchema(vendor) {
   return {
     "~standard": {
       version: 1,
@@ -251,31 +1011,84 @@ function idTokenClaimsSchema(vendor) {
             ]
           };
         }
-        const claims = value;
+        const params = value;
         const issues = [];
-        const result = { ...claims };
-        const stringFields = ["iss", "aud", "sub", "sid", "name", "email", "preferred_username", "picture"];
-        for (const field of stringFields) {
-          if (field in claims && claims[field] !== undefined) {
-            if (typeof claims[field] !== "string") {
+        const result = {};
+        if ("code" in params) {
+          if (typeof params.code === "string") {
+            result.code = params.code;
+          } else {
+            issues.push({
+              message: "code must be a string",
+              path: ["code"]
+            });
+          }
+        } else if (!("error" in params)) {
+          issues.push({
+            message: "code is required",
+            path: ["code"]
+          });
+        }
+        if ("state" in params) {
+          if (typeof params.state === "string" || params.state === undefined) {
+            result.state = params.state;
+          } else {
+            issues.push({
+              message: "state must be a string",
+              path: ["state"]
+            });
+          }
+        }
+        if ("session_state" in params) {
+          if (typeof params.session_state === "string" || params.session_state === undefined) {
+            result.session_state = params.session_state;
+          } else {
+            issues.push({
+              message: "session_state must be a string",
+              path: ["session_state"]
+            });
+          }
+        }
+        if ("error" in params) {
+          if (typeof params.error === "string") {
+            result.error = params.error;
+          } else {
+            issues.push({
+              message: "error must be a string",
+              path: ["error"]
+            });
+          }
+          if ("error_description" in params) {
+            if (typeof params.error_description === "string" || params.error_description === undefined) {
+              result.error_description = params.error_description;
+            } else {
               issues.push({
-                message: `${field} must be a string`,
-                path: [field]
+                message: "error_description must be a string",
+                path: ["error_description"]
               });
             }
           }
-        }
-        const numberFields = ["exp", "iat"];
-        for (const field of numberFields) {
-          if (field in claims && claims[field] !== undefined) {
-            if (typeof claims[field] !== "number") {
+          if ("error_uri" in params) {
+            if (typeof params.error_uri === "string" || params.error_uri === undefined) {
+              result.error_uri = params.error_uri;
+            } else {
               issues.push({
-                message: `${field} must be a number`,
-                path: [field]
+                message: "error_uri must be a string",
+                path: ["error_uri"]
               });
             }
           }
         }
+        if ("iss" in params) {
+          if (typeof params.iss === "string" || params.iss === undefined) {
+            result.iss = params.iss;
+          } else {
+            issues.push({
+              message: "iss must be a string",
+              path: ["iss"]
+            });
+          }
+        }
         if (issues.length > 0) {
           return { issues };
         }
@@ -284,50 +1097,241 @@ function idTokenClaimsSchema(vendor) {
     }
   };
 }
-
-// packages/react/src/utils.ts
-var defaultInstance;
-function must(value, message = "Assertion failed. Required value is null or undefined.") {
-  if (value === undefined || value === null) {
-    throw new Error(message);
-  }
-  return value;
-}
-function setDefaultInstance(es) {
-  defaultInstance = es;
-}
-function getDefaultInstance() {
-  return defaultInstance;
-}
-function getES(es) {
-  if (es)
-    return es;
-  if (defaultInstance)
-    return defaultInstance;
-  throw new Error(`TODO standardize the error message when there isn't a default EntepriseStandard`);
-}
-
-// packages/react/src/sso.ts
-var jwksCache = new Map;
-function sso(config) {
-  const configWithDefaults = {
-    ...config,
-    authority: must(config.authority, "Missing 'authority' from SSO Config"),
-    token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
-    authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
-    client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
-    redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
-    scope: must(config.scope, "Missing 'scope' from SSO Config"),
-    response_type: config.response_type ?? "code",
-    cookies_secure: config.cookies_secure !== undefined ? config.cookies_secure : true,
-    cookies_same_site: config.cookies_same_site !== undefined ? config.cookies_same_site : "Strict",
-    cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
-    cookies_path: config.cookies_path ?? "/"
-  };
-  async function getUser(request) {
+function tokenResponseSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const response = value;
+        const issues = [];
+        const result = {};
+        if ("access_token" in response) {
+          if (typeof response.access_token === "string") {
+            result.access_token = response.access_token;
+          } else {
+            issues.push({
+              message: "access_token must be a string",
+              path: ["access_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "access_token is required",
+            path: ["access_token"]
+          });
+        }
+        if ("id_token" in response) {
+          if (typeof response.id_token === "string") {
+            result.id_token = response.id_token;
+          } else {
+            issues.push({
+              message: "id_token must be a string",
+              path: ["id_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "id_token is required",
+            path: ["id_token"]
+          });
+        }
+        if ("token_type" in response) {
+          if (typeof response.token_type === "string") {
+            result.token_type = response.token_type;
+          } else {
+            issues.push({
+              message: "token_type must be a string",
+              path: ["token_type"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "token_type is required",
+            path: ["token_type"]
+          });
+        }
+        if ("refresh_token" in response) {
+          if (typeof response.refresh_token === "string" || response.refresh_token === undefined) {
+            result.refresh_token = response.refresh_token;
+          } else {
+            issues.push({
+              message: "refresh_token must be a string",
+              path: ["refresh_token"]
+            });
+          }
+        }
+        if ("scope" in response) {
+          if (typeof response.scope === "string" || response.scope === undefined) {
+            result.scope = response.scope;
+          } else {
+            issues.push({
+              message: "scope must be a string",
+              path: ["scope"]
+            });
+          }
+        }
+        if ("session_state" in response) {
+          if (typeof response.session_state === "string" || response.session_state === undefined) {
+            result.session_state = response.session_state;
+          } else {
+            issues.push({
+              message: "session_state must be a string",
+              path: ["session_state"]
+            });
+          }
+        }
+        if ("expires" in response) {
+          if (typeof response.expires === "string" || response.expires === undefined) {
+            result.expires = response.expires;
+          } else {
+            issues.push({
+              message: "expires must be a string",
+              path: ["expires"]
+            });
+          }
+        }
+        if ("expires_in" in response) {
+          if (typeof response.expires_in === "number" || response.expires_in === undefined) {
+            result.expires_in = response.expires_in;
+          } else {
+            issues.push({
+              message: "expires_in must be a number",
+              path: ["expires_in"]
+            });
+          }
+        }
+        if ("refresh_expires_in" in response) {
+          if (typeof response.refresh_expires_in === "number" || response.refresh_expires_in === undefined) {
+            result.refresh_expires_in = response.refresh_expires_in;
+          } else {
+            issues.push({
+              message: "refresh_expires_in must be a number",
+              path: ["refresh_expires_in"]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+function idTokenClaimsSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const claims = value;
+        const issues = [];
+        const result = { ...claims };
+        const stringFields = ["iss", "aud", "sub", "sid", "name", "email", "preferred_username", "picture"];
+        for (const field of stringFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "string") {
+              issues.push({
+                message: `${field} must be a string`,
+                path: [field]
+              });
+            }
+          }
+        }
+        const numberFields = ["exp", "iat"];
+        for (const field of numberFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "number") {
+              issues.push({
+                message: `${field} must be a number`,
+                path: [field]
+              });
+            }
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+
+// packages/react/src/utils.ts
+var defaultInstance;
+function must(value, message = "Assertion failed. Required value is null or undefined.") {
+  if (value === undefined || value === null) {
+    throw new Error(message);
+  }
+  return value;
+}
+function setDefaultInstance(es) {
+  defaultInstance = es;
+}
+function getDefaultInstance() {
+  return defaultInstance;
+}
+function getES(es) {
+  if (es)
+    return es;
+  if (defaultInstance)
+    return defaultInstance;
+  throw new Error(`TODO standardize the error message when there isn't a default EntepriseStandard`);
+}
+
+// packages/react/src/sso.ts
+var jwksCache = new Map;
+function sso(config) {
+  let configWithDefaults;
+  const handlerDefaults = {
+    loginUrl: config?.loginUrl,
+    userUrl: config?.userUrl,
+    errorUrl: config?.errorUrl,
+    landingUrl: config?.landingUrl,
+    tokenUrl: config?.tokenUrl,
+    refreshUrl: config?.refreshUrl,
+    jwksUrl: config?.jwksUrl,
+    logoutUrl: config?.logoutUrl,
+    logoutBackChannelUrl: config?.logoutBackChannelUrl,
+    validation: config?.validation
+  };
+  configWithDefaults = !config ? undefined : {
+    ...config,
+    authority: must(config.authority, "Missing 'authority' from SSO Config"),
+    token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
+    authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
+    client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
+    redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
+    scope: must(config.scope, "Missing 'scope' from SSO Config"),
+    response_type: config.response_type ?? "code",
+    cookies_secure: config.cookies_secure !== undefined ? config.cookies_secure : true,
+    cookies_same_site: config.cookies_same_site !== undefined ? config.cookies_same_site : "Strict",
+    cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
+    cookies_path: config.cookies_path ?? "/"
+  };
+  async function getUser(request) {
     if (!configWithDefaults) {
-      console.error("SSO Manager not initialized");
-      return;
+      throw new Error("Enterprise Standard SSO Manager not initialized");
     }
     try {
       const { tokens } = await getTokenFromCookies(request);
@@ -348,16 +1352,35 @@ function sso(config) {
       statusText: "Unauthorized"
     });
   }
-  async function initiateLogin({ landingUrl, errorUrl }) {
+  async function initiateLogin({ landingUrl, errorUrl }, requestUrl) {
     if (!configWithDefaults) {
-      console.error("SSO Manager not initialized");
-      return Promise.resolve(new Response("SSO Manager not initialized", { status: 503 }));
+      throw new Error("Enterprise Standard SSO Manager not initialized");
     }
     const state = generateRandomString();
     const codeVerifier = generateRandomString(64);
+    let normalizedRedirectUri = configWithDefaults.redirect_uri;
+    try {
+      new URL(normalizedRedirectUri);
+    } catch {
+      if (requestUrl) {
+        try {
+          const baseUrl = new URL(requestUrl);
+          const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
+          normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
+        } catch {
+          try {
+            const authUrl = new URL(configWithDefaults.authorization_url);
+            const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
+            normalizedRedirectUri = new URL(path, authUrl.origin).toString();
+          } catch {
+            throw new Error(`Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`);
+          }
+        }
+      }
+    }
     const url = new URL(configWithDefaults.authorization_url);
     url.searchParams.append("client_id", configWithDefaults.client_id);
-    url.searchParams.append("redirect_uri", configWithDefaults.redirect_uri);
+    url.searchParams.append("redirect_uri", normalizedRedirectUri);
     url.searchParams.append("response_type", "code");
     url.searchParams.append("scope", configWithDefaults.scope);
     url.searchParams.append("state", state);
@@ -379,6 +1402,9 @@ function sso(config) {
     });
   }
   async function logout(request, _config) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
     try {
       const refreshToken2 = getCookie("refresh", request);
       if (refreshToken2) {
@@ -387,12 +1413,12 @@ function sso(config) {
     } catch (error) {
       console.warn("Failed to revoke token:", error);
     }
-    if (config.session_store) {
+    if (configWithDefaults.session_store) {
       try {
         const user = await getUser(request);
         if (user?.sso?.profile.sid) {
           const sid = user.sso.profile.sid;
-          await config.session_store.delete(sid);
+          await configWithDefaults.session_store.delete(sid);
           console.log(`Session ${sid} deleted from store`);
         }
       } catch (error) {
@@ -437,11 +1463,11 @@ function sso(config) {
     }
   }
   async function logoutBackChannel(request) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
     if (!configWithDefaults.session_store) {
-      return new Response("Back-Channel Logout requires session_store configuration", {
-        status: 400,
-        statusText: "Bad Request"
-      });
+      throw new Error("Back-Channel Logout requires session_store configuration");
     }
     try {
       const contentType = request.headers.get("content-type");
@@ -472,8 +1498,7 @@ function sso(config) {
   }
   async function callbackHandler(request, validation) {
     if (!configWithDefaults) {
-      console.error("SSO Manager not initialized");
-      return Promise.resolve(new Response("SSO Manager not initialized", { status: 503 }));
+      throw new Error("Enterprise Standard SSO Manager not initialized");
     }
     const url = new URL(request.url);
     const params = new URLSearchParams(url.search);
@@ -503,9 +1528,9 @@ function sso(config) {
       if (stateFromUrl !== state) {
         throw new Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');
       }
-      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation);
+      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation, request.url);
       const user = await parseUser(tokenResponse, validation);
-      if (config.session_store) {
+      if (configWithDefaults.session_store) {
         try {
           const sid = user.sso.profile.sid;
           const sub = user.id;
@@ -516,7 +1541,7 @@ function sso(config) {
               createdAt: new Date,
               lastActivityAt: new Date
             };
-            await config.session_store.create(session);
+            await configWithDefaults.session_store.create(session);
           } else {
             console.warn("Session creation skipped: missing sid or sub in ID token claims");
           }
@@ -524,6 +1549,31 @@ function sso(config) {
           console.warn("Failed to create session:", error);
         }
       }
+      if (configWithDefaults.user_store) {
+        try {
+          const sub = user.id;
+          if (sub) {
+            const now = new Date;
+            const existingUser = await configWithDefaults.user_store.get(sub);
+            if (existingUser || configWithDefaults.enable_jit_user_provisioning) {
+              const storedUser = {
+                ...existingUser ?? {},
+                ...user,
+                id: sub,
+                createdAt: existingUser?.createdAt ?? now,
+                updatedAt: now
+              };
+              await configWithDefaults.user_store.upsert(storedUser);
+            } else {
+              console.warn("JIT user provisioning disabled: user not found in store and will not be created");
+            }
+          } else {
+            console.warn("User storage skipped: missing sub in ID token claims");
+          }
+        } catch (error) {
+          console.warn("Failed to store user:", error);
+        }
+      }
       return new Response("Authentication successful, redirecting", {
         status: 302,
         headers: [
@@ -543,61 +1593,843 @@ function sso(config) {
             headers: [["Location", errorUrl]]
           });
         }
-      } catch (_err) {
-        console.warn("Error parsing the errorUrl from the OIDC cookie");
+      } catch (_err) {
+        console.warn("Error parsing the errorUrl from the OIDC cookie");
+      }
+      console.warn("No error page was found in the cookies. The user will be shown a default error page.");
+      return new Response("An error occurred during authentication, please return to the application homepage and try again.", {
+        status: 500
+      });
+    }
+  }
+  async function parseUser(token, validation) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    const idToken = await parseJwt(token.id_token, validation);
+    const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
+    const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1000);
+    return {
+      id: idToken.sub,
+      userName: idToken.preferred_username || "",
+      name: idToken.name || "",
+      email: idToken.email || "",
+      emails: [
+        {
+          value: idToken.email || "",
+          primary: true
+        }
+      ],
+      avatarUrl: idToken.picture,
+      sso: {
+        profile: {
+          ...idToken,
+          iss: idToken.iss || configWithDefaults.authority,
+          aud: idToken.aud || configWithDefaults.client_id
+        },
+        tenant: {
+          id: idToken.idp || idToken.iss || configWithDefaults.authority,
+          name: idToken.iss || configWithDefaults.authority
+        },
+        scope: token.scope,
+        tokenType: token.token_type,
+        sessionState: token.session_state,
+        expires
+      }
+    };
+  }
+  async function exchangeCodeForToken(code, codeVerifier, validation, requestUrl) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    const tokenUrl = configWithDefaults.token_url;
+    let normalizedRedirectUri = configWithDefaults.redirect_uri;
+    try {
+      new URL(normalizedRedirectUri);
+    } catch {
+      if (requestUrl) {
+        try {
+          const baseUrl = new URL(requestUrl);
+          const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
+          normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
+        } catch {
+          try {
+            const tokenUrlObj = new URL(tokenUrl);
+            const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
+            normalizedRedirectUri = new URL(path, tokenUrlObj.origin).toString();
+          } catch {
+            throw new Error(`Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`);
+          }
+        }
+      }
+    }
+    const body = new URLSearchParams;
+    body.append("grant_type", "authorization_code");
+    body.append("code", code);
+    body.append("redirect_uri", normalizedRedirectUri);
+    body.append("client_id", configWithDefaults.client_id);
+    if (configWithDefaults.client_secret) {
+      body.append("client_secret", configWithDefaults.client_secret);
+    }
+    body.append("code_verifier", codeVerifier);
+    try {
+      const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: body.toString()
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        console.error("Token exchange error:", data);
+        throw new Error(`Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
+      }
+      const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema("builtin");
+      const tokenResult = await tokenResponseValidator["~standard"].validate(data);
+      if ("issues" in tokenResult) {
+        console.error("Token response validation failed:", tokenResult.issues);
+        throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join("; ")}`);
+      }
+      return tokenResult.value;
+    } catch (error) {
+      console.error("Error during token exchange:", error);
+      throw error;
+    }
+  }
+  async function refreshToken(refreshToken2) {
+    return retryWithBackoff(async () => {
+      if (!configWithDefaults) {
+        throw new Error("Enterprise Standard SSO Manager not initialized");
+      }
+      const tokenUrl = configWithDefaults.token_url;
+      const body = new URLSearchParams;
+      body.append("grant_type", "refresh_token");
+      body.append("refresh_token", refreshToken2);
+      body.append("client_id", configWithDefaults.client_id);
+      const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: body.toString()
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        console.error("Token refresh error:", data);
+        throw new Error(`Token refresh failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
+      }
+      return data;
+    });
+  }
+  async function revokeToken(token) {
+    try {
+      if (!configWithDefaults) {
+        throw new Error("Enterprise Standard SSO Manager not initialized");
+      }
+      if (!configWithDefaults.revocation_endpoint) {
+        return;
+      }
+      const body = new URLSearchParams;
+      body.append("token", token);
+      body.append("token_type_hint", "refresh_token");
+      body.append("client_id", configWithDefaults.client_id);
+      const response = await fetch(configWithDefaults.revocation_endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: body.toString()
+      });
+      if (!response.ok) {
+        console.warn("Token revocation failed:", response.status, response.statusText);
+      } else {
+        console.log("Token revoked successfully");
+      }
+    } catch (error) {
+      console.warn("Error revoking token:", error);
+    }
+  }
+  async function fetchJwks() {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    const url = configWithDefaults.jwks_uri || `${configWithDefaults.authority}/protocol/openid-connect/certs`;
+    const cached = jwksCache.get(url);
+    if (cached)
+      return cached;
+    return retryWithBackoff(async () => {
+      if (!configWithDefaults)
+        throw new Error("SSO Manager not initialized");
+      const response = await fetch(url);
+      if (!response.ok)
+        throw new Error("Failed to fetch JWKS");
+      const jwks = await response.json();
+      jwksCache.set(url, jwks);
+      return jwks;
+    });
+  }
+  async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
+    let lastError = new Error("Placeholder Error");
+    for (let attempt = 0;attempt <= maxRetries; attempt++) {
+      try {
+        return await operation();
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+        if (error instanceof Error && error.message.includes("400")) {
+          throw error;
+        }
+        if (attempt === maxRetries) {
+          throw lastError;
+        }
+        const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
+        const jitter = Math.random() * 0.1 * delay;
+        await new Promise((resolve) => setTimeout(resolve, delay + jitter));
+        console.warn(`Retry attempt ${attempt + 1} after ${delay + jitter}ms delay`);
+      }
+    }
+    throw lastError;
+  }
+  async function parseJwt(token, validation) {
+    try {
+      const parts = token.split(".");
+      if (parts.length !== 3)
+        throw new Error("Invalid JWT");
+      const header = JSON.parse(atob(parts[0].replace(/-/g, "+").replace(/_/g, "/")));
+      const payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+      const signature = parts[2].replace(/-/g, "+").replace(/_/g, "/");
+      const publicKey = await getPublicKey(header.kid);
+      const encoder = new TextEncoder;
+      const data = encoder.encode(`${parts[0]}.${parts[1]}`);
+      const isValid = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", publicKey, Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)), data);
+      if (!isValid)
+        throw new Error("Invalid JWT signature");
+      const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema("builtin");
+      const claimsResult = await idTokenClaimsValidator["~standard"].validate(payload);
+      if ("issues" in claimsResult) {
+        console.error("ID token claims validation failed:", claimsResult.issues);
+        throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join("; ")}`);
+      }
+      return claimsResult.value;
+    } catch (e) {
+      console.error("Error verifying JWT:", e);
+      throw e;
+    }
+  }
+  function generateRandomString(length = 32) {
+    const array = new Uint8Array(length);
+    crypto.getRandomValues(array);
+    return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("").substring(0, length);
+  }
+  async function pkceChallengeFromVerifier(verifier) {
+    const encoder = new TextEncoder;
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashBase64 = btoa(String.fromCharCode(...hashArray)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return hashBase64;
+  }
+  async function getPublicKey(kid) {
+    const jwks = await fetchJwks();
+    const key = jwks.keys.find((k) => k.kid === kid);
+    if (!key)
+      throw new Error("Public key not found");
+    const publicKey = await crypto.subtle.importKey("jwk", {
+      kty: key.kty,
+      n: key.n,
+      e: key.e
+    }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    return publicKey;
+  }
+  function createJwtCookies(token, expires) {
+    const control = {
+      expires_in: token.expires_in,
+      refresh_expires_in: token.refresh_expires_in,
+      scope: token.scope,
+      session_state: token.session_state,
+      token_type: token.token_type,
+      expires: expires.toISOString()
+    };
+    return [
+      ["Set-Cookie", createCookie("access", token.access_token, expires)],
+      ["Set-Cookie", createCookie("id", token.id_token, expires)],
+      ["Set-Cookie", createCookie("refresh", token.refresh_token ?? "", expires)],
+      ["Set-Cookie", createCookie("control", control, expires)]
+    ];
+  }
+  async function getTokenFromCookies(req) {
+    const access_token = getCookie("access", req);
+    const id_token = getCookie("id", req);
+    const refresh_token = getCookie("refresh", req);
+    const control = getCookie("control", req, true);
+    if (!access_token || !id_token || !refresh_token || !control) {
+      return { tokens: undefined, refreshHeaders: [] };
+    }
+    let tokenResponse = {
+      access_token,
+      id_token,
+      refresh_token,
+      ...control
+    };
+    if (control.expires && refresh_token && Date.now() > new Date(control.expires).getTime()) {
+      tokenResponse = await refreshToken(refresh_token);
+      const user = await parseUser(tokenResponse);
+      const refreshHeaders = createJwtCookies(tokenResponse, user.sso.expires);
+      return { tokens: tokenResponse, refreshHeaders };
+    }
+    return { tokens: tokenResponse, refreshHeaders: [] };
+  }
+  async function getJwt(request) {
+    const { tokens } = await getTokenFromCookies(request);
+    if (!tokens)
+      return;
+    return tokens.access_token;
+  }
+  function createCookie(name, value, expires) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    name = `${configWithDefaults.cookies_prefix}.${name}`;
+    if (typeof value !== "string") {
+      value = btoa(JSON.stringify(value));
+    }
+    let exp;
+    if (expires instanceof Date) {
+      exp = `Expires=${expires.toUTCString()}`;
+    } else if (typeof expires === "number") {
+      exp = `Max-Age=${expires}`;
+    } else {
+      throw new Error("Invalid expires type", expires);
+    }
+    if (value.length > 4000) {
+      throw new Error(`Error setting cookie: ${name}. Cookie length is: ${value.length}`);
+    }
+    return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
+  }
+  function clearCookie(name) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    return `${configWithDefaults.cookies_prefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
+  }
+  function getCookie(name, req, parse = false) {
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    const header = req.headers.get("cookie");
+    if (!header)
+      return null;
+    const cookie = header.split(";").find((row) => row.trim().startsWith(`${configWithDefaults.cookies_prefix}.${name}=`));
+    if (!cookie)
+      return null;
+    const val = cookie.split("=")[1].trim();
+    if (!parse)
+      return val;
+    const str = atob(val);
+    return JSON.parse(str);
+  }
+  async function handler(request, handlerConfig) {
+    const {
+      loginUrl,
+      userUrl,
+      errorUrl,
+      landingUrl,
+      tokenUrl,
+      refreshUrl,
+      logoutUrl,
+      logoutBackChannelUrl,
+      jwksUrl,
+      validation
+    } = { ...handlerDefaults, ...handlerConfig };
+    if (!configWithDefaults) {
+      throw new Error("Enterprise Standard SSO Manager not initialized");
+    }
+    if (!loginUrl) {
+      console.error("loginUrl is required");
+    }
+    const path = new URL(request.url).pathname;
+    let redirectUriPath;
+    try {
+      redirectUriPath = new URL(configWithDefaults.redirect_uri).pathname;
+    } catch {
+      try {
+        const requestUrl = new URL(request.url);
+        const redirectUri = configWithDefaults.redirect_uri.startsWith("//") ? configWithDefaults.redirect_uri.slice(1) : configWithDefaults.redirect_uri;
+        redirectUriPath = new URL(redirectUri, requestUrl.origin).pathname;
+      } catch {
+        redirectUriPath = configWithDefaults.redirect_uri.startsWith("/") ? configWithDefaults.redirect_uri : `/${configWithDefaults.redirect_uri}`;
+      }
+    }
+    if (redirectUriPath === path) {
+      return callbackHandler(request, validation);
+    }
+    if (loginUrl === path) {
+      return initiateLogin({
+        landingUrl: landingUrl || "/",
+        errorUrl
+      }, request.url);
+    }
+    if (userUrl === path) {
+      const { tokens, refreshHeaders } = await getTokenFromCookies(request);
+      if (!tokens) {
+        return new Response("User not logged in", { status: 401 });
+      }
+      const user = await parseUser(tokens);
+      return new Response(JSON.stringify(user), {
+        headers: [["Content-Type", "application/json"], ...refreshHeaders]
+      });
+    }
+    if (tokenUrl === path) {
+      const { tokens, refreshHeaders } = await getTokenFromCookies(request);
+      if (!tokens) {
+        return new Response("User not logged in", { status: 401 });
+      }
+      return new Response(JSON.stringify({
+        token: tokens.access_token,
+        expires: tokens.expires
+      }), {
+        headers: [["Content-Type", "application/json"], ...refreshHeaders]
+      });
+    }
+    if (refreshUrl === path) {
+      const refresh_token = getCookie("refresh", request);
+      if (!refresh_token) {
+        return new Response("User not logged in", { status: 401 });
+      }
+      const newTokenResponse = await refreshToken(refresh_token);
+      const user = await parseUser(newTokenResponse);
+      const refreshHeaders = createJwtCookies(newTokenResponse, user.sso.expires);
+      return new Response("Refresh Complete", {
+        status: 200,
+        headers: refreshHeaders
+      });
+    }
+    if (logoutUrl === path) {
+      return logout(request, { landingUrl: landingUrl || "/" });
+    }
+    if (logoutBackChannelUrl === path) {
+      return logoutBackChannel(request);
+    }
+    if (jwksUrl === path) {
+      const jwks = await fetchJwks();
+      return new Response(JSON.stringify(jwks), {
+        headers: [["Content-Type", "application/json"]]
+      });
+    }
+    return new Response("Not Found", { status: 404 });
+  }
+  if (!configWithDefaults) {
+    throw new Error("Enterprise Standard SSO Manager not initialized");
+  }
+  return {
+    ...configWithDefaults,
+    getUser,
+    getRequiredUser,
+    getJwt,
+    initiateLogin,
+    logout,
+    callbackHandler,
+    handler
+  };
+}
+
+// packages/react/src/vault.ts
+function vault(url) {
+  async function getFullSecret(path, token) {
+    const resp = await fetch(`${url}/${path}`, { headers: { "X-Vault-Token": token } });
+    if (resp.status !== 200) {
+      throw new Error(`Vault returned invalid status, ${resp.status}: '${resp.statusText}' from URL: ${url}`);
+    }
+    try {
+      const secret = await resp.json();
+      return secret.data;
+    } catch (cause) {
+      throw new Error("Error retrieving secret", { cause });
+    }
+  }
+  return {
+    url,
+    getFullSecret,
+    getSecret: async (path, token) => {
+      return (await getFullSecret(path, token)).data;
+    }
+  };
+}
+
+// packages/react/src/types/workload-schema.ts
+function jwtAssertionClaimsSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const claims = value;
+        const issues = [];
+        const result = { ...claims };
+        const requiredStringFields = ["iss", "sub"];
+        for (const field of requiredStringFields) {
+          if (field in claims) {
+            if (typeof claims[field] !== "string") {
+              issues.push({
+                message: `${field} must be a string`,
+                path: [field]
+              });
+            }
+          } else {
+            issues.push({
+              message: `${field} is required`,
+              path: [field]
+            });
+          }
+        }
+        if ("aud" in claims && claims.aud !== undefined) {
+          const aud = claims.aud;
+          if (typeof aud !== "string" && !Array.isArray(aud)) {
+            issues.push({
+              message: "aud must be a string or array of strings",
+              path: ["aud"]
+            });
+          } else if (Array.isArray(aud) && !aud.every((a) => typeof a === "string")) {
+            issues.push({
+              message: "aud array must contain only strings",
+              path: ["aud"]
+            });
+          }
+        }
+        const optionalStringFields = ["jti", "scope"];
+        for (const field of optionalStringFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "string") {
+              issues.push({
+                message: `${field} must be a string`,
+                path: [field]
+              });
+            }
+          }
+        }
+        const requiredNumberFields = ["exp", "iat"];
+        for (const field of requiredNumberFields) {
+          if (field in claims) {
+            if (typeof claims[field] !== "number") {
+              issues.push({
+                message: `${field} must be a number`,
+                path: [field]
+              });
+            }
+          } else {
+            issues.push({
+              message: `${field} is required`,
+              path: [field]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+function workloadTokenResponseSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const response = value;
+        const issues = [];
+        const result = {};
+        if ("access_token" in response) {
+          if (typeof response.access_token === "string") {
+            result.access_token = response.access_token;
+          } else {
+            issues.push({
+              message: "access_token must be a string",
+              path: ["access_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "access_token is required",
+            path: ["access_token"]
+          });
+        }
+        if ("token_type" in response) {
+          if (typeof response.token_type === "string") {
+            result.token_type = response.token_type;
+          } else {
+            issues.push({
+              message: "token_type must be a string",
+              path: ["token_type"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "token_type is required",
+            path: ["token_type"]
+          });
+        }
+        if ("scope" in response) {
+          if (typeof response.scope === "string" || response.scope === undefined) {
+            result.scope = response.scope;
+          } else {
+            issues.push({
+              message: "scope must be a string",
+              path: ["scope"]
+            });
+          }
+        }
+        if ("refresh_token" in response) {
+          if (typeof response.refresh_token === "string" || response.refresh_token === undefined) {
+            result.refresh_token = response.refresh_token;
+          } else {
+            issues.push({
+              message: "refresh_token must be a string",
+              path: ["refresh_token"]
+            });
+          }
+        }
+        if ("expires" in response) {
+          if (typeof response.expires === "string" || response.expires === undefined) {
+            result.expires = response.expires;
+          } else {
+            issues.push({
+              message: "expires must be a string",
+              path: ["expires"]
+            });
+          }
+        }
+        if ("expires_in" in response) {
+          if (typeof response.expires_in === "number" || response.expires_in === undefined) {
+            result.expires_in = response.expires_in;
+          } else {
+            issues.push({
+              message: "expires_in must be a number",
+              path: ["expires_in"]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
       }
-      console.warn("No error page was found in the cookies. The user will be shown a default error page.");
-      return new Response("An error occurred during authentication, please return to the application homepage and try again.", {
-        status: 500
-      });
     }
+  };
+}
+
+// packages/react/src/workload-token-store.ts
+class InMemoryWorkloadTokenStore {
+  tokens = new Map;
+  async set(token) {
+    this.tokens.set(token.workload_id, token);
   }
-  async function parseUser(token, validation) {
-    if (!configWithDefaults)
-      throw new Error("SSO Manager not initialized");
-    const idToken = await parseJwt(token.id_token, validation);
-    const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
-    const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1000);
-    return {
-      id: idToken.sub,
-      userName: idToken.preferred_username || "",
-      name: idToken.name || "",
-      email: idToken.email || "",
-      emails: [
-        {
-          value: idToken.email || "",
-          primary: true
+  async get(workload_id) {
+    const token = this.tokens.get(workload_id);
+    if (!token)
+      return null;
+    if (Date.now() > token.expires_at.getTime()) {
+      this.tokens.delete(workload_id);
+      return null;
+    }
+    return token;
+  }
+  async delete(workload_id) {
+    this.tokens.delete(workload_id);
+  }
+  async isValid(workload_id) {
+    const token = await this.get(workload_id);
+    return token !== null;
+  }
+  async cleanup() {
+    const now = Date.now();
+    for (const [workload_id, token] of this.tokens.entries()) {
+      if (now > token.expires_at.getTime()) {
+        this.tokens.delete(workload_id);
+      }
+    }
+  }
+}
+
+// packages/react/src/workload.ts
+var jwksCache2 = new Map;
+function isJwtBearerConfig(config) {
+  return "workload_id" in config || "private_key" in config;
+}
+function isClientCredentialsConfig(config) {
+  return "client_id" in config || "client_secret" in config;
+}
+function isServerOnlyConfig(config) {
+  return "jwks_uri" in config && !("workload_id" in config) && !("client_id" in config);
+}
+function validateWorkloadConfig(config) {
+  const hasJwtBearer = "workload_id" in config && "private_key" in config;
+  const hasClientCreds = "client_id" in config && "client_secret" in config;
+  const hasServerOnly = "jwks_uri" in config;
+  if (!hasJwtBearer && !hasClientCreds && !hasServerOnly) {
+    throw new Error("Invalid WorkloadConfig: must provide either (workload_id + private_key) for JWT Bearer Grant, " + "(client_id + client_secret) for OAuth2 Client Credentials, or (jwks_uri) for server-only token validation");
+  }
+}
+function workload(config) {
+  validateWorkloadConfig(config);
+  let configWithDefaults;
+  if (isJwtBearerConfig(config)) {
+    configWithDefaults = {
+      ...config,
+      token_url: must(config.token_url, "Missing 'token_url' from Workload Config"),
+      workload_id: must(config.workload_id, "Missing 'workload_id' from Workload Config"),
+      audience: must(config.audience, "Missing 'audience' from Workload Config"),
+      scope: config.scope ?? "",
+      algorithm: config.algorithm ?? "RS256",
+      token_lifetime: config.token_lifetime ?? 300,
+      refresh_threshold: config.refresh_threshold ?? 60,
+      auto_refresh: config.auto_refresh !== undefined ? config.auto_refresh : true,
+      token_store: config.token_store ?? new InMemoryWorkloadTokenStore
+    };
+  } else if (isClientCredentialsConfig(config)) {
+    configWithDefaults = {
+      ...config,
+      token_url: must(config.token_url, "Missing 'token_url' from Workload Config"),
+      client_id: must(config.client_id, "Missing 'client_id' from Workload Config"),
+      client_secret: must(config.client_secret, "Missing 'client_secret' from Workload Config"),
+      scope: config.scope ?? "",
+      token_lifetime: config.token_lifetime ?? 300,
+      refresh_threshold: config.refresh_threshold ?? 60,
+      auto_refresh: config.auto_refresh !== undefined ? config.auto_refresh : true,
+      token_store: config.token_store ?? new InMemoryWorkloadTokenStore
+    };
+  } else {
+    configWithDefaults = config;
+  }
+  const initialized = true;
+  function ensureInitialized() {
+    if (!initialized) {
+      throw new Error("Enterprise Standard Workload Manager not initialized");
+    }
+  }
+  function generateJTI() {
+    const array = new Uint8Array(16);
+    crypto.getRandomValues(array);
+    return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  function base64UrlEncode(data) {
+    let base64;
+    if (typeof data === "string") {
+      base64 = btoa(data);
+    } else {
+      base64 = btoa(String.fromCharCode(...data));
+    }
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  function base64UrlDecode(base64url) {
+    let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+    while (base64.length % 4) {
+      base64 += "=";
+    }
+    return atob(base64);
+  }
+  function getAlgorithmParams(alg) {
+    if (alg.startsWith("RS")) {
+      const hash = alg === "RS256" ? "SHA-256" : alg === "RS384" ? "SHA-384" : "SHA-512";
+      return { name: "RSASSA-PKCS1-v1_5", hash };
+    } else if (alg.startsWith("ES")) {
+      const namedCurve = alg === "ES256" ? "P-256" : alg === "ES384" ? "P-384" : "P-521";
+      const hash = alg === "ES256" ? "SHA-256" : alg === "ES384" ? "SHA-384" : "SHA-512";
+      return { name: "ECDSA", namedCurve, hash };
+    }
+    throw new Error(`Unsupported algorithm: ${alg}`);
+  }
+  async function importPrivateKey(pemKey, algorithm) {
+    const pemContents = pemKey.replace(/-----BEGIN PRIVATE KEY-----/, "").replace(/-----END PRIVATE KEY-----/, "").replace(/\s/g, "");
+    const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
+    const algorithmParams = getAlgorithmParams(algorithm);
+    return crypto.subtle.importKey("pkcs8", binaryDer, algorithmParams, false, ["sign"]);
+  }
+  async function signJWT(data, privateKeyPEM, algorithm) {
+    const privateKey = await importPrivateKey(privateKeyPEM, algorithm);
+    const encoder = new TextEncoder;
+    const dataBuffer = encoder.encode(data);
+    const algorithmParams = getAlgorithmParams(algorithm);
+    const signatureBuffer = await crypto.subtle.sign(algorithmParams, privateKey, dataBuffer);
+    return base64UrlEncode(new Uint8Array(signatureBuffer));
+  }
+  async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
+    let lastError = new Error("Placeholder Error");
+    for (let attempt = 0;attempt <= maxRetries; attempt++) {
+      try {
+        return await operation();
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+        if (lastError.message.includes("400") || lastError.message.includes("401") || lastError.message.includes("403") || lastError.message.includes("404")) {
+          throw lastError;
+        }
+        if (attempt < maxRetries) {
+          const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
+          const jitter = Math.random() * delay * 0.1;
+          await new Promise((resolve) => setTimeout(resolve, delay + jitter));
         }
-      ],
-      avatarUrl: idToken.picture,
-      sso: {
-        profile: {
-          ...idToken,
-          iss: idToken.iss || configWithDefaults.authority,
-          aud: idToken.aud || configWithDefaults.client_id
-        },
-        tenant: {
-          id: idToken.idp || idToken.iss || configWithDefaults.authority,
-          name: idToken.iss || configWithDefaults.authority
-        },
-        scope: token.scope,
-        tokenType: token.token_type,
-        sessionState: token.session_state,
-        expires
       }
+    }
+    throw lastError;
+  }
+  async function generateJWTAssertion(scope) {
+    ensureInitialized();
+    if (!isJwtBearerConfig(config)) {
+      throw new Error("generateJWTAssertion is only available in JWT Bearer Grant mode");
+    }
+    const cfg = configWithDefaults;
+    const now = Math.floor(Date.now() / 1000);
+    const claims = {
+      iss: cfg.workload_id,
+      sub: cfg.workload_id,
+      aud: cfg.audience ?? "",
+      exp: now + cfg.token_lifetime,
+      iat: now,
+      jti: generateJTI(),
+      scope: scope ?? cfg.scope
     };
+    const header = {
+      alg: cfg.algorithm,
+      typ: "JWT",
+      kid: cfg.key_id
+    };
+    const encodedHeader = base64UrlEncode(JSON.stringify(header));
+    const encodedPayload = base64UrlEncode(JSON.stringify(claims));
+    const signatureInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = await signJWT(signatureInput, cfg.private_key, cfg.algorithm);
+    return `${signatureInput}.${signature}`;
   }
-  async function exchangeCodeForToken(code, codeVerifier, validation) {
-    if (!configWithDefaults)
-      throw new Error("SSO Manager not initialized");
-    const tokenUrl = configWithDefaults.token_url;
-    const body = new URLSearchParams;
-    body.append("grant_type", "authorization_code");
-    body.append("code", code);
-    body.append("redirect_uri", configWithDefaults.redirect_uri);
-    body.append("client_id", configWithDefaults.client_id);
-    body.append("code_verifier", codeVerifier);
-    try {
+  async function acquireTokenJwtBearer(scope, validation) {
+    const cfg = configWithDefaults;
+    return retryWithBackoff(async () => {
+      const tokenUrl = cfg.token_url;
+      const assertion = await generateJWTAssertion(scope);
+      const body = new URLSearchParams;
+      body.append("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
+      body.append("assertion", assertion);
+      if (scope)
+        body.append("scope", scope);
       const response = await fetch(tokenUrl, {
         method: "POST",
         headers: {
@@ -608,30 +2440,41 @@ function sso(config) {
       });
       const data = await response.json();
       if (!response.ok) {
-        console.error("Token exchange error:", data);
-        throw new Error(`Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
+        console.error("Token acquisition error:", data);
+        throw new Error(`Token acquisition failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
       }
-      const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema("builtin");
-      const tokenResult = await tokenResponseValidator["~standard"].validate(data);
-      if ("issues" in tokenResult) {
-        console.error("Token response validation failed:", tokenResult.issues);
-        throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join("; ")}`);
+      const validator = validation?.tokenResponse ?? workloadTokenResponseSchema("builtin");
+      const result = await validator["~standard"].validate(data);
+      if ("issues" in result) {
+        console.error("Token response validation failed:", result.issues);
+        throw new Error(`Token response validation failed: ${result.issues?.map((i) => i.message).join("; ")}`);
       }
-      return tokenResult.value;
-    } catch (error) {
-      console.error("Error during token exchange:", error);
-      throw error;
-    }
+      if (cfg.token_store) {
+        const expiresAt = new Date(Date.now() + (result.value.expires_in ?? 300) * 1000);
+        const cachedToken = {
+          workload_id: cfg.workload_id,
+          access_token: result.value.access_token,
+          token_type: result.value.token_type,
+          scope: result.value.scope,
+          expires_at: expiresAt,
+          created_at: new Date,
+          refresh_token: result.value.refresh_token
+        };
+        await cfg.token_store.set(cachedToken);
+      }
+      return result.value;
+    });
   }
-  async function refreshToken(refreshToken2) {
+  async function acquireTokenClientCredentials(scope, validation) {
+    const cfg = configWithDefaults;
     return retryWithBackoff(async () => {
-      if (!configWithDefaults)
-        throw new Error("SSO Manager not initialized");
-      const tokenUrl = configWithDefaults.token_url;
+      const tokenUrl = cfg.token_url;
       const body = new URLSearchParams;
-      body.append("grant_type", "refresh_token");
-      body.append("refresh_token", refreshToken2);
-      body.append("client_id", configWithDefaults.client_id);
+      body.append("grant_type", "client_credentials");
+      body.append("client_id", cfg.client_id);
+      body.append("client_secret", cfg.client_secret);
+      if (scope)
+        body.append("scope", scope);
       const response = await fetch(tokenUrl, {
         method: "POST",
         headers: {
@@ -642,24 +2485,110 @@ function sso(config) {
       });
       const data = await response.json();
       if (!response.ok) {
-        console.error("Token refresh error:", data);
-        throw new Error(`Token refresh failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
+        console.error("Token acquisition error:", data);
+        throw new Error(`Token acquisition failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
       }
-      return data;
+      const validator = validation?.tokenResponse ?? workloadTokenResponseSchema("builtin");
+      const result = await validator["~standard"].validate(data);
+      if ("issues" in result) {
+        console.error("Token response validation failed:", result.issues);
+        throw new Error(`Token response validation failed: ${result.issues?.map((i) => i.message).join("; ")}`);
+      }
+      if (cfg.token_store) {
+        const expiresAt = new Date(Date.now() + (result.value.expires_in ?? 300) * 1000);
+        const cachedToken = {
+          workload_id: cfg.client_id,
+          access_token: result.value.access_token,
+          token_type: result.value.token_type,
+          scope: result.value.scope,
+          expires_at: expiresAt,
+          created_at: new Date,
+          refresh_token: result.value.refresh_token
+        };
+        await cfg.token_store.set(cachedToken);
+      }
+      return result.value;
     });
   }
+  async function getToken(scope) {
+    ensureInitialized();
+    if (isServerOnlyConfig(config)) {
+      throw new Error("Cannot acquire tokens: Workload is configured in server-only mode (validation only). " + "To acquire tokens, configure client_id + client_secret for OAuth2 Client Credentials, " + "or workload_id + private_key for JWT Bearer Grant.");
+    }
+    if (!configWithDefaults.token_url) {
+      throw new Error("Cannot acquire tokens: Missing token_url in WorkloadConfig. " + "Client role requires token_url to be configured in vault.");
+    }
+    if (isJwtBearerConfig(configWithDefaults)) {
+      if (!configWithDefaults.private_key) {
+        throw new Error("Cannot acquire tokens: Missing private_key in WorkloadConfig. " + "JWT Bearer Grant client role requires private_key to be configured in vault.");
+      }
+    } else if (isClientCredentialsConfig(configWithDefaults)) {
+      if (!configWithDefaults.client_secret) {
+        throw new Error("Cannot acquire tokens: Missing client_secret in WorkloadConfig. " + "OAuth2 Client Credentials client role requires client_secret to be configured in vault.");
+      }
+    }
+    const requestedScope = scope ?? configWithDefaults.scope ?? "";
+    let cacheKey;
+    if (isJwtBearerConfig(configWithDefaults)) {
+      cacheKey = configWithDefaults.workload_id;
+    } else if (isClientCredentialsConfig(configWithDefaults)) {
+      cacheKey = configWithDefaults.client_id;
+    } else {
+      throw new Error("Invalid WorkloadConfig");
+    }
+    const cfg = configWithDefaults;
+    if (cfg.token_store) {
+      const cachedToken = await cfg.token_store.get(cacheKey);
+      if (cachedToken) {
+        const now = Date.now();
+        const expiresAt = cachedToken.expires_at.getTime();
+        const refreshThreshold = cfg.refresh_threshold * 1000;
+        if (now + refreshThreshold < expiresAt) {
+          return cachedToken.access_token;
+        }
+        if (cfg.auto_refresh) {
+          try {
+            const newToken = isJwtBearerConfig(config) ? await acquireTokenJwtBearer(requestedScope) : await acquireTokenClientCredentials(requestedScope);
+            return newToken.access_token;
+          } catch (error) {
+            if (now < expiresAt) {
+              console.warn("Token refresh failed, using cached token:", error);
+              return cachedToken.access_token;
+            }
+            throw error;
+          }
+        }
+      }
+    }
+    const tokenResponse = isJwtBearerConfig(config) ? await acquireTokenJwtBearer(requestedScope) : await acquireTokenClientCredentials(requestedScope);
+    return tokenResponse.access_token;
+  }
+  async function refreshToken() {
+    ensureInitialized();
+    if (isServerOnlyConfig(config)) {
+      throw new Error("Cannot refresh tokens: Workload is configured in server-only mode (validation only).");
+    }
+    const cfg = configWithDefaults;
+    return isJwtBearerConfig(cfg) ? await acquireTokenJwtBearer(cfg.scope) : await acquireTokenClientCredentials(cfg.scope);
+  }
   async function revokeToken(token) {
+    ensureInitialized();
     try {
-      if (!configWithDefaults)
-        throw new Error("SSO Manager not initialized");
-      if (!configWithDefaults.revocation_endpoint) {
+      if (!config.revocation_endpoint) {
         return;
       }
       const body = new URLSearchParams;
       body.append("token", token);
-      body.append("token_type_hint", "refresh_token");
-      body.append("client_id", configWithDefaults.client_id);
-      const response = await fetch(configWithDefaults.revocation_endpoint, {
+      body.append("token_type_hint", "access_token");
+      if (isJwtBearerConfig(config)) {
+        const cfg = configWithDefaults;
+        body.append("client_id", cfg.workload_id);
+      } else if (isClientCredentialsConfig(config)) {
+        const cfg = configWithDefaults;
+        body.append("client_id", cfg.client_id);
+        body.append("client_secret", cfg.client_secret);
+      }
+      const response = await fetch(config.revocation_endpoint, {
         method: "POST",
         headers: {
           "Content-Type": "application/x-www-form-urlencoded"
@@ -671,273 +2600,498 @@ function sso(config) {
       } else {
         console.log("Token revoked successfully");
       }
+      if (config.token_store) {
+        let cacheKey;
+        if (isJwtBearerConfig(config)) {
+          cacheKey = configWithDefaults.workload_id;
+        } else if (isClientCredentialsConfig(config)) {
+          cacheKey = configWithDefaults.client_id;
+        } else {
+          return;
+        }
+        await config.token_store.delete(cacheKey);
+      }
     } catch (error) {
       console.warn("Error revoking token:", error);
     }
   }
   async function fetchJwks() {
-    const url = configWithDefaults.jwks_uri || `${configWithDefaults.authority}/protocol/openid-connect/certs`;
-    const cached = jwksCache.get(url);
+    ensureInitialized();
+    const url = config.jwks_uri;
+    if (!url) {
+      throw new Error("Cannot validate tokens: Missing jwks_uri in WorkloadConfig. " + "Server role requires jwks_uri to be configured in vault to fetch public keys for token validation.");
+    }
+    const cached = jwksCache2.get(url);
     if (cached)
       return cached;
     return retryWithBackoff(async () => {
-      if (!configWithDefaults)
-        throw new Error("SSO Manager not initialized");
       const response = await fetch(url);
       if (!response.ok)
         throw new Error("Failed to fetch JWKS");
       const jwks = await response.json();
-      jwksCache.set(url, jwks);
+      jwksCache2.set(url, jwks);
       return jwks;
     });
   }
-  async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
-    let lastError = new Error("Placeholder Error");
-    for (let attempt = 0;attempt <= maxRetries; attempt++) {
-      try {
-        return await operation();
-      } catch (error) {
-        lastError = error instanceof Error ? error : new Error(String(error));
-        if (error instanceof Error && error.message.includes("400")) {
-          throw error;
-        }
-        if (attempt === maxRetries) {
-          throw lastError;
-        }
-        const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
-        const jitter = Math.random() * 0.1 * delay;
-        await new Promise((resolve) => setTimeout(resolve, delay + jitter));
-        console.warn(`Retry attempt ${attempt + 1} after ${delay + jitter}ms delay`);
-      }
-    }
-    throw lastError;
+  async function getPublicKey(kid) {
+    const jwks = await fetchJwks();
+    const key = jwks.keys.find((k) => k.kid === kid);
+    if (!key)
+      throw new Error("Public key not found");
+    const defaultAlg = isJwtBearerConfig(config) ? configWithDefaults.algorithm : "RS256";
+    const algorithmParams = getAlgorithmParams(key.alg || defaultAlg);
+    return crypto.subtle.importKey("jwk", key, algorithmParams, false, ["verify"]);
   }
-  async function parseJwt(token, validation) {
+  async function parseJWT(token, validation) {
+    ensureInitialized();
     try {
       const parts = token.split(".");
       if (parts.length !== 3)
         throw new Error("Invalid JWT");
-      const header = JSON.parse(atob(parts[0].replace(/-/g, "+").replace(/_/g, "/")));
-      const payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
-      const signature = parts[2].replace(/-/g, "+").replace(/_/g, "/");
+      const header = JSON.parse(base64UrlDecode(parts[0]));
+      const payload = JSON.parse(base64UrlDecode(parts[1]));
       const publicKey = await getPublicKey(header.kid);
+      const signature = parts[2];
       const encoder = new TextEncoder;
       const data = encoder.encode(`${parts[0]}.${parts[1]}`);
-      const isValid = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", publicKey, Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)), data);
+      const signatureBytes = Uint8Array.from(base64UrlDecode(signature), (c) => c.charCodeAt(0));
+      const algorithmParams = getAlgorithmParams(header.alg);
+      const isValid = await crypto.subtle.verify(algorithmParams, publicKey, signatureBytes, data);
       if (!isValid)
         throw new Error("Invalid JWT signature");
-      const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema("builtin");
-      const claimsResult = await idTokenClaimsValidator["~standard"].validate(payload);
-      if ("issues" in claimsResult) {
-        console.error("ID token claims validation failed:", claimsResult.issues);
-        throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join("; ")}`);
+      const validator = validation?.jwtAssertionClaims ?? jwtAssertionClaimsSchema("builtin");
+      const result = await validator["~standard"].validate(payload);
+      if ("issues" in result) {
+        console.error("JWT claims validation failed:", result.issues);
+        throw new Error(`JWT claims validation failed: ${result.issues?.map((i) => i.message).join("; ")}`);
       }
-      return claimsResult.value;
-    } catch (e) {
-      console.error("Error verifying JWT:", e);
-      throw e;
+      return result.value;
+    } catch (error) {
+      console.error("Error verifying JWT:", error);
+      throw error;
     }
   }
-  function generateRandomString(length = 32) {
-    const array = new Uint8Array(length);
-    crypto.getRandomValues(array);
-    return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("").substring(0, length);
-  }
-  async function pkceChallengeFromVerifier(verifier) {
-    const encoder = new TextEncoder;
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const hashBase64 = btoa(String.fromCharCode(...hashArray)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    return hashBase64;
-  }
-  async function getPublicKey(kid) {
-    const jwks = await fetchJwks();
-    const key = jwks.keys.find((k) => k.kid === kid);
-    if (!key)
-      throw new Error("Public key not found");
-    const publicKey = await crypto.subtle.importKey("jwk", {
-      kty: key.kty,
-      n: key.n,
-      e: key.e
-    }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
-    return publicKey;
-  }
-  function createJwtCookies(token, expires) {
-    const control = {
-      expires_in: token.expires_in,
-      refresh_expires_in: token.refresh_expires_in,
-      scope: token.scope,
-      session_state: token.session_state,
-      token_type: token.token_type,
-      expires: expires.toISOString()
-    };
-    return [
-      ["Set-Cookie", createCookie("access", token.access_token, expires)],
-      ["Set-Cookie", createCookie("id", token.id_token, expires)],
-      ["Set-Cookie", createCookie("refresh", token.refresh_token ?? "", expires)],
-      ["Set-Cookie", createCookie("control", control, expires)]
-    ];
-  }
-  async function getTokenFromCookies(req) {
-    const access_token = getCookie("access", req);
-    const id_token = getCookie("id", req);
-    const refresh_token = getCookie("refresh", req);
-    const control = getCookie("control", req, true);
-    if (!access_token || !id_token || !refresh_token || !control) {
-      return { tokens: undefined, refreshHeaders: [] };
-    }
-    let tokenResponse = {
-      access_token,
-      id_token,
-      refresh_token,
-      ...control
-    };
-    if (control.expires && refresh_token && Date.now() > new Date(control.expires).getTime()) {
-      tokenResponse = await refreshToken(refresh_token);
-      const user = await parseUser(tokenResponse);
-      const refreshHeaders = createJwtCookies(tokenResponse, user.sso.expires);
-      return { tokens: tokenResponse, refreshHeaders };
+  async function validateToken(token, validation) {
+    ensureInitialized();
+    try {
+      const claims = await parseJWT(token, validation);
+      const now = Math.floor(Date.now() / 1000);
+      if (claims.exp && claims.exp < now) {
+        return { valid: false, error: "Token expired" };
+      }
+      if (isJwtBearerConfig(config)) {
+        if (config.audience && claims.aud !== config.audience) {
+          return { valid: false, error: "Invalid audience" };
+        }
+      } else if (isClientCredentialsConfig(config)) {
+        if (config.issuer && claims.iss !== config.issuer) {
+          return { valid: false, error: "Invalid issuer" };
+        }
+        if (config.audience && claims.aud !== config.audience) {
+          return { valid: false, error: "Invalid audience" };
+        }
+      } else {
+        const serverConfig = config;
+        if (serverConfig.issuer && claims.iss !== serverConfig.issuer) {
+          return { valid: false, error: "Invalid issuer" };
+        }
+      }
+      return {
+        valid: true,
+        claims,
+        expiresAt: claims.exp ? new Date(claims.exp * 1000) : undefined
+      };
+    } catch (error) {
+      return {
+        valid: false,
+        error: error instanceof Error ? error.message : String(error)
+      };
     }
-    return { tokens: tokenResponse, refreshHeaders: [] };
   }
-  async function getJwt(request) {
-    const { tokens } = await getTokenFromCookies(request);
-    if (!tokens)
+  async function getWorkload(request) {
+    ensureInitialized();
+    if (!config.jwks_uri) {
+      throw new Error("Cannot validate tokens: Missing jwks_uri in WorkloadConfig. " + "Server role requires jwks_uri to be configured in vault to fetch public keys for token validation.");
+    }
+    const authHeader = request.headers.get("Authorization");
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
       return;
-    return tokens.access_token;
+    }
+    const token = authHeader.substring(7);
+    const result = await validateToken(token, configWithDefaults.validation);
+    if (!result.valid || !result.claims) {
+      return;
+    }
+    return {
+      workload_id: result.claims.sub,
+      client_id: typeof result.claims.client_id === "string" ? result.claims.client_id : undefined,
+      scope: result.claims.scope,
+      claims: result.claims
+    };
   }
-  function createCookie(name, value, expires) {
-    name = `${configWithDefaults.cookies_prefix}.${name}`;
-    if (typeof value !== "string") {
-      value = btoa(JSON.stringify(value));
+  async function handler(request) {
+    ensureInitialized();
+    const tokenUrl = configWithDefaults.tokenUrl;
+    const validateUrl = configWithDefaults.validateUrl;
+    const jwksUrl = configWithDefaults.jwksUrl;
+    const refreshUrl = configWithDefaults.refreshUrl;
+    const validation = configWithDefaults.validation;
+    const path = new URL(request.url).pathname;
+    if (tokenUrl === path && request.method === "GET") {
+      const url = new URL(request.url);
+      const scope = url.searchParams.get("scope") || undefined;
+      const token = await getToken(scope);
+      return new Response(JSON.stringify({ access_token: token, token_type: "Bearer" }), {
+        headers: [["Content-Type", "application/json"]]
+      });
     }
-    let exp;
-    if (expires instanceof Date) {
-      exp = `Expires=${expires.toUTCString()}`;
-    } else if (typeof expires === "number") {
-      exp = `Max-Age=${expires}`;
-    } else {
-      throw new Error("Invalid expires type", expires);
+    if (validateUrl === path && request.method === "POST") {
+      const authHeader = request.headers.get("Authorization");
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return new Response(JSON.stringify({ valid: false, error: "Missing Authorization header" }), {
+          status: 401,
+          headers: [["Content-Type", "application/json"]]
+        });
+      }
+      const token = authHeader.substring(7);
+      const result = await validateToken(token, validation);
+      return new Response(JSON.stringify(result), {
+        status: result.valid ? 200 : 401,
+        headers: [["Content-Type", "application/json"]]
+      });
     }
-    if (value.length > 4000) {
-      throw new Error(`Error setting cookie: ${name}. Cookie length is: ${value.length}`);
+    if (jwksUrl === path && request.method === "GET") {
+      const jwks = await fetchJwks();
+      return new Response(JSON.stringify(jwks), {
+        headers: [["Content-Type", "application/json"]]
+      });
     }
-    return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
+    if (refreshUrl === path && request.method === "POST") {
+      const tokenResponse = await refreshToken();
+      return new Response(JSON.stringify(tokenResponse), {
+        headers: [["Content-Type", "application/json"]]
+      });
+    }
+    return new Response("Not Found", { status: 404 });
   }
-  function clearCookie(name) {
-    return `${configWithDefaults.cookies_prefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
+  return {
+    ...configWithDefaults,
+    getToken,
+    refreshToken,
+    generateJWTAssertion,
+    revokeToken,
+    validateToken,
+    getWorkload,
+    parseJWT,
+    handler
+  };
+}
+
+// packages/react/src/group-store.ts
+class InMemoryGroupStore {
+  groups = new Map;
+  externalIdIndex = new Map;
+  displayNameIndex = new Map;
+  async get(id) {
+    return this.groups.get(id) ?? null;
   }
-  function getCookie(name, req, parse = false) {
-    const header = req.headers.get("cookie");
-    if (!header)
+  async getByExternalId(externalId) {
+    const id = this.externalIdIndex.get(externalId);
+    if (!id)
       return null;
-    const cookie = header.split(";").find((row) => row.trim().startsWith(`${configWithDefaults.cookies_prefix}.${name}=`));
-    if (!cookie)
+    return this.groups.get(id) ?? null;
+  }
+  async getByDisplayName(displayName) {
+    const id = this.displayNameIndex.get(displayName.toLowerCase());
+    if (!id)
       return null;
-    const val = cookie.split("=")[1].trim();
-    if (!parse)
-      return val;
-    const str = atob(val);
-    return JSON.parse(str);
+    return this.groups.get(id) ?? null;
   }
-  async function handler(request, handlerConfig) {
-    const { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl, logoutUrl, logoutBackChannelUrl, jwksUrl, validation } = handlerConfig ?? {};
-    if (!loginUrl) {
-      console.error("loginUrl is required");
-    }
-    const path = new URL(request.url).pathname;
-    if (new URL(configWithDefaults.redirect_uri).pathname === path) {
-      return callbackHandler(request, validation);
+  async list() {
+    return Array.from(this.groups.values());
+  }
+  async upsert(group) {
+    const existing = this.groups.get(group.id);
+    if (existing) {
+      if (existing.externalId && existing.externalId !== group.externalId) {
+        this.externalIdIndex.delete(existing.externalId);
+      }
+      if (existing.displayName.toLowerCase() !== group.displayName.toLowerCase()) {
+        this.displayNameIndex.delete(existing.displayName.toLowerCase());
+      }
     }
-    if (loginUrl === path) {
-      return initiateLogin({
-        landingUrl: landingUrl || "/",
-        errorUrl
-      });
+    this.groups.set(group.id, group);
+    if (group.externalId) {
+      this.externalIdIndex.set(group.externalId, group.id);
     }
-    if (userUrl === path) {
-      const { tokens, refreshHeaders } = await getTokenFromCookies(request);
-      if (!tokens) {
-        return new Response("User not logged in", { status: 401 });
+    this.displayNameIndex.set(group.displayName.toLowerCase(), group.id);
+  }
+  async delete(id) {
+    const group = this.groups.get(id);
+    if (group) {
+      if (group.externalId) {
+        this.externalIdIndex.delete(group.externalId);
       }
-      const user = await parseUser(tokens);
-      return new Response(JSON.stringify(user), {
-        headers: [["Content-Type", "application/json"], ...refreshHeaders]
-      });
+      this.displayNameIndex.delete(group.displayName.toLowerCase());
     }
-    if (tokenUrl === path) {
-      const { tokens, refreshHeaders } = await getTokenFromCookies(request);
-      if (!tokens) {
-        return new Response("User not logged in", { status: 401 });
-      }
-      return new Response(JSON.stringify({
-        token: tokens.access_token,
-        expires: tokens.expires
-      }), {
-        headers: [["Content-Type", "application/json"], ...refreshHeaders]
-      });
+    this.groups.delete(id);
+  }
+  async addMember(groupId, member) {
+    const group = this.groups.get(groupId);
+    if (!group) {
+      throw new Error(`Group ${groupId} not found`);
     }
-    if (refreshUrl === path) {
-      const refresh_token = getCookie("refresh", request);
-      if (!refresh_token) {
-        return new Response("User not logged in", { status: 401 });
-      }
-      const newTokenResponse = await refreshToken(refresh_token);
-      const user = await parseUser(newTokenResponse);
-      const refreshHeaders = createJwtCookies(newTokenResponse, user.sso.expires);
-      return new Response("Refresh Complete", {
-        status: 200,
-        headers: refreshHeaders
-      });
+    const members = group.members ?? [];
+    if (!members.some((m) => m.value === member.value)) {
+      members.push(member);
+      group.members = members;
+      group.updatedAt = new Date;
     }
-    if (logoutUrl === path) {
-      return logout(request, { landingUrl: landingUrl || "/" });
+  }
+  async removeMember(groupId, memberId) {
+    const group = this.groups.get(groupId);
+    if (!group) {
+      throw new Error(`Group ${groupId} not found`);
     }
-    if (logoutBackChannelUrl === path) {
-      return logoutBackChannel(request);
+    if (group.members) {
+      group.members = group.members.filter((m) => m.value !== memberId);
+      group.updatedAt = new Date;
     }
-    if (jwksUrl === path) {
-      const jwks = await fetchJwks();
-      return new Response(JSON.stringify(jwks), {
-        headers: [["Content-Type", "application/json"]]
-      });
+  }
+}
+// packages/react/src/tenant.ts
+class TenantRequestError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TenantRequestError";
+  }
+}
+function serializeESConfig(configOrES) {
+  if (configOrES && typeof configOrES === "object" && "sso" in configOrES && "workload" in configOrES && "iam" in configOrES) {
+    const config2 = {
+      defaultInstance: configOrES.defaultInstance,
+      sso: configOrES.sso ? serializeESConfig(configOrES.sso) : undefined,
+      iam: configOrES.iam ? serializeESConfig(configOrES.iam) : undefined,
+      workload: configOrES.workload ? serializeESConfig(configOrES.workload) : undefined,
+      validation: configOrES.validation
+    };
+    return config2;
+  }
+  const config = configOrES;
+  if (config === null || config === undefined) {
+    return config;
+  }
+  if (typeof config !== "object") {
+    return config;
+  }
+  if (Array.isArray(config)) {
+    return config.map((item) => serializeESConfig(item));
+  }
+  const isStore = typeof config.get === "function" || typeof config.set === "function" || typeof config.create === "function" || typeof config.delete === "function" || typeof config.upsert === "function" || typeof config.list === "function";
+  const isValidator = config["~standard"] !== undefined;
+  if (typeof config === "function" || isStore || isValidator) {
+    return;
+  }
+  if (config instanceof Date) {
+    return config.toISOString();
+  }
+  const serialized = {};
+  for (const key in config) {
+    if (Object.prototype.hasOwnProperty.call(config, key)) {
+      if (key === "session_store" || key === "user_store" || key === "token_store" || key === "group_store" || key === "validation" || key === "vault" || key === "getUser" || key === "getRequiredUser" || key === "getJwt" || key === "initiateLogin" || key === "logout" || key === "callbackHandler" || key === "handler" || key === "getToken" || key === "refreshToken" || key === "generateJWTAssertion" || key === "revokeToken" || key === "validateToken" || key === "getWorkload" || key === "parseJWT" || key === "createUser" || key === "getBaseUrl" || key === "groups_outbound" || key === "groups_inbound") {
+        continue;
+      }
+      const value = serializeESConfig(config[key]);
+      if (value !== undefined) {
+        serialized[key] = value;
+      }
     }
-    return new Response("Not Found", { status: 404 });
   }
+  return serialized;
+}
+async function parseTenantRequest(request) {
+  if (request.method !== "POST") {
+    throw new TenantRequestError("Only POST method is supported");
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch (_error) {
+    throw new TenantRequestError("Invalid JSON in request body");
+  }
+  if (typeof body !== "object" || body === null) {
+    throw new TenantRequestError("Request body must be an object");
+  }
+  const tenantRequest = body;
+  if (!tenantRequest.appId) {
+    throw new TenantRequestError("Missing required field: appId");
+  }
+  if (!tenantRequest.companyId) {
+    throw new TenantRequestError("Missing required field: companyId");
+  }
+  if (!tenantRequest.companyName) {
+    throw new TenantRequestError("Missing required field: companyName");
+  }
+  if (!tenantRequest.environmentType) {
+    throw new TenantRequestError("Missing required field: environmentType");
+  }
+  if (!tenantRequest.email) {
+    throw new TenantRequestError("Missing required field: email");
+  }
+  if (!tenantRequest.webhookUrl) {
+    throw new TenantRequestError("Missing required field: webhookUrl");
+  }
+  const validEnvironmentTypes = ["POC", "DEV", "QA", "PROD"];
+  if (!validEnvironmentTypes.includes(tenantRequest.environmentType)) {
+    throw new TenantRequestError(`Invalid environmentType: ${tenantRequest.environmentType}. Must be one of: ${validEnvironmentTypes.join(", ")}`);
+  }
+  try {
+    new URL(tenantRequest.webhookUrl);
+  } catch {
+    throw new TenantRequestError("Invalid webhookUrl: must be a valid URL");
+  }
+  const appId = tenantRequest.appId;
+  const companyId = tenantRequest.companyId;
+  const companyName = tenantRequest.companyName;
+  const environmentType = tenantRequest.environmentType;
+  const email = tenantRequest.email;
+  const webhookUrl = tenantRequest.webhookUrl;
   return {
-    getUser,
-    getRequiredUser,
-    getJwt,
-    initiateLogin,
-    logout,
-    callbackHandler,
-    handler
+    appId,
+    companyId,
+    companyName,
+    environmentType,
+    email,
+    webhookUrl
   };
 }
+async function sendTenantWebhook(webhookUrl, payload) {
+  try {
+    const response = await fetch(webhookUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(payload)
+    });
+    if (!response.ok) {
+      console.error(`Failed to send webhook update: ${response.status} ${response.statusText}`);
+    }
+  } catch (error) {
+    console.error("Failed to send webhook update:", error);
+  }
+}
 
-// packages/react/src/vault.ts
-function vault(url) {
-  async function getFullSecret(path, token) {
-    const resp = await fetch(`${url}/${path}`, { headers: { "X-Vault-Token": token } });
-    if (resp.status !== 200) {
-      throw new Error(`Vault returned invalid status, ${resp.status}: '${resp.statusText}' from URL: ${url}`);
+class InMemoryTenantStore {
+  tenants = new Map;
+  companyIdIndex = new Map;
+  async get(appId) {
+    return this.tenants.get(appId) ?? null;
+  }
+  async getByCompanyId(companyId) {
+    const appIds = this.companyIdIndex.get(companyId);
+    if (!appIds || appIds.size === 0)
+      return [];
+    const tenants = [];
+    for (const appId of appIds) {
+      const tenant = this.tenants.get(appId);
+      if (tenant) {
+        tenants.push(tenant);
+      }
     }
-    try {
-      const secret = await resp.json();
-      return secret.data;
-    } catch (cause) {
-      throw new Error("Error retrieving secret", { cause });
+    return tenants;
+  }
+  async list() {
+    return Array.from(this.tenants.values());
+  }
+  async upsert(tenant) {
+    const existing = this.tenants.get(tenant.appId);
+    if (existing && existing.companyId !== tenant.companyId) {
+      const oldAppIds = this.companyIdIndex.get(existing.companyId);
+      if (oldAppIds) {
+        oldAppIds.delete(tenant.appId);
+        if (oldAppIds.size === 0) {
+          this.companyIdIndex.delete(existing.companyId);
+        }
+      }
+    }
+    this.tenants.set(tenant.appId, tenant);
+    let appIds = this.companyIdIndex.get(tenant.companyId);
+    if (!appIds) {
+      appIds = new Set;
+      this.companyIdIndex.set(tenant.companyId, appIds);
     }
+    appIds.add(tenant.appId);
+    return tenant;
   }
-  return {
-    url,
-    getFullSecret,
-    getSecret: async (path, token) => {
-      return (await getFullSecret(path, token)).data;
+  async delete(appId) {
+    const tenant = this.tenants.get(appId);
+    if (tenant) {
+      const appIds = this.companyIdIndex.get(tenant.companyId);
+      if (appIds) {
+        appIds.delete(appId);
+        if (appIds.size === 0) {
+          this.companyIdIndex.delete(tenant.companyId);
+        }
+      }
     }
-  };
+    this.tenants.delete(appId);
+  }
+}
+// packages/react/src/workload-server.ts
+function getWorkloadInstance(config) {
+  const es = getES(config?.es);
+  if (!es.workload) {
+    console.error("Workload authentication not configured in EnterpriseStandard");
+    return;
+  }
+  return es.workload;
+}
+function unavailable() {
+  return new Response(JSON.stringify({ error: "Workload authentication unavailable" }), {
+    status: 503,
+    statusText: "Workload authentication unavailable",
+    headers: { "Content-Type": "application/json" }
+  });
+}
+async function getWorkload(request, config) {
+  const workloadAuth = getWorkloadInstance(config);
+  if (!workloadAuth) {
+    return;
+  }
+  return workloadAuth.getWorkload(request);
+}
+async function getWorkloadToken(scope, config) {
+  const workloadAuth = getWorkloadInstance(config);
+  if (!workloadAuth)
+    throw unavailable();
+  return workloadAuth.getToken(scope);
+}
+async function validateWorkloadToken(request, config) {
+  const workloadAuth = getWorkloadInstance(config);
+  if (!workloadAuth) {
+    return { valid: false, error: "Workload authentication unavailable" };
+  }
+  const authHeader = request.headers.get("Authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    return { valid: false, error: "Missing or invalid Authorization header" };
+  }
+  const token = authHeader.substring(7);
+  return workloadAuth.validateToken(token);
+}
+async function revokeWorkloadToken(token, config) {
+  const workloadAuth = getWorkloadInstance(config);
+  if (!workloadAuth)
+    throw unavailable();
+  return workloadAuth.revokeToken(token);
+}
+async function workloadHandler(request, config) {
+  const workloadAuth = getWorkloadInstance(config);
+  if (!workloadAuth)
+    throw unavailable();
+  return workloadAuth.handler(request);
 }
+
 // packages/react/src/server.ts
 function getSSO(config) {
   const es = getES(config?.es);
@@ -947,7 +3101,7 @@ function getSSO(config) {
   }
   return es.sso;
 }
-function unavailable() {
+function unavailable2() {
   new Response(JSON.stringify({ error: "SSO Unavailable" }), {
     status: 503,
     statusText: "SSO Unavailable",
@@ -960,26 +3114,26 @@ async function getUser(request, config) {
 async function getRequiredUser(request, config) {
   const sso2 = getSSO(config);
   if (!sso2)
-    throw unavailable();
+    throw unavailable2();
   return sso2.getRequiredUser(request);
 }
 async function initiateLogin(config) {
   const sso2 = getSSO(config);
   if (!sso2)
-    throw unavailable();
+    throw unavailable2();
   return sso2.initiateLogin(config);
 }
 async function callback(request, config) {
   const sso2 = getSSO(config);
   if (!sso2)
-    throw unavailable();
+    throw unavailable2();
   return sso2.callbackHandler(request);
 }
 async function handler(request, config) {
   const sso2 = getSSO(config);
   if (!sso2)
-    throw unavailable();
-  return sso2.handler(request, config);
+    throw unavailable2();
+  return sso2.handler(request);
 }
 // packages/react/src/session-store.ts
 class InMemorySessionStore {
@@ -1301,41 +3455,147 @@ async function logout(logoutUrl) {
     };
   }
 }
+// packages/react/src/user-store.ts
+class InMemoryUserStore {
+  users = new Map;
+  emailIndex = new Map;
+  userNameIndex = new Map;
+  async get(sub) {
+    return this.users.get(sub) ?? null;
+  }
+  async getByEmail(email) {
+    const sub = this.emailIndex.get(email.toLowerCase());
+    if (!sub)
+      return null;
+    return this.users.get(sub) ?? null;
+  }
+  async getByUserName(userName) {
+    const sub = this.userNameIndex.get(userName.toLowerCase());
+    if (!sub)
+      return null;
+    return this.users.get(sub) ?? null;
+  }
+  async upsert(user) {
+    const existing = this.users.get(user.id);
+    if (existing) {
+      if (existing.email && existing.email.toLowerCase() !== user.email?.toLowerCase()) {
+        this.emailIndex.delete(existing.email.toLowerCase());
+      }
+      if (existing.userName && existing.userName.toLowerCase() !== user.userName?.toLowerCase()) {
+        this.userNameIndex.delete(existing.userName.toLowerCase());
+      }
+    }
+    this.users.set(user.id, user);
+    if (user.email) {
+      this.emailIndex.set(user.email.toLowerCase(), user.id);
+    }
+    if (user.userName) {
+      this.userNameIndex.set(user.userName.toLowerCase(), user.id);
+    }
+  }
+  async delete(sub) {
+    const user = this.users.get(sub);
+    if (user) {
+      if (user.email) {
+        this.emailIndex.delete(user.email.toLowerCase());
+      }
+      if (user.userName) {
+        this.userNameIndex.delete(user.userName.toLowerCase());
+      }
+    }
+    this.users.delete(sub);
+  }
+}
 
 // packages/react/src/index.ts
-async function enterpriseStandard(appKey, initConfig) {
-  let vaultUrl;
-  let vaultToken;
-  let secrets;
-  const ioniteUrl = initConfig?.ioniteUrl ?? "https://ionite.com";
-  if (appKey?.startsWith("IONITE_PUBLIC_DEMO_")) {
+function extractSsoValidation(validation) {
+  if (!validation)
+    return;
+  const val = validation;
+  if (val.callbackParams || val.idTokenClaims || val.tokenResponse) {
+    return val;
+  }
+  if (typeof val === "object" && "sso" in val) {
+    return val.sso;
+  }
+  return;
+}
+function extractWorkloadValidation(validation) {
+  if (!validation)
+    return;
+  const val = validation;
+  if (val.jwtAssertionClaims || val.tokenResponse) {
+    return val;
+  }
+  if (typeof val === "object" && "workload" in val) {
+    return val.workload;
+  }
+  return;
+}
+async function enterpriseStandard(appId, initConfig) {
+  const ioniteUrl = process.env.IONITE_URL ?? "https://ionite.com";
+  let vaultUrl = process.env.ES_VAULT_URL;
+  const vaultToken = process.env.ES_VAULT_TOKEN;
+  const vaultPath = process.env.ES_VAULT_PATH;
+  let secret;
+  if (appId?.startsWith("IONITE_PUBLIC_DEMO_") && !vaultUrl) {
     vaultUrl = "https://vault-ionite.ionite.dev/v1/secret/data";
-    const port = appKey.slice("IONITE_PUBLIC_DEMO_".length);
-    secrets = {
-      sso: {
-        path: `public/IONITE_PUBLIC_DEMO_SSO_${port}`,
-        token: "hvs.VGhD2hmXDH9PmZjTacZx0G5K"
-      }
+    secret = {
+      path: `public/${appId}`,
+      token: "hvs.VGhD2hmXDH9PmZjTacZx0G5K"
     };
-  } else if (appKey) {
-    if (!vaultUrl || !vaultToken) {
-      throw new Error("TODO something is wrong with the ionite config, handle this error");
-    }
-    secrets = {};
-  } else {
-    throw new Error("TODO tell them how to connect to ionite");
+  } else if (vaultUrl && vaultToken && vaultPath) {
+    secret = {
+      path: vaultPath,
+      token: vaultToken
+    };
+  } else if (!vaultUrl || !vaultToken || !vaultPath) {
+    console.log("NODE_ENV", "development");
+    const cmd = `${process.versions.bun ? "bun" : "npm"} ionite login --app ${appId}`;
+    throw new Error(`@enterprisestandard configuration missing.
+ For development, login with the ionite CLI using "${cmd}" or visit ${ioniteUrl}/api/applications/apiKeys/create?appId=${appId}. If this is a non-development environment, ensure that you are deployed with the correct tenant pattern.`);
   }
   const defaultInstance2 = getDefaultInstance();
   const vaultClient = vault(vaultUrl);
+  const ssoValidation = extractSsoValidation(initConfig?.validation);
+  const workloadValidation = extractWorkloadValidation(initConfig?.validation);
+  let vaultData = {};
+  if (secret) {
+    vaultData = await vaultClient.getSecret(secret.path, secret.token);
+  }
+  const workloadConfig = {
+    ...vaultData.workload,
+    ...initConfig?.workload,
+    jwks_uri: initConfig?.workload?.jwks_uri ?? vaultData.workload?.jwks_uri,
+    token_url: initConfig?.workload?.token_url ?? vaultData.workload?.token_url,
+    validation: initConfig?.workload?.validation ?? workloadValidation
+  };
+  const workloadInstance = workload(workloadConfig);
+  const ssoConfig = {
+    ...vaultData.sso,
+    ...initConfig?.sso,
+    validation: initConfig?.sso?.validation ?? ssoValidation
+  };
+  const ssoInstance = sso(ssoConfig);
+  const iamConfig = {
+    ...vaultData.iam,
+    ...initConfig?.iam
+  };
+  const iamInstance = iam(iamConfig, workloadInstance);
+  const mergedConfig = {
+    defaultInstance: initConfig?.defaultInstance,
+    sso: ssoConfig,
+    iam: iamConfig,
+    workload: workloadConfig,
+    validation: initConfig?.validation
+  };
   const result = {
-    ioniteUrl,
+    ...mergedConfig,
     defaultInstance: initConfig?.defaultInstance || initConfig?.defaultInstance !== false && !defaultInstance2,
     vault: vaultClient,
-    sso: secrets.sso ? sso({
-      ...await vaultClient.getSecret(secrets.sso.path, secrets.sso.token),
-      ...initConfig
-    }) : undefined,
-    iam: secrets.iam ? await iam(await vaultClient.getSecret(secrets.iam.path, secrets.iam.token)) : undefined
+    sso: ssoInstance,
+    iam: iamInstance,
+    workload: workloadInstance
   };
   if (result.defaultInstance) {
     if (defaultInstance2) {
@@ -1346,23 +3606,46 @@ async function enterpriseStandard(appKey, initConfig) {
   return result;
 }
 export {
+  workloadTokenResponseSchema,
+  workloadHandler,
+  workload,
+  vault,
+  validateWorkloadToken,
+  userSchema,
   useUser,
   useToken,
   tokenResponseSchema,
+  sso,
+  serializeESConfig,
+  sendTenantWebhook,
+  revokeWorkloadToken,
+  parseTenantRequest,
   oidcCallbackSchema,
   logout,
+  jwtAssertionClaimsSchema,
   initiateLogin,
   idTokenClaimsSchema,
+  iam,
   handler,
+  groupResourceSchema,
+  getWorkloadToken,
+  getWorkload,
   getUser,
   getRequiredUser,
+  getES,
+  getDefaultInstance,
   enterpriseStandard,
   callback,
+  TenantRequestError,
   SignedOut,
   SignedIn,
   SignInLoading,
   SSOProvider,
-  InMemorySessionStore
+  InMemoryWorkloadTokenStore,
+  InMemoryUserStore,
+  InMemoryTenantStore,
+  InMemorySessionStore,
+  InMemoryGroupStore
 };
 
-//# debugId=11B14D9E3E6DAB9F64756E2164756E21
+//# debugId=755D0ECE5A3DFE8164756E2164756E21