@enterprisestandard/react 0.0.5-beta.20260115.4 → 0.0.6

package/dist/index.js

@@ -1,3740 +1 @@
-// src/types/scim-schema.ts
-function validateString(value, fieldName, required, issues, path) {
-  if (value === void 0 || value === null) {
-    if (required) {
-      issues.push({
-        message: `${fieldName} is required`,
-        path
-      });
-    }
-    return void 0;
-  }
-  if (typeof value !== "string") {
-    issues.push({
-      message: `${fieldName} must be a string`,
-      path
-    });
-    return void 0;
-  }
-  return value;
-}
-function validateBoolean(value, fieldName, issues, path) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (typeof value !== "boolean") {
-    issues.push({
-      message: `${fieldName} must be a boolean`,
-      path
-    });
-    return void 0;
-  }
-  return value;
-}
-function validateName(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (typeof value !== "object" || value === null) {
-    issues.push({
-      message: "name must be an object",
-      path: basePath
-    });
-    return void 0;
-  }
-  const name = value;
-  const result = {};
-  result.formatted = validateString(name.formatted, "formatted", false, issues, [...basePath, "formatted"]);
-  result.familyName = validateString(name.familyName, "familyName", false, issues, [...basePath, "familyName"]);
-  result.givenName = validateString(name.givenName, "givenName", false, issues, [...basePath, "givenName"]);
-  result.middleName = validateString(name.middleName, "middleName", false, issues, [...basePath, "middleName"]);
-  result.honorificPrefix = validateString(name.honorificPrefix, "honorificPrefix", false, issues, [
-    ...basePath,
-    "honorificPrefix"
-  ]);
-  result.honorificSuffix = validateString(name.honorificSuffix, "honorificSuffix", false, issues, [
-    ...basePath,
-    "honorificSuffix"
-  ]);
-  return result;
-}
-function validateEmails(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (!Array.isArray(value)) {
-    issues.push({
-      message: "emails must be an array",
-      path: basePath
-    });
-    return void 0;
-  }
-  const emails = [];
-  for (let i = 0; i < value.length; i++) {
-    const email = value[i];
-    const emailPath = [...basePath, i];
-    if (typeof email !== "object" || email === null) {
-      issues.push({
-        message: "email must be an object",
-        path: emailPath
-      });
-      continue;
-    }
-    const emailObj = email;
-    const emailValue = validateString(emailObj.value, "value", true, issues, [...emailPath, "value"]);
-    if (emailValue) {
-      emails.push({
-        value: emailValue,
-        display: validateString(emailObj.display, "display", false, issues, [...emailPath, "display"]),
-        type: validateString(emailObj.type, "type", false, issues, [...emailPath, "type"]),
-        primary: validateBoolean(emailObj.primary, "primary", issues, [...emailPath, "primary"])
-      });
-    }
-  }
-  return emails.length > 0 ? emails : void 0;
-}
-function validatePhoneNumbers(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (!Array.isArray(value)) {
-    issues.push({
-      message: "phoneNumbers must be an array",
-      path: basePath
-    });
-    return void 0;
-  }
-  const phoneNumbers = [];
-  for (let i = 0; i < value.length; i++) {
-    const phone = value[i];
-    const phonePath = [...basePath, i];
-    if (typeof phone !== "object" || phone === null) {
-      issues.push({
-        message: "phoneNumber must be an object",
-        path: phonePath
-      });
-      continue;
-    }
-    const phoneObj = phone;
-    const phoneValue = validateString(phoneObj.value, "value", true, issues, [...phonePath, "value"]);
-    if (phoneValue) {
-      phoneNumbers.push({
-        value: phoneValue,
-        display: validateString(phoneObj.display, "display", false, issues, [...phonePath, "display"]),
-        type: validateString(phoneObj.type, "type", false, issues, [...phonePath, "type"]),
-        primary: validateBoolean(phoneObj.primary, "primary", issues, [...phonePath, "primary"])
-      });
-    }
-  }
-  return phoneNumbers.length > 0 ? phoneNumbers : void 0;
-}
-function validateAddresses(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (!Array.isArray(value)) {
-    issues.push({
-      message: "addresses must be an array",
-      path: basePath
-    });
-    return void 0;
-  }
-  const addresses = [];
-  for (let i = 0; i < value.length; i++) {
-    const address = value[i];
-    const addressPath = [...basePath, i];
-    if (typeof address !== "object" || address === null) {
-      issues.push({
-        message: "address must be an object",
-        path: addressPath
-      });
-      continue;
-    }
-    const addressObj = address;
-    addresses.push({
-      formatted: validateString(addressObj.formatted, "formatted", false, issues, [...addressPath, "formatted"]),
-      streetAddress: validateString(addressObj.streetAddress, "streetAddress", false, issues, [
-        ...addressPath,
-        "streetAddress"
-      ]),
-      locality: validateString(addressObj.locality, "locality", false, issues, [...addressPath, "locality"]),
-      region: validateString(addressObj.region, "region", false, issues, [...addressPath, "region"]),
-      postalCode: validateString(addressObj.postalCode, "postalCode", false, issues, [...addressPath, "postalCode"]),
-      country: validateString(addressObj.country, "country", false, issues, [...addressPath, "country"]),
-      type: validateString(addressObj.type, "type", false, issues, [...addressPath, "type"]),
-      primary: validateBoolean(addressObj.primary, "primary", issues, [...addressPath, "primary"])
-    });
-  }
-  return addresses.length > 0 ? addresses : void 0;
-}
-function validateGroups(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (!Array.isArray(value)) {
-    issues.push({
-      message: "groups must be an array",
-      path: basePath
-    });
-    return void 0;
-  }
-  const groups = [];
-  for (let i = 0; i < value.length; i++) {
-    const group = value[i];
-    const groupPath = [...basePath, i];
-    if (typeof group !== "object" || group === null) {
-      issues.push({
-        message: "group must be an object",
-        path: groupPath
-      });
-      continue;
-    }
-    const groupObj = group;
-    const groupValue = validateString(groupObj.value, "value", true, issues, [...groupPath, "value"]);
-    if (groupValue) {
-      groups.push({
-        value: groupValue,
-        $ref: validateString(groupObj.$ref, "$ref", false, issues, [...groupPath, "$ref"]),
-        display: validateString(groupObj.display, "display", false, issues, [...groupPath, "display"]),
-        type: validateString(groupObj.type, "type", false, issues, [...groupPath, "type"])
-      });
-    }
-  }
-  return groups.length > 0 ? groups : void 0;
-}
-function validateRoles(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (!Array.isArray(value)) {
-    issues.push({
-      message: "roles must be an array",
-      path: basePath
-    });
-    return void 0;
-  }
-  const roles = [];
-  for (let i = 0; i < value.length; i++) {
-    const role = value[i];
-    const rolePath = [...basePath, i];
-    if (typeof role !== "object" || role === null) {
-      issues.push({
-        message: "role must be an object",
-        path: rolePath
-      });
-      continue;
-    }
-    const roleObj = role;
-    const roleValue = validateString(roleObj.value, "value", true, issues, [...rolePath, "value"]);
-    if (roleValue) {
-      roles.push({
-        value: roleValue,
-        display: validateString(roleObj.display, "display", false, issues, [...rolePath, "display"]),
-        type: validateString(roleObj.type, "type", false, issues, [...rolePath, "type"]),
-        primary: validateBoolean(roleObj.primary, "primary", issues, [...rolePath, "primary"])
-      });
-    }
-  }
-  return roles.length > 0 ? roles : void 0;
-}
-function validateEnterpriseUser(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (typeof value !== "object" || value === null) {
-    issues.push({
-      message: "Enterprise User extension must be an object",
-      path: basePath
-    });
-    return void 0;
-  }
-  const enterprise = value;
-  const result = {};
-  result.employeeNumber = validateString(enterprise.employeeNumber, "employeeNumber", false, issues, [
-    ...basePath,
-    "employeeNumber"
-  ]);
-  result.costCenter = validateString(enterprise.costCenter, "costCenter", false, issues, [...basePath, "costCenter"]);
-  result.organization = validateString(enterprise.organization, "organization", false, issues, [
-    ...basePath,
-    "organization"
-  ]);
-  result.division = validateString(enterprise.division, "division", false, issues, [...basePath, "division"]);
-  result.department = validateString(enterprise.department, "department", false, issues, [...basePath, "department"]);
-  if (enterprise.manager !== void 0 && enterprise.manager !== null) {
-    if (typeof enterprise.manager !== "object" || enterprise.manager === null) {
-      issues.push({
-        message: "manager must be an object",
-        path: [...basePath, "manager"]
-      });
-    } else {
-      const manager = enterprise.manager;
-      result.manager = {
-        value: validateString(manager.value, "value", false, issues, [...basePath, "manager", "value"]),
-        $ref: validateString(manager.$ref, "$ref", false, issues, [...basePath, "manager", "$ref"]),
-        displayName: validateString(manager.displayName, "displayName", false, issues, [
-          ...basePath,
-          "manager",
-          "displayName"
-        ])
-      };
-    }
-  }
-  return result;
-}
-function userSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const user = value;
-        const issues = [];
-        const result = {};
-        const userName = validateString(user.userName, "userName", true, issues, ["userName"]);
-        if (!userName) {
-          return { issues };
-        }
-        result.userName = userName;
-        result.id = validateString(user.id, "id", false, issues, ["id"]);
-        result.externalId = validateString(user.externalId, "externalId", false, issues, ["externalId"]);
-        result.displayName = validateString(user.displayName, "displayName", false, issues, ["displayName"]);
-        result.nickName = validateString(user.nickName, "nickName", false, issues, ["nickName"]);
-        result.profileUrl = validateString(user.profileUrl, "profileUrl", false, issues, ["profileUrl"]);
-        result.title = validateString(user.title, "title", false, issues, ["title"]);
-        result.userType = validateString(user.userType, "userType", false, issues, ["userType"]);
-        result.preferredLanguage = validateString(user.preferredLanguage, "preferredLanguage", false, issues, [
-          "preferredLanguage"
-        ]);
-        result.locale = validateString(user.locale, "locale", false, issues, ["locale"]);
-        result.timezone = validateString(user.timezone, "timezone", false, issues, ["timezone"]);
-        result.password = validateString(user.password, "password", false, issues, ["password"]);
-        result.active = validateBoolean(user.active, "active", issues, ["active"]);
-        result.name = validateName(user.name, issues, ["name"]);
-        result.emails = validateEmails(user.emails, issues, ["emails"]);
-        result.phoneNumbers = validatePhoneNumbers(user.phoneNumbers, issues, ["phoneNumbers"]);
-        result.addresses = validateAddresses(user.addresses, issues, ["addresses"]);
-        result.groups = validateGroups(user.groups, issues, ["groups"]);
-        result.roles = validateRoles(user.roles, issues, ["roles"]);
-        const enterpriseKey = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
-        if (user[enterpriseKey] !== void 0) {
-          result[enterpriseKey] = validateEnterpriseUser(user[enterpriseKey], issues, [enterpriseKey]);
-        }
-        if (user.schemas !== void 0) {
-          if (Array.isArray(user.schemas)) {
-            result.schemas = user.schemas.filter((s) => typeof s === "string");
-          } else {
-            issues.push({
-              message: "schemas must be an array",
-              path: ["schemas"]
-            });
-          }
-        }
-        if (user.meta !== void 0) {
-          if (typeof user.meta === "object" && user.meta !== null) {
-            const meta = user.meta;
-            result.meta = {
-              resourceType: typeof meta.resourceType === "string" ? meta.resourceType : void 0,
-              created: typeof meta.created === "string" ? meta.created : void 0,
-              lastModified: typeof meta.lastModified === "string" ? meta.lastModified : void 0,
-              location: typeof meta.location === "string" ? meta.location : void 0,
-              version: typeof meta.version === "string" ? meta.version : void 0
-            };
-          } else {
-            issues.push({
-              message: "meta must be an object",
-              path: ["meta"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-function validateMembers(value, issues, basePath) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (!Array.isArray(value)) {
-    issues.push({
-      message: "members must be an array",
-      path: basePath
-    });
-    return void 0;
-  }
-  const members = [];
-  for (let i = 0; i < value.length; i++) {
-    const member = value[i];
-    const memberPath = [...basePath, i];
-    if (typeof member !== "object" || member === null) {
-      issues.push({
-        message: "member must be an object",
-        path: memberPath
-      });
-      continue;
-    }
-    const memberObj = member;
-    const memberValue = validateString(memberObj.value, "value", true, issues, [...memberPath, "value"]);
-    if (memberValue) {
-      const memberType = validateString(memberObj.type, "type", false, issues, [...memberPath, "type"]);
-      members.push({
-        value: memberValue,
-        $ref: validateString(memberObj.$ref, "$ref", false, issues, [...memberPath, "$ref"]),
-        display: validateString(memberObj.display, "display", false, issues, [...memberPath, "display"]),
-        type: memberType === "User" || memberType === "Group" ? memberType : void 0
-      });
-    }
-  }
-  return members.length > 0 ? members : void 0;
-}
-function groupResourceSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const group = value;
-        const issues = [];
-        const result = {};
-        const displayName = validateString(group.displayName, "displayName", true, issues, ["displayName"]);
-        if (!displayName) {
-          return { issues };
-        }
-        result.displayName = displayName;
-        result.id = validateString(group.id, "id", false, issues, ["id"]);
-        result.externalId = validateString(group.externalId, "externalId", false, issues, ["externalId"]);
-        result.members = validateMembers(group.members, issues, ["members"]);
-        if (group.schemas !== void 0) {
-          if (Array.isArray(group.schemas)) {
-            result.schemas = group.schemas.filter((s) => typeof s === "string");
-          } else {
-            issues.push({
-              message: "schemas must be an array",
-              path: ["schemas"]
-            });
-          }
-        }
-        if (group.meta !== void 0) {
-          if (typeof group.meta === "object" && group.meta !== null) {
-            const meta = group.meta;
-            result.meta = {
-              resourceType: typeof meta.resourceType === "string" ? meta.resourceType : void 0,
-              created: typeof meta.created === "string" ? meta.created : void 0,
-              lastModified: typeof meta.lastModified === "string" ? meta.lastModified : void 0,
-              location: typeof meta.location === "string" ? meta.location : void 0,
-              version: typeof meta.version === "string" ? meta.version : void 0
-            };
-          } else {
-            issues.push({
-              message: "meta must be an object",
-              path: ["meta"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-
-// src/iam.ts
-var SCIM_CONTENT_TYPE = "application/scim+json";
-function scimErrorResponse(status, detail, scimType) {
-  return new Response(
-    JSON.stringify({
-      schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
-      status: String(status),
-      scimType,
-      detail
-    }),
-    {
-      status,
-      headers: { "Content-Type": SCIM_CONTENT_TYPE }
-    }
-  );
-}
-function scimListResponse(resources) {
-  return new Response(
-    JSON.stringify({
-      schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
-      totalResults: resources.length,
-      startIndex: 1,
-      itemsPerPage: resources.length,
-      Resources: resources
-    }),
-    {
-      status: 200,
-      headers: { "Content-Type": SCIM_CONTENT_TYPE }
-    }
-  );
-}
-function scimResourceResponse(resource, status = 200) {
-  return new Response(JSON.stringify(resource), {
-    status,
-    headers: { "Content-Type": SCIM_CONTENT_TYPE }
-  });
-}
-function storedGroupToResource(group) {
-  return {
-    schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
-    id: group.id,
-    externalId: group.externalId,
-    displayName: group.displayName,
-    members: group.members,
-    meta: {
-      resourceType: "Group",
-      created: group.createdAt.toISOString(),
-      lastModified: group.updatedAt.toISOString()
-    }
-  };
-}
-function generateId() {
-  return crypto.randomUUID();
-}
-function iam(config, workload2) {
-  const { url, group_store } = config;
-  async function buildHeaders() {
-    const token = await workload2.getToken();
-    return new Headers({
-      "Content-Type": SCIM_CONTENT_TYPE,
-      Accept: SCIM_CONTENT_TYPE,
-      Authorization: `Bearer ${token}`
-    });
-  }
-  async function scimRequest(method, endpoint, body, validator) {
-    if (!url) {
-      return {
-        success: false,
-        error: {
-          schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
-          status: "500",
-          detail: "IAM URL not configured for outgoing requests"
-        },
-        status: 500
-      };
-    }
-    const requestUrl = `${url}${endpoint}`;
-    try {
-      const headers = await buildHeaders();
-      const response = await fetch(requestUrl, {
-        method,
-        headers,
-        body: body ? JSON.stringify(body) : void 0
-      });
-      const responseData = await response.json();
-      if (!response.ok) {
-        return {
-          success: false,
-          error: responseData,
-          status: response.status
-        };
-      }
-      if (validator) {
-        const validationResult = await validator["~standard"].validate(responseData);
-        if ("issues" in validationResult) {
-          return {
-            success: false,
-            error: {
-              schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
-              status: "400",
-              scimType: "invalidValue",
-              detail: `Response validation failed: ${validationResult.issues?.map((i) => i.message).join("; ")}`
-            },
-            status: 400
-          };
-        }
-        return {
-          success: true,
-          data: validationResult.value,
-          status: response.status
-        };
-      }
-      return {
-        success: true,
-        data: responseData,
-        status: response.status
-      };
-    } catch (error) {
-      return {
-        success: false,
-        error: {
-          schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
-          status: "500",
-          detail: error instanceof Error ? error.message : "Unknown error occurred"
-        },
-        status: 500
-      };
-    }
-  }
-  function getBaseUrl() {
-    return url;
-  }
-  let groups_outbound;
-  let createUser;
-  if (url) {
-    createUser = async (user, options) => {
-      const userPayload = {
-        ...user,
-        schemas: user.schemas ?? [
-          "urn:ietf:params:scim:schemas:core:2.0:User",
-          "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
-        ]
-      };
-      const validator = options?.validation ?? userSchema("es-iam");
-      return scimRequest("POST", "/Users", userPayload, validator);
-    };
-    async function createGroup(displayName, options) {
-      const groupPayload = {
-        schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
-        displayName,
-        externalId: options?.externalId,
-        members: options?.members
-      };
-      const validator = options?.validation ?? groupResourceSchema("es-iam");
-      return scimRequest("POST", "/Groups", groupPayload, validator);
-    }
-    groups_outbound = {
-      createGroup
-    };
-  }
-  let groups_inbound;
-  if (group_store) {
-    const store = group_store;
-    const validateAuth = async (request) => {
-      const auth = request.headers.get("Authorization");
-      if (!auth || !auth.startsWith("Bearer ")) {
-        return false;
-      }
-      try {
-        const token = auth.substring(7);
-        const result = await workload2.validateToken(token);
-        return result.valid;
-      } catch {
-        return false;
-      }
-    };
-    const handler2 = async (request, handlerConfig) => {
-      const isAuthorized = await validateAuth(request);
-      if (!isAuthorized) {
-        return scimErrorResponse(401, "Authorization required");
-      }
-      const urlObj = new URL(request.url);
-      const basePath = handlerConfig?.basePath ?? "/Groups";
-      let path = urlObj.pathname;
-      if (path.startsWith(basePath)) {
-        path = path.substring(basePath.length);
-      }
-      const groupIdMatch = path.match(/^\/([^/]+)$/);
-      const groupId = groupIdMatch?.[1];
-      const method = request.method;
-      try {
-        if (groupId) {
-          switch (method) {
-            case "GET":
-              return await handleGetGroup(groupId);
-            case "PUT":
-              return await handleReplaceGroup(request, groupId);
-            case "PATCH":
-              return await handlePatchGroup(request, groupId);
-            case "DELETE":
-              return await handleDeleteGroup(groupId);
-            default:
-              return scimErrorResponse(405, "Method not allowed");
-          }
-        } else if (path === "" || path === "/") {
-          switch (method) {
-            case "GET":
-              return await handleListGroups();
-            case "POST":
-              return await handleCreateGroup(request);
-            default:
-              return scimErrorResponse(405, "Method not allowed");
-          }
-        }
-        return scimErrorResponse(404, "Resource not found");
-      } catch (error) {
-        console.error("Groups inbound handler error:", error);
-        return scimErrorResponse(500, error instanceof Error ? error.message : "Internal server error");
-      }
-    };
-    const handleListGroups = async () => {
-      const groups = await store.list();
-      const resources = groups.map(storedGroupToResource);
-      return scimListResponse(resources);
-    };
-    const handleGetGroup = async (id) => {
-      const group = await store.get(id);
-      if (!group) {
-        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
-      }
-      return scimResourceResponse(storedGroupToResource(group));
-    };
-    const handleCreateGroup = async (request) => {
-      const body = await request.json();
-      if (!body.displayName) {
-        return scimErrorResponse(400, "displayName is required", "invalidValue");
-      }
-      const now = /* @__PURE__ */ new Date();
-      const storedGroup = {
-        id: generateId(),
-        displayName: body.displayName,
-        externalId: body.externalId,
-        members: body.members,
-        createdAt: now,
-        updatedAt: now
-      };
-      await store.upsert(storedGroup);
-      return scimResourceResponse(storedGroupToResource(storedGroup), 201);
-    };
-    const handleReplaceGroup = async (request, id) => {
-      const existing = await store.get(id);
-      if (!existing) {
-        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
-      }
-      const body = await request.json();
-      const updatedGroup = {
-        ...existing,
-        displayName: body.displayName ?? existing.displayName,
-        externalId: body.externalId,
-        members: body.members,
-        updatedAt: /* @__PURE__ */ new Date()
-      };
-      await store.upsert(updatedGroup);
-      return scimResourceResponse(storedGroupToResource(updatedGroup));
-    };
-    const handlePatchGroup = async (request, id) => {
-      const existing = await store.get(id);
-      if (!existing) {
-        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
-      }
-      const body = await request.json();
-      const operations = body.Operations ?? [];
-      const updated = { ...existing };
-      for (const op of operations) {
-        if (op.op === "replace" && op.path && op.value !== void 0) {
-          if (op.path === "displayName") {
-            updated.displayName = op.value;
-          }
-        } else if (op.op === "add" && op.path && op.value !== void 0) {
-          if (op.path === "members") {
-            const newMembers = op.value;
-            updated.members = [...updated.members ?? [], ...newMembers];
-          }
-        } else if (op.op === "remove" && op.path) {
-          if (op.path.startsWith("members[")) {
-            const match = op.path.match(/members\[value eq "([^"]+)"\]/);
-            if (match) {
-              updated.members = (updated.members ?? []).filter((m) => m.value !== match[1]);
-            }
-          }
-        }
-      }
-      updated.updatedAt = /* @__PURE__ */ new Date();
-      await store.upsert(updated);
-      return scimResourceResponse(storedGroupToResource(updated));
-    };
-    const handleDeleteGroup = async (id) => {
-      const existing = await store.get(id);
-      if (!existing) {
-        return scimErrorResponse(404, `Group ${id} not found`, "invalidValue");
-      }
-      await store.delete(id);
-      return new Response(null, { status: 204 });
-    };
-    groups_inbound = {
-      handler: handler2
-    };
-  }
-  let users_inbound;
-  if (config.user_store) {
-    const store = config.user_store;
-    async function validateAuth(request) {
-      const auth = request.headers.get("Authorization");
-      if (!auth || !auth.startsWith("Bearer ")) {
-        return false;
-      }
-      try {
-        const token = auth.substring(7);
-        const result = await workload2.validateToken(token);
-        return result.valid;
-      } catch {
-        return false;
-      }
-    }
-    const storedUserToScimUser = (storedUser) => {
-      return {
-        schemas: [
-          "urn:ietf:params:scim:schemas:core:2.0:User",
-          "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
-        ],
-        id: storedUser.id,
-        userName: storedUser.userName || storedUser.email || storedUser.id,
-        displayName: storedUser.name || storedUser.userName || storedUser.email,
-        name: storedUser.name ? {
-          givenName: storedUser.name.split(" ")[0],
-          familyName: storedUser.name.split(" ").slice(1).join(" ") || void 0
-        } : void 0,
-        emails: storedUser.email ? [{ value: storedUser.email, primary: true }] : [],
-        active: true,
-        meta: {
-          resourceType: "User",
-          created: storedUser.createdAt.toISOString(),
-          lastModified: storedUser.updatedAt.toISOString()
-        }
-      };
-    };
-    const scimUserToStoredUser = (scimUser) => {
-      const now = /* @__PURE__ */ new Date();
-      const primaryEmail = scimUser.emails?.find((e) => e.primary)?.value || scimUser.emails?.[0]?.value;
-      const name = scimUser.name ? `${scimUser.name.givenName || ""} ${scimUser.name.familyName || ""}`.trim() : scimUser.displayName;
-      const userId = scimUser.id || generateId();
-      const userName = scimUser.userName || primaryEmail || userId;
-      return {
-        id: userId,
-        userName,
-        name: name || scimUser.displayName || userName,
-        email: primaryEmail || userName,
-        avatarUrl: scimUser.profileUrl,
-        sso: {
-          profile: {
-            sub: userId,
-            iss: "iam-provisioned",
-            aud: "iam-provisioned",
-            exp: Math.floor(Date.now() / 1e3) + 3600,
-            iat: Math.floor(Date.now() / 1e3),
-            email: primaryEmail || userName,
-            email_verified: true,
-            name: name || scimUser.displayName || userName,
-            preferred_username: userName
-          },
-          tenant: {
-            id: "iam-provisioned",
-            name: "IAM Provisioned"
-          },
-          scope: "openid profile email",
-          tokenType: "Bearer",
-          expires: new Date(Date.now() + 3600 * 1e3)
-        },
-        createdAt: scimUser.meta?.created ? new Date(scimUser.meta.created) : now,
-        updatedAt: scimUser.meta?.lastModified ? new Date(scimUser.meta.lastModified) : now
-      };
-    };
-    const handler2 = async (request, handlerConfig) => {
-      const isAuthorized = await validateAuth(request);
-      if (!isAuthorized) {
-        return scimErrorResponse(401, "Authorization required");
-      }
-      const urlObj = new URL(request.url);
-      const basePath = handlerConfig?.basePath ?? "/Users";
-      let path = urlObj.pathname;
-      if (path.startsWith(basePath)) {
-        path = path.substring(basePath.length);
-      }
-      const userIdMatch = path.match(/^\/([^/]+)$/);
-      const userId = userIdMatch?.[1];
-      const method = request.method;
-      try {
-        if (userId) {
-          switch (method) {
-            case "GET":
-              return await handleGetUser(userId);
-            case "PUT":
-              return await handleReplaceUser(request, userId);
-            case "PATCH":
-              return await handlePatchUser(request, userId);
-            case "DELETE":
-              return await handleDeleteUser(userId);
-            default:
-              return scimErrorResponse(405, "Method not allowed");
-          }
-        } else if (path === "" || path === "/") {
-          switch (method) {
-            case "GET":
-              return await handleListUsers();
-            case "POST":
-              return await handleCreateUser(request);
-            default:
-              return scimErrorResponse(405, "Method not allowed");
-          }
-        }
-        return scimErrorResponse(404, "Resource not found");
-      } catch (error) {
-        console.error("Users inbound handler error:", error);
-        return scimErrorResponse(500, error instanceof Error ? error.message : "Internal server error");
-      }
-    };
-    const handleListUsers = async () => {
-      return scimListResponse([]);
-    };
-    const handleGetUser = async (id) => {
-      const user = await store.get(id);
-      if (!user) {
-        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
-      }
-      return scimResourceResponse(storedUserToScimUser(user));
-    };
-    const handleCreateUser = async (request) => {
-      const body = await request.json();
-      if (!body.userName && !body.emails?.[0]?.value) {
-        return scimErrorResponse(400, "userName or email is required", "invalidValue");
-      }
-      const storedUser = scimUserToStoredUser(body);
-      await store.upsert(storedUser);
-      return scimResourceResponse(storedUserToScimUser(storedUser), 201);
-    };
-    const handleReplaceUser = async (request, id) => {
-      const existing = await store.get(id);
-      if (!existing) {
-        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
-      }
-      const body = await request.json();
-      const updatedUser = scimUserToStoredUser({ ...body, id });
-      updatedUser.createdAt = existing.createdAt;
-      updatedUser.updatedAt = /* @__PURE__ */ new Date();
-      await store.upsert(updatedUser);
-      return scimResourceResponse(storedUserToScimUser(updatedUser));
-    };
-    const handlePatchUser = async (request, id) => {
-      const existing = await store.get(id);
-      if (!existing) {
-        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
-      }
-      const body = await request.json();
-      const operations = body.Operations ?? [];
-      const updated = { ...existing };
-      for (const op of operations) {
-        if (op.op === "replace" && op.path && op.value !== void 0) {
-          if (op.path === "displayName") {
-            updated.name = op.value;
-          } else if (op.path === "userName") {
-            updated.userName = op.value;
-          } else if (op.path.startsWith("name.")) {
-            const namePart = op.path.split(".")[1];
-            if (!updated.name) updated.name = "";
-            if (namePart === "givenName") {
-              updated.name = `${op.value} ${updated.name.split(" ").slice(1).join(" ")}`.trim();
-            } else if (namePart === "familyName") {
-              updated.name = `${updated.name.split(" ")[0]} ${op.value}`.trim();
-            }
-          } else if (op.path === "emails") {
-            const emails = op.value;
-            const primaryEmail = emails?.find((e) => e.primary)?.value || emails?.[0]?.value;
-            if (primaryEmail) updated.email = primaryEmail;
-          }
-        } else if (op.op === "add" && op.path && op.value !== void 0) {
-          if (op.path === "emails") {
-            const newEmails = op.value;
-            const primaryEmail = newEmails?.find((e) => e.primary)?.value || newEmails?.[0]?.value;
-            if (primaryEmail) updated.email = primaryEmail;
-          }
-        } else if (op.op === "remove" && op.path) {
-          if (op.path === "displayName") {
-            updated.name = "";
-          }
-        }
-      }
-      updated.updatedAt = /* @__PURE__ */ new Date();
-      await store.upsert(updated);
-      return scimResourceResponse(storedUserToScimUser(updated));
-    };
-    const handleDeleteUser = async (id) => {
-      const existing = await store.get(id);
-      if (!existing) {
-        return scimErrorResponse(404, `User ${id} not found`, "invalidValue");
-      }
-      await store.delete(id);
-      return new Response(null, { status: 204 });
-    };
-    users_inbound = {
-      handler: handler2
-    };
-  }
-  async function topLevelHandler(request, handlerConfig) {
-    const urlObj = new URL(request.url);
-    const path = urlObj.pathname;
-    const usersUrl = handlerConfig?.usersUrl ?? config.usersUrl ?? "/api/iam/Users";
-    const groupsUrl = handlerConfig?.groupsUrl ?? config.groupsUrl ?? "/api/iam/Groups";
-    if (path.startsWith(usersUrl) && users_inbound) {
-      return users_inbound.handler(request, { basePath: usersUrl });
-    }
-    if (path.startsWith(groupsUrl) && groups_inbound) {
-      return groups_inbound.handler(request, { basePath: groupsUrl });
-    }
-    return scimErrorResponse(404, "Resource not found");
-  }
-  return {
-    ...config,
-    createUser,
-    getBaseUrl,
-    groups_outbound,
-    groups_inbound,
-    users_inbound,
-    handler: topLevelHandler
-  };
-}
-
-// src/types/oidc-schema.ts
-function oidcCallbackSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const params = value;
-        const issues = [];
-        const result = {};
-        if ("code" in params) {
-          if (typeof params.code === "string") {
-            result.code = params.code;
-          } else {
-            issues.push({
-              message: "code must be a string",
-              path: ["code"]
-            });
-          }
-        } else if (!("error" in params)) {
-          issues.push({
-            message: "code is required",
-            path: ["code"]
-          });
-        }
-        if ("state" in params) {
-          if (typeof params.state === "string" || params.state === void 0) {
-            result.state = params.state;
-          } else {
-            issues.push({
-              message: "state must be a string",
-              path: ["state"]
-            });
-          }
-        }
-        if ("session_state" in params) {
-          if (typeof params.session_state === "string" || params.session_state === void 0) {
-            result.session_state = params.session_state;
-          } else {
-            issues.push({
-              message: "session_state must be a string",
-              path: ["session_state"]
-            });
-          }
-        }
-        if ("error" in params) {
-          if (typeof params.error === "string") {
-            result.error = params.error;
-          } else {
-            issues.push({
-              message: "error must be a string",
-              path: ["error"]
-            });
-          }
-          if ("error_description" in params) {
-            if (typeof params.error_description === "string" || params.error_description === void 0) {
-              result.error_description = params.error_description;
-            } else {
-              issues.push({
-                message: "error_description must be a string",
-                path: ["error_description"]
-              });
-            }
-          }
-          if ("error_uri" in params) {
-            if (typeof params.error_uri === "string" || params.error_uri === void 0) {
-              result.error_uri = params.error_uri;
-            } else {
-              issues.push({
-                message: "error_uri must be a string",
-                path: ["error_uri"]
-              });
-            }
-          }
-        }
-        if ("iss" in params) {
-          if (typeof params.iss === "string" || params.iss === void 0) {
-            result.iss = params.iss;
-          } else {
-            issues.push({
-              message: "iss must be a string",
-              path: ["iss"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-function tokenResponseSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const response = value;
-        const issues = [];
-        const result = {};
-        if ("access_token" in response) {
-          if (typeof response.access_token === "string") {
-            result.access_token = response.access_token;
-          } else {
-            issues.push({
-              message: "access_token must be a string",
-              path: ["access_token"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "access_token is required",
-            path: ["access_token"]
-          });
-        }
-        if ("id_token" in response) {
-          if (typeof response.id_token === "string") {
-            result.id_token = response.id_token;
-          } else {
-            issues.push({
-              message: "id_token must be a string",
-              path: ["id_token"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "id_token is required",
-            path: ["id_token"]
-          });
-        }
-        if ("token_type" in response) {
-          if (typeof response.token_type === "string") {
-            result.token_type = response.token_type;
-          } else {
-            issues.push({
-              message: "token_type must be a string",
-              path: ["token_type"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "token_type is required",
-            path: ["token_type"]
-          });
-        }
-        if ("refresh_token" in response) {
-          if (typeof response.refresh_token === "string" || response.refresh_token === void 0) {
-            result.refresh_token = response.refresh_token;
-          } else {
-            issues.push({
-              message: "refresh_token must be a string",
-              path: ["refresh_token"]
-            });
-          }
-        }
-        if ("scope" in response) {
-          if (typeof response.scope === "string" || response.scope === void 0) {
-            result.scope = response.scope;
-          } else {
-            issues.push({
-              message: "scope must be a string",
-              path: ["scope"]
-            });
-          }
-        }
-        if ("session_state" in response) {
-          if (typeof response.session_state === "string" || response.session_state === void 0) {
-            result.session_state = response.session_state;
-          } else {
-            issues.push({
-              message: "session_state must be a string",
-              path: ["session_state"]
-            });
-          }
-        }
-        if ("expires" in response) {
-          if (typeof response.expires === "string" || response.expires === void 0) {
-            result.expires = response.expires;
-          } else {
-            issues.push({
-              message: "expires must be a string",
-              path: ["expires"]
-            });
-          }
-        }
-        if ("expires_in" in response) {
-          if (typeof response.expires_in === "number" || response.expires_in === void 0) {
-            result.expires_in = response.expires_in;
-          } else {
-            issues.push({
-              message: "expires_in must be a number",
-              path: ["expires_in"]
-            });
-          }
-        }
-        if ("refresh_expires_in" in response) {
-          if (typeof response.refresh_expires_in === "number" || response.refresh_expires_in === void 0) {
-            result.refresh_expires_in = response.refresh_expires_in;
-          } else {
-            issues.push({
-              message: "refresh_expires_in must be a number",
-              path: ["refresh_expires_in"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-function idTokenClaimsSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const claims = value;
-        const issues = [];
-        const result = { ...claims };
-        const stringFields = ["iss", "aud", "sub", "sid", "name", "email", "preferred_username", "picture"];
-        for (const field of stringFields) {
-          if (field in claims && claims[field] !== void 0) {
-            if (typeof claims[field] !== "string") {
-              issues.push({
-                message: `${field} must be a string`,
-                path: [field]
-              });
-            }
-          }
-        }
-        const numberFields = ["exp", "iat"];
-        for (const field of numberFields) {
-          if (field in claims && claims[field] !== void 0) {
-            if (typeof claims[field] !== "number") {
-              issues.push({
-                message: `${field} must be a number`,
-                path: [field]
-              });
-            }
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-
-// src/utils.ts
-var defaultInstance;
-function must(value, message = "Assertion failed. Required value is null or undefined.") {
-  if (value === void 0 || value === null) {
-    throw new Error(message);
-  }
-  return value;
-}
-function setDefaultInstance(es) {
-  defaultInstance = es;
-}
-function getDefaultInstance() {
-  return defaultInstance;
-}
-function getES(es) {
-  if (es) return es;
-  if (defaultInstance) return defaultInstance;
-  throw new Error(`TODO standardize the error message when there isn't a default EntepriseStandard`);
-}
-
-// src/sso.ts
-var jwksCache = /* @__PURE__ */ new Map();
-function sso(config) {
-  let configWithDefaults;
-  const handlerDefaults = {
-    loginUrl: config?.loginUrl,
-    userUrl: config?.userUrl,
-    errorUrl: config?.errorUrl,
-    landingUrl: config?.landingUrl,
-    tokenUrl: config?.tokenUrl,
-    refreshUrl: config?.refreshUrl,
-    jwksUrl: config?.jwksUrl,
-    logoutUrl: config?.logoutUrl,
-    logoutBackChannelUrl: config?.logoutBackChannelUrl,
-    validation: config?.validation
-  };
-  configWithDefaults = !config ? void 0 : {
-    ...config,
-    authority: must(config.authority, "Missing 'authority' from SSO Config"),
-    token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
-    authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
-    client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
-    redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
-    scope: must(config.scope, "Missing 'scope' from SSO Config"),
-    response_type: config.response_type ?? "code",
-    cookies_secure: config.cookies_secure !== void 0 ? config.cookies_secure : true,
-    cookies_same_site: config.cookies_same_site !== void 0 ? config.cookies_same_site : "Strict",
-    cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
-    cookies_path: config.cookies_path ?? "/"
-  };
-  async function getUser2(request) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    try {
-      const { tokens } = await getTokenFromCookies(request);
-      if (!tokens) return void 0;
-      return await parseUser(tokens);
-    } catch (error) {
-      console.error("Error parsing user from cookies:", error);
-      return void 0;
-    }
-  }
-  async function getRequiredUser2(request) {
-    const user = await getUser2(request);
-    if (user) return user;
-    throw new Response("Unauthorized", {
-      status: 401,
-      statusText: "Unauthorized"
-    });
-  }
-  async function initiateLogin2({ landingUrl, errorUrl }, requestUrl) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    const state = generateRandomString();
-    const codeVerifier = generateRandomString(64);
-    let normalizedRedirectUri = configWithDefaults.redirect_uri;
-    try {
-      new URL(normalizedRedirectUri);
-    } catch {
-      if (requestUrl) {
-        try {
-          const baseUrl = new URL(requestUrl);
-          const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
-          normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
-        } catch {
-          try {
-            const authUrl = new URL(configWithDefaults.authorization_url);
-            const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
-            normalizedRedirectUri = new URL(path, authUrl.origin).toString();
-          } catch {
-            throw new Error(
-              `Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`
-            );
-          }
-        }
-      }
-    }
-    const url = new URL(configWithDefaults.authorization_url);
-    url.searchParams.append("client_id", configWithDefaults.client_id);
-    url.searchParams.append("redirect_uri", normalizedRedirectUri);
-    url.searchParams.append("response_type", "code");
-    url.searchParams.append("scope", configWithDefaults.scope);
-    url.searchParams.append("state", state);
-    const codeChallenge = await pkceChallengeFromVerifier(codeVerifier);
-    url.searchParams.append("code_challenge", codeChallenge);
-    url.searchParams.append("code_challenge_method", "S256");
-    const val = {
-      state,
-      codeVerifier,
-      landingUrl,
-      errorUrl
-    };
-    return new Response("Redirecting to SSO Provider", {
-      status: 302,
-      headers: {
-        Location: url.toString(),
-        "Set-Cookie": createCookie("state", val, 86400)
-      }
-    });
-  }
-  async function logout2(request, _config) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    try {
-      const refreshToken2 = getCookie("refresh", request);
-      if (refreshToken2) {
-        await revokeToken(refreshToken2);
-      }
-    } catch (error) {
-      console.warn("Failed to revoke token:", error);
-    }
-    if (configWithDefaults.session_store) {
-      try {
-        const user = await getUser2(request);
-        if (user?.sso?.profile.sid) {
-          const sid = user.sso.profile.sid;
-          await configWithDefaults.session_store.delete(sid);
-          console.log(`Session ${sid} deleted from store`);
-        }
-      } catch (error) {
-        console.warn("Failed to delete session:", error);
-      }
-    }
-    const clearHeaders = [
-      ["Set-Cookie", clearCookie("access")],
-      ["Set-Cookie", clearCookie("id")],
-      ["Set-Cookie", clearCookie("refresh")],
-      ["Set-Cookie", clearCookie("control")],
-      ["Set-Cookie", clearCookie("state")]
-    ];
-    const url = new URL(request.url);
-    const redirectTo = url.searchParams.get("redirect");
-    if (redirectTo) {
-      return new Response("Logged out", {
-        status: 302,
-        headers: [["Location", redirectTo], ...clearHeaders]
-      });
-    }
-    const accept = request.headers.get("accept");
-    const isAjax = accept?.includes("application/json") || accept?.includes("text/javascript");
-    if (isAjax) {
-      return new Response(JSON.stringify({ success: true, message: "Logged out" }), {
-        status: 200,
-        headers: [["Content-Type", "application/json"], ...clearHeaders]
-      });
-    } else {
-      return new Response(
-        `
-          <!DOCTYPE html><html lang="en"><body>
-            <h1>Logout Complete</h1>
-            <div style="display: none">
-              It is not recommended to show the default logout page. Include '?redirect=/someHomePage' or logout asynchronously.
-              Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
-            </div>
-          </body></html>
-        `,
-        {
-          status: 200,
-          headers: [["Content-Type", "text/html"], ...clearHeaders]
-        }
-      );
-    }
-  }
-  async function logoutBackChannel(request) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    if (!configWithDefaults.session_store) {
-      throw new Error("Back-Channel Logout requires session_store configuration");
-    }
-    try {
-      const contentType = request.headers.get("content-type");
-      if (!contentType || !contentType.includes("application/x-www-form-urlencoded")) {
-        return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded", {
-          status: 400
-        });
-      }
-      const body = await request.text();
-      const params = new URLSearchParams(body);
-      const logoutToken = params.get("logout_token");
-      if (!logoutToken) {
-        return new Response("Missing logout_token parameter", { status: 400 });
-      }
-      const claims = await parseJwt(logoutToken);
-      const sid = claims.sid;
-      if (!sid) {
-        console.warn("Back-Channel Logout: logout_token missing sid claim");
-        return new Response("Invalid logout_token: missing sid claim", { status: 400 });
-      }
-      await configWithDefaults.session_store.delete(sid);
-      console.log(`Back-Channel Logout: successfully deleted session ${sid}`);
-      return new Response("OK", { status: 200 });
-    } catch (error) {
-      console.error("Error during back-channel logout:", error);
-      return new Response("Internal Server Error", { status: 500 });
-    }
-  }
-  async function callbackHandler(request, validation) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    const url = new URL(request.url);
-    const params = new URLSearchParams(url.search);
-    const callbackParamsValidator = validation?.callbackParams ?? oidcCallbackSchema("builtin");
-    const paramsObject = Object.fromEntries(params.entries());
-    const paramsResult = await callbackParamsValidator["~standard"].validate(paramsObject);
-    if ("issues" in paramsResult) {
-      return new Response(
-        JSON.stringify({
-          error: "validation_failed",
-          message: "OIDC callback parameters validation failed",
-          issues: paramsResult.issues?.map((i) => ({
-            path: i.path?.join("."),
-            message: i.message
-          }))
-        }),
-        {
-          status: 400,
-          headers: { "Content-Type": "application/json" }
-        }
-      );
-    }
-    const { code: codeFromUrl, state: stateFromUrl } = paramsResult.value;
-    try {
-      const cookie = getCookie("state", request, true);
-      const { codeVerifier, state, landingUrl } = cookie ?? {};
-      must(
-        codeVerifier,
-        'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly'
-      );
-      must(state, 'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
-      must(landingUrl, 'OIDC "landingUrl" was not present in cookies');
-      if (stateFromUrl !== state) {
-        throw new Error(
-          'SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie'
-        );
-      }
-      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation, request.url);
-      const user = await parseUser(tokenResponse, validation);
-      if (configWithDefaults.session_store) {
-        try {
-          const sid = user.sso.profile.sid;
-          const sub = user.id;
-          if (sid && sub) {
-            const session = {
-              sid,
-              sub,
-              createdAt: /* @__PURE__ */ new Date(),
-              lastActivityAt: /* @__PURE__ */ new Date()
-            };
-            await configWithDefaults.session_store.create(session);
-          } else {
-            console.warn("Session creation skipped: missing sid or sub in ID token claims");
-          }
-        } catch (error) {
-          console.warn("Failed to create session:", error);
-        }
-      }
-      if (configWithDefaults.user_store) {
-        try {
-          const sub = user.id;
-          if (sub) {
-            const now = /* @__PURE__ */ new Date();
-            const existingUser = await configWithDefaults.user_store.get(sub);
-            if (existingUser || configWithDefaults.enable_jit_user_provisioning) {
-              const storedUser = {
-                ...existingUser ?? {},
-                ...user,
-                id: sub,
-                createdAt: existingUser?.createdAt ?? now,
-                updatedAt: now
-              };
-              await configWithDefaults.user_store.upsert(storedUser);
-            } else {
-              console.warn("JIT user provisioning disabled: user not found in store and will not be created");
-            }
-          } else {
-            console.warn("User storage skipped: missing sub in ID token claims");
-          }
-        } catch (error) {
-          console.warn("Failed to store user:", error);
-        }
-      }
-      return new Response("Authentication successful, redirecting", {
-        status: 302,
-        headers: [
-          ["Location", landingUrl],
-          ["Set-Cookie", clearCookie("state")],
-          ...createJwtCookies(tokenResponse, user.sso.expires)
-        ]
-      });
-    } catch (error) {
-      console.error("Error during sign-in callback:", error);
-      try {
-        const cookie = getCookie("state", request, true);
-        const { errorUrl } = cookie ?? {};
-        if (errorUrl) {
-          return new Response("Redirecting to error url", {
-            status: 302,
-            headers: [["Location", errorUrl]]
-          });
-        }
-      } catch (_err) {
-        console.warn("Error parsing the errorUrl from the OIDC cookie");
-      }
-      console.warn("No error page was found in the cookies. The user will be shown a default error page.");
-      return new Response(
-        "An error occurred during authentication, please return to the application homepage and try again.",
-        {
-          status: 500
-        }
-      );
-    }
-  }
-  async function parseUser(token, validation) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    const idToken = await parseJwt(token.id_token, validation);
-    const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
-    const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1e3);
-    return {
-      id: idToken.sub,
-      userName: idToken.preferred_username || "",
-      name: idToken.name || "",
-      email: idToken.email || "",
-      emails: [
-        {
-          value: idToken.email || "",
-          primary: true
-        }
-      ],
-      avatarUrl: idToken.picture,
-      sso: {
-        profile: {
-          ...idToken,
-          iss: idToken.iss || configWithDefaults.authority,
-          aud: idToken.aud || configWithDefaults.client_id
-        },
-        tenant: {
-          id: idToken.idp || idToken.iss || configWithDefaults.authority,
-          name: idToken.iss || configWithDefaults.authority
-        },
-        scope: token.scope,
-        tokenType: token.token_type,
-        sessionState: token.session_state,
-        expires
-      }
-    };
-  }
-  async function exchangeCodeForToken(code, codeVerifier, validation, requestUrl) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    const tokenUrl = configWithDefaults.token_url;
-    let normalizedRedirectUri = configWithDefaults.redirect_uri;
-    try {
-      new URL(normalizedRedirectUri);
-    } catch {
-      if (requestUrl) {
-        try {
-          const baseUrl = new URL(requestUrl);
-          const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
-          normalizedRedirectUri = new URL(path, baseUrl.origin).toString();
-        } catch {
-          try {
-            const tokenUrlObj = new URL(tokenUrl);
-            const path = normalizedRedirectUri.startsWith("//") ? normalizedRedirectUri.slice(1) : normalizedRedirectUri.startsWith("/") ? normalizedRedirectUri : `/${normalizedRedirectUri}`;
-            normalizedRedirectUri = new URL(path, tokenUrlObj.origin).toString();
-          } catch {
-            throw new Error(
-              `Invalid redirect_uri: "${configWithDefaults.redirect_uri}". It must be a valid absolute URL.`
-            );
-          }
-        }
-      }
-    }
-    const body = new URLSearchParams();
-    body.append("grant_type", "authorization_code");
-    body.append("code", code);
-    body.append("redirect_uri", normalizedRedirectUri);
-    body.append("client_id", configWithDefaults.client_id);
-    if (configWithDefaults.client_secret) {
-      body.append("client_secret", configWithDefaults.client_secret);
-    }
-    body.append("code_verifier", codeVerifier);
-    try {
-      const response = await fetch(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: body.toString()
-      });
-      const data = await response.json();
-      if (!response.ok) {
-        console.error("Token exchange error:", data);
-        throw new Error(
-          `Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim()
-        );
-      }
-      const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema("builtin");
-      const tokenResult = await tokenResponseValidator["~standard"].validate(data);
-      if ("issues" in tokenResult) {
-        console.error("Token response validation failed:", tokenResult.issues);
-        throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join("; ")}`);
-      }
-      return tokenResult.value;
-    } catch (error) {
-      console.error("Error during token exchange:", error);
-      throw error;
-    }
-  }
-  async function refreshToken(refreshToken2) {
-    return retryWithBackoff(async () => {
-      if (!configWithDefaults) {
-        throw new Error("Enterprise Standard SSO Manager not initialized");
-      }
-      const tokenUrl = configWithDefaults.token_url;
-      const body = new URLSearchParams();
-      body.append("grant_type", "refresh_token");
-      body.append("refresh_token", refreshToken2);
-      body.append("client_id", configWithDefaults.client_id);
-      const response = await fetch(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: body.toString()
-      });
-      const data = await response.json();
-      if (!response.ok) {
-        console.error("Token refresh error:", data);
-        throw new Error(
-          `Token refresh failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim()
-        );
-      }
-      return data;
-    });
-  }
-  async function revokeToken(token) {
-    try {
-      if (!configWithDefaults) {
-        throw new Error("Enterprise Standard SSO Manager not initialized");
-      }
-      if (!configWithDefaults.revocation_endpoint) {
-        return;
-      }
-      const body = new URLSearchParams();
-      body.append("token", token);
-      body.append("token_type_hint", "refresh_token");
-      body.append("client_id", configWithDefaults.client_id);
-      const response = await fetch(configWithDefaults.revocation_endpoint, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: body.toString()
-      });
-      if (!response.ok) {
-        console.warn("Token revocation failed:", response.status, response.statusText);
-      } else {
-        console.log("Token revoked successfully");
-      }
-    } catch (error) {
-      console.warn("Error revoking token:", error);
-    }
-  }
-  async function fetchJwks() {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    const url = configWithDefaults.jwks_uri || `${configWithDefaults.authority}/protocol/openid-connect/certs`;
-    const cached = jwksCache.get(url);
-    if (cached) return cached;
-    return retryWithBackoff(async () => {
-      if (!configWithDefaults) throw new Error("SSO Manager not initialized");
-      const response = await fetch(url);
-      if (!response.ok) throw new Error("Failed to fetch JWKS");
-      const jwks = await response.json();
-      jwksCache.set(url, jwks);
-      return jwks;
-    });
-  }
-  async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1e3, maxDelay = 3e4) {
-    let lastError = new Error("Placeholder Error");
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      try {
-        return await operation();
-      } catch (error) {
-        lastError = error instanceof Error ? error : new Error(String(error));
-        if (error instanceof Error && error.message.includes("400")) {
-          throw error;
-        }
-        if (attempt === maxRetries) {
-          throw lastError;
-        }
-        const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
-        const jitter = Math.random() * 0.1 * delay;
-        await new Promise((resolve) => setTimeout(resolve, delay + jitter));
-        console.warn(`Retry attempt ${attempt + 1} after ${delay + jitter}ms delay`);
-      }
-    }
-    throw lastError;
-  }
-  async function parseJwt(token, validation) {
-    try {
-      const parts = token.split(".");
-      if (parts.length !== 3) throw new Error("Invalid JWT");
-      const header = JSON.parse(atob(parts[0].replace(/-/g, "+").replace(/_/g, "/")));
-      const payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
-      const signature = parts[2].replace(/-/g, "+").replace(/_/g, "/");
-      const publicKey = await getPublicKey(header.kid);
-      const encoder = new TextEncoder();
-      const data = encoder.encode(`${parts[0]}.${parts[1]}`);
-      const isValid = await crypto.subtle.verify(
-        "RSASSA-PKCS1-v1_5",
-        publicKey,
-        Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)),
-        data
-      );
-      if (!isValid) throw new Error("Invalid JWT signature");
-      const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema("builtin");
-      const claimsResult = await idTokenClaimsValidator["~standard"].validate(payload);
-      if ("issues" in claimsResult) {
-        console.error("ID token claims validation failed:", claimsResult.issues);
-        throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join("; ")}`);
-      }
-      return claimsResult.value;
-    } catch (e) {
-      console.error("Error verifying JWT:", e);
-      throw e;
-    }
-  }
-  function generateRandomString(length = 32) {
-    const array = new Uint8Array(length);
-    crypto.getRandomValues(array);
-    return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("").substring(0, length);
-  }
-  async function pkceChallengeFromVerifier(verifier) {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const hashBase64 = btoa(String.fromCharCode(...hashArray)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    return hashBase64;
-  }
-  async function getPublicKey(kid) {
-    const jwks = await fetchJwks();
-    const key = jwks.keys.find((k) => k.kid === kid);
-    if (!key) throw new Error("Public key not found");
-    const publicKey = await crypto.subtle.importKey(
-      "jwk",
-      {
-        kty: key.kty,
-        n: key.n,
-        e: key.e
-      },
-      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
-      false,
-      ["verify"]
-    );
-    return publicKey;
-  }
-  function createJwtCookies(token, expires) {
-    const control = {
-      expires_in: token.expires_in,
-      refresh_expires_in: token.refresh_expires_in,
-      scope: token.scope,
-      session_state: token.session_state,
-      token_type: token.token_type,
-      expires: expires.toISOString()
-    };
-    return [
-      ["Set-Cookie", createCookie("access", token.access_token, expires)],
-      ["Set-Cookie", createCookie("id", token.id_token, expires)],
-      ["Set-Cookie", createCookie("refresh", token.refresh_token ?? "", expires)],
-      ["Set-Cookie", createCookie("control", control, expires)]
-    ];
-  }
-  async function getTokenFromCookies(req) {
-    const access_token = getCookie("access", req);
-    const id_token = getCookie("id", req);
-    const refresh_token = getCookie("refresh", req);
-    const control = getCookie("control", req, true);
-    if (!access_token || !id_token || !refresh_token || !control) {
-      return { tokens: void 0, refreshHeaders: [] };
-    }
-    let tokenResponse = {
-      access_token,
-      id_token,
-      refresh_token,
-      ...control
-    };
-    if (control.expires && refresh_token && Date.now() > new Date(control.expires).getTime()) {
-      tokenResponse = await refreshToken(refresh_token);
-      const user = await parseUser(tokenResponse);
-      const refreshHeaders = createJwtCookies(tokenResponse, user.sso.expires);
-      return { tokens: tokenResponse, refreshHeaders };
-    }
-    return { tokens: tokenResponse, refreshHeaders: [] };
-  }
-  async function getJwt(request) {
-    const { tokens } = await getTokenFromCookies(request);
-    if (!tokens) return void 0;
-    return tokens.access_token;
-  }
-  function createCookie(name, value, expires) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    name = `${configWithDefaults.cookies_prefix}.${name}`;
-    if (typeof value !== "string") {
-      value = btoa(JSON.stringify(value));
-    }
-    let exp;
-    if (expires instanceof Date) {
-      exp = `Expires=${expires.toUTCString()}`;
-    } else if (typeof expires === "number") {
-      exp = `Max-Age=${expires}`;
-    } else {
-      throw new Error("Invalid expires type", expires);
-    }
-    if (value.length > 4e3) {
-      throw new Error(`Error setting cookie: ${name}. Cookie length is: ${value.length}`);
-    }
-    return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
-  }
-  function clearCookie(name) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    return `${configWithDefaults.cookies_prefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
-  }
-  function getCookie(name, req, parse = false) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    const header = req.headers.get("cookie");
-    if (!header) return null;
-    const cookie = header.split(";").find((row) => row.trim().startsWith(`${configWithDefaults.cookies_prefix}.${name}=`));
-    if (!cookie) return null;
-    const val = cookie.split("=")[1].trim();
-    if (!parse) return val;
-    const str = atob(val);
-    return JSON.parse(str);
-  }
-  async function handler2(request, es) {
-    const {
-      loginUrl,
-      userUrl,
-      errorUrl,
-      landingUrl,
-      tokenUrl,
-      refreshUrl,
-      logoutUrl,
-      logoutBackChannelUrl,
-      jwksUrl,
-      validation
-    } = { ...handlerDefaults, ...es?.sso };
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard SSO Manager not initialized");
-    }
-    if (!loginUrl) {
-      console.error("loginUrl is required");
-    }
-    const path = new URL(request.url).pathname;
-    let redirectUriPath;
-    try {
-      redirectUriPath = new URL(configWithDefaults.redirect_uri).pathname;
-    } catch {
-      try {
-        const requestUrl = new URL(request.url);
-        const redirectUri = configWithDefaults.redirect_uri.startsWith("//") ? configWithDefaults.redirect_uri.slice(1) : configWithDefaults.redirect_uri;
-        redirectUriPath = new URL(redirectUri, requestUrl.origin).pathname;
-      } catch {
-        redirectUriPath = configWithDefaults.redirect_uri.startsWith("/") ? configWithDefaults.redirect_uri : `/${configWithDefaults.redirect_uri}`;
-      }
-    }
-    if (redirectUriPath === path) {
-      return callbackHandler(request, validation);
-    }
-    if (loginUrl === path) {
-      return initiateLogin2(
-        {
-          landingUrl: landingUrl || "/",
-          errorUrl
-        },
-        request.url
-      );
-    }
-    if (userUrl === path) {
-      const { tokens, refreshHeaders } = await getTokenFromCookies(request);
-      if (!tokens) {
-        return new Response("User not logged in", { status: 401 });
-      }
-      const user = await parseUser(tokens);
-      return new Response(JSON.stringify(user), {
-        headers: [["Content-Type", "application/json"], ...refreshHeaders]
-      });
-    }
-    if (tokenUrl === path) {
-      const { tokens, refreshHeaders } = await getTokenFromCookies(request);
-      if (!tokens) {
-        return new Response("User not logged in", { status: 401 });
-      }
-      return new Response(
-        JSON.stringify({
-          token: tokens.access_token,
-          expires: tokens.expires
-        }),
-        {
-          headers: [["Content-Type", "application/json"], ...refreshHeaders]
-        }
-      );
-    }
-    if (refreshUrl === path) {
-      const refresh_token = getCookie("refresh", request);
-      if (!refresh_token) {
-        return new Response("User not logged in", { status: 401 });
-      }
-      const newTokenResponse = await refreshToken(refresh_token);
-      const user = await parseUser(newTokenResponse);
-      const refreshHeaders = createJwtCookies(newTokenResponse, user.sso.expires);
-      return new Response("Refresh Complete", {
-        status: 200,
-        headers: refreshHeaders
-      });
-    }
-    if (logoutUrl === path) {
-      return logout2(request, { landingUrl: landingUrl || "/" });
-    }
-    if (logoutBackChannelUrl === path) {
-      return logoutBackChannel(request);
-    }
-    if (jwksUrl === path) {
-      const jwks = await fetchJwks();
-      return new Response(JSON.stringify(jwks), {
-        headers: [["Content-Type", "application/json"]]
-      });
-    }
-    return new Response("Not Found", { status: 404 });
-  }
-  if (!configWithDefaults) {
-    throw new Error("Enterprise Standard SSO Manager not initialized");
-  }
-  return {
-    ...configWithDefaults,
-    getUser: getUser2,
-    getRequiredUser: getRequiredUser2,
-    getJwt,
-    initiateLogin: initiateLogin2,
-    logout: logout2,
-    callbackHandler,
-    handler: handler2
-  };
-}
-
-// src/vault.ts
-function vault(url) {
-  async function getFullSecret(path, token) {
-    const resp = await fetch(`${url}/${path}`, { headers: { "X-Vault-Token": token } });
-    if (resp.status !== 200) {
-      throw new Error(`Vault returned invalid status, ${resp.status}: '${resp.statusText}' from URL: ${url}`);
-    }
-    try {
-      const secret = await resp.json();
-      return secret.data;
-    } catch (cause) {
-      throw new Error("Error retrieving secret", { cause });
-    }
-  }
-  return {
-    url,
-    getFullSecret,
-    getSecret: async (path, token) => {
-      return (await getFullSecret(path, token)).data;
-    }
-  };
-}
-
-// src/types/workload-schema.ts
-function jwtAssertionClaimsSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const claims = value;
-        const issues = [];
-        const result = { ...claims };
-        const requiredStringFields = ["iss", "sub"];
-        for (const field of requiredStringFields) {
-          if (field in claims) {
-            if (typeof claims[field] !== "string") {
-              issues.push({
-                message: `${field} must be a string`,
-                path: [field]
-              });
-            }
-          } else {
-            issues.push({
-              message: `${field} is required`,
-              path: [field]
-            });
-          }
-        }
-        if ("aud" in claims && claims.aud !== void 0) {
-          const aud = claims.aud;
-          if (typeof aud !== "string" && !Array.isArray(aud)) {
-            issues.push({
-              message: "aud must be a string or array of strings",
-              path: ["aud"]
-            });
-          } else if (Array.isArray(aud) && !aud.every((a) => typeof a === "string")) {
-            issues.push({
-              message: "aud array must contain only strings",
-              path: ["aud"]
-            });
-          }
-        }
-        const optionalStringFields = ["jti", "scope"];
-        for (const field of optionalStringFields) {
-          if (field in claims && claims[field] !== void 0) {
-            if (typeof claims[field] !== "string") {
-              issues.push({
-                message: `${field} must be a string`,
-                path: [field]
-              });
-            }
-          }
-        }
-        const requiredNumberFields = ["exp", "iat"];
-        for (const field of requiredNumberFields) {
-          if (field in claims) {
-            if (typeof claims[field] !== "number") {
-              issues.push({
-                message: `${field} must be a number`,
-                path: [field]
-              });
-            }
-          } else {
-            issues.push({
-              message: `${field} is required`,
-              path: [field]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-function workloadTokenResponseSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const response = value;
-        const issues = [];
-        const result = {};
-        if ("access_token" in response) {
-          if (typeof response.access_token === "string") {
-            result.access_token = response.access_token;
-          } else {
-            issues.push({
-              message: "access_token must be a string",
-              path: ["access_token"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "access_token is required",
-            path: ["access_token"]
-          });
-        }
-        if ("token_type" in response) {
-          if (typeof response.token_type === "string") {
-            result.token_type = response.token_type;
-          } else {
-            issues.push({
-              message: "token_type must be a string",
-              path: ["token_type"]
-            });
-          }
-        } else {
-          issues.push({
-            message: "token_type is required",
-            path: ["token_type"]
-          });
-        }
-        if ("scope" in response) {
-          if (typeof response.scope === "string" || response.scope === void 0) {
-            result.scope = response.scope;
-          } else {
-            issues.push({
-              message: "scope must be a string",
-              path: ["scope"]
-            });
-          }
-        }
-        if ("refresh_token" in response) {
-          if (typeof response.refresh_token === "string" || response.refresh_token === void 0) {
-            result.refresh_token = response.refresh_token;
-          } else {
-            issues.push({
-              message: "refresh_token must be a string",
-              path: ["refresh_token"]
-            });
-          }
-        }
-        if ("expires" in response) {
-          if (typeof response.expires === "string" || response.expires === void 0) {
-            result.expires = response.expires;
-          } else {
-            issues.push({
-              message: "expires must be a string",
-              path: ["expires"]
-            });
-          }
-        }
-        if ("expires_in" in response) {
-          if (typeof response.expires_in === "number" || response.expires_in === void 0) {
-            result.expires_in = response.expires_in;
-          } else {
-            issues.push({
-              message: "expires_in must be a number",
-              path: ["expires_in"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
-
-// src/workload-token-store.ts
-var InMemoryWorkloadTokenStore = class {
-  constructor() {
-    this.tokens = /* @__PURE__ */ new Map();
-  }
-  async set(token) {
-    this.tokens.set(token.workload_id, token);
-  }
-  async get(workload_id) {
-    const token = this.tokens.get(workload_id);
-    if (!token) return null;
-    if (Date.now() > token.expires_at.getTime()) {
-      this.tokens.delete(workload_id);
-      return null;
-    }
-    return token;
-  }
-  async delete(workload_id) {
-    this.tokens.delete(workload_id);
-  }
-  async isValid(workload_id) {
-    const token = await this.get(workload_id);
-    return token !== null;
-  }
-  async cleanup() {
-    const now = Date.now();
-    for (const [workload_id, token] of this.tokens.entries()) {
-      if (now > token.expires_at.getTime()) {
-        this.tokens.delete(workload_id);
-      }
-    }
-  }
-};
-
-// src/workload.ts
-var jwksCache2 = /* @__PURE__ */ new Map();
-function isJwtBearerConfig(config) {
-  return "workload_id" in config || "private_key" in config;
-}
-function isClientCredentialsConfig(config) {
-  return "client_id" in config || "client_secret" in config;
-}
-function isServerOnlyConfig(config) {
-  return "jwks_uri" in config && !("workload_id" in config) && !("client_id" in config);
-}
-function validateWorkloadConfig(config) {
-  const hasJwtBearer = "workload_id" in config && "private_key" in config;
-  const hasClientCreds = "client_id" in config && "client_secret" in config;
-  const hasServerOnly = "jwks_uri" in config;
-  if (!hasJwtBearer && !hasClientCreds && !hasServerOnly) {
-    throw new Error(
-      "Invalid WorkloadConfig: must provide either (workload_id + private_key) for JWT Bearer Grant, (client_id + client_secret) for OAuth2 Client Credentials, or (jwks_uri) for server-only token validation"
-    );
-  }
-}
-function workload(config) {
-  let configWithDefaults;
-  if (!config) {
-    configWithDefaults = void 0;
-  } else {
-    try {
-      validateWorkloadConfig(config);
-      if (isJwtBearerConfig(config)) {
-        configWithDefaults = {
-          ...config,
-          token_url: must(config.token_url, "Missing 'token_url' from Workload Config"),
-          workload_id: must(config.workload_id, "Missing 'workload_id' from Workload Config"),
-          audience: must(config.audience, "Missing 'audience' from Workload Config"),
-          scope: config.scope ?? "",
-          algorithm: config.algorithm ?? "RS256",
-          token_lifetime: config.token_lifetime ?? 300,
-          refresh_threshold: config.refresh_threshold ?? 60,
-          auto_refresh: config.auto_refresh !== void 0 ? config.auto_refresh : true,
-          token_store: config.token_store ?? new InMemoryWorkloadTokenStore()
-        };
-      } else if (isClientCredentialsConfig(config)) {
-        configWithDefaults = {
-          ...config,
-          token_url: must(config.token_url, "Missing 'token_url' from Workload Config"),
-          client_id: must(config.client_id, "Missing 'client_id' from Workload Config"),
-          client_secret: must(config.client_secret, "Missing 'client_secret' from Workload Config"),
-          scope: config.scope ?? "",
-          token_lifetime: config.token_lifetime ?? 300,
-          refresh_threshold: config.refresh_threshold ?? 60,
-          auto_refresh: config.auto_refresh !== void 0 ? config.auto_refresh : true,
-          token_store: config.token_store ?? new InMemoryWorkloadTokenStore()
-        };
-      } else {
-        configWithDefaults = config;
-      }
-    } catch {
-      configWithDefaults = void 0;
-    }
-  }
-  const initialized = true;
-  function _ensureInitialized() {
-    if (!initialized || !configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-  }
-  function generateJTI() {
-    const array = new Uint8Array(16);
-    crypto.getRandomValues(array);
-    return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
-  }
-  function base64UrlEncode(data) {
-    let base64;
-    if (typeof data === "string") {
-      base64 = btoa(data);
-    } else {
-      base64 = btoa(String.fromCharCode(...data));
-    }
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-  }
-  function base64UrlDecode(base64url) {
-    let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
-    while (base64.length % 4) {
-      base64 += "=";
-    }
-    return atob(base64);
-  }
-  function getAlgorithmParams(alg) {
-    if (alg.startsWith("RS")) {
-      const hash = alg === "RS256" ? "SHA-256" : alg === "RS384" ? "SHA-384" : "SHA-512";
-      return { name: "RSASSA-PKCS1-v1_5", hash };
-    } else if (alg.startsWith("ES")) {
-      const namedCurve = alg === "ES256" ? "P-256" : alg === "ES384" ? "P-384" : "P-521";
-      const hash = alg === "ES256" ? "SHA-256" : alg === "ES384" ? "SHA-384" : "SHA-512";
-      return { name: "ECDSA", namedCurve, hash };
-    }
-    throw new Error(`Unsupported algorithm: ${alg}`);
-  }
-  async function importPrivateKey(pemKey, algorithm) {
-    const pemContents = pemKey.replace(/-----BEGIN PRIVATE KEY-----/, "").replace(/-----END PRIVATE KEY-----/, "").replace(/\s/g, "");
-    const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
-    const algorithmParams = getAlgorithmParams(algorithm);
-    return crypto.subtle.importKey("pkcs8", binaryDer, algorithmParams, false, ["sign"]);
-  }
-  async function signJWT(data, privateKeyPEM, algorithm) {
-    const privateKey = await importPrivateKey(privateKeyPEM, algorithm);
-    const encoder = new TextEncoder();
-    const dataBuffer = encoder.encode(data);
-    const algorithmParams = getAlgorithmParams(algorithm);
-    const signatureBuffer = await crypto.subtle.sign(algorithmParams, privateKey, dataBuffer);
-    return base64UrlEncode(new Uint8Array(signatureBuffer));
-  }
-  async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1e3, maxDelay = 3e4) {
-    let lastError = new Error("Placeholder Error");
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      try {
-        return await operation();
-      } catch (error) {
-        lastError = error instanceof Error ? error : new Error(String(error));
-        if (lastError.message.includes("400") || lastError.message.includes("401") || lastError.message.includes("403") || lastError.message.includes("404")) {
-          throw lastError;
-        }
-        if (attempt < maxRetries) {
-          const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
-          const jitter = Math.random() * delay * 0.1;
-          await new Promise((resolve) => setTimeout(resolve, delay + jitter));
-        }
-      }
-    }
-    throw lastError;
-  }
-  async function generateJWTAssertion(scope) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    if (!isJwtBearerConfig(configWithDefaults)) {
-      throw new Error("generateJWTAssertion is only available in JWT Bearer Grant mode");
-    }
-    const cfg = configWithDefaults;
-    const now = Math.floor(Date.now() / 1e3);
-    const claims = {
-      iss: cfg.workload_id,
-      sub: cfg.workload_id,
-      aud: cfg.audience ?? "",
-      exp: now + cfg.token_lifetime,
-      iat: now,
-      jti: generateJTI(),
-      scope: scope ?? cfg.scope
-    };
-    const header = {
-      alg: cfg.algorithm,
-      typ: "JWT",
-      kid: cfg.key_id
-    };
-    const encodedHeader = base64UrlEncode(JSON.stringify(header));
-    const encodedPayload = base64UrlEncode(JSON.stringify(claims));
-    const signatureInput = `${encodedHeader}.${encodedPayload}`;
-    const signature = await signJWT(signatureInput, cfg.private_key, cfg.algorithm);
-    return `${signatureInput}.${signature}`;
-  }
-  async function acquireTokenJwtBearer(scope, validation) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    const cfg = configWithDefaults;
-    return retryWithBackoff(async () => {
-      const tokenUrl = cfg.token_url;
-      const assertion = await generateJWTAssertion(scope);
-      const body = new URLSearchParams();
-      body.append("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
-      body.append("assertion", assertion);
-      if (scope) body.append("scope", scope);
-      const response = await fetch(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: body.toString()
-      });
-      const data = await response.json();
-      if (!response.ok) {
-        console.error("Token acquisition error:", data);
-        throw new Error(
-          `Token acquisition failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim()
-        );
-      }
-      const validator = validation?.tokenResponse ?? workloadTokenResponseSchema("builtin");
-      const result = await validator["~standard"].validate(data);
-      if ("issues" in result) {
-        console.error("Token response validation failed:", result.issues);
-        throw new Error(`Token response validation failed: ${result.issues?.map((i) => i.message).join("; ")}`);
-      }
-      if (cfg.token_store) {
-        const expiresAt = new Date(Date.now() + (result.value.expires_in ?? 300) * 1e3);
-        const cachedToken = {
-          workload_id: cfg.workload_id,
-          access_token: result.value.access_token,
-          token_type: result.value.token_type,
-          scope: result.value.scope,
-          expires_at: expiresAt,
-          created_at: /* @__PURE__ */ new Date(),
-          refresh_token: result.value.refresh_token
-        };
-        await cfg.token_store.set(cachedToken);
-      }
-      return result.value;
-    });
-  }
-  async function acquireTokenClientCredentials(scope, validation) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    const cfg = configWithDefaults;
-    return retryWithBackoff(async () => {
-      const tokenUrl = cfg.token_url;
-      const body = new URLSearchParams();
-      body.append("grant_type", "client_credentials");
-      body.append("client_id", cfg.client_id);
-      body.append("client_secret", cfg.client_secret);
-      if (scope) body.append("scope", scope);
-      const response = await fetch(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        },
-        body: body.toString()
-      });
-      const data = await response.json();
-      if (!response.ok) {
-        console.error("Token acquisition error:", data);
-        throw new Error(
-          `Token acquisition failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim()
-        );
-      }
-      const validator = validation?.tokenResponse ?? workloadTokenResponseSchema("builtin");
-      const result = await validator["~standard"].validate(data);
-      if ("issues" in result) {
-        console.error("Token response validation failed:", result.issues);
-        throw new Error(`Token response validation failed: ${result.issues?.map((i) => i.message).join("; ")}`);
-      }
-      if (cfg.token_store) {
-        const expiresAt = new Date(Date.now() + (result.value.expires_in ?? 300) * 1e3);
-        const cachedToken = {
-          workload_id: cfg.client_id,
-          access_token: result.value.access_token,
-          token_type: result.value.token_type,
-          scope: result.value.scope,
-          expires_at: expiresAt,
-          created_at: /* @__PURE__ */ new Date(),
-          refresh_token: result.value.refresh_token
-        };
-        await cfg.token_store.set(cachedToken);
-      }
-      return result.value;
-    });
-  }
-  async function getToken(scope) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    if (isServerOnlyConfig(configWithDefaults)) {
-      throw new Error(
-        "Cannot acquire tokens: Workload is configured in server-only mode (validation only). To acquire tokens, configure client_id + client_secret for OAuth2 Client Credentials, or workload_id + private_key for JWT Bearer Grant."
-      );
-    }
-    if (!configWithDefaults.token_url) {
-      throw new Error(
-        "Cannot acquire tokens: Missing token_url in WorkloadConfig. Client role requires token_url to be configured in vault."
-      );
-    }
-    if (isJwtBearerConfig(configWithDefaults)) {
-      if (!configWithDefaults.private_key) {
-        throw new Error(
-          "Cannot acquire tokens: Missing private_key in WorkloadConfig. JWT Bearer Grant client role requires private_key to be configured in vault."
-        );
-      }
-    } else if (isClientCredentialsConfig(configWithDefaults)) {
-      if (!configWithDefaults.client_secret) {
-        throw new Error(
-          "Cannot acquire tokens: Missing client_secret in WorkloadConfig. OAuth2 Client Credentials client role requires client_secret to be configured in vault."
-        );
-      }
-    }
-    const requestedScope = scope ?? configWithDefaults.scope ?? "";
-    let cacheKey;
-    if (isJwtBearerConfig(configWithDefaults)) {
-      cacheKey = configWithDefaults.workload_id;
-    } else if (isClientCredentialsConfig(configWithDefaults)) {
-      cacheKey = configWithDefaults.client_id;
-    } else {
-      throw new Error("Invalid WorkloadConfig");
-    }
-    const cfg = configWithDefaults;
-    if (cfg.token_store) {
-      const cachedToken = await cfg.token_store.get(cacheKey);
-      if (cachedToken) {
-        const now = Date.now();
-        const expiresAt = cachedToken.expires_at.getTime();
-        const refreshThreshold = cfg.refresh_threshold * 1e3;
-        if (now + refreshThreshold < expiresAt) {
-          return cachedToken.access_token;
-        }
-        if (cfg.auto_refresh) {
-          try {
-            const newToken = isJwtBearerConfig(configWithDefaults) ? await acquireTokenJwtBearer(requestedScope) : await acquireTokenClientCredentials(requestedScope);
-            return newToken.access_token;
-          } catch (error) {
-            if (now < expiresAt) {
-              console.warn("Token refresh failed, using cached token:", error);
-              return cachedToken.access_token;
-            }
-            throw error;
-          }
-        }
-      }
-    }
-    const tokenResponse = isJwtBearerConfig(configWithDefaults) ? await acquireTokenJwtBearer(requestedScope) : await acquireTokenClientCredentials(requestedScope);
-    return tokenResponse.access_token;
-  }
-  async function refreshToken() {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    if (isServerOnlyConfig(configWithDefaults)) {
-      throw new Error("Cannot refresh tokens: Workload is configured in server-only mode (validation only).");
-    }
-    const cfg = configWithDefaults;
-    return isJwtBearerConfig(cfg) ? await acquireTokenJwtBearer(cfg.scope) : await acquireTokenClientCredentials(cfg.scope);
-  }
-  async function revokeToken(token) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    try {
-      if (!configWithDefaults.revocation_endpoint) {
-        return;
-      }
-      const body = new URLSearchParams();
-      body.append("token", token);
-      body.append("token_type_hint", "access_token");
-      if (isJwtBearerConfig(configWithDefaults)) {
-        const cfg = configWithDefaults;
-        body.append("client_id", cfg.workload_id);
-      } else if (isClientCredentialsConfig(configWithDefaults)) {
-        const cfg = configWithDefaults;
-        body.append("client_id", cfg.client_id);
-        body.append("client_secret", cfg.client_secret);
-      }
-      const response = await fetch(configWithDefaults.revocation_endpoint, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: body.toString()
-      });
-      if (!response.ok) {
-        console.warn("Token revocation failed:", response.status, response.statusText);
-      } else {
-        console.log("Token revoked successfully");
-      }
-      if (configWithDefaults.token_store) {
-        let cacheKey;
-        if (isJwtBearerConfig(configWithDefaults)) {
-          cacheKey = configWithDefaults.workload_id;
-        } else if (isClientCredentialsConfig(configWithDefaults)) {
-          cacheKey = configWithDefaults.client_id;
-        } else {
-          return;
-        }
-        await configWithDefaults.token_store.delete(cacheKey);
-      }
-    } catch (error) {
-      console.warn("Error revoking token:", error);
-    }
-  }
-  async function fetchJwks() {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    const url = configWithDefaults.jwks_uri;
-    if (!url) {
-      throw new Error(
-        "Cannot validate tokens: Missing jwks_uri in WorkloadConfig. Server role requires jwks_uri to be configured in vault to fetch public keys for token validation."
-      );
-    }
-    const cached = jwksCache2.get(url);
-    if (cached) return cached;
-    return retryWithBackoff(async () => {
-      const response = await fetch(url);
-      if (!response.ok) throw new Error("Failed to fetch JWKS");
-      const jwks = await response.json();
-      jwksCache2.set(url, jwks);
-      return jwks;
-    });
-  }
-  async function getPublicKey(kid) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    const jwks = await fetchJwks();
-    const key = jwks.keys.find((k) => k.kid === kid);
-    if (!key) throw new Error("Public key not found");
-    const defaultAlg = isJwtBearerConfig(configWithDefaults) ? configWithDefaults.algorithm : "RS256";
-    const algorithmParams = getAlgorithmParams(key.alg || defaultAlg);
-    return crypto.subtle.importKey("jwk", key, algorithmParams, false, ["verify"]);
-  }
-  async function parseJWT(token, validation) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    try {
-      const parts = token.split(".");
-      if (parts.length !== 3) throw new Error("Invalid JWT");
-      const header = JSON.parse(base64UrlDecode(parts[0]));
-      const payload = JSON.parse(base64UrlDecode(parts[1]));
-      const publicKey = await getPublicKey(header.kid);
-      const signature = parts[2];
-      const encoder = new TextEncoder();
-      const data = encoder.encode(`${parts[0]}.${parts[1]}`);
-      const signatureBytes = Uint8Array.from(base64UrlDecode(signature), (c) => c.charCodeAt(0));
-      const algorithmParams = getAlgorithmParams(header.alg);
-      const isValid = await crypto.subtle.verify(algorithmParams, publicKey, signatureBytes, data);
-      if (!isValid) throw new Error("Invalid JWT signature");
-      const validator = validation?.jwtAssertionClaims ?? jwtAssertionClaimsSchema("builtin");
-      const result = await validator["~standard"].validate(payload);
-      if ("issues" in result) {
-        console.error("JWT claims validation failed:", result.issues);
-        throw new Error(`JWT claims validation failed: ${result.issues?.map((i) => i.message).join("; ")}`);
-      }
-      return result.value;
-    } catch (error) {
-      console.error("Error verifying JWT:", error);
-      throw error;
-    }
-  }
-  async function validateToken(token, validation) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    try {
-      const claims = await parseJWT(token, validation);
-      const now = Math.floor(Date.now() / 1e3);
-      if (claims.exp && claims.exp < now) {
-        return { valid: false, error: "Token expired" };
-      }
-      if (isJwtBearerConfig(configWithDefaults)) {
-        if (configWithDefaults.audience && claims.aud !== configWithDefaults.audience) {
-          return { valid: false, error: "Invalid audience" };
-        }
-      } else if (isClientCredentialsConfig(configWithDefaults)) {
-        if (configWithDefaults.issuer && claims.iss !== configWithDefaults.issuer) {
-          return { valid: false, error: "Invalid issuer" };
-        }
-        if (configWithDefaults.audience && claims.aud !== configWithDefaults.audience) {
-          return { valid: false, error: "Invalid audience" };
-        }
-      } else {
-        const serverConfig = configWithDefaults;
-        if (serverConfig.issuer && claims.iss !== serverConfig.issuer) {
-          return { valid: false, error: "Invalid issuer" };
-        }
-      }
-      return {
-        valid: true,
-        claims,
-        expiresAt: claims.exp ? new Date(claims.exp * 1e3) : void 0
-      };
-    } catch (error) {
-      return {
-        valid: false,
-        error: error instanceof Error ? error.message : String(error)
-      };
-    }
-  }
-  async function getWorkload2(request) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    if (!configWithDefaults.jwks_uri) {
-      throw new Error(
-        "Cannot validate tokens: Missing jwks_uri in WorkloadConfig. Server role requires jwks_uri to be configured in vault to fetch public keys for token validation."
-      );
-    }
-    const authHeader = request.headers.get("Authorization");
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-      return void 0;
-    }
-    const token = authHeader.substring(7);
-    const result = await validateToken(token, configWithDefaults.validation);
-    if (!result.valid || !result.claims) {
-      return void 0;
-    }
-    return {
-      workload_id: result.claims.sub,
-      // Subject is the workload identity
-      client_id: typeof result.claims.client_id === "string" ? result.claims.client_id : void 0,
-      // May be present in OAuth2 tokens
-      scope: result.claims.scope,
-      claims: result.claims
-    };
-  }
-  async function handler2(request) {
-    if (!configWithDefaults) {
-      throw new Error("Enterprise Standard Workload Manager not initialized");
-    }
-    const tokenUrl = configWithDefaults.tokenUrl;
-    const validateUrl = configWithDefaults.validateUrl;
-    const jwksUrl = configWithDefaults.jwksUrl;
-    const refreshUrl = configWithDefaults.refreshUrl;
-    const validation = configWithDefaults.validation;
-    const path = new URL(request.url).pathname;
-    if (tokenUrl === path && request.method === "GET") {
-      const url = new URL(request.url);
-      const scope = url.searchParams.get("scope") || void 0;
-      const token = await getToken(scope);
-      return new Response(JSON.stringify({ access_token: token, token_type: "Bearer" }), {
-        headers: [["Content-Type", "application/json"]]
-      });
-    }
-    if (validateUrl === path && request.method === "POST") {
-      const authHeader = request.headers.get("Authorization");
-      if (!authHeader || !authHeader.startsWith("Bearer ")) {
-        return new Response(JSON.stringify({ valid: false, error: "Missing Authorization header" }), {
-          status: 401,
-          headers: [["Content-Type", "application/json"]]
-        });
-      }
-      const token = authHeader.substring(7);
-      const result = await validateToken(token, validation);
-      return new Response(JSON.stringify(result), {
-        status: result.valid ? 200 : 401,
-        headers: [["Content-Type", "application/json"]]
-      });
-    }
-    if (jwksUrl === path && request.method === "GET") {
-      const jwks = await fetchJwks();
-      return new Response(JSON.stringify(jwks), {
-        headers: [["Content-Type", "application/json"]]
-      });
-    }
-    if (refreshUrl === path && request.method === "POST") {
-      const tokenResponse = await refreshToken();
-      return new Response(JSON.stringify(tokenResponse), {
-        headers: [["Content-Type", "application/json"]]
-      });
-    }
-    return new Response("Not Found", { status: 404 });
-  }
-  return {
-    ...configWithDefaults ?? {},
-    getToken,
-    refreshToken,
-    generateJWTAssertion,
-    revokeToken,
-    validateToken,
-    getWorkload: getWorkload2,
-    parseJWT,
-    handler: handler2
-  };
-}
-
-// src/group-store.ts
-var InMemoryGroupStore = class {
-  constructor() {
-    /** Primary storage: id -> group */
-    this.groups = /* @__PURE__ */ new Map();
-    /** Secondary index: externalId -> id */
-    this.externalIdIndex = /* @__PURE__ */ new Map();
-    /** Secondary index: displayName (lowercase) -> id */
-    this.displayNameIndex = /* @__PURE__ */ new Map();
-  }
-  async get(id) {
-    return this.groups.get(id) ?? null;
-  }
-  async getByExternalId(externalId) {
-    const id = this.externalIdIndex.get(externalId);
-    if (!id) return null;
-    return this.groups.get(id) ?? null;
-  }
-  async getByDisplayName(displayName) {
-    const id = this.displayNameIndex.get(displayName.toLowerCase());
-    if (!id) return null;
-    return this.groups.get(id) ?? null;
-  }
-  async list() {
-    return Array.from(this.groups.values());
-  }
-  async upsert(group) {
-    const existing = this.groups.get(group.id);
-    if (existing) {
-      if (existing.externalId && existing.externalId !== group.externalId) {
-        this.externalIdIndex.delete(existing.externalId);
-      }
-      if (existing.displayName.toLowerCase() !== group.displayName.toLowerCase()) {
-        this.displayNameIndex.delete(existing.displayName.toLowerCase());
-      }
-    }
-    this.groups.set(group.id, group);
-    if (group.externalId) {
-      this.externalIdIndex.set(group.externalId, group.id);
-    }
-    this.displayNameIndex.set(group.displayName.toLowerCase(), group.id);
-  }
-  async delete(id) {
-    const group = this.groups.get(id);
-    if (group) {
-      if (group.externalId) {
-        this.externalIdIndex.delete(group.externalId);
-      }
-      this.displayNameIndex.delete(group.displayName.toLowerCase());
-    }
-    this.groups.delete(id);
-  }
-  async addMember(groupId, member) {
-    const group = this.groups.get(groupId);
-    if (!group) {
-      throw new Error(`Group ${groupId} not found`);
-    }
-    const members = group.members ?? [];
-    if (!members.some((m) => m.value === member.value)) {
-      members.push(member);
-      group.members = members;
-      group.updatedAt = /* @__PURE__ */ new Date();
-    }
-  }
-  async removeMember(groupId, memberId) {
-    const group = this.groups.get(groupId);
-    if (!group) {
-      throw new Error(`Group ${groupId} not found`);
-    }
-    if (group.members) {
-      group.members = group.members.filter((m) => m.value !== memberId);
-      group.updatedAt = /* @__PURE__ */ new Date();
-    }
-  }
-};
-
-// src/session-store.ts
-var InMemorySessionStore = class {
-  constructor() {
-    this.sessions = /* @__PURE__ */ new Map();
-  }
-  async create(session) {
-    if (this.sessions.has(session.sid)) {
-      throw new Error(`Session with sid ${session.sid} already exists`);
-    }
-    this.sessions.set(session.sid, session);
-  }
-  async get(sid) {
-    return this.sessions.get(sid) ?? null;
-  }
-  async update(sid, data) {
-    const session = this.sessions.get(sid);
-    if (!session) {
-      throw new Error(`Session with sid ${sid} not found`);
-    }
-    const updated = { ...session, ...data };
-    this.sessions.set(sid, updated);
-  }
-  async delete(sid) {
-    this.sessions.delete(sid);
-  }
-};
-
-// src/tenant.ts
-var TenantRequestError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TenantRequestError";
-  }
-};
-function serializeESConfig(configOrES) {
-  if (configOrES && typeof configOrES === "object" && "sso" in configOrES && "workload" in configOrES && "iam" in configOrES) {
-    const config2 = {
-      defaultInstance: configOrES.defaultInstance,
-      sso: configOrES.sso ? serializeESConfig(configOrES.sso) : void 0,
-      iam: configOrES.iam ? serializeESConfig(configOrES.iam) : void 0,
-      workload: configOrES.workload ? serializeESConfig(configOrES.workload) : void 0,
-      validation: configOrES.validation
-    };
-    return config2;
-  }
-  const config = configOrES;
-  if (config === null || config === void 0) {
-    return config;
-  }
-  if (typeof config !== "object") {
-    return config;
-  }
-  if (Array.isArray(config)) {
-    return config.map((item) => serializeESConfig(item));
-  }
-  const isStore = typeof config.get === "function" || typeof config.set === "function" || typeof config.create === "function" || typeof config.delete === "function" || typeof config.upsert === "function" || typeof config.list === "function";
-  const isValidator = config["~standard"] !== void 0;
-  if (typeof config === "function" || isStore || isValidator) {
-    return void 0;
-  }
-  if (config instanceof Date) {
-    return config.toISOString();
-  }
-  const serialized = {};
-  for (const key in config) {
-    if (Object.hasOwn(config, key)) {
-      if (key === "session_store" || key === "user_store" || key === "token_store" || key === "group_store" || key === "validation" || key === "vault" || // Skip vault instance
-      // Skip method properties from service instances
-      key === "getUser" || key === "getRequiredUser" || key === "getJwt" || key === "initiateLogin" || key === "logout" || key === "callbackHandler" || key === "handler" || key === "getToken" || key === "refreshToken" || key === "generateJWTAssertion" || key === "revokeToken" || key === "validateToken" || key === "getWorkload" || key === "parseJWT" || key === "createUser" || key === "getBaseUrl" || key === "groups_outbound" || key === "groups_inbound") {
-        continue;
-      }
-      const value = serializeESConfig(config[key]);
-      if (value !== void 0) {
-        serialized[key] = value;
-      }
-    }
-  }
-  return serialized;
-}
-async function parseTenantRequest(request) {
-  if (request.method !== "POST") {
-    throw new TenantRequestError("Only POST method is supported");
-  }
-  let body;
-  try {
-    body = await request.json();
-  } catch (_error) {
-    throw new TenantRequestError("Invalid JSON in request body");
-  }
-  if (typeof body !== "object" || body === null) {
-    throw new TenantRequestError("Request body must be an object");
-  }
-  const tenantRequest = body;
-  if (!tenantRequest.appId) {
-    throw new TenantRequestError("Missing required field: appId");
-  }
-  if (!tenantRequest.companyId) {
-    throw new TenantRequestError("Missing required field: companyId");
-  }
-  if (!tenantRequest.companyName) {
-    throw new TenantRequestError("Missing required field: companyName");
-  }
-  if (!tenantRequest.environmentType) {
-    throw new TenantRequestError("Missing required field: environmentType");
-  }
-  if (!tenantRequest.email) {
-    throw new TenantRequestError("Missing required field: email");
-  }
-  if (!tenantRequest.webhookUrl) {
-    throw new TenantRequestError("Missing required field: webhookUrl");
-  }
-  const validEnvironmentTypes = ["POC", "DEV", "QA", "PROD"];
-  if (!validEnvironmentTypes.includes(tenantRequest.environmentType)) {
-    throw new TenantRequestError(
-      `Invalid environmentType: ${tenantRequest.environmentType}. Must be one of: ${validEnvironmentTypes.join(", ")}`
-    );
-  }
-  try {
-    new URL(tenantRequest.webhookUrl);
-  } catch {
-    throw new TenantRequestError("Invalid webhookUrl: must be a valid URL");
-  }
-  const appId = tenantRequest.appId;
-  const companyId = tenantRequest.companyId;
-  const companyName = tenantRequest.companyName;
-  const environmentType = tenantRequest.environmentType;
-  const email = tenantRequest.email;
-  const webhookUrl = tenantRequest.webhookUrl;
-  return {
-    appId,
-    companyId,
-    companyName,
-    environmentType,
-    email,
-    webhookUrl
-  };
-}
-async function sendTenantWebhook(webhookUrl, payload) {
-  try {
-    const response = await fetch(webhookUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(payload)
-    });
-    if (!response.ok) {
-      console.error(`Failed to send webhook update: ${response.status} ${response.statusText}`);
-    }
-  } catch (error) {
-    console.error("Failed to send webhook update:", error);
-  }
-}
-var InMemoryTenantStore = class {
-  constructor() {
-    /** Primary storage: appId -> tenant */
-    this.tenants = /* @__PURE__ */ new Map();
-    /** Secondary index: companyId -> Set of appIds (since one company can have multiple apps) */
-    this.companyIdIndex = /* @__PURE__ */ new Map();
-  }
-  async get(appId) {
-    return this.tenants.get(appId) ?? null;
-  }
-  async getByCompanyId(companyId) {
-    const appIds = this.companyIdIndex.get(companyId);
-    if (!appIds || appIds.size === 0) return [];
-    const tenants = [];
-    for (const appId of appIds) {
-      const tenant = this.tenants.get(appId);
-      if (tenant) {
-        tenants.push(tenant);
-      }
-    }
-    return tenants;
-  }
-  async list() {
-    return Array.from(this.tenants.values());
-  }
-  async upsert(tenant) {
-    const existing = this.tenants.get(tenant.appId);
-    if (existing && existing.companyId !== tenant.companyId) {
-      const oldAppIds = this.companyIdIndex.get(existing.companyId);
-      if (oldAppIds) {
-        oldAppIds.delete(tenant.appId);
-        if (oldAppIds.size === 0) {
-          this.companyIdIndex.delete(existing.companyId);
-        }
-      }
-    }
-    this.tenants.set(tenant.appId, tenant);
-    let appIds = this.companyIdIndex.get(tenant.companyId);
-    if (!appIds) {
-      appIds = /* @__PURE__ */ new Set();
-      this.companyIdIndex.set(tenant.companyId, appIds);
-    }
-    appIds.add(tenant.appId);
-    return tenant;
-  }
-  async delete(appId) {
-    const tenant = this.tenants.get(appId);
-    if (tenant) {
-      const appIds = this.companyIdIndex.get(tenant.companyId);
-      if (appIds) {
-        appIds.delete(appId);
-        if (appIds.size === 0) {
-          this.companyIdIndex.delete(tenant.companyId);
-        }
-      }
-    }
-    this.tenants.delete(appId);
-  }
-};
-
-// src/workload-server.ts
-function unavailable(error) {
-  error = error ?? "Workload authentication unavailable";
-  new Response(JSON.stringify({ error }), {
-    status: 503,
-    statusText: error,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function getWorkload(request, es) {
-  const workloadAuth = getES(es)?.workload;
-  if (!workloadAuth) {
-    return void 0;
-  }
-  return workloadAuth.getWorkload(request);
-}
-async function getWorkloadToken(scope, es) {
-  const workloadAuth = getES(es)?.workload;
-  if (!workloadAuth) throw unavailable();
-  return workloadAuth.getToken(scope);
-}
-async function validateWorkloadToken(request, es) {
-  const workloadAuth = getES(es)?.workload;
-  if (!workloadAuth) {
-    return { valid: false, error: "Workload authentication unavailable" };
-  }
-  const authHeader = request.headers.get("Authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return { valid: false, error: "Missing or invalid Authorization header" };
-  }
-  const token = authHeader.substring(7);
-  return workloadAuth.validateToken(token);
-}
-async function revokeWorkloadToken(token, es) {
-  const workloadAuth = getES(es)?.workload;
-  if (!workloadAuth) throw unavailable();
-  return workloadAuth.revokeToken(token);
-}
-async function workloadHandler(request, es) {
-  const workloadAuth = getES(es)?.workload;
-  if (!workloadAuth) throw unavailable();
-  return workloadAuth.handler(request);
-}
-
-// src/sso-server.ts
-function unavailable2(error) {
-  error = error ?? "SSO Unavailable";
-  new Response(JSON.stringify({ error }), {
-    status: 503,
-    statusText: error,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-async function getUser(request, es) {
-  return getES(es)?.sso.getUser(request);
-}
-async function getRequiredUser(request, es) {
-  const sso2 = getES(es)?.sso;
-  if (!sso2) throw unavailable2();
-  return sso2.getRequiredUser(request);
-}
-async function initiateLogin(config, es) {
-  const sso2 = getES(es)?.sso;
-  if (!sso2) throw unavailable2();
-  return sso2.initiateLogin(config);
-}
-async function callback(request, es) {
-  const sso2 = getES(es)?.sso;
-  if (!sso2) throw unavailable2();
-  return sso2.callbackHandler(request);
-}
-async function handler(request, es) {
-  es = getES(es);
-  if (!es) throw unavailable2();
-  return es.sso.handler(request, es);
-}
-
-// src/ui/sign-in-loading.tsx
-import { Fragment, jsx } from "react/jsx-runtime";
-function SignInLoading({ complete = false, children }) {
-  const { isLoading } = useUser();
-  if (isLoading && !complete) return /* @__PURE__ */ jsx(Fragment, { children });
-  return null;
-}
-
-// src/ui/signed-in.tsx
-import { Fragment as Fragment2, jsx as jsx2 } from "react/jsx-runtime";
-function SignedIn({ children }) {
-  const { user } = useUser();
-  if (user) return /* @__PURE__ */ jsx2(Fragment2, { children });
-  return null;
-}
-
-// src/ui/signed-out.tsx
-import { Fragment as Fragment3, jsx as jsx3 } from "react/jsx-runtime";
-function SignedOut({ children }) {
-  const { user, isLoading } = useUser();
-  if (user || isLoading) return null;
-  return /* @__PURE__ */ jsx3(Fragment3, { children });
-}
-
-// src/ui/sso-provider.tsx
-import { createContext, useCallback, useContext, useEffect, useState } from "react";
-import { jsx as jsx4 } from "react/jsx-runtime";
-var CTX = createContext(void 0);
-var generateStorageKey = (tenantId) => {
-  return `es-sso-user-${tenantId.replace(/[^a-zA-Z0-9]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "")}`;
-};
-function SSOProvider({
-  tenantId,
-  storage = "memory",
-  storageKey,
-  userUrl,
-  tokenUrl,
-  refreshUrl,
-  disableListener = false,
-  children
-}) {
-  const [user, setUserState] = useState(null);
-  const [isLoading, setIsLoading] = useState(!!userUrl);
-  const actualStorageKey = storageKey || (tenantId ? generateStorageKey(tenantId) : "es-sso-user");
-  const isValidUser = useCallback(
-    (user2) => {
-      if (!user2 || !tenantId) return true;
-      return user2.sso?.tenant?.id === tenantId;
-    },
-    [tenantId]
-  );
-  const loadUserFromStorage = useCallback(() => {
-    if (storage === "memory" || typeof window === "undefined") return null;
-    try {
-      const storageObject = storage === "local" ? localStorage : sessionStorage;
-      const userData = storageObject.getItem(actualStorageKey);
-      if (!userData) return null;
-      const parsedUser = JSON.parse(userData);
-      if (parsedUser.sso?.expires) {
-        parsedUser.sso.expires = new Date(parsedUser.sso.expires);
-      }
-      return isValidUser(parsedUser) ? parsedUser : null;
-    } catch (error) {
-      console.error("Error loading user from storage:", error);
-      return null;
-    }
-  }, [storage, actualStorageKey, isValidUser]);
-  const saveUserToStorage = useCallback(
-    (user2) => {
-      if (storage === "memory" || typeof window === "undefined") return;
-      try {
-        const storageObject = storage === "local" ? localStorage : sessionStorage;
-        if (user2 === null) {
-          storageObject.removeItem(actualStorageKey);
-        } else {
-          storageObject.setItem(actualStorageKey, JSON.stringify(user2));
-        }
-      } catch (error) {
-        console.error("Error saving user to storage:", error);
-      }
-    },
-    [storage, actualStorageKey]
-  );
-  const setUser = useCallback(
-    (newUser) => {
-      if (newUser && !isValidUser(newUser)) return;
-      setUserState(newUser);
-      saveUserToStorage(newUser);
-    },
-    [isValidUser, saveUserToStorage]
-  );
-  const fetchUserFromUrl = useCallback(async () => {
-    if (!userUrl) return;
-    setIsLoading(true);
-    try {
-      const response = await fetch(userUrl);
-      if (response.status === 401) {
-        setUserState(null);
-        saveUserToStorage(null);
-        setIsLoading(false);
-        return;
-      }
-      if (!response.ok) {
-        throw new Error(`Failed to fetch user: ${response.status} ${response.statusText}`);
-      }
-      const userData = await response.json();
-      if (userData.sso?.expires && typeof userData.sso.expires === "string") {
-        userData.sso.expires = new Date(userData.sso.expires);
-      }
-      if (isValidUser(userData)) {
-        setUserState(userData);
-        saveUserToStorage(userData);
-      }
-    } catch (error) {
-      console.error("Error fetching user from URL:", error);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [userUrl, isValidUser, saveUserToStorage]);
-  useEffect(() => {
-    const storedUser = loadUserFromStorage();
-    if (storedUser) {
-      setUserState(storedUser);
-    }
-    if (userUrl) {
-      fetchUserFromUrl();
-    } else {
-      setIsLoading(false);
-    }
-  }, [loadUserFromStorage, userUrl, fetchUserFromUrl]);
-  useEffect(() => {
-    if (disableListener || storage === "memory") return;
-    const handleStorageChange = (event) => {
-      if (event.key !== actualStorageKey) return;
-      if (event.newValue === null) {
-        setUserState(null);
-      } else {
-        try {
-          const parsedUser = JSON.parse(event.newValue);
-          if (parsedUser.sso?.expires) {
-            parsedUser.sso.expires = new Date(parsedUser.sso.expires);
-          }
-          if (isValidUser(parsedUser)) {
-            setUserState(parsedUser);
-          }
-        } catch (error) {
-          console.error("Error parsing user from storage event:", error);
-        }
-      }
-    };
-    const handleLogout = () => {
-      setUserState(null);
-    };
-    window.addEventListener("storage", handleStorageChange);
-    window.addEventListener("es-sso-logout", handleLogout);
-    return () => {
-      window.removeEventListener("storage", handleStorageChange);
-      window.removeEventListener("es-sso-logout", handleLogout);
-    };
-  }, [disableListener, storage, actualStorageKey, isValidUser]);
-  const contextValue = {
-    user,
-    setUser,
-    isLoading,
-    tokenUrl,
-    refreshUrl
-  };
-  return /* @__PURE__ */ jsx4(CTX.Provider, { value: contextValue, children });
-}
-function useUser() {
-  const context = useContext(CTX);
-  if (context === void 0) {
-    throw new Error("useUser must be used within a SSOProvider");
-  }
-  return context;
-}
-function useToken() {
-  const context = useContext(CTX);
-  if (context === void 0) {
-    throw new Error("useToken must be used within a SSOProvider");
-  }
-  const { tokenUrl, refreshUrl } = context;
-  if (!tokenUrl || !refreshUrl) {
-    throw new Error('useToken requires that a "tokenUrl" and "refreshUrl" be set in the SSOProvider');
-  }
-  const [token, setToken] = useState(null);
-  const [expires, setExpires] = useState(null);
-  const [isLoading, setIsLoading] = useState(!!tokenUrl);
-  const [error, setError] = useState(null);
-  const fetchJwt = useCallback(
-    async (url) => {
-      setIsLoading(true);
-      setError(null);
-      try {
-        const response = await fetch(url);
-        if (response.status === 401) {
-          context.setUser(null);
-          setToken(null);
-          setExpires(null);
-          setIsLoading(false);
-          return;
-        }
-        if (!response.ok) {
-          throw new Error(`Failed to fetch JWT: ${response.status} ${response.statusText}`);
-        }
-        const data = await response.json();
-        setToken(data.token);
-        setExpires(new Date(data.expires));
-      } catch (err) {
-        const error2 = err instanceof Error ? err : new Error(String(err));
-        setError(error2);
-        setToken(null);
-        setExpires(null);
-        console.error("Error fetching JWT:", error2);
-      } finally {
-        setIsLoading(false);
-      }
-    },
-    [context]
-  );
-  const refresh = useCallback(async () => {
-    const url = refreshUrl || tokenUrl;
-    if (!url) {
-      console.warn("No tokenUrl or refreshUrl provided");
-      return;
-    }
-    await fetchJwt(url);
-  }, [refreshUrl, tokenUrl, fetchJwt]);
-  useEffect(() => {
-    if (!tokenUrl) {
-      setIsLoading(false);
-      return;
-    }
-    fetchJwt(tokenUrl);
-  }, [tokenUrl, fetchJwt]);
-  useEffect(() => {
-    if (!expires || !refreshUrl) return;
-    const checkExpiration = () => {
-      const now = /* @__PURE__ */ new Date();
-      const timeUntilExpiry = expires.getTime() - now.getTime();
-      if (timeUntilExpiry <= 6e4 && timeUntilExpiry > 0) {
-        refresh();
-      }
-    };
-    checkExpiration();
-    const interval = setInterval(checkExpiration, 3e4);
-    return () => clearInterval(interval);
-  }, [expires, refreshUrl, refresh]);
-  return {
-    token,
-    isLoading,
-    error,
-    refresh
-  };
-}
-async function logout(logoutUrl) {
-  try {
-    const response = await fetch(logoutUrl, {
-      headers: { Accept: "application/json" }
-    });
-    if (!response.ok) {
-      return { success: false, error: `HTTP ${response.status}` };
-    }
-    const data = await response.json();
-    if (!data.success) {
-      return { success: false, error: data.message || "Logout failed" };
-    }
-    if (typeof window !== "undefined") {
-      for (let i = localStorage.length - 1; i >= 0; i--) {
-        const key = localStorage.key(i);
-        if (key?.startsWith("es-sso-user")) {
-          localStorage.removeItem(key);
-        }
-      }
-      for (let i = sessionStorage.length - 1; i >= 0; i--) {
-        const key = sessionStorage.key(i);
-        if (key?.startsWith("es-sso-user")) {
-          sessionStorage.removeItem(key);
-        }
-      }
-      window.dispatchEvent(new CustomEvent("es-sso-logout"));
-    }
-    return { success: true };
-  } catch (error) {
-    return {
-      success: false,
-      error: error instanceof Error ? error.message : "Network error"
-    };
-  }
-}
-
-// src/user-store.ts
-var InMemoryUserStore = class {
-  constructor() {
-    /** Primary storage: sub -> user */
-    this.users = /* @__PURE__ */ new Map();
-    /** Secondary index: email -> sub */
-    this.emailIndex = /* @__PURE__ */ new Map();
-    /** Secondary index: userName -> sub */
-    this.userNameIndex = /* @__PURE__ */ new Map();
-  }
-  async get(sub) {
-    return this.users.get(sub) ?? null;
-  }
-  async getByEmail(email) {
-    const sub = this.emailIndex.get(email.toLowerCase());
-    if (!sub) return null;
-    return this.users.get(sub) ?? null;
-  }
-  async getByUserName(userName) {
-    const sub = this.userNameIndex.get(userName.toLowerCase());
-    if (!sub) return null;
-    return this.users.get(sub) ?? null;
-  }
-  async upsert(user) {
-    const existing = this.users.get(user.id);
-    if (existing) {
-      if (existing.email && existing.email.toLowerCase() !== user.email?.toLowerCase()) {
-        this.emailIndex.delete(existing.email.toLowerCase());
-      }
-      if (existing.userName && existing.userName.toLowerCase() !== user.userName?.toLowerCase()) {
-        this.userNameIndex.delete(existing.userName.toLowerCase());
-      }
-    }
-    this.users.set(user.id, user);
-    if (user.email) {
-      this.emailIndex.set(user.email.toLowerCase(), user.id);
-    }
-    if (user.userName) {
-      this.userNameIndex.set(user.userName.toLowerCase(), user.id);
-    }
-  }
-  async delete(sub) {
-    const user = this.users.get(sub);
-    if (user) {
-      if (user.email) {
-        this.emailIndex.delete(user.email.toLowerCase());
-      }
-      if (user.userName) {
-        this.userNameIndex.delete(user.userName.toLowerCase());
-      }
-    }
-    this.users.delete(sub);
-  }
-};
-
-// src/index.ts
-function extractSsoValidation(validation) {
-  if (!validation) return void 0;
-  const val = validation;
-  if (val.callbackParams || val.idTokenClaims || val.tokenResponse) {
-    return val;
-  }
-  if (typeof val === "object" && "sso" in val) {
-    return val.sso;
-  }
-  return void 0;
-}
-function extractWorkloadValidation(validation) {
-  if (!validation) return void 0;
-  const val = validation;
-  if (val.jwtAssertionClaims || val.tokenResponse) {
-    return val;
-  }
-  if (typeof val === "object" && "workload" in val) {
-    return val.workload;
-  }
-  return void 0;
-}
-async function enterpriseStandard(appId, initConfig) {
-  const ioniteUrl = process.env.IONITE_URL ?? "https://ionite.com";
-  let vaultUrl = process.env.ES_VAULT_URL;
-  const vaultToken = process.env.ES_VAULT_TOKEN;
-  const vaultPath = process.env.ES_VAULT_PATH;
-  let secret;
-  if (appId?.startsWith("IONITE_PUBLIC_DEMO_") && !vaultUrl) {
-    vaultUrl = "https://vault-ionite.ionite.dev/v1/secret/data";
-    secret = {
-      path: `public/${appId}`,
-      token: "hvs.VGhD2hmXDH9PmZjTacZx0G5K"
-    };
-  } else if (vaultUrl && vaultToken && vaultPath) {
-    secret = {
-      path: vaultPath,
-      token: vaultToken
-    };
-  } else if (!vaultUrl || !vaultToken || !vaultPath) {
-    const msg = "@enterprisestandard configuration missing.";
-    if (process.env.NODE_ENV === "development") {
-      const cmd = `${process.versions.bun ? "bun" : "npm"} ionite login --app ${appId}`;
-      console.warn(
-        `${msg} For development, login with the ionite CLI using "${cmd}" or visit ${ioniteUrl}/api/applications/apiKeys/create?appId=${appId}.`
-      );
-      const wl = workload(void 0);
-      return {
-        defaultInstance: false,
-        vault: vault(""),
-        sso: sso(void 0),
-        iam: iam({}, wl),
-        workload: wl
-      };
-    } else {
-      throw new Error(
-        `${msg} Ensure that you are deployed with the correct tenant pattern for process.env.NODE_ENV=${process.env.NODE_ENV}.`
-      );
-    }
-  }
-  const defaultInstance2 = getDefaultInstance();
-  const vaultClient = vault(vaultUrl);
-  const ssoValidation = extractSsoValidation(initConfig?.validation);
-  const workloadValidation = extractWorkloadValidation(initConfig?.validation);
-  let vaultData = {};
-  if (secret) {
-    vaultData = await vaultClient.getSecret(secret.path, secret.token);
-  }
-  const workloadConfig = {
-    ...vaultData.workload,
-    // Base from vault (includes jwks_uri, token_url, etc.)
-    ...initConfig?.workload,
-    // Override with initConfig (if provided) - only overrides explicit properties
-    // Ensure critical vault fields are preserved if not overridden
-    jwks_uri: initConfig?.workload?.jwks_uri ?? vaultData.workload?.jwks_uri,
-    token_url: initConfig?.workload?.token_url ?? vaultData.workload?.token_url,
-    validation: initConfig?.workload?.validation ?? workloadValidation
-    // Apply validation defaults
-  };
-  const workloadInstance = workload(workloadConfig);
-  const ssoConfig = {
-    ...vaultData.sso,
-    // Base from vault
-    ...initConfig?.sso,
-    // Override with initConfig (if provided)
-    validation: initConfig?.sso?.validation ?? ssoValidation
-    // Apply validation defaults
-  };
-  const ssoInstance = sso(ssoConfig);
-  const iamConfig = {
-    ...vaultData.iam,
-    // Base from vault
-    ...initConfig?.iam
-    // Override with initConfig (if provided)
-  };
-  const iamInstance = iam(iamConfig, workloadInstance);
-  const mergedConfig = {
-    defaultInstance: initConfig?.defaultInstance,
-    sso: ssoConfig,
-    iam: iamConfig,
-    workload: workloadConfig,
-    validation: initConfig?.validation
-  };
-  const result = {
-    ...mergedConfig,
-    defaultInstance: initConfig?.defaultInstance || initConfig?.defaultInstance !== false && !defaultInstance2,
-    vault: vaultClient,
-    sso: ssoInstance,
-    iam: iamInstance,
-    workload: workloadInstance
-  };
-  if (result.defaultInstance) {
-    if (defaultInstance2) {
-      defaultInstance2.defaultInstance = false;
-    }
-    setDefaultInstance(result);
-  }
-  return result;
-}
-export {
-  InMemoryGroupStore,
-  InMemorySessionStore,
-  InMemoryTenantStore,
-  InMemoryUserStore,
-  InMemoryWorkloadTokenStore,
-  SSOProvider,
-  SignInLoading,
-  SignedIn,
-  SignedOut,
-  TenantRequestError,
-  callback,
-  enterpriseStandard,
-  getDefaultInstance,
-  getRequiredUser,
-  getUser,
-  getWorkload,
-  getWorkloadToken,
-  groupResourceSchema,
-  handler,
-  iam,
-  idTokenClaimsSchema,
-  initiateLogin,
-  jwtAssertionClaimsSchema,
-  logout,
-  oidcCallbackSchema,
-  parseTenantRequest,
-  revokeWorkloadToken,
-  sendTenantWebhook,
-  serializeESConfig,
-  sso,
-  tokenResponseSchema,
-  useToken,
-  useUser,
-  userSchema,
-  validateWorkloadToken,
-  vault,
-  workload,
-  workloadHandler,
-  workloadTokenResponseSchema
-};
-//# sourceMappingURL=index.js.map
+import{createContext as p,useCallback as $,useContext as w,useEffect as T,useState as m}from"react";import{jsxDEV as c}from"react/jsx-dev-runtime";var b=p(void 0),E=(R)=>{return`es-sso-user-${R.replace(/[^a-zA-Z0-9]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"")}`};function k({tenantId:R,storage:P="memory",storageKey:A,userUrl:q,tokenUrl:H,refreshUrl:C,disableListener:X=!1,children:f}){let[J,Q]=m(null),[F,Y]=m(!!q),M=A||(R?E(R):"es-sso-user"),z=$((W)=>{if(!W||!R)return!0;return W.sso?.tenant?.id===R},[R]),B=$(()=>{if(P==="memory"||typeof window>"u")return null;try{let N=(P==="local"?localStorage:sessionStorage).getItem(M);if(!N)return null;let Z=JSON.parse(N);if(Z.sso?.expires)Z.sso.expires=new Date(Z.sso.expires);return z(Z)?Z:null}catch(W){return console.error("Error loading user from storage:",W),null}},[P,M,z]),G=$((W)=>{if(P==="memory"||typeof window>"u")return;try{let N=P==="local"?localStorage:sessionStorage;if(W===null)N.removeItem(M);else N.setItem(M,JSON.stringify(W))}catch(N){console.error("Error saving user to storage:",N)}},[P,M]),K=$((W)=>{if(W&&!z(W))return;Q(W),G(W)},[z,G]),j=$(async()=>{if(!q)return;Y(!0);try{let W=await fetch(q);if(W.status===401){Q(null),G(null),Y(!1);return}if(!W.ok)throw Error(`Failed to fetch user: ${W.status} ${W.statusText}`);let N=await W.json();if(N.sso?.expires&&typeof N.sso.expires==="string")N.sso.expires=new Date(N.sso.expires);if(z(N))Q(N),G(N)}catch(W){console.error("Error fetching user from URL:",W)}finally{Y(!1)}},[q,z,G]);T(()=>{let W=B();if(W)Q(W);if(q)j();else Y(!1)},[B,q,j]),T(()=>{if(X||P==="memory")return;let W=(Z)=>{if(Z.key!==M)return;if(Z.newValue===null)Q(null);else try{let _=JSON.parse(Z.newValue);if(_.sso?.expires)_.sso.expires=new Date(_.sso.expires);if(z(_))Q(_)}catch(_){console.error("Error parsing user from storage event:",_)}},N=()=>{Q(null)};return window.addEventListener("storage",W),window.addEventListener("es-sso-logout",N),()=>{window.removeEventListener("storage",W),window.removeEventListener("es-sso-logout",N)}},[X,P,M,z]);let I={user:J,setUser:K,isLoading:F,tokenUrl:H,refreshUrl:C};return c(b.Provider,{value:I,children:f},void 0,!1,void 0,this)}function O(){let R=w(b);if(R===void 0)throw Error("useUser must be used within a SSOProvider");return R}function S(){let R=w(b);if(R===void 0)throw Error("useToken must be used within a SSOProvider");let{tokenUrl:P,refreshUrl:A}=R;if(!P||!A)throw Error('useToken requires that a "tokenUrl" and "refreshUrl" be set in the SSOProvider');let[q,H]=m(null),[C,X]=m(null),[f,J]=m(!!P),[Q,F]=m(null),Y=$(async(z)=>{J(!0),F(null);try{let B=await fetch(z);if(B.status===401){R.setUser(null),H(null),X(null),J(!1);return}if(!B.ok)throw Error(`Failed to fetch JWT: ${B.status} ${B.statusText}`);let G=await B.json();H(G.token),X(new Date(G.expires))}catch(B){let G=B instanceof Error?B:Error(String(B));F(G),H(null),X(null),console.error("Error fetching JWT:",G)}finally{J(!1)}},[R]),M=$(async()=>{let z=A||P;if(!z){console.warn("No tokenUrl or refreshUrl provided");return}await Y(z)},[A,P,Y]);return T(()=>{if(!P){J(!1);return}Y(P)},[P,Y]),T(()=>{if(!C||!A)return;let z=()=>{let G=new Date,K=C.getTime()-G.getTime();if(K<=60000&&K>0)M()};z();let B=setInterval(z,30000);return()=>clearInterval(B)},[C,A,M]),{token:q,isLoading:f,error:Q,refresh:M}}async function x(R){try{let P=await fetch(R,{headers:{Accept:"application/json"}});if(!P.ok)return{success:!1,error:`HTTP ${P.status}`};let A=await P.json();if(!A.success)return{success:!1,error:A.message||"Logout failed"};if(typeof window<"u"){for(let q=localStorage.length-1;q>=0;q--){let H=localStorage.key(q);if(H?.startsWith("es-sso-user"))localStorage.removeItem(H)}for(let q=sessionStorage.length-1;q>=0;q--){let H=sessionStorage.key(q);if(H?.startsWith("es-sso-user"))sessionStorage.removeItem(H)}window.dispatchEvent(new CustomEvent("es-sso-logout"))}return{success:!0}}catch(P){return{success:!1,error:P instanceof Error?P.message:"Network error"}}}import{jsxDEV as L,Fragment as y}from"react/jsx-dev-runtime";function i({complete:R=!1,children:P}){let{isLoading:A}=O();if(A&&!R)return L(y,{children:P},void 0,!1,void 0,this);return L(y,{},void 0,!1,void 0,this)}import{jsxDEV as V,Fragment as h}from"react/jsx-dev-runtime";function d({children:R}){let{user:P}=O();if(P)return V(h,{children:R},void 0,!1,void 0,this);return V(h,{},void 0,!1,void 0,this)}import{jsxDEV as v,Fragment as D}from"react/jsx-dev-runtime";function g({children:R}){let{user:P,isLoading:A}=O();if(P||A)return v(D,{},void 0,!1,void 0,this);return v(D,{children:R},void 0,!1,void 0,this)}export{O as useUser,S as useToken,x as logout,g as SignedOut,d as SignedIn,i as SignInLoading,k as SSOProvider};