@happyvertical/directory 0.74.8

package/dist/index.js

@@ -0,0 +1,1942 @@
+import { IAMClient, ListUsersCommand, CreateUserCommand, GetUserCommand, UpdateUserCommand, DeleteUserCommand, CreateGroupCommand, GetGroupCommand, DeleteGroupCommand, ListGroupsCommand, AddUserToGroupCommand, RemoveUserFromGroupCommand, ListGroupsForUserCommand, AttachUserPolicyCommand, DetachUserPolicyCommand, CreateAccessKeyCommand, DeleteAccessKeyCommand } from "@aws-sdk/client-iam";
+import { OrganizationsClient, CreateOrganizationalUnitCommand, DescribeOrganizationalUnitCommand, ListOrganizationalUnitsForParentCommand, CreateAccountCommand, DescribeCreateAccountStatusCommand, ListAccountsCommand, MoveAccountCommand } from "@aws-sdk/client-organizations";
+import pg from "pg";
+class DirectoryError extends Error {
+  code;
+  provider;
+  cause;
+  constructor(message, code, provider, cause) {
+    super(message);
+    this.name = "DirectoryError";
+    this.code = code;
+    this.provider = provider;
+    this.cause = cause;
+  }
+}
+class ConnectionError extends DirectoryError {
+  constructor(message, provider, cause) {
+    super(message, "CONNECTION_ERROR", provider, cause);
+    this.name = "ConnectionError";
+  }
+}
+class AuthenticationError extends DirectoryError {
+  constructor(message, provider, cause) {
+    super(message, "AUTHENTICATION_ERROR", provider, cause);
+    this.name = "AuthenticationError";
+  }
+}
+class NotFoundError extends DirectoryError {
+  resourceType;
+  resourceId;
+  constructor(resourceType, resourceId, provider, cause) {
+    super(
+      `${resourceType} not found: ${resourceId}`,
+      "NOT_FOUND",
+      provider,
+      cause
+    );
+    this.name = "NotFoundError";
+    this.resourceType = resourceType;
+    this.resourceId = resourceId;
+  }
+}
+class ConflictError extends DirectoryError {
+  resourceType;
+  resourceId;
+  constructor(resourceType, resourceId, provider, cause) {
+    super(
+      `${resourceType} already exists: ${resourceId}`,
+      "CONFLICT",
+      provider,
+      cause
+    );
+    this.name = "ConflictError";
+    this.resourceType = resourceType;
+    this.resourceId = resourceId;
+  }
+}
+class ValidationError extends DirectoryError {
+  constructor(message, provider, cause) {
+    super(message, "VALIDATION_ERROR", provider, cause);
+    this.name = "ValidationError";
+  }
+}
+class RateLimitError extends DirectoryError {
+  retryAfter;
+  constructor(provider, retryAfter) {
+    super(
+      `Rate limit exceeded${retryAfter ? ` (retry after ${retryAfter}s)` : ""}`,
+      "RATE_LIMIT",
+      provider
+    );
+    this.name = "RateLimitError";
+    this.retryAfter = retryAfter;
+  }
+}
+function handleAwsError(error, context) {
+  if (error instanceof AuthenticationError || error instanceof ConnectionError || error instanceof NotFoundError || error instanceof ConflictError || error instanceof DirectoryError) {
+    throw error;
+  }
+  const awsError = error;
+  const name = awsError.name ?? "";
+  const message = awsError.message ?? String(error);
+  switch (name) {
+    case "EntityAlreadyExistsException":
+    case "DuplicateOrganizationalUnitException":
+      throw new ConflictError("resource", context, "aws", error);
+    case "NoSuchEntityException":
+    case "OrganizationalUnitNotFoundException":
+    case "AccountNotFoundException":
+      throw new NotFoundError("resource", context, "aws", error);
+    case "AccessDeniedException":
+    case "InvalidClientTokenId":
+    case "UnrecognizedClientException":
+    case "InvalidAccessKeyId":
+      throw new AuthenticationError(`${context}: ${message}`, "aws", error);
+    default:
+      throw new DirectoryError(
+        `${context}: ${message}`,
+        "AWS_ERROR",
+        "aws",
+        error
+      );
+  }
+}
+function mapIamUserToDirectoryUser(user) {
+  const displayNameTag = user.Tags?.find((t) => t.Key === "DisplayName");
+  const emailTag = user.Tags?.find((t) => t.Key === "Email");
+  return {
+    id: user.UserName ?? "",
+    username: user.UserName ?? "",
+    displayName: displayNameTag?.Value,
+    email: emailTag?.Value,
+    active: true,
+    metadata: {
+      arn: user.Arn,
+      userId: user.UserId,
+      createDate: user.CreateDate?.toISOString()
+    }
+  };
+}
+function mapIamGroupToDirectoryGroup(group) {
+  return {
+    id: group.GroupName ?? "",
+    name: group.GroupName ?? "",
+    metadata: {
+      arn: group.Arn,
+      groupId: group.GroupId,
+      createDate: group.CreateDate?.toISOString()
+    }
+  };
+}
+function mapIamUserToAwsIamUser(user) {
+  return {
+    username: user.UserName ?? "",
+    arn: user.Arn,
+    userId: user.UserId,
+    createDate: user.CreateDate
+  };
+}
+class AwsAdapter {
+  constructor(options) {
+    this.options = options;
+    const clientConfig = {
+      region: options.region,
+      ...options.credentials ? { credentials: options.credentials } : {}
+    };
+    this.orgs = new OrganizationsClient(clientConfig);
+    this.iam = new IAMClient(clientConfig);
+  }
+  orgs;
+  iam;
+  // ==========================================================================
+  // Connection
+  // ==========================================================================
+  async testConnection() {
+    try {
+      await this.iam.send(new ListUsersCommand({ MaxItems: 1 }));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async disconnect() {
+  }
+  // ==========================================================================
+  // User CRUD (DirectoryAdapter -> IAM Users)
+  // ==========================================================================
+  async createUser(input) {
+    try {
+      const tags = [];
+      if (input.displayName) {
+        tags.push({ Key: "DisplayName", Value: input.displayName });
+      }
+      if (input.email) {
+        tags.push({ Key: "Email", Value: input.email });
+      }
+      const result = await this.iam.send(
+        new CreateUserCommand({
+          UserName: input.username,
+          ...tags.length > 0 ? { Tags: tags } : {}
+        })
+      );
+      return mapIamUserToDirectoryUser({
+        ...result.User,
+        Tags: tags
+      });
+    } catch (error) {
+      handleAwsError(error, `createUser(${input.username})`);
+    }
+  }
+  async getUser(id) {
+    try {
+      const result = await this.iam.send(new GetUserCommand({ UserName: id }));
+      return mapIamUserToDirectoryUser(result.User ?? {});
+    } catch (error) {
+      handleAwsError(error, `getUser(${id})`);
+    }
+  }
+  async updateUser(id, _input) {
+    try {
+      await this.iam.send(new UpdateUserCommand({ UserName: id }));
+      return this.getUser(id);
+    } catch (error) {
+      handleAwsError(error, `updateUser(${id})`);
+    }
+  }
+  async deleteUser(id) {
+    try {
+      await this.iam.send(new DeleteUserCommand({ UserName: id }));
+    } catch (error) {
+      handleAwsError(error, `deleteUser(${id})`);
+    }
+  }
+  async listUsers() {
+    try {
+      const result = await this.iam.send(new ListUsersCommand({}));
+      return (result.Users ?? []).map((u) => mapIamUserToDirectoryUser(u));
+    } catch (error) {
+      handleAwsError(error, "listUsers");
+    }
+  }
+  // ==========================================================================
+  // Group CRUD (DirectoryAdapter -> IAM Groups)
+  // ==========================================================================
+  async createGroup(input) {
+    try {
+      const result = await this.iam.send(
+        new CreateGroupCommand({ GroupName: input.name })
+      );
+      const group = mapIamGroupToDirectoryGroup(result.Group ?? {});
+      if (input.members) {
+        for (const memberId of input.members) {
+          await this.addUserToGroup(memberId, input.name);
+        }
+      }
+      return group;
+    } catch (error) {
+      handleAwsError(error, `createGroup(${input.name})`);
+    }
+  }
+  async getGroup(id) {
+    try {
+      const result = await this.iam.send(
+        new GetGroupCommand({ GroupName: id })
+      );
+      const group = mapIamGroupToDirectoryGroup(result.Group ?? {});
+      group.members = (result.Users ?? []).map((u) => u.UserName ?? "");
+      return group;
+    } catch (error) {
+      handleAwsError(error, `getGroup(${id})`);
+    }
+  }
+  async updateGroup(id, _input) {
+    return this.getGroup(id);
+  }
+  async deleteGroup(id) {
+    try {
+      await this.iam.send(new DeleteGroupCommand({ GroupName: id }));
+    } catch (error) {
+      handleAwsError(error, `deleteGroup(${id})`);
+    }
+  }
+  async listGroups() {
+    try {
+      const result = await this.iam.send(new ListGroupsCommand({}));
+      return (result.Groups ?? []).map((g) => mapIamGroupToDirectoryGroup(g));
+    } catch (error) {
+      handleAwsError(error, "listGroups");
+    }
+  }
+  // ==========================================================================
+  // Membership
+  // ==========================================================================
+  async addUserToGroup(userId, groupId) {
+    try {
+      await this.iam.send(
+        new AddUserToGroupCommand({
+          UserName: userId,
+          GroupName: groupId
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `addUserToGroup(${userId}, ${groupId})`);
+    }
+  }
+  async removeUserFromGroup(userId, groupId) {
+    try {
+      await this.iam.send(
+        new RemoveUserFromGroupCommand({
+          UserName: userId,
+          GroupName: groupId
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `removeUserFromGroup(${userId}, ${groupId})`);
+    }
+  }
+  async getGroupMembers(groupId) {
+    try {
+      const result = await this.iam.send(
+        new GetGroupCommand({ GroupName: groupId })
+      );
+      return (result.Users ?? []).map((u) => mapIamUserToDirectoryUser(u));
+    } catch (error) {
+      handleAwsError(error, `getGroupMembers(${groupId})`);
+    }
+  }
+  async getUserGroups(userId) {
+    try {
+      const result = await this.iam.send(
+        new ListGroupsForUserCommand({ UserName: userId })
+      );
+      return (result.Groups ?? []).map((g) => mapIamGroupToDirectoryGroup(g));
+    } catch (error) {
+      handleAwsError(error, `getUserGroups(${userId})`);
+    }
+  }
+  // ==========================================================================
+  // Organizational Units (AwsDirectoryAdapter)
+  // ==========================================================================
+  async createOrganizationalUnit(input) {
+    try {
+      const result = await this.orgs.send(
+        new CreateOrganizationalUnitCommand({
+          ParentId: input.parentId,
+          Name: input.name
+        })
+      );
+      const ou = result.OrganizationalUnit;
+      return {
+        id: ou?.Id ?? "",
+        name: ou?.Name ?? "",
+        arn: ou?.Arn,
+        parentId: input.parentId
+      };
+    } catch (error) {
+      handleAwsError(error, `createOrganizationalUnit(${input.name})`);
+    }
+  }
+  async getOrganizationalUnit(id) {
+    try {
+      const result = await this.orgs.send(
+        new DescribeOrganizationalUnitCommand({
+          OrganizationalUnitId: id
+        })
+      );
+      const ou = result.OrganizationalUnit;
+      return {
+        id: ou?.Id ?? "",
+        name: ou?.Name ?? "",
+        arn: ou?.Arn
+      };
+    } catch (error) {
+      handleAwsError(error, `getOrganizationalUnit(${id})`);
+    }
+  }
+  async listOrganizationalUnits(parentId) {
+    try {
+      const result = await this.orgs.send(
+        new ListOrganizationalUnitsForParentCommand({
+          ParentId: parentId
+        })
+      );
+      return (result.OrganizationalUnits ?? []).map((ou) => ({
+        id: ou.Id ?? "",
+        name: ou.Name ?? "",
+        arn: ou.Arn,
+        parentId
+      }));
+    } catch (error) {
+      handleAwsError(error, `listOrganizationalUnits(${parentId})`);
+    }
+  }
+  // ==========================================================================
+  // Accounts (AwsDirectoryAdapter)
+  // ==========================================================================
+  async createAccount(input) {
+    try {
+      const result = await this.orgs.send(
+        new CreateAccountCommand({
+          AccountName: input.name,
+          Email: input.email,
+          ...input.roleName ? { RoleName: input.roleName } : {}
+        })
+      );
+      const status = result.CreateAccountStatus;
+      return {
+        id: status?.Id ?? "",
+        accountId: status?.AccountId,
+        state: status?.State ?? "IN_PROGRESS",
+        failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
+      };
+    } catch (error) {
+      handleAwsError(error, `createAccount(${input.name})`);
+    }
+  }
+  async getAccountCreationStatus(id) {
+    try {
+      const result = await this.orgs.send(
+        new DescribeCreateAccountStatusCommand({
+          CreateAccountRequestId: id
+        })
+      );
+      const status = result.CreateAccountStatus;
+      return {
+        id: status?.Id ?? "",
+        accountId: status?.AccountId,
+        state: status?.State ?? "IN_PROGRESS",
+        failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
+      };
+    } catch (error) {
+      handleAwsError(error, `getAccountCreationStatus(${id})`);
+    }
+  }
+  async listAccounts() {
+    try {
+      const result = await this.orgs.send(new ListAccountsCommand({}));
+      return (result.Accounts ?? []).map((a) => ({
+        id: a.Id ?? "",
+        name: a.Name ?? "",
+        email: a.Email ?? "",
+        arn: a.Arn,
+        status: a.Status ? String(a.Status) : void 0
+      }));
+    } catch (error) {
+      handleAwsError(error, "listAccounts");
+    }
+  }
+  async moveAccount(accountId, sourceParentId, destParentId) {
+    try {
+      await this.orgs.send(
+        new MoveAccountCommand({
+          AccountId: accountId,
+          SourceParentId: sourceParentId,
+          DestinationParentId: destParentId
+        })
+      );
+    } catch (error) {
+      handleAwsError(
+        error,
+        `moveAccount(${accountId}, ${sourceParentId} -> ${destParentId})`
+      );
+    }
+  }
+  // ==========================================================================
+  // IAM Users (AwsDirectoryAdapter)
+  // ==========================================================================
+  async createIamUser(input) {
+    try {
+      const result = await this.iam.send(
+        new CreateUserCommand({
+          UserName: input.username,
+          ...input.path ? { Path: input.path } : {}
+        })
+      );
+      return mapIamUserToAwsIamUser(result.User ?? {});
+    } catch (error) {
+      handleAwsError(error, `createIamUser(${input.username})`);
+    }
+  }
+  async getIamUser(username) {
+    try {
+      const result = await this.iam.send(
+        new GetUserCommand({ UserName: username })
+      );
+      return mapIamUserToAwsIamUser(result.User ?? {});
+    } catch (error) {
+      handleAwsError(error, `getIamUser(${username})`);
+    }
+  }
+  async deleteIamUser(username) {
+    try {
+      await this.iam.send(new DeleteUserCommand({ UserName: username }));
+    } catch (error) {
+      handleAwsError(error, `deleteIamUser(${username})`);
+    }
+  }
+  async listIamUsers() {
+    try {
+      const result = await this.iam.send(new ListUsersCommand({}));
+      return (result.Users ?? []).map((u) => mapIamUserToAwsIamUser(u));
+    } catch (error) {
+      handleAwsError(error, "listIamUsers");
+    }
+  }
+  // ==========================================================================
+  // IAM Policies (AwsDirectoryAdapter)
+  // ==========================================================================
+  async attachUserPolicy(username, policyArn) {
+    try {
+      await this.iam.send(
+        new AttachUserPolicyCommand({
+          UserName: username,
+          PolicyArn: policyArn
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `attachUserPolicy(${username}, ${policyArn})`);
+    }
+  }
+  async detachUserPolicy(username, policyArn) {
+    try {
+      await this.iam.send(
+        new DetachUserPolicyCommand({
+          UserName: username,
+          PolicyArn: policyArn
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `detachUserPolicy(${username}, ${policyArn})`);
+    }
+  }
+  // ==========================================================================
+  // Access Keys (AwsDirectoryAdapter)
+  // ==========================================================================
+  async createAccessKey(username) {
+    try {
+      const result = await this.iam.send(
+        new CreateAccessKeyCommand({ UserName: username })
+      );
+      const key = result.AccessKey;
+      return {
+        accessKeyId: key?.AccessKeyId ?? "",
+        secretAccessKey: key?.SecretAccessKey ?? "",
+        username: key?.UserName ?? username,
+        createDate: key?.CreateDate
+      };
+    } catch (error) {
+      handleAwsError(error, `createAccessKey(${username})`);
+    }
+  }
+  async deleteAccessKey(username, accessKeyId) {
+    try {
+      await this.iam.send(
+        new DeleteAccessKeyCommand({
+          UserName: username,
+          AccessKeyId: accessKeyId
+        })
+      );
+    } catch (error) {
+      handleAwsError(error, `deleteAccessKey(${username}, ${accessKeyId})`);
+    }
+  }
+}
+const aws = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  AwsAdapter
+}, Symbol.toStringTag, { value: "Module" }));
+class KanidmAdapter {
+  constructor(options) {
+    this.options = options;
+    if (!options.apiToken && (!options.adminUsername || !options.adminPassword)) {
+      throw new ValidationError(
+        "KanidmAdapter requires either apiToken or both adminUsername and adminPassword",
+        "kanidm"
+      );
+    }
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.timeout = options.timeout ?? 3e4;
+  }
+  baseUrl;
+  timeout;
+  adminToken = null;
+  adminTokenExpiry = 0;
+  // ==========================================================================
+  // Authentication
+  // ==========================================================================
+  async getAdminToken() {
+    if (this.options.apiToken) {
+      return this.options.apiToken;
+    }
+    if (this.adminToken && Date.now() < this.adminTokenExpiry) {
+      return this.adminToken;
+    }
+    const authUrl = `${this.baseUrl}/v1/auth`;
+    const initResponse = await fetch(authUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        step: {
+          init2: {
+            username: this.options.adminUsername,
+            issue: "token",
+            privileged: true
+          }
+        }
+      }),
+      signal: AbortSignal.timeout(this.timeout)
+    });
+    if (!initResponse.ok) {
+      throw new AuthenticationError(
+        "Failed to initialize admin authentication",
+        "kanidm"
+      );
+    }
+    const cookies = initResponse.headers.get("set-cookie");
+    const beginResponse = await fetch(authUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...cookies ? { Cookie: cookies } : {}
+      },
+      body: JSON.stringify({ step: { begin: "password" } }),
+      signal: AbortSignal.timeout(this.timeout)
+    });
+    if (!beginResponse.ok) {
+      throw new AuthenticationError(
+        "Failed to begin password authentication",
+        "kanidm"
+      );
+    }
+    const credResponse = await fetch(authUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...cookies ? { Cookie: cookies } : {}
+      },
+      body: JSON.stringify({
+        step: { cred: { password: this.options.adminPassword } }
+      }),
+      signal: AbortSignal.timeout(this.timeout)
+    });
+    if (!credResponse.ok) {
+      throw new AuthenticationError("Invalid admin credentials", "kanidm");
+    }
+    const result = await credResponse.json();
+    const token = result.state?.success || result.token;
+    if (!token) {
+      throw new AuthenticationError("Failed to obtain admin token", "kanidm");
+    }
+    this.adminToken = token;
+    this.adminTokenExpiry = Date.now() + 36e5;
+    return this.adminToken;
+  }
+  // ==========================================================================
+  // HTTP Helper
+  // ==========================================================================
+  async request(method, path, body) {
+    const token = await this.getAdminToken();
+    const url = `${this.baseUrl}${path}`;
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`
+        },
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
+        signal: AbortSignal.timeout(this.timeout)
+      });
+    } catch (error) {
+      if (error instanceof TypeError) {
+        throw new ConnectionError(
+          `Failed to connect to Kanidm at ${this.baseUrl}`,
+          "kanidm",
+          error
+        );
+      }
+      throw error;
+    }
+    if (response.ok) {
+      const text = await response.text();
+      if (!text) return void 0;
+      return JSON.parse(text);
+    }
+    const errorBody = await response.text().catch(() => "");
+    switch (response.status) {
+      case 401:
+      case 403:
+        this.adminToken = null;
+        this.adminTokenExpiry = 0;
+        throw new AuthenticationError(
+          errorBody || `Authentication failed: ${response.status}`,
+          "kanidm"
+        );
+      case 404:
+        throw new NotFoundError("resource", path, "kanidm");
+      case 409:
+        throw new ConflictError("resource", path, "kanidm");
+      default:
+        throw new DirectoryError(
+          errorBody || `Request failed: ${response.status} ${response.statusText}`,
+          "REQUEST_ERROR",
+          "kanidm"
+        );
+    }
+  }
+  // ==========================================================================
+  // Mapping Helpers
+  // ==========================================================================
+  mapPersonToUser(data) {
+    const attrs = data.attrs;
+    return {
+      id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "name") ?? "",
+      username: this.attrFirst(attrs, "name") ?? "",
+      displayName: this.attrFirst(attrs, "displayname"),
+      email: this.attrFirst(attrs, "mail"),
+      active: this.attrFirst(attrs, "class") ? !attrs.class?.includes("recycled") : true,
+      groups: attrs.memberof,
+      metadata: { attrs }
+    };
+  }
+  mapGroupToDirectoryGroup(data) {
+    const attrs = data.attrs;
+    return {
+      id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "name") ?? "",
+      name: this.attrFirst(attrs, "name") ?? "",
+      displayName: this.attrFirst(attrs, "displayname"),
+      description: this.attrFirst(attrs, "description"),
+      members: attrs.member,
+      metadata: { attrs }
+    };
+  }
+  mapOAuth2Client(data) {
+    const attrs = data.attrs;
+    return {
+      id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "oauth2_rs_name") ?? "",
+      name: this.attrFirst(attrs, "oauth2_rs_name") ?? "",
+      displayName: this.attrFirst(attrs, "displayname"),
+      redirectUris: attrs.oauth2_rs_origin ?? [],
+      scopes: attrs.oauth2_rs_scope_map ? attrs.oauth2_rs_scope_map : void 0,
+      metadata: { attrs }
+    };
+  }
+  attrFirst(attrs, key) {
+    const values = attrs[key];
+    return values?.[0];
+  }
+  // ==========================================================================
+  // Connection
+  // ==========================================================================
+  async testConnection() {
+    try {
+      await this.getAdminToken();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async disconnect() {
+    this.adminToken = null;
+    this.adminTokenExpiry = 0;
+  }
+  // ==========================================================================
+  // User CRUD
+  // ==========================================================================
+  async createUser(input) {
+    const body = {
+      attrs: {
+        name: [input.username],
+        ...input.displayName ? { displayname: [input.displayName] } : {},
+        ...input.email ? { mail: [input.email] } : {},
+        ...input.metadata ?? {}
+      }
+    };
+    await this.request("POST", "/v1/person", body);
+    return this.getUser(input.username);
+  }
+  async getUser(id) {
+    const data = await this.request(
+      "GET",
+      `/v1/person/${encodeURIComponent(id)}`
+    );
+    return this.mapPersonToUser(data);
+  }
+  async updateUser(id, input) {
+    const attrs = {};
+    if (input.displayName !== void 0) {
+      attrs.displayname = [input.displayName];
+    }
+    if (input.email !== void 0) {
+      attrs.mail = [input.email];
+    }
+    await this.request("PATCH", `/v1/person/${encodeURIComponent(id)}`, {
+      attrs
+    });
+    return this.getUser(id);
+  }
+  async deleteUser(id) {
+    await this.request("DELETE", `/v1/person/${encodeURIComponent(id)}`);
+  }
+  async listUsers() {
+    const data = await this.request("GET", "/v1/person");
+    return (data ?? []).map((entry) => this.mapPersonToUser(entry));
+  }
+  // ==========================================================================
+  // Group CRUD
+  // ==========================================================================
+  async createGroup(input) {
+    const body = {
+      attrs: {
+        name: [input.name],
+        ...input.displayName ? { displayname: [input.displayName] } : {},
+        ...input.description ? { description: [input.description] } : {},
+        ...input.members ? { member: input.members } : {},
+        ...input.metadata ?? {}
+      }
+    };
+    await this.request("POST", "/v1/group", body);
+    return this.getGroup(input.name);
+  }
+  async getGroup(id) {
+    const data = await this.request(
+      "GET",
+      `/v1/group/${encodeURIComponent(id)}`
+    );
+    return this.mapGroupToDirectoryGroup(data);
+  }
+  async updateGroup(id, input) {
+    const attrs = {};
+    if (input.displayName !== void 0) {
+      attrs.displayname = [input.displayName];
+    }
+    if (input.description !== void 0) {
+      attrs.description = [input.description];
+    }
+    await this.request("PATCH", `/v1/group/${encodeURIComponent(id)}`, {
+      attrs
+    });
+    return this.getGroup(id);
+  }
+  async deleteGroup(id) {
+    await this.request("DELETE", `/v1/group/${encodeURIComponent(id)}`);
+  }
+  async listGroups() {
+    const data = await this.request("GET", "/v1/group");
+    return (data ?? []).map((entry) => this.mapGroupToDirectoryGroup(entry));
+  }
+  // ==========================================================================
+  // Membership
+  // ==========================================================================
+  async addUserToGroup(userId, groupId) {
+    await this.request(
+      "POST",
+      `/v1/group/${encodeURIComponent(groupId)}/_attr/member`,
+      [userId]
+    );
+  }
+  async removeUserFromGroup(userId, groupId) {
+    await this.request(
+      "DELETE",
+      `/v1/group/${encodeURIComponent(groupId)}/_attr/member`,
+      [userId]
+    );
+  }
+  async getGroupMembers(groupId) {
+    const group = await this.getGroup(groupId);
+    if (!group.members || group.members.length === 0) {
+      return [];
+    }
+    const users = [];
+    for (const memberId of group.members) {
+      try {
+        const user = await this.getUser(memberId);
+        users.push(user);
+      } catch (error) {
+        if (!(error instanceof NotFoundError)) {
+          throw error;
+        }
+      }
+    }
+    return users;
+  }
+  async getUserGroups(userId) {
+    const user = await this.getUser(userId);
+    if (!user.groups || user.groups.length === 0) {
+      return [];
+    }
+    const groups = [];
+    for (const groupId of user.groups) {
+      try {
+        const group = await this.getGroup(groupId);
+        groups.push(group);
+      } catch (error) {
+        if (!(error instanceof NotFoundError)) {
+          throw error;
+        }
+      }
+    }
+    return groups;
+  }
+  // ==========================================================================
+  // OAuth2 Client CRUD
+  // ==========================================================================
+  async createOAuth2Client(input) {
+    const body = {
+      attrs: {
+        oauth2_rs_name: [input.name],
+        ...input.displayName ? { displayname: [input.displayName] } : {},
+        oauth2_rs_origin: input.redirectUris,
+        ...input.scopes ? { oauth2_rs_scope_map: input.scopes } : {}
+      }
+    };
+    await this.request("POST", "/v1/oauth2", body);
+    return this.getOAuth2Client(input.name);
+  }
+  async getOAuth2Client(id) {
+    const data = await this.request(
+      "GET",
+      `/v1/oauth2/${encodeURIComponent(id)}`
+    );
+    return this.mapOAuth2Client(data);
+  }
+  async updateOAuth2Client(id, input) {
+    const attrs = {};
+    if (input.displayName !== void 0) {
+      attrs.displayname = [input.displayName];
+    }
+    if (input.redirectUris !== void 0) {
+      attrs.oauth2_rs_origin = input.redirectUris;
+    }
+    if (input.scopes !== void 0) {
+      attrs.oauth2_rs_scope_map = input.scopes;
+    }
+    await this.request("PATCH", `/v1/oauth2/${encodeURIComponent(id)}`, {
+      attrs
+    });
+    return this.getOAuth2Client(id);
+  }
+  async deleteOAuth2Client(id) {
+    await this.request("DELETE", `/v1/oauth2/${encodeURIComponent(id)}`);
+  }
+  async listOAuth2Clients() {
+    const data = await this.request("GET", "/v1/oauth2");
+    return (data ?? []).map((entry) => this.mapOAuth2Client(entry));
+  }
+  // ==========================================================================
+  // OAuth2 Secret Management
+  // ==========================================================================
+  async getOAuth2ClientSecret(id) {
+    const data = await this.request(
+      "GET",
+      `/v1/oauth2/${encodeURIComponent(id)}/_basic_secret`
+    );
+    return data;
+  }
+  // ==========================================================================
+  // Credential Management
+  // ==========================================================================
+  async createCredentialResetIntent(userId, options) {
+    const ttl = options?.ttl ?? 3600;
+    const token = await this.request(
+      "GET",
+      `/v1/person/${encodeURIComponent(userId)}/_credential/_update_intent/${ttl}`
+    );
+    return {
+      token,
+      url: `${this.baseUrl}/ui/reset?token=${encodeURIComponent(token)}`,
+      ttl
+    };
+  }
+}
+const kanidm = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  KanidmAdapter
+}, Symbol.toStringTag, { value: "Module" }));
+const { Client } = pg;
+const PROVIDER$1 = "postgres";
+const SYSTEM_ROLE_PREFIX = "pg_";
+const SYSTEM_ROLES = /* @__PURE__ */ new Set(["postgres"]);
+const SYSTEM_DATABASES = /* @__PURE__ */ new Set(["template0", "template1", "postgres"]);
+class PostgresAdapter {
+  options;
+  client = null;
+  constructor(options) {
+    this.options = options;
+  }
+  // ==========================================================================
+  // Private Helpers
+  // ==========================================================================
+  /**
+   * Escape a SQL identifier by wrapping in double quotes and escaping
+   * any embedded double quotes. Used for DDL statements where
+   * parameterized queries are not supported.
+   */
+  escapeIdentifier(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+  }
+  /**
+   * Escape a SQL string literal by wrapping in single quotes and escaping
+   * any embedded single quotes. Used for DDL statements (e.g., passwords)
+   * where parameterized queries are not supported.
+   */
+  escapeLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+  }
+  /**
+   * Get or create the pg.Client instance. Connects lazily on first use.
+   */
+  async getClient() {
+    if (this.client) {
+      return this.client;
+    }
+    try {
+      this.client = new Client({
+        host: this.options.host,
+        port: this.options.port ?? 5432,
+        user: this.options.adminUser,
+        password: this.options.adminPassword,
+        database: this.options.database ?? "postgres",
+        ssl: this.options.ssl ? typeof this.options.ssl === "object" ? this.options.ssl : { rejectUnauthorized: false } : void 0
+      });
+      await this.client.connect();
+      return this.client;
+    } catch (error) {
+      this.client = null;
+      throw this.mapError(error);
+    }
+  }
+  /**
+   * Check if a role name is a system role that should be excluded from lists.
+   */
+  isSystemRole(rolname) {
+    return rolname.startsWith(SYSTEM_ROLE_PREFIX) || SYSTEM_ROLES.has(rolname);
+  }
+  /**
+   * Map a pg_roles row to a DirectoryUser.
+   */
+  rowToUser(row) {
+    return {
+      id: row.rolname,
+      username: row.rolname,
+      active: true,
+      metadata: {
+        superuser: row.rolsuper,
+        createDb: row.rolcreatedb,
+        createRole: row.rolcreaterole
+      }
+    };
+  }
+  /**
+   * Map a pg_roles row to a DirectoryGroup.
+   */
+  rowToGroup(row) {
+    return {
+      id: row.rolname,
+      name: row.rolname,
+      metadata: {
+        superuser: row.rolsuper,
+        createDb: row.rolcreatedb,
+        createRole: row.rolcreaterole
+      }
+    };
+  }
+  /**
+   * Map a pg_roles row to a PgRole.
+   */
+  rowToPgRole(row) {
+    return {
+      name: row.rolname,
+      login: row.rolcanlogin,
+      superuser: row.rolsuper,
+      createDb: row.rolcreatedb,
+      createRole: row.rolcreaterole
+    };
+  }
+  /**
+   * Map a pg_database row to a PgDatabase.
+   */
+  rowToDatabase(row) {
+    return {
+      name: row.datname,
+      owner: row.owner,
+      encoding: row.encoding,
+      size: row.size
+    };
+  }
+  /**
+   * Map PostgreSQL errors to directory error classes.
+   */
+  mapError(error) {
+    if (error instanceof DirectoryError) {
+      return error;
+    }
+    const pgError = error;
+    switch (pgError.code) {
+      case "42710":
+        return new ConflictError(
+          "role",
+          pgError.message ?? "unknown",
+          PROVIDER$1,
+          error
+        );
+      case "42704":
+        return new NotFoundError(
+          "role",
+          pgError.message ?? "unknown",
+          PROVIDER$1,
+          error
+        );
+      case "28P01":
+        return new AuthenticationError(
+          pgError.message ?? "Invalid password",
+          PROVIDER$1,
+          error
+        );
+    }
+    const message = pgError.message ?? (error instanceof Error ? error.message : String(error));
+    if (message.includes("ECONNREFUSED") || message.includes("connect ETIMEDOUT") || message.includes("getaddrinfo")) {
+      return new ConnectionError(
+        `Failed to connect to PostgreSQL: ${message}`,
+        PROVIDER$1,
+        error
+      );
+    }
+    return new DirectoryError(message, "UNKNOWN_ERROR", PROVIDER$1, error);
+  }
+  // ==========================================================================
+  // Connection
+  // ==========================================================================
+  async testConnection() {
+    try {
+      const client = await this.getClient();
+      await client.query("SELECT 1");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async disconnect() {
+    if (this.client) {
+      await this.client.end();
+      this.client = null;
+    }
+  }
+  // ==========================================================================
+  // User CRUD (PostgreSQL roles WITH LOGIN)
+  // ==========================================================================
+  async createUser(input) {
+    const client = await this.getClient();
+    try {
+      let sql = `CREATE ROLE ${this.escapeIdentifier(input.username)} WITH LOGIN`;
+      if (input.password) {
+        sql += ` PASSWORD ${this.escapeLiteral(input.password)}`;
+      }
+      await client.query(sql);
+      return this.getUser(input.username);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async getUser(id) {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         FROM pg_roles
+         WHERE rolname = $1 AND rolcanlogin = true`,
+        [id]
+      );
+      if (result.rows.length === 0) {
+        throw new NotFoundError("user", id, PROVIDER$1);
+      }
+      return this.rowToUser(result.rows[0]);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async updateUser(id, input) {
+    const client = await this.getClient();
+    try {
+      await this.getUser(id);
+      const alterClauses = [];
+      if (input.password !== void 0) {
+        alterClauses.push(`PASSWORD ${this.escapeLiteral(input.password)}`);
+      }
+      if (alterClauses.length > 0) {
+        const sql = `ALTER ROLE ${this.escapeIdentifier(id)} WITH ${alterClauses.join(" ")}`;
+        await client.query(sql);
+      }
+      return this.getUser(id);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async deleteUser(id) {
+    const client = await this.getClient();
+    try {
+      await this.getUser(id);
+      await client.query(`DROP ROLE ${this.escapeIdentifier(id)}`);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async listUsers() {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         FROM pg_roles
+         WHERE rolcanlogin = true
+         ORDER BY rolname`
+      );
+      return result.rows.filter(
+        (row) => !this.isSystemRole(row.rolname)
+      ).map((row) => this.rowToUser(row));
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  // ==========================================================================
+  // Group CRUD (PostgreSQL roles WITHOUT LOGIN)
+  // ==========================================================================
+  async createGroup(input) {
+    const client = await this.getClient();
+    try {
+      await client.query(
+        `CREATE ROLE ${this.escapeIdentifier(input.name)} NOLOGIN`
+      );
+      if (input.members) {
+        for (const member of input.members) {
+          await this.addUserToGroup(member, input.name);
+        }
+      }
+      return this.getGroup(input.name);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async getGroup(id) {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         FROM pg_roles
+         WHERE rolname = $1 AND rolcanlogin = false`,
+        [id]
+      );
+      if (result.rows.length === 0) {
+        throw new NotFoundError("group", id, PROVIDER$1);
+      }
+      return this.rowToGroup(result.rows[0]);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async updateGroup(id, _input) {
+    return this.getGroup(id);
+  }
+  async deleteGroup(id) {
+    const client = await this.getClient();
+    try {
+      await this.getGroup(id);
+      await client.query(`DROP ROLE ${this.escapeIdentifier(id)}`);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async listGroups() {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         FROM pg_roles
+         WHERE rolcanlogin = false
+         ORDER BY rolname`
+      );
+      return result.rows.filter(
+        (row) => !this.isSystemRole(row.rolname)
+      ).map((row) => this.rowToGroup(row));
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  // ==========================================================================
+  // Membership (GRANT/REVOKE role TO/FROM role)
+  // ==========================================================================
+  async addUserToGroup(userId, groupId) {
+    const client = await this.getClient();
+    try {
+      await client.query(
+        `GRANT ${this.escapeIdentifier(groupId)} TO ${this.escapeIdentifier(userId)}`
+      );
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async removeUserFromGroup(userId, groupId) {
+    const client = await this.getClient();
+    try {
+      await client.query(
+        `REVOKE ${this.escapeIdentifier(groupId)} FROM ${this.escapeIdentifier(userId)}`
+      );
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async getGroupMembers(groupId) {
+    const client = await this.getClient();
+    try {
+      await this.getGroup(groupId);
+      const result = await client.query(
+        `SELECT r.rolname, r.rolsuper, r.rolcreatedb, r.rolcreaterole, r.rolcanlogin
+         FROM pg_auth_members m
+         JOIN pg_roles g ON g.oid = m.roleid
+         JOIN pg_roles r ON r.oid = m.member
+         WHERE g.rolname = $1 AND r.rolcanlogin = true
+         ORDER BY r.rolname`,
+        [groupId]
+      );
+      return result.rows.map(
+        (row) => this.rowToUser(row)
+      );
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async getUserGroups(userId) {
+    const client = await this.getClient();
+    try {
+      await this.getUser(userId);
+      const result = await client.query(
+        `SELECT g.rolname, g.rolsuper, g.rolcreatedb, g.rolcreaterole, g.rolcanlogin
+         FROM pg_auth_members m
+         JOIN pg_roles g ON g.oid = m.roleid
+         JOIN pg_roles r ON r.oid = m.member
+         WHERE r.rolname = $1 AND g.rolcanlogin = false
+         ORDER BY g.rolname`,
+        [userId]
+      );
+      return result.rows.map(
+        (row) => this.rowToGroup(row)
+      );
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  // ==========================================================================
+  // Database Provisioning
+  // ==========================================================================
+  async createDatabase(input) {
+    const client = await this.getClient();
+    try {
+      let sql = `CREATE DATABASE ${this.escapeIdentifier(input.name)} OWNER ${this.escapeIdentifier(input.owner)}`;
+      if (input.encoding) {
+        sql += ` ENCODING ${this.escapeLiteral(input.encoding)}`;
+      }
+      await client.query(sql);
+      return this.getDatabase(input.name);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async getDatabase(name) {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT
+           d.datname,
+           pg_catalog.pg_get_userbyid(d.datdba) AS owner,
+           pg_encoding_to_char(d.encoding) AS encoding,
+           pg_database_size(d.datname)::text AS size
+         FROM pg_database d
+         WHERE d.datname = $1`,
+        [name]
+      );
+      if (result.rows.length === 0) {
+        throw new NotFoundError("database", name, PROVIDER$1);
+      }
+      return this.rowToDatabase(result.rows[0]);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async dropDatabase(name) {
+    const client = await this.getClient();
+    try {
+      await this.getDatabase(name);
+      await client.query(`DROP DATABASE ${this.escapeIdentifier(name)}`);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async listDatabases() {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT
+           d.datname,
+           pg_catalog.pg_get_userbyid(d.datdba) AS owner,
+           pg_encoding_to_char(d.encoding) AS encoding,
+           pg_database_size(d.datname)::text AS size
+         FROM pg_database d
+         ORDER BY d.datname`
+      );
+      return result.rows.filter(
+        (row) => !SYSTEM_DATABASES.has(row.datname)
+      ).map((row) => this.rowToDatabase(row));
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  // ==========================================================================
+  // Role Provisioning
+  // ==========================================================================
+  async createRole(input) {
+    const client = await this.getClient();
+    try {
+      const options = [];
+      if (input.login !== void 0) {
+        options.push(input.login ? "LOGIN" : "NOLOGIN");
+      }
+      if (input.password) {
+        options.push(`PASSWORD ${this.escapeLiteral(input.password)}`);
+      }
+      if (input.superuser !== void 0) {
+        options.push(input.superuser ? "SUPERUSER" : "NOSUPERUSER");
+      }
+      if (input.createDb !== void 0) {
+        options.push(input.createDb ? "CREATEDB" : "NOCREATEDB");
+      }
+      if (input.createRole !== void 0) {
+        options.push(input.createRole ? "CREATEROLE" : "NOCREATEROLE");
+      }
+      let sql = `CREATE ROLE ${this.escapeIdentifier(input.name)}`;
+      if (options.length > 0) {
+        sql += ` WITH ${options.join(" ")}`;
+      }
+      await client.query(sql);
+      return this.getRole(input.name);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async getRole(name) {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT rolname, rolcanlogin, rolsuper, rolcreatedb, rolcreaterole
+         FROM pg_roles
+         WHERE rolname = $1`,
+        [name]
+      );
+      if (result.rows.length === 0) {
+        throw new NotFoundError("role", name, PROVIDER$1);
+      }
+      return this.rowToPgRole(result.rows[0]);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async dropRole(name) {
+    const client = await this.getClient();
+    try {
+      await this.getRole(name);
+      await client.query(`DROP ROLE ${this.escapeIdentifier(name)}`);
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async listRoles() {
+    const client = await this.getClient();
+    try {
+      const result = await client.query(
+        `SELECT rolname, rolcanlogin, rolsuper, rolcreatedb, rolcreaterole
+         FROM pg_roles
+         ORDER BY rolname`
+      );
+      return result.rows.filter(
+        (row) => !this.isSystemRole(row.rolname)
+      ).map((row) => this.rowToPgRole(row));
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  // ==========================================================================
+  // Access Control (GRANT/REVOKE on databases)
+  // ==========================================================================
+  async grantAccess(roleName, databaseName) {
+    const client = await this.getClient();
+    try {
+      await client.query(
+        `GRANT ALL ON DATABASE ${this.escapeIdentifier(databaseName)} TO ${this.escapeIdentifier(roleName)}`
+      );
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+  async revokeAccess(roleName, databaseName) {
+    const client = await this.getClient();
+    try {
+      await client.query(
+        `REVOKE ALL ON DATABASE ${this.escapeIdentifier(databaseName)} FROM ${this.escapeIdentifier(roleName)}`
+      );
+    } catch (error) {
+      throw this.mapError(error);
+    }
+  }
+}
+const postgres = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  PostgresAdapter
+}, Symbol.toStringTag, { value: "Module" }));
+const PROVIDER = "stalwart";
+const DEFAULT_TIMEOUT = 3e4;
+class StalwartAdapter {
+  options;
+  authHeader;
+  constructor(options) {
+    this.options = options;
+    this.authHeader = `Basic ${btoa(`${options.username}:${options.password}`)}`;
+  }
+  get timeout() {
+    return this.options.timeout ?? DEFAULT_TIMEOUT;
+  }
+  // ==========================================================================
+  // HTTP Helper
+  // ==========================================================================
+  async request(method, path, body) {
+    const url = `${this.options.baseUrl}${path}`;
+    const headers = {
+      Authorization: this.authHeader,
+      Accept: "application/json"
+    };
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+    }
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: AbortSignal.timeout(this.timeout)
+      });
+    } catch (error) {
+      if (error instanceof DOMException && error.name === "TimeoutError") {
+        throw new ConnectionError(
+          `Request timed out after ${this.timeout}ms: ${method} ${path}`,
+          PROVIDER,
+          error
+        );
+      }
+      throw new ConnectionError(
+        `Failed to connect to Stalwart: ${error.message}`,
+        PROVIDER,
+        error
+      );
+    }
+    if (response.ok) {
+      const text = await response.text();
+      if (!text) return void 0;
+      try {
+        return JSON.parse(text);
+      } catch {
+        return text;
+      }
+    }
+    const errorBody = await response.text().catch(() => "");
+    switch (response.status) {
+      case 401:
+      case 403:
+        throw new AuthenticationError(
+          `Authentication failed: ${response.status} ${response.statusText}`,
+          PROVIDER
+        );
+      case 404:
+        throw new NotFoundError("resource", path, PROVIDER);
+      case 409:
+        throw new ConflictError("resource", path, PROVIDER);
+      default:
+        throw new DirectoryError(
+          `Stalwart API error: ${response.status} ${response.statusText}${errorBody ? ` - ${errorBody}` : ""}`,
+          "API_ERROR",
+          PROVIDER
+        );
+    }
+  }
+  // ==========================================================================
+  // Connection
+  // ==========================================================================
+  async testConnection() {
+    try {
+      await this.request("GET", "/api/principal?type=individual&limit=1");
+      return true;
+    } catch (error) {
+      if (error instanceof AuthenticationError) {
+        throw error;
+      }
+      return false;
+    }
+  }
+  async disconnect() {
+  }
+  // ==========================================================================
+  // User CRUD
+  // ==========================================================================
+  async createUser(input) {
+    const principal = {
+      name: input.username,
+      type: "individual",
+      description: input.displayName,
+      emails: input.email ? [input.email] : [],
+      secrets: input.password ? [input.password] : void 0
+    };
+    await this.request("POST", "/api/principal", principal);
+    return this.getUser(input.username);
+  }
+  async getUser(id) {
+    const principal = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(id)}`
+    );
+    return this.principalToUser(principal);
+  }
+  async updateUser(id, input) {
+    const patch = {};
+    if (input.displayName !== void 0) patch.description = input.displayName;
+    if (input.email !== void 0) patch.emails = [input.email];
+    if (input.password !== void 0) patch.secrets = [input.password];
+    await this.request(
+      "PATCH",
+      `/api/principal/${encodeURIComponent(id)}`,
+      patch
+    );
+    return this.getUser(id);
+  }
+  async deleteUser(id) {
+    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+  }
+  async listUsers() {
+    const names = await this.request(
+      "GET",
+      "/api/principal?type=individual"
+    );
+    const users = await Promise.all(
+      (names ?? []).map((name) => this.getUser(name))
+    );
+    return users;
+  }
+  // ==========================================================================
+  // Group CRUD
+  // ==========================================================================
+  async createGroup(input) {
+    const principal = {
+      name: input.name,
+      type: "group",
+      description: input.description ?? input.displayName,
+      members: input.members
+    };
+    await this.request("POST", "/api/principal", principal);
+    return this.getGroup(input.name);
+  }
+  async getGroup(id) {
+    const principal = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(id)}`
+    );
+    return this.principalToGroup(principal);
+  }
+  async updateGroup(id, input) {
+    const patch = {};
+    if (input.displayName !== void 0) patch.description = input.displayName;
+    if (input.description !== void 0) patch.description = input.description;
+    await this.request(
+      "PATCH",
+      `/api/principal/${encodeURIComponent(id)}`,
+      patch
+    );
+    return this.getGroup(id);
+  }
+  async deleteGroup(id) {
+    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+  }
+  async listGroups() {
+    const names = await this.request(
+      "GET",
+      "/api/principal?type=group"
+    );
+    const groups = await Promise.all(
+      (names ?? []).map((name) => this.getGroup(name))
+    );
+    return groups;
+  }
+  // ==========================================================================
+  // Membership
+  // ==========================================================================
+  async addUserToGroup(userId, groupId) {
+    const group = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(groupId)}`
+    );
+    const members = group.members ?? [];
+    if (!members.includes(userId)) {
+      members.push(userId);
+    }
+    await this.request(
+      "PATCH",
+      `/api/principal/${encodeURIComponent(groupId)}`,
+      { members }
+    );
+  }
+  async removeUserFromGroup(userId, groupId) {
+    const group = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(groupId)}`
+    );
+    const members = (group.members ?? []).filter((m) => m !== userId);
+    await this.request(
+      "PATCH",
+      `/api/principal/${encodeURIComponent(groupId)}`,
+      { members }
+    );
+  }
+  async getGroupMembers(groupId) {
+    const group = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(groupId)}`
+    );
+    const members = group.members ?? [];
+    const users = await Promise.all(members.map((name) => this.getUser(name)));
+    return users;
+  }
+  async getUserGroups(userId) {
+    const user = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(userId)}`
+    );
+    const groupNames = user.memberOf ?? [];
+    const groups = await Promise.all(
+      groupNames.map((name) => this.getGroup(name))
+    );
+    return groups;
+  }
+  // ==========================================================================
+  // Domain CRUD
+  // ==========================================================================
+  async createDomain(input) {
+    const principal = {
+      name: input.name,
+      type: "domain"
+    };
+    await this.request("POST", "/api/principal", principal);
+    return this.getDomain(input.name);
+  }
+  async getDomain(id) {
+    const principal = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(id)}`
+    );
+    return {
+      id: principal.name,
+      name: principal.name,
+      active: true
+    };
+  }
+  async deleteDomain(id) {
+    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+  }
+  async listDomains() {
+    const names = await this.request(
+      "GET",
+      "/api/principal?type=domain"
+    );
+    const domains = await Promise.all(
+      (names ?? []).map((name) => this.getDomain(name))
+    );
+    return domains;
+  }
+  // ==========================================================================
+  // DKIM
+  // ==========================================================================
+  async createDkimKey(input) {
+    const result = await this.request("POST", "/api/dkim", {
+      domain: input.domain,
+      selector: input.selector
+    });
+    return {
+      id: result?.id ?? `${input.selector}._domainkey.${input.domain}`,
+      domain: input.domain,
+      selector: input.selector,
+      publicKey: result?.publicKey
+    };
+  }
+  // ==========================================================================
+  // DNS Records
+  // ==========================================================================
+  async getDnsRecords(domain) {
+    const records = await this.request(
+      "GET",
+      `/api/dns/records/${encodeURIComponent(domain)}`
+    );
+    return records ?? [];
+  }
+  // ==========================================================================
+  // Mailbox CRUD
+  // ==========================================================================
+  async createMailbox(input) {
+    const atIndex = input.email.indexOf("@");
+    const localPart = atIndex >= 0 ? input.email.slice(0, atIndex) : input.email;
+    const principal = {
+      name: localPart,
+      type: "individual",
+      description: input.name,
+      emails: [input.email],
+      secrets: [input.password],
+      quota: input.quota
+    };
+    await this.request("POST", "/api/principal", principal);
+    return this.getMailbox(localPart);
+  }
+  async getMailbox(id) {
+    const principal = await this.request(
+      "GET",
+      `/api/principal/${encodeURIComponent(id)}`
+    );
+    return this.principalToMailbox(principal);
+  }
+  async updateMailbox(id, input) {
+    const patch = {};
+    if (input.name !== void 0) patch.description = input.name;
+    if (input.password !== void 0) patch.secrets = [input.password];
+    if (input.quota !== void 0) patch.quota = input.quota;
+    await this.request(
+      "PATCH",
+      `/api/principal/${encodeURIComponent(id)}`,
+      patch
+    );
+    return this.getMailbox(id);
+  }
+  async deleteMailbox(id) {
+    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+  }
+  async listMailboxes() {
+    const names = await this.request(
+      "GET",
+      "/api/principal?type=individual"
+    );
+    const mailboxes = await Promise.all(
+      (names ?? []).map((name) => this.getMailbox(name))
+    );
+    return mailboxes;
+  }
+  // ==========================================================================
+  // Principal Mapping Helpers
+  // ==========================================================================
+  principalToUser(principal) {
+    return {
+      id: principal.name,
+      username: principal.name,
+      displayName: principal.description,
+      email: principal.emails?.[0],
+      active: true,
+      groups: principal.memberOf
+    };
+  }
+  principalToGroup(principal) {
+    return {
+      id: principal.name,
+      name: principal.name,
+      displayName: principal.description,
+      description: principal.description,
+      members: principal.members
+    };
+  }
+  principalToMailbox(principal) {
+    return {
+      id: principal.name,
+      name: principal.description ?? principal.name,
+      email: principal.emails?.[0] ?? "",
+      quota: principal.quota,
+      active: true
+    };
+  }
+}
+const stalwart = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  StalwartAdapter
+}, Symbol.toStringTag, { value: "Module" }));
+function isKanidmOptions(opts) {
+  return opts.type === "kanidm";
+}
+function isStalwartOptions(opts) {
+  return opts.type === "stalwart";
+}
+function isPostgresOptions(opts) {
+  return opts.type === "postgres";
+}
+function isAwsOptions(opts) {
+  return opts.type === "aws";
+}
+async function getDirectoryAdapter(options) {
+  if (isKanidmOptions(options)) {
+    const { KanidmAdapter: KanidmAdapter2 } = await Promise.resolve().then(() => kanidm);
+    return new KanidmAdapter2(options);
+  }
+  if (isStalwartOptions(options)) {
+    const { StalwartAdapter: StalwartAdapter2 } = await Promise.resolve().then(() => stalwart);
+    return new StalwartAdapter2(options);
+  }
+  if (isPostgresOptions(options)) {
+    const { PostgresAdapter: PostgresAdapter2 } = await Promise.resolve().then(() => postgres);
+    return new PostgresAdapter2(options);
+  }
+  if (isAwsOptions(options)) {
+    const { AwsAdapter: AwsAdapter2 } = await Promise.resolve().then(() => aws);
+    return new AwsAdapter2(options);
+  }
+  throw new Error(
+    `Unknown directory adapter type: ${options.type}`
+  );
+}
+async function getKanidmAdapter(options) {
+  const { KanidmAdapter: KanidmAdapter2 } = await Promise.resolve().then(() => kanidm);
+  return new KanidmAdapter2({ type: "kanidm", ...options });
+}
+async function getStalwartAdapter(options) {
+  const { StalwartAdapter: StalwartAdapter2 } = await Promise.resolve().then(() => stalwart);
+  return new StalwartAdapter2({ type: "stalwart", ...options });
+}
+async function getPostgresAdapter(options) {
+  const { PostgresAdapter: PostgresAdapter2 } = await Promise.resolve().then(() => postgres);
+  return new PostgresAdapter2({ type: "postgres", ...options });
+}
+async function getAwsAdapter(options) {
+  const { AwsAdapter: AwsAdapter2 } = await Promise.resolve().then(() => aws);
+  return new AwsAdapter2({ type: "aws", ...options });
+}
+export {
+  AuthenticationError,
+  AwsAdapter,
+  ConflictError,
+  ConnectionError,
+  DirectoryError,
+  KanidmAdapter,
+  NotFoundError,
+  PostgresAdapter,
+  RateLimitError,
+  StalwartAdapter,
+  ValidationError,
+  getAwsAdapter,
+  getDirectoryAdapter,
+  getKanidmAdapter,
+  getPostgresAdapter,
+  getStalwartAdapter,
+  isAwsOptions,
+  isKanidmOptions,
+  isPostgresOptions,
+  isStalwartOptions
+};
+//# sourceMappingURL=index.js.map