@happyvertical/directory 0.80.0 → 0.80.1

package/dist/index.js

@@ -1,2222 +1,1622 @@
-import { IAMClient, ListUsersCommand, CreateUserCommand, GetUserCommand, UpdateUserCommand, DeleteUserCommand, CreateGroupCommand, GetGroupCommand, DeleteGroupCommand, ListGroupsCommand, AddUserToGroupCommand, RemoveUserFromGroupCommand, ListGroupsForUserCommand, GetRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand, TagRoleCommand, CreateRoleCommand, PutRolePolicyCommand, AttachUserPolicyCommand, DetachUserPolicyCommand, CreateAccessKeyCommand, DeleteAccessKeyCommand } from "@aws-sdk/client-iam";
-import { OrganizationsClient, CreateOrganizationalUnitCommand, DescribeOrganizationalUnitCommand, ListOrganizationalUnitsForParentCommand, CreateAccountCommand, DescribeCreateAccountStatusCommand, ListAccountsCommand, ListParentsCommand, MoveAccountCommand, TagResourceCommand } from "@aws-sdk/client-organizations";
-import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts";
+import { a as NotFoundError, i as DirectoryError, n as ConflictError, o as RateLimitError, r as ConnectionError, s as ValidationError, t as AuthenticationError } from "./chunks/errors-DjVGsCVd.js";
+import { AddUserToGroupCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateRoleCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteUserCommand, DetachUserPolicyCommand, GetGroupCommand, GetRoleCommand, GetUserCommand, IAMClient, ListGroupsCommand, ListGroupsForUserCommand, ListUsersCommand, PutRolePolicyCommand, RemoveUserFromGroupCommand, TagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
+import { CreateAccountCommand, CreateOrganizationalUnitCommand, DescribeCreateAccountStatusCommand, DescribeOrganizationalUnitCommand, ListAccountsCommand, ListOrganizationalUnitsForParentCommand, ListParentsCommand, MoveAccountCommand, OrganizationsClient, TagResourceCommand } from "@aws-sdk/client-organizations";
+import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
 import pg from "pg";
-class DirectoryError extends Error {
-  code;
-  provider;
-  cause;
-  constructor(message, code, provider, cause) {
-    super(message);
-    this.name = "DirectoryError";
-    this.code = code;
-    this.provider = provider;
-    this.cause = cause;
-  }
-}
-class ConnectionError extends DirectoryError {
-  constructor(message, provider, cause) {
-    super(message, "CONNECTION_ERROR", provider, cause);
-    this.name = "ConnectionError";
-  }
-}
-class AuthenticationError extends DirectoryError {
-  constructor(message, provider, cause) {
-    super(message, "AUTHENTICATION_ERROR", provider, cause);
-    this.name = "AuthenticationError";
-  }
-}
-class NotFoundError extends DirectoryError {
-  resourceType;
-  resourceId;
-  constructor(resourceType, resourceId, provider, cause) {
-    super(
-      `${resourceType} not found: ${resourceId}`,
-      "NOT_FOUND",
-      provider,
-      cause
-    );
-    this.name = "NotFoundError";
-    this.resourceType = resourceType;
-    this.resourceId = resourceId;
-  }
-}
-class ConflictError extends DirectoryError {
-  resourceType;
-  resourceId;
-  constructor(resourceType, resourceId, provider, cause) {
-    super(
-      `${resourceType} already exists: ${resourceId}`,
-      "CONFLICT",
-      provider,
-      cause
-    );
-    this.name = "ConflictError";
-    this.resourceType = resourceType;
-    this.resourceId = resourceId;
-  }
-}
-class ValidationError extends DirectoryError {
-  constructor(message, provider, cause) {
-    super(message, "VALIDATION_ERROR", provider, cause);
-    this.name = "ValidationError";
-  }
-}
-class RateLimitError extends DirectoryError {
-  retryAfter;
-  constructor(provider, retryAfter) {
-    super(
-      `Rate limit exceeded${retryAfter ? ` (retry after ${retryAfter}s)` : ""}`,
-      "RATE_LIMIT",
-      provider
-    );
-    this.name = "RateLimitError";
-    this.retryAfter = retryAfter;
-  }
-}
-const DEFAULT_ACCOUNT_CREATION_TIMEOUT_MS = 10 * 60 * 1e3;
-const DEFAULT_ACCOUNT_CREATION_POLL_INTERVAL_MS = 5 * 1e3;
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/adapters/aws.ts
+/**
+* AWS directory adapter
+*
+* Implements AwsDirectoryAdapter using AWS SDK v3 for Organizations and IAM.
+* Provides user/group CRUD (mapped to IAM), membership management,
+* organizational unit operations, account management, and access key operations.
+*
+* Caveats:
+* - Account creation is asynchronous; use getAccountCreationStatus to poll.
+* - AWS accounts cannot be truly deleted via the API.
+* - IAM CreateUser does not set passwords (use CreateLoginProfile separately).
+*/
+var aws_exports = /* @__PURE__ */ __exportAll({ AwsAdapter: () => AwsAdapter });
+var DEFAULT_ACCOUNT_CREATION_TIMEOUT_MS = 600 * 1e3;
+var DEFAULT_ACCOUNT_CREATION_POLL_INTERVAL_MS = 5 * 1e3;
 function handleAwsError(error, context) {
-  if (error instanceof AuthenticationError || error instanceof ConnectionError || error instanceof NotFoundError || error instanceof ConflictError || error instanceof DirectoryError) {
-    throw error;
-  }
-  const awsError = error;
-  const name = awsError.name ?? "";
-  const message = awsError.message ?? String(error);
-  switch (name) {
-    case "EntityAlreadyExistsException":
-    case "DuplicateOrganizationalUnitException":
-      throw new ConflictError("resource", context, "aws", error);
-    case "NoSuchEntityException":
-    case "OrganizationalUnitNotFoundException":
-    case "AccountNotFoundException":
-      throw new NotFoundError("resource", context, "aws", error);
-    case "AccessDeniedException":
-    case "InvalidClientTokenId":
-    case "UnrecognizedClientException":
-    case "InvalidAccessKeyId":
-      throw new AuthenticationError(`${context}: ${message}`, "aws", error);
-    default:
-      throw new DirectoryError(
-        `${context}: ${message}`,
-        "AWS_ERROR",
-        "aws",
-        error
-      );
-  }
+	if (error instanceof AuthenticationError || error instanceof ConnectionError || error instanceof NotFoundError || error instanceof ConflictError || error instanceof DirectoryError) throw error;
+	const awsError = error;
+	const name = awsError.name ?? "";
+	const message = awsError.message ?? String(error);
+	switch (name) {
+		case "EntityAlreadyExistsException":
+		case "DuplicateOrganizationalUnitException": throw new ConflictError("resource", context, "aws", error);
+		case "NoSuchEntityException":
+		case "OrganizationalUnitNotFoundException":
+		case "AccountNotFoundException": throw new NotFoundError("resource", context, "aws", error);
+		case "AccessDeniedException":
+		case "InvalidClientTokenId":
+		case "UnrecognizedClientException":
+		case "InvalidAccessKeyId": throw new AuthenticationError(`${context}: ${message}`, "aws", error);
+		default: throw new DirectoryError(`${context}: ${message}`, "AWS_ERROR", "aws", error);
+	}
 }
 function mapIamUserToDirectoryUser(user) {
-  const displayNameTag = user.Tags?.find((t) => t.Key === "DisplayName");
-  const emailTag = user.Tags?.find((t) => t.Key === "Email");
-  return {
-    id: user.UserName ?? "",
-    username: user.UserName ?? "",
-    displayName: displayNameTag?.Value,
-    email: emailTag?.Value,
-    active: true,
-    metadata: {
-      arn: user.Arn,
-      userId: user.UserId,
-      createDate: user.CreateDate?.toISOString()
-    }
-  };
+	const displayNameTag = user.Tags?.find((t) => t.Key === "DisplayName");
+	const emailTag = user.Tags?.find((t) => t.Key === "Email");
+	return {
+		id: user.UserName ?? "",
+		username: user.UserName ?? "",
+		displayName: displayNameTag?.Value,
+		email: emailTag?.Value,
+		active: true,
+		metadata: {
+			arn: user.Arn,
+			userId: user.UserId,
+			createDate: user.CreateDate?.toISOString()
+		}
+	};
 }
 function mapIamGroupToDirectoryGroup(group) {
-  return {
-    id: group.GroupName ?? "",
-    name: group.GroupName ?? "",
-    metadata: {
-      arn: group.Arn,
-      groupId: group.GroupId,
-      createDate: group.CreateDate?.toISOString()
-    }
-  };
+	return {
+		id: group.GroupName ?? "",
+		name: group.GroupName ?? "",
+		metadata: {
+			arn: group.Arn,
+			groupId: group.GroupId,
+			createDate: group.CreateDate?.toISOString()
+		}
+	};
 }
 function mapIamUserToAwsIamUser(user) {
-  return {
-    username: user.UserName ?? "",
-    arn: user.Arn,
-    userId: user.UserId,
-    createDate: user.CreateDate
-  };
+	return {
+		username: user.UserName ?? "",
+		arn: user.Arn,
+		userId: user.UserId,
+		createDate: user.CreateDate
+	};
 }
 function mapAwsAccount(account) {
-  return {
-    id: account.Id ?? "",
-    name: account.Name ?? "",
-    email: account.Email ?? "",
-    arn: account.Arn,
-    status: account.Status ? String(account.Status) : void 0
-  };
+	return {
+		id: account.Id ?? "",
+		name: account.Name ?? "",
+		email: account.Email ?? "",
+		arn: account.Arn,
+		status: account.Status ? String(account.Status) : void 0
+	};
 }
 function mapAwsIamRole(role) {
-  return {
-    roleName: role.RoleName ?? "",
-    arn: role.Arn,
-    roleId: role.RoleId,
-    path: role.Path,
-    createDate: role.CreateDate,
-    assumeRolePolicyDocument: role.AssumeRolePolicyDocument
-  };
+	return {
+		roleName: role.RoleName ?? "",
+		arn: role.Arn,
+		roleId: role.RoleId,
+		path: role.Path,
+		createDate: role.CreateDate,
+		assumeRolePolicyDocument: role.AssumeRolePolicyDocument
+	};
 }
 function toAwsTags(tags) {
-  const entries = Object.entries(tags ?? {}).filter(([key]) => key.length > 0);
-  if (entries.length === 0) {
-    return void 0;
-  }
-  return entries.map(([Key, Value]) => ({ Key, Value }));
+	const entries = Object.entries(tags ?? {}).filter(([key]) => key.length > 0);
+	if (entries.length === 0) return;
+	return entries.map(([Key, Value]) => ({
+		Key,
+		Value
+	}));
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-class AwsAdapter {
-  constructor(options) {
-    this.options = options;
-    const clientConfig = {
-      region: options.region,
-      ...options.credentials ? { credentials: options.credentials } : {}
-    };
-    this.orgs = new OrganizationsClient(clientConfig);
-    this.iam = new IAMClient(clientConfig);
-    this.sts = new STSClient(clientConfig);
-  }
-  orgs;
-  iam;
-  sts;
-  // ==========================================================================
-  // Connection
-  // ==========================================================================
-  async testConnection() {
-    try {
-      await this.iam.send(new ListUsersCommand({ MaxItems: 1 }));
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async disconnect() {
-  }
-  // ==========================================================================
-  // User CRUD (DirectoryAdapter -> IAM Users)
-  // ==========================================================================
-  async createUser(input) {
-    try {
-      const tags = [];
-      if (input.displayName) {
-        tags.push({ Key: "DisplayName", Value: input.displayName });
-      }
-      if (input.email) {
-        tags.push({ Key: "Email", Value: input.email });
-      }
-      const result = await this.iam.send(
-        new CreateUserCommand({
-          UserName: input.username,
-          ...tags.length > 0 ? { Tags: tags } : {}
-        })
-      );
-      return mapIamUserToDirectoryUser({
-        ...result.User,
-        Tags: tags
-      });
-    } catch (error) {
-      handleAwsError(error, `createUser(${input.username})`);
-    }
-  }
-  async getUser(id) {
-    try {
-      const result = await this.iam.send(new GetUserCommand({ UserName: id }));
-      return mapIamUserToDirectoryUser(result.User ?? {});
-    } catch (error) {
-      handleAwsError(error, `getUser(${id})`);
-    }
-  }
-  async updateUser(id, _input) {
-    try {
-      await this.iam.send(new UpdateUserCommand({ UserName: id }));
-      return this.getUser(id);
-    } catch (error) {
-      handleAwsError(error, `updateUser(${id})`);
-    }
-  }
-  async deleteUser(id) {
-    try {
-      await this.iam.send(new DeleteUserCommand({ UserName: id }));
-    } catch (error) {
-      handleAwsError(error, `deleteUser(${id})`);
-    }
-  }
-  async listUsers() {
-    try {
-      const result = await this.iam.send(new ListUsersCommand({}));
-      return (result.Users ?? []).map((u) => mapIamUserToDirectoryUser(u));
-    } catch (error) {
-      handleAwsError(error, "listUsers");
-    }
-  }
-  // ==========================================================================
-  // Group CRUD (DirectoryAdapter -> IAM Groups)
-  // ==========================================================================
-  async createGroup(input) {
-    try {
-      const result = await this.iam.send(
-        new CreateGroupCommand({ GroupName: input.name })
-      );
-      const group = mapIamGroupToDirectoryGroup(result.Group ?? {});
-      if (input.members) {
-        for (const memberId of input.members) {
-          await this.addUserToGroup(memberId, input.name);
-        }
-      }
-      return group;
-    } catch (error) {
-      handleAwsError(error, `createGroup(${input.name})`);
-    }
-  }
-  async getGroup(id) {
-    try {
-      const result = await this.iam.send(
-        new GetGroupCommand({ GroupName: id })
-      );
-      const group = mapIamGroupToDirectoryGroup(result.Group ?? {});
-      group.members = (result.Users ?? []).map((u) => u.UserName ?? "");
-      return group;
-    } catch (error) {
-      handleAwsError(error, `getGroup(${id})`);
-    }
-  }
-  async updateGroup(id, _input) {
-    return this.getGroup(id);
-  }
-  async deleteGroup(id) {
-    try {
-      await this.iam.send(new DeleteGroupCommand({ GroupName: id }));
-    } catch (error) {
-      handleAwsError(error, `deleteGroup(${id})`);
-    }
-  }
-  async listGroups() {
-    try {
-      const result = await this.iam.send(new ListGroupsCommand({}));
-      return (result.Groups ?? []).map((g) => mapIamGroupToDirectoryGroup(g));
-    } catch (error) {
-      handleAwsError(error, "listGroups");
-    }
-  }
-  // ==========================================================================
-  // Membership
-  // ==========================================================================
-  async addUserToGroup(userId, groupId) {
-    try {
-      await this.iam.send(
-        new AddUserToGroupCommand({
-          UserName: userId,
-          GroupName: groupId
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `addUserToGroup(${userId}, ${groupId})`);
-    }
-  }
-  async removeUserFromGroup(userId, groupId) {
-    try {
-      await this.iam.send(
-        new RemoveUserFromGroupCommand({
-          UserName: userId,
-          GroupName: groupId
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `removeUserFromGroup(${userId}, ${groupId})`);
-    }
-  }
-  async getGroupMembers(groupId) {
-    try {
-      const result = await this.iam.send(
-        new GetGroupCommand({ GroupName: groupId })
-      );
-      return (result.Users ?? []).map((u) => mapIamUserToDirectoryUser(u));
-    } catch (error) {
-      handleAwsError(error, `getGroupMembers(${groupId})`);
-    }
-  }
-  async getUserGroups(userId) {
-    try {
-      const result = await this.iam.send(
-        new ListGroupsForUserCommand({ UserName: userId })
-      );
-      return (result.Groups ?? []).map((g) => mapIamGroupToDirectoryGroup(g));
-    } catch (error) {
-      handleAwsError(error, `getUserGroups(${userId})`);
-    }
-  }
-  // ==========================================================================
-  // Organizational Units (AwsDirectoryAdapter)
-  // ==========================================================================
-  async createOrganizationalUnit(input) {
-    try {
-      const result = await this.orgs.send(
-        new CreateOrganizationalUnitCommand({
-          ParentId: input.parentId,
-          Name: input.name,
-          Tags: toAwsTags(input.tags)
-        })
-      );
-      const ou = result.OrganizationalUnit;
-      return {
-        id: ou?.Id ?? "",
-        name: ou?.Name ?? "",
-        arn: ou?.Arn,
-        parentId: input.parentId
-      };
-    } catch (error) {
-      handleAwsError(error, `createOrganizationalUnit(${input.name})`);
-    }
-  }
-  async getOrganizationalUnit(id) {
-    try {
-      const result = await this.orgs.send(
-        new DescribeOrganizationalUnitCommand({
-          OrganizationalUnitId: id
-        })
-      );
-      const ou = result.OrganizationalUnit;
-      return {
-        id: ou?.Id ?? "",
-        name: ou?.Name ?? "",
-        arn: ou?.Arn
-      };
-    } catch (error) {
-      handleAwsError(error, `getOrganizationalUnit(${id})`);
-    }
-  }
-  async listOrganizationalUnits(parentId) {
-    try {
-      const organizationalUnits = [];
-      let nextToken;
-      do {
-        const result = await this.orgs.send(
-          new ListOrganizationalUnitsForParentCommand({
-            ParentId: parentId,
-            NextToken: nextToken
-          })
-        );
-        organizationalUnits.push(
-          ...(result.OrganizationalUnits ?? []).map((ou) => ({
-            id: ou.Id ?? "",
-            name: ou.Name ?? "",
-            arn: ou.Arn,
-            parentId
-          }))
-        );
-        nextToken = result.NextToken;
-      } while (nextToken);
-      return organizationalUnits;
-    } catch (error) {
-      handleAwsError(error, `listOrganizationalUnits(${parentId})`);
-    }
-  }
-  async findOrganizationalUnitByName(parentId, name) {
-    const organizationalUnits = await this.listOrganizationalUnits(parentId);
-    return organizationalUnits.find((ou) => ou.name === name) ?? null;
-  }
-  async ensureOrganizationalUnit(input) {
-    const existing = await this.findOrganizationalUnitByName(
-      input.parentId,
-      input.name
-    );
-    if (existing) {
-      if (input.tags) {
-        await this.tagAwsOrganizationsResource(existing.id, input.tags);
-      }
-      return existing;
-    }
-    return this.createOrganizationalUnit(input);
-  }
-  // ==========================================================================
-  // Accounts (AwsDirectoryAdapter)
-  // ==========================================================================
-  async createAccount(input) {
-    try {
-      const result = await this.orgs.send(
-        new CreateAccountCommand({
-          AccountName: input.name,
-          Email: input.email,
-          ...input.roleName ? { RoleName: input.roleName } : {},
-          Tags: toAwsTags(input.tags)
-        })
-      );
-      const status = result.CreateAccountStatus;
-      if (!status?.Id) {
-        throw new DirectoryError(
-          `createAccount(${input.name}) did not return a create account request id`,
-          "AWS_ACCOUNT_CREATION_REQUEST_ID_MISSING",
-          "aws"
-        );
-      }
-      return {
-        id: status.Id,
-        accountId: status?.AccountId,
-        state: status?.State ?? "IN_PROGRESS",
-        failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
-      };
-    } catch (error) {
-      handleAwsError(error, `createAccount(${input.name})`);
-    }
-  }
-  async getAccountCreationStatus(id) {
-    try {
-      const result = await this.orgs.send(
-        new DescribeCreateAccountStatusCommand({
-          CreateAccountRequestId: id
-        })
-      );
-      const status = result.CreateAccountStatus;
-      return {
-        id: status?.Id ?? "",
-        accountId: status?.AccountId,
-        state: status?.State ?? "IN_PROGRESS",
-        failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
-      };
-    } catch (error) {
-      handleAwsError(error, `getAccountCreationStatus(${id})`);
-    }
-  }
-  async listAccounts() {
-    try {
-      const accounts = [];
-      let nextToken;
-      do {
-        const result = await this.orgs.send(
-          new ListAccountsCommand({ NextToken: nextToken })
-        );
-        accounts.push(...(result.Accounts ?? []).map((a) => mapAwsAccount(a)));
-        nextToken = result.NextToken;
-      } while (nextToken);
-      return accounts;
-    } catch (error) {
-      handleAwsError(error, "listAccounts");
-    }
-  }
-  async findAccountByEmail(email) {
-    const accounts = await this.listAccounts();
-    return accounts.find(
-      (account) => account.email.toLowerCase() === email.toLowerCase()
-    ) ?? null;
-  }
-  async ensureAccount(input) {
-    const existing = await this.findAccountByEmail(input.email);
-    if (existing) {
-      if (input.tags) {
-        await this.tagAwsOrganizationsResource(existing.id, input.tags);
-      }
-      return existing;
-    }
-    const createStatus = await this.createAccount(input);
-    const finalStatus = await this.waitForAccountCreation(
-      createStatus.id,
-      input.wait
-    );
-    if (finalStatus.state !== "SUCCEEDED" || !finalStatus.accountId) {
-      throw new DirectoryError(
-        `ensureAccount(${input.email}) failed: ${finalStatus.failureReason ?? finalStatus.state}`,
-        "AWS_ACCOUNT_CREATION_FAILED",
-        "aws"
-      );
-    }
-    const created = await this.findAccountByEmail(input.email);
-    if (created) {
-      return created;
-    }
-    return {
-      id: finalStatus.accountId,
-      name: input.name,
-      email: input.email,
-      status: "ACTIVE"
-    };
-  }
-  async waitForAccountCreation(id, options = {}) {
-    const timeoutMs = options.timeoutMs ?? DEFAULT_ACCOUNT_CREATION_TIMEOUT_MS;
-    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_ACCOUNT_CREATION_POLL_INTERVAL_MS;
-    const startedAt = Date.now();
-    while (true) {
-      const status = await this.getAccountCreationStatus(id);
-      if (status.state !== "IN_PROGRESS") {
-        return status;
-      }
-      if (Date.now() - startedAt >= timeoutMs) {
-        throw new DirectoryError(
-          `waitForAccountCreation(${id}) timed out after ${timeoutMs}ms`,
-          "AWS_ACCOUNT_CREATION_TIMEOUT",
-          "aws"
-        );
-      }
-      await sleep(pollIntervalMs);
-    }
-  }
-  async getAccountParent(accountId) {
-    try {
-      const result = await this.orgs.send(
-        new ListParentsCommand({ ChildId: accountId })
-      );
-      const parent = result.Parents?.[0];
-      if (!parent?.Id) {
-        return null;
-      }
-      return {
-        id: parent.Id,
-        type: parent.Type ? String(parent.Type) : ""
-      };
-    } catch (error) {
-      handleAwsError(error, `getAccountParent(${accountId})`);
-    }
-  }
-  async ensureAccountInOrganizationalUnit(accountId, destinationParentId) {
-    const currentParent = await this.getAccountParent(accountId);
-    if (currentParent?.id === destinationParentId) {
-      return;
-    }
-    if (!currentParent?.id) {
-      throw new DirectoryError(
-        `ensureAccountInOrganizationalUnit(${accountId}) could not determine the current account parent`,
-        "AWS_ACCOUNT_PARENT_MISSING",
-        "aws"
-      );
-    }
-    await this.moveAccount(accountId, currentParent.id, destinationParentId);
-  }
-  async moveAccount(accountId, sourceParentId, destParentId) {
-    try {
-      await this.orgs.send(
-        new MoveAccountCommand({
-          AccountId: accountId,
-          SourceParentId: sourceParentId,
-          DestinationParentId: destParentId
-        })
-      );
-    } catch (error) {
-      handleAwsError(
-        error,
-        `moveAccount(${accountId}, ${sourceParentId} -> ${destParentId})`
-      );
-    }
-  }
-  async tagAwsOrganizationsResource(resourceId, tags) {
-    const awsTags = toAwsTags(tags);
-    if (!awsTags) {
-      return;
-    }
-    try {
-      await this.orgs.send(
-        new TagResourceCommand({
-          ResourceId: resourceId,
-          Tags: awsTags
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `tagAwsOrganizationsResource(${resourceId})`);
-    }
-  }
-  // ==========================================================================
-  // STS (AwsDirectoryAdapter)
-  // ==========================================================================
-  async assumeAwsRole(input) {
-    try {
-      const result = await this.sts.send(
-        new AssumeRoleCommand({
-          RoleArn: input.roleArn,
-          RoleSessionName: input.sessionName,
-          ...input.externalId ? { ExternalId: input.externalId } : {},
-          ...input.durationSeconds ? { DurationSeconds: input.durationSeconds } : {}
-        })
-      );
-      const credentials = result.Credentials;
-      if (!credentials?.AccessKeyId || !credentials.SecretAccessKey || !credentials.SessionToken) {
-        throw new DirectoryError(
-          `assumeAwsRole(${input.roleArn}) returned incomplete credentials`,
-          "AWS_ASSUME_ROLE_INCOMPLETE_CREDENTIALS",
-          "aws"
-        );
-      }
-      return {
-        accessKeyId: credentials.AccessKeyId,
-        secretAccessKey: credentials.SecretAccessKey,
-        sessionToken: credentials.SessionToken,
-        expiration: credentials.Expiration,
-        assumedRoleArn: result.AssumedRoleUser?.Arn,
-        assumedRoleId: result.AssumedRoleUser?.AssumedRoleId
-      };
-    } catch (error) {
-      handleAwsError(error, `assumeAwsRole(${input.roleArn})`);
-    }
-  }
-  // ==========================================================================
-  // IAM Roles (AwsDirectoryAdapter)
-  // ==========================================================================
-  async getIamRole(roleName) {
-    try {
-      const result = await this.iam.send(
-        new GetRoleCommand({ RoleName: roleName })
-      );
-      return mapAwsIamRole(result.Role ?? {});
-    } catch (error) {
-      handleAwsError(error, `getIamRole(${roleName})`);
-    }
-  }
-  async ensureIamRole(input) {
-    try {
-      await this.getIamRole(input.roleName);
-      await this.iam.send(
-        new UpdateAssumeRolePolicyCommand({
-          RoleName: input.roleName,
-          PolicyDocument: input.assumeRolePolicyDocument
-        })
-      );
-      if (input.description !== void 0) {
-        await this.iam.send(
-          new UpdateRoleCommand({
-            RoleName: input.roleName,
-            Description: input.description
-          })
-        );
-      }
-      const tags = toAwsTags(input.tags);
-      if (tags) {
-        await this.iam.send(
-          new TagRoleCommand({
-            RoleName: input.roleName,
-            Tags: tags
-          })
-        );
-      }
-      return this.getIamRole(input.roleName);
-    } catch (error) {
-      if (!(error instanceof NotFoundError)) {
-        throw error;
-      }
-    }
-    try {
-      const result = await this.iam.send(
-        new CreateRoleCommand({
-          RoleName: input.roleName,
-          AssumeRolePolicyDocument: input.assumeRolePolicyDocument,
-          ...input.description ? { Description: input.description } : {},
-          ...input.path ? { Path: input.path } : {},
-          Tags: toAwsTags(input.tags)
-        })
-      );
-      return mapAwsIamRole(result.Role ?? {});
-    } catch (error) {
-      handleAwsError(error, `ensureIamRole(${input.roleName})`);
-    }
-  }
-  async putIamRolePolicy(input) {
-    try {
-      await this.iam.send(
-        new PutRolePolicyCommand({
-          RoleName: input.roleName,
-          PolicyName: input.policyName,
-          PolicyDocument: input.policyDocument
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `putIamRolePolicy(${input.roleName})`);
-    }
-  }
-  // ==========================================================================
-  // IAM Users (AwsDirectoryAdapter)
-  // ==========================================================================
-  async createIamUser(input) {
-    try {
-      const result = await this.iam.send(
-        new CreateUserCommand({
-          UserName: input.username,
-          ...input.path ? { Path: input.path } : {}
-        })
-      );
-      return mapIamUserToAwsIamUser(result.User ?? {});
-    } catch (error) {
-      handleAwsError(error, `createIamUser(${input.username})`);
-    }
-  }
-  async getIamUser(username) {
-    try {
-      const result = await this.iam.send(
-        new GetUserCommand({ UserName: username })
-      );
-      return mapIamUserToAwsIamUser(result.User ?? {});
-    } catch (error) {
-      handleAwsError(error, `getIamUser(${username})`);
-    }
-  }
-  async deleteIamUser(username) {
-    try {
-      await this.iam.send(new DeleteUserCommand({ UserName: username }));
-    } catch (error) {
-      handleAwsError(error, `deleteIamUser(${username})`);
-    }
-  }
-  async listIamUsers() {
-    try {
-      const result = await this.iam.send(new ListUsersCommand({}));
-      return (result.Users ?? []).map((u) => mapIamUserToAwsIamUser(u));
-    } catch (error) {
-      handleAwsError(error, "listIamUsers");
-    }
-  }
-  // ==========================================================================
-  // IAM Policies (AwsDirectoryAdapter)
-  // ==========================================================================
-  async attachUserPolicy(username, policyArn) {
-    try {
-      await this.iam.send(
-        new AttachUserPolicyCommand({
-          UserName: username,
-          PolicyArn: policyArn
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `attachUserPolicy(${username}, ${policyArn})`);
-    }
-  }
-  async detachUserPolicy(username, policyArn) {
-    try {
-      await this.iam.send(
-        new DetachUserPolicyCommand({
-          UserName: username,
-          PolicyArn: policyArn
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `detachUserPolicy(${username}, ${policyArn})`);
-    }
-  }
-  // ==========================================================================
-  // Access Keys (AwsDirectoryAdapter)
-  // ==========================================================================
-  async createAccessKey(username) {
-    try {
-      const result = await this.iam.send(
-        new CreateAccessKeyCommand({ UserName: username })
-      );
-      const key = result.AccessKey;
-      return {
-        accessKeyId: key?.AccessKeyId ?? "",
-        secretAccessKey: key?.SecretAccessKey ?? "",
-        username: key?.UserName ?? username,
-        createDate: key?.CreateDate
-      };
-    } catch (error) {
-      handleAwsError(error, `createAccessKey(${username})`);
-    }
-  }
-  async deleteAccessKey(username, accessKeyId) {
-    try {
-      await this.iam.send(
-        new DeleteAccessKeyCommand({
-          UserName: username,
-          AccessKeyId: accessKeyId
-        })
-      );
-    } catch (error) {
-      handleAwsError(error, `deleteAccessKey(${username}, ${accessKeyId})`);
-    }
-  }
+	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-const aws = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  AwsAdapter
-}, Symbol.toStringTag, { value: "Module" }));
-class KanidmAdapter {
-  constructor(options) {
-    this.options = options;
-    if (!options.apiToken && (!options.adminUsername || !options.adminPassword)) {
-      throw new ValidationError(
-        "KanidmAdapter requires either apiToken or both adminUsername and adminPassword",
-        "kanidm"
-      );
-    }
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-    this.timeout = options.timeout ?? 3e4;
-  }
-  baseUrl;
-  timeout;
-  adminToken = null;
-  adminTokenExpiry = 0;
-  // ==========================================================================
-  // Authentication
-  // ==========================================================================
-  async getAdminToken() {
-    if (this.options.apiToken) {
-      return this.options.apiToken;
-    }
-    if (this.adminToken && Date.now() < this.adminTokenExpiry) {
-      return this.adminToken;
-    }
-    const authUrl = `${this.baseUrl}/v1/auth`;
-    const initResponse = await fetch(authUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        step: {
-          init2: {
-            username: this.options.adminUsername,
-            issue: "token",
-            privileged: true
-          }
-        }
-      }),
-      signal: AbortSignal.timeout(this.timeout)
-    });
-    if (!initResponse.ok) {
-      throw new AuthenticationError(
-        "Failed to initialize admin authentication",
-        "kanidm"
-      );
-    }
-    const cookies = initResponse.headers.get("set-cookie");
-    const beginResponse = await fetch(authUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...cookies ? { Cookie: cookies } : {}
-      },
-      body: JSON.stringify({ step: { begin: "password" } }),
-      signal: AbortSignal.timeout(this.timeout)
-    });
-    if (!beginResponse.ok) {
-      throw new AuthenticationError(
-        "Failed to begin password authentication",
-        "kanidm"
-      );
-    }
-    const credResponse = await fetch(authUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...cookies ? { Cookie: cookies } : {}
-      },
-      body: JSON.stringify({
-        step: { cred: { password: this.options.adminPassword } }
-      }),
-      signal: AbortSignal.timeout(this.timeout)
-    });
-    if (!credResponse.ok) {
-      throw new AuthenticationError("Invalid admin credentials", "kanidm");
-    }
-    const result = await credResponse.json();
-    const token = result.state?.success || result.token;
-    if (!token) {
-      throw new AuthenticationError("Failed to obtain admin token", "kanidm");
-    }
-    this.adminToken = token;
-    this.adminTokenExpiry = Date.now() + 36e5;
-    return this.adminToken;
-  }
-  // ==========================================================================
-  // HTTP Helper
-  // ==========================================================================
-  async request(method, path, body) {
-    const token = await this.getAdminToken();
-    const url = `${this.baseUrl}${path}`;
-    let response;
-    try {
-      response = await fetch(url, {
-        method,
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${token}`
-        },
-        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
-        signal: AbortSignal.timeout(this.timeout)
-      });
-    } catch (error) {
-      if (error instanceof TypeError) {
-        throw new ConnectionError(
-          `Failed to connect to Kanidm at ${this.baseUrl}`,
-          "kanidm",
-          error
-        );
-      }
-      throw error;
-    }
-    if (response.ok) {
-      const text = await response.text();
-      if (!text) return void 0;
-      return JSON.parse(text);
-    }
-    const errorBody = await response.text().catch(() => "");
-    switch (response.status) {
-      case 401:
-      case 403:
-        this.adminToken = null;
-        this.adminTokenExpiry = 0;
-        throw new AuthenticationError(
-          errorBody || `Authentication failed: ${response.status}`,
-          "kanidm"
-        );
-      case 404:
-        throw new NotFoundError("resource", path, "kanidm");
-      case 409:
-        throw new ConflictError("resource", path, "kanidm");
-      default:
-        throw new DirectoryError(
-          errorBody || `Request failed: ${response.status} ${response.statusText}`,
-          "REQUEST_ERROR",
-          "kanidm"
-        );
-    }
-  }
-  // ==========================================================================
-  // Mapping Helpers
-  // ==========================================================================
-  mapPersonToUser(data) {
-    const attrs = data.attrs;
-    return {
-      id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "name") ?? "",
-      username: this.attrFirst(attrs, "name") ?? "",
-      displayName: this.attrFirst(attrs, "displayname"),
-      email: this.attrFirst(attrs, "mail"),
-      active: this.attrFirst(attrs, "class") ? !attrs.class?.includes("recycled") : true,
-      groups: attrs.memberof,
-      metadata: { attrs }
-    };
-  }
-  mapGroupToDirectoryGroup(data) {
-    const attrs = data.attrs;
-    return {
-      id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "name") ?? "",
-      name: this.attrFirst(attrs, "name") ?? "",
-      displayName: this.attrFirst(attrs, "displayname"),
-      description: this.attrFirst(attrs, "description"),
-      members: attrs.member,
-      metadata: { attrs }
-    };
-  }
-  mapOAuth2Client(data) {
-    const attrs = data.attrs;
-    return {
-      id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "oauth2_rs_name") ?? "",
-      name: this.attrFirst(attrs, "oauth2_rs_name") ?? "",
-      displayName: this.attrFirst(attrs, "displayname"),
-      redirectUris: attrs.oauth2_rs_origin ?? [],
-      scopes: attrs.oauth2_rs_scope_map ? attrs.oauth2_rs_scope_map : void 0,
-      metadata: { attrs }
-    };
-  }
-  attrFirst(attrs, key) {
-    const values = attrs[key];
-    return values?.[0];
-  }
-  // ==========================================================================
-  // Connection
-  // ==========================================================================
-  async testConnection() {
-    try {
-      await this.getAdminToken();
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async disconnect() {
-    this.adminToken = null;
-    this.adminTokenExpiry = 0;
-  }
-  // ==========================================================================
-  // User CRUD
-  // ==========================================================================
-  async createUser(input) {
-    const body = {
-      attrs: {
-        name: [input.username],
-        ...input.displayName ? { displayname: [input.displayName] } : {},
-        ...input.email ? { mail: [input.email] } : {},
-        ...input.metadata ?? {}
-      }
-    };
-    await this.request("POST", "/v1/person", body);
-    return this.getUser(input.username);
-  }
-  async getUser(id) {
-    const data = await this.request(
-      "GET",
-      `/v1/person/${encodeURIComponent(id)}`
-    );
-    return this.mapPersonToUser(data);
-  }
-  async updateUser(id, input) {
-    const attrs = {};
-    if (input.displayName !== void 0) {
-      attrs.displayname = [input.displayName];
-    }
-    if (input.email !== void 0) {
-      attrs.mail = [input.email];
-    }
-    await this.request("PATCH", `/v1/person/${encodeURIComponent(id)}`, {
-      attrs
-    });
-    return this.getUser(id);
-  }
-  async deleteUser(id) {
-    await this.request("DELETE", `/v1/person/${encodeURIComponent(id)}`);
-  }
-  async listUsers() {
-    const data = await this.request("GET", "/v1/person");
-    return (data ?? []).map((entry) => this.mapPersonToUser(entry));
-  }
-  // ==========================================================================
-  // Group CRUD
-  // ==========================================================================
-  async createGroup(input) {
-    const body = {
-      attrs: {
-        name: [input.name],
-        ...input.displayName ? { displayname: [input.displayName] } : {},
-        ...input.description ? { description: [input.description] } : {},
-        ...input.members ? { member: input.members } : {},
-        ...input.metadata ?? {}
-      }
-    };
-    await this.request("POST", "/v1/group", body);
-    return this.getGroup(input.name);
-  }
-  async getGroup(id) {
-    const data = await this.request(
-      "GET",
-      `/v1/group/${encodeURIComponent(id)}`
-    );
-    return this.mapGroupToDirectoryGroup(data);
-  }
-  async updateGroup(id, input) {
-    const attrs = {};
-    if (input.displayName !== void 0) {
-      attrs.displayname = [input.displayName];
-    }
-    if (input.description !== void 0) {
-      attrs.description = [input.description];
-    }
-    await this.request("PATCH", `/v1/group/${encodeURIComponent(id)}`, {
-      attrs
-    });
-    return this.getGroup(id);
-  }
-  async deleteGroup(id) {
-    await this.request("DELETE", `/v1/group/${encodeURIComponent(id)}`);
-  }
-  async listGroups() {
-    const data = await this.request("GET", "/v1/group");
-    return (data ?? []).map((entry) => this.mapGroupToDirectoryGroup(entry));
-  }
-  // ==========================================================================
-  // Membership
-  // ==========================================================================
-  async addUserToGroup(userId, groupId) {
-    await this.request(
-      "POST",
-      `/v1/group/${encodeURIComponent(groupId)}/_attr/member`,
-      [userId]
-    );
-  }
-  async removeUserFromGroup(userId, groupId) {
-    await this.request(
-      "DELETE",
-      `/v1/group/${encodeURIComponent(groupId)}/_attr/member`,
-      [userId]
-    );
-  }
-  async getGroupMembers(groupId) {
-    const group = await this.getGroup(groupId);
-    if (!group.members || group.members.length === 0) {
-      return [];
-    }
-    const users = [];
-    for (const memberId of group.members) {
-      try {
-        const user = await this.getUser(memberId);
-        users.push(user);
-      } catch (error) {
-        if (!(error instanceof NotFoundError)) {
-          throw error;
-        }
-      }
-    }
-    return users;
-  }
-  async getUserGroups(userId) {
-    const user = await this.getUser(userId);
-    if (!user.groups || user.groups.length === 0) {
-      return [];
-    }
-    const groups = [];
-    for (const groupId of user.groups) {
-      try {
-        const group = await this.getGroup(groupId);
-        groups.push(group);
-      } catch (error) {
-        if (!(error instanceof NotFoundError)) {
-          throw error;
-        }
-      }
-    }
-    return groups;
-  }
-  // ==========================================================================
-  // OAuth2 Client CRUD
-  // ==========================================================================
-  async createOAuth2Client(input) {
-    const body = {
-      attrs: {
-        oauth2_rs_name: [input.name],
-        ...input.displayName ? { displayname: [input.displayName] } : {},
-        oauth2_rs_origin: input.redirectUris,
-        ...input.scopes ? { oauth2_rs_scope_map: input.scopes } : {}
-      }
-    };
-    await this.request("POST", "/v1/oauth2", body);
-    return this.getOAuth2Client(input.name);
-  }
-  async getOAuth2Client(id) {
-    const data = await this.request(
-      "GET",
-      `/v1/oauth2/${encodeURIComponent(id)}`
-    );
-    return this.mapOAuth2Client(data);
-  }
-  async updateOAuth2Client(id, input) {
-    const attrs = {};
-    if (input.displayName !== void 0) {
-      attrs.displayname = [input.displayName];
-    }
-    if (input.redirectUris !== void 0) {
-      attrs.oauth2_rs_origin = input.redirectUris;
-    }
-    if (input.scopes !== void 0) {
-      attrs.oauth2_rs_scope_map = input.scopes;
-    }
-    await this.request("PATCH", `/v1/oauth2/${encodeURIComponent(id)}`, {
-      attrs
-    });
-    return this.getOAuth2Client(id);
-  }
-  async deleteOAuth2Client(id) {
-    await this.request("DELETE", `/v1/oauth2/${encodeURIComponent(id)}`);
-  }
-  async listOAuth2Clients() {
-    const data = await this.request("GET", "/v1/oauth2");
-    return (data ?? []).map((entry) => this.mapOAuth2Client(entry));
-  }
-  // ==========================================================================
-  // OAuth2 Secret Management
-  // ==========================================================================
-  async getOAuth2ClientSecret(id) {
-    const data = await this.request(
-      "GET",
-      `/v1/oauth2/${encodeURIComponent(id)}/_basic_secret`
-    );
-    return data;
-  }
-  // ==========================================================================
-  // Credential Management
-  // ==========================================================================
-  async createCredentialResetIntent(userId, options) {
-    const ttl = options?.ttl ?? 3600;
-    const token = await this.request(
-      "GET",
-      `/v1/person/${encodeURIComponent(userId)}/_credential/_update_intent/${ttl}`
-    );
-    return {
-      token,
-      url: `${this.baseUrl}/ui/reset?token=${encodeURIComponent(token)}`,
-      ttl
-    };
-  }
-}
-const kanidm = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  KanidmAdapter
-}, Symbol.toStringTag, { value: "Module" }));
-const { Client } = pg;
-const PROVIDER$1 = "postgres";
-const SYSTEM_ROLE_PREFIX = "pg_";
-const SYSTEM_ROLES = /* @__PURE__ */ new Set(["postgres"]);
-const SYSTEM_DATABASES = /* @__PURE__ */ new Set(["template0", "template1", "postgres"]);
-class PostgresAdapter {
-  options;
-  client = null;
-  constructor(options) {
-    this.options = options;
-  }
-  // ==========================================================================
-  // Private Helpers
-  // ==========================================================================
-  /**
-   * Escape a SQL identifier by wrapping in double quotes and escaping
-   * any embedded double quotes. Used for DDL statements where
-   * parameterized queries are not supported.
-   */
-  escapeIdentifier(name) {
-    return `"${name.replace(/"/g, '""')}"`;
-  }
-  /**
-   * Escape a SQL string literal by wrapping in single quotes and escaping
-   * any embedded single quotes. Used for DDL statements (e.g., passwords)
-   * where parameterized queries are not supported.
-   */
-  escapeLiteral(value) {
-    return `'${value.replace(/'/g, "''")}'`;
-  }
-  /**
-   * Get or create the pg.Client instance. Connects lazily on first use.
-   */
-  async getClient() {
-    if (this.client) {
-      return this.client;
-    }
-    try {
-      this.client = new Client({
-        host: this.options.host,
-        port: this.options.port ?? 5432,
-        user: this.options.adminUser,
-        password: this.options.adminPassword,
-        database: this.options.database ?? "postgres",
-        ssl: this.options.ssl ? typeof this.options.ssl === "object" ? this.options.ssl : { rejectUnauthorized: false } : void 0
-      });
-      await this.client.connect();
-      return this.client;
-    } catch (error) {
-      this.client = null;
-      throw this.mapError(error);
-    }
-  }
-  /**
-   * Check if a role name is a system role that should be excluded from lists.
-   */
-  isSystemRole(rolname) {
-    return rolname.startsWith(SYSTEM_ROLE_PREFIX) || SYSTEM_ROLES.has(rolname);
-  }
-  /**
-   * Map a pg_roles row to a DirectoryUser.
-   */
-  rowToUser(row) {
-    return {
-      id: row.rolname,
-      username: row.rolname,
-      active: true,
-      metadata: {
-        superuser: row.rolsuper,
-        createDb: row.rolcreatedb,
-        createRole: row.rolcreaterole
-      }
-    };
-  }
-  /**
-   * Map a pg_roles row to a DirectoryGroup.
-   */
-  rowToGroup(row) {
-    return {
-      id: row.rolname,
-      name: row.rolname,
-      metadata: {
-        superuser: row.rolsuper,
-        createDb: row.rolcreatedb,
-        createRole: row.rolcreaterole
-      }
-    };
-  }
-  /**
-   * Map a pg_roles row to a PgRole.
-   */
-  rowToPgRole(row) {
-    return {
-      name: row.rolname,
-      login: row.rolcanlogin,
-      superuser: row.rolsuper,
-      createDb: row.rolcreatedb,
-      createRole: row.rolcreaterole
-    };
-  }
-  /**
-   * Map a pg_database row to a PgDatabase.
-   */
-  rowToDatabase(row) {
-    return {
-      name: row.datname,
-      owner: row.owner,
-      encoding: row.encoding,
-      size: row.size
-    };
-  }
-  /**
-   * Map PostgreSQL errors to directory error classes.
-   */
-  mapError(error) {
-    if (error instanceof DirectoryError) {
-      return error;
-    }
-    const pgError = error;
-    switch (pgError.code) {
-      case "42710":
-        return new ConflictError(
-          "role",
-          pgError.message ?? "unknown",
-          PROVIDER$1,
-          error
-        );
-      case "42704":
-        return new NotFoundError(
-          "role",
-          pgError.message ?? "unknown",
-          PROVIDER$1,
-          error
-        );
-      case "28P01":
-        return new AuthenticationError(
-          pgError.message ?? "Invalid password",
-          PROVIDER$1,
-          error
-        );
-    }
-    const message = pgError.message ?? (error instanceof Error ? error.message : String(error));
-    if (message.includes("ECONNREFUSED") || message.includes("connect ETIMEDOUT") || message.includes("getaddrinfo")) {
-      return new ConnectionError(
-        `Failed to connect to PostgreSQL: ${message}`,
-        PROVIDER$1,
-        error
-      );
-    }
-    return new DirectoryError(message, "UNKNOWN_ERROR", PROVIDER$1, error);
-  }
-  // ==========================================================================
-  // Connection
-  // ==========================================================================
-  async testConnection() {
-    try {
-      const client = await this.getClient();
-      await client.query("SELECT 1");
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async disconnect() {
-    if (this.client) {
-      await this.client.end();
-      this.client = null;
-    }
-  }
-  // ==========================================================================
-  // User CRUD (PostgreSQL roles WITH LOGIN)
-  // ==========================================================================
-  async createUser(input) {
-    const client = await this.getClient();
-    try {
-      let sql = `CREATE ROLE ${this.escapeIdentifier(input.username)} WITH LOGIN`;
-      if (input.password) {
-        sql += ` PASSWORD ${this.escapeLiteral(input.password)}`;
-      }
-      await client.query(sql);
-      return this.getUser(input.username);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async getUser(id) {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+var AwsAdapter = class {
+	options;
+	orgs;
+	iam;
+	sts;
+	constructor(options) {
+		this.options = options;
+		const clientConfig = {
+			region: options.region,
+			...options.credentials ? { credentials: options.credentials } : {}
+		};
+		this.orgs = new OrganizationsClient(clientConfig);
+		this.iam = new IAMClient(clientConfig);
+		this.sts = new STSClient(clientConfig);
+	}
+	async testConnection() {
+		try {
+			await this.iam.send(new ListUsersCommand({ MaxItems: 1 }));
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async disconnect() {}
+	async createUser(input) {
+		try {
+			const tags = [];
+			if (input.displayName) tags.push({
+				Key: "DisplayName",
+				Value: input.displayName
+			});
+			if (input.email) tags.push({
+				Key: "Email",
+				Value: input.email
+			});
+			return mapIamUserToDirectoryUser({
+				...(await this.iam.send(new CreateUserCommand({
+					UserName: input.username,
+					...tags.length > 0 ? { Tags: tags } : {}
+				}))).User,
+				Tags: tags
+			});
+		} catch (error) {
+			handleAwsError(error, `createUser(${input.username})`);
+		}
+	}
+	async getUser(id) {
+		try {
+			return mapIamUserToDirectoryUser((await this.iam.send(new GetUserCommand({ UserName: id }))).User ?? {});
+		} catch (error) {
+			handleAwsError(error, `getUser(${id})`);
+		}
+	}
+	async updateUser(id, _input) {
+		try {
+			await this.iam.send(new UpdateUserCommand({ UserName: id }));
+			return this.getUser(id);
+		} catch (error) {
+			handleAwsError(error, `updateUser(${id})`);
+		}
+	}
+	async deleteUser(id) {
+		try {
+			await this.iam.send(new DeleteUserCommand({ UserName: id }));
+		} catch (error) {
+			handleAwsError(error, `deleteUser(${id})`);
+		}
+	}
+	async listUsers() {
+		try {
+			return ((await this.iam.send(new ListUsersCommand({}))).Users ?? []).map((u) => mapIamUserToDirectoryUser(u));
+		} catch (error) {
+			handleAwsError(error, "listUsers");
+		}
+	}
+	async createGroup(input) {
+		try {
+			const group = mapIamGroupToDirectoryGroup((await this.iam.send(new CreateGroupCommand({ GroupName: input.name }))).Group ?? {});
+			if (input.members) for (const memberId of input.members) await this.addUserToGroup(memberId, input.name);
+			return group;
+		} catch (error) {
+			handleAwsError(error, `createGroup(${input.name})`);
+		}
+	}
+	async getGroup(id) {
+		try {
+			const result = await this.iam.send(new GetGroupCommand({ GroupName: id }));
+			const group = mapIamGroupToDirectoryGroup(result.Group ?? {});
+			group.members = (result.Users ?? []).map((u) => u.UserName ?? "");
+			return group;
+		} catch (error) {
+			handleAwsError(error, `getGroup(${id})`);
+		}
+	}
+	async updateGroup(id, _input) {
+		return this.getGroup(id);
+	}
+	async deleteGroup(id) {
+		try {
+			await this.iam.send(new DeleteGroupCommand({ GroupName: id }));
+		} catch (error) {
+			handleAwsError(error, `deleteGroup(${id})`);
+		}
+	}
+	async listGroups() {
+		try {
+			return ((await this.iam.send(new ListGroupsCommand({}))).Groups ?? []).map((g) => mapIamGroupToDirectoryGroup(g));
+		} catch (error) {
+			handleAwsError(error, "listGroups");
+		}
+	}
+	async addUserToGroup(userId, groupId) {
+		try {
+			await this.iam.send(new AddUserToGroupCommand({
+				UserName: userId,
+				GroupName: groupId
+			}));
+		} catch (error) {
+			handleAwsError(error, `addUserToGroup(${userId}, ${groupId})`);
+		}
+	}
+	async removeUserFromGroup(userId, groupId) {
+		try {
+			await this.iam.send(new RemoveUserFromGroupCommand({
+				UserName: userId,
+				GroupName: groupId
+			}));
+		} catch (error) {
+			handleAwsError(error, `removeUserFromGroup(${userId}, ${groupId})`);
+		}
+	}
+	async getGroupMembers(groupId) {
+		try {
+			return ((await this.iam.send(new GetGroupCommand({ GroupName: groupId }))).Users ?? []).map((u) => mapIamUserToDirectoryUser(u));
+		} catch (error) {
+			handleAwsError(error, `getGroupMembers(${groupId})`);
+		}
+	}
+	async getUserGroups(userId) {
+		try {
+			return ((await this.iam.send(new ListGroupsForUserCommand({ UserName: userId }))).Groups ?? []).map((g) => mapIamGroupToDirectoryGroup(g));
+		} catch (error) {
+			handleAwsError(error, `getUserGroups(${userId})`);
+		}
+	}
+	async createOrganizationalUnit(input) {
+		try {
+			const ou = (await this.orgs.send(new CreateOrganizationalUnitCommand({
+				ParentId: input.parentId,
+				Name: input.name,
+				Tags: toAwsTags(input.tags)
+			}))).OrganizationalUnit;
+			return {
+				id: ou?.Id ?? "",
+				name: ou?.Name ?? "",
+				arn: ou?.Arn,
+				parentId: input.parentId
+			};
+		} catch (error) {
+			handleAwsError(error, `createOrganizationalUnit(${input.name})`);
+		}
+	}
+	async getOrganizationalUnit(id) {
+		try {
+			const ou = (await this.orgs.send(new DescribeOrganizationalUnitCommand({ OrganizationalUnitId: id }))).OrganizationalUnit;
+			return {
+				id: ou?.Id ?? "",
+				name: ou?.Name ?? "",
+				arn: ou?.Arn
+			};
+		} catch (error) {
+			handleAwsError(error, `getOrganizationalUnit(${id})`);
+		}
+	}
+	async listOrganizationalUnits(parentId) {
+		try {
+			const organizationalUnits = [];
+			let nextToken;
+			do {
+				const result = await this.orgs.send(new ListOrganizationalUnitsForParentCommand({
+					ParentId: parentId,
+					NextToken: nextToken
+				}));
+				organizationalUnits.push(...(result.OrganizationalUnits ?? []).map((ou) => ({
+					id: ou.Id ?? "",
+					name: ou.Name ?? "",
+					arn: ou.Arn,
+					parentId
+				})));
+				nextToken = result.NextToken;
+			} while (nextToken);
+			return organizationalUnits;
+		} catch (error) {
+			handleAwsError(error, `listOrganizationalUnits(${parentId})`);
+		}
+	}
+	async findOrganizationalUnitByName(parentId, name) {
+		return (await this.listOrganizationalUnits(parentId)).find((ou) => ou.name === name) ?? null;
+	}
+	async ensureOrganizationalUnit(input) {
+		const existing = await this.findOrganizationalUnitByName(input.parentId, input.name);
+		if (existing) {
+			if (input.tags) await this.tagAwsOrganizationsResource(existing.id, input.tags);
+			return existing;
+		}
+		return this.createOrganizationalUnit(input);
+	}
+	async createAccount(input) {
+		try {
+			const status = (await this.orgs.send(new CreateAccountCommand({
+				AccountName: input.name,
+				Email: input.email,
+				...input.roleName ? { RoleName: input.roleName } : {},
+				Tags: toAwsTags(input.tags)
+			}))).CreateAccountStatus;
+			if (!status?.Id) throw new DirectoryError(`createAccount(${input.name}) did not return a create account request id`, "AWS_ACCOUNT_CREATION_REQUEST_ID_MISSING", "aws");
+			return {
+				id: status.Id,
+				accountId: status?.AccountId,
+				state: status?.State ?? "IN_PROGRESS",
+				failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
+			};
+		} catch (error) {
+			handleAwsError(error, `createAccount(${input.name})`);
+		}
+	}
+	async getAccountCreationStatus(id) {
+		try {
+			const status = (await this.orgs.send(new DescribeCreateAccountStatusCommand({ CreateAccountRequestId: id }))).CreateAccountStatus;
+			return {
+				id: status?.Id ?? "",
+				accountId: status?.AccountId,
+				state: status?.State ?? "IN_PROGRESS",
+				failureReason: status?.FailureReason ? String(status.FailureReason) : void 0
+			};
+		} catch (error) {
+			handleAwsError(error, `getAccountCreationStatus(${id})`);
+		}
+	}
+	async listAccounts() {
+		try {
+			const accounts = [];
+			let nextToken;
+			do {
+				const result = await this.orgs.send(new ListAccountsCommand({ NextToken: nextToken }));
+				accounts.push(...(result.Accounts ?? []).map((a) => mapAwsAccount(a)));
+				nextToken = result.NextToken;
+			} while (nextToken);
+			return accounts;
+		} catch (error) {
+			handleAwsError(error, "listAccounts");
+		}
+	}
+	async findAccountByEmail(email) {
+		return (await this.listAccounts()).find((account) => account.email.toLowerCase() === email.toLowerCase()) ?? null;
+	}
+	async ensureAccount(input) {
+		const existing = await this.findAccountByEmail(input.email);
+		if (existing) {
+			if (input.tags) await this.tagAwsOrganizationsResource(existing.id, input.tags);
+			return existing;
+		}
+		const createStatus = await this.createAccount(input);
+		const finalStatus = await this.waitForAccountCreation(createStatus.id, input.wait);
+		if (finalStatus.state !== "SUCCEEDED" || !finalStatus.accountId) throw new DirectoryError(`ensureAccount(${input.email}) failed: ${finalStatus.failureReason ?? finalStatus.state}`, "AWS_ACCOUNT_CREATION_FAILED", "aws");
+		const created = await this.findAccountByEmail(input.email);
+		if (created) return created;
+		return {
+			id: finalStatus.accountId,
+			name: input.name,
+			email: input.email,
+			status: "ACTIVE"
+		};
+	}
+	async waitForAccountCreation(id, options = {}) {
+		const timeoutMs = options.timeoutMs ?? DEFAULT_ACCOUNT_CREATION_TIMEOUT_MS;
+		const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_ACCOUNT_CREATION_POLL_INTERVAL_MS;
+		const startedAt = Date.now();
+		while (true) {
+			const status = await this.getAccountCreationStatus(id);
+			if (status.state !== "IN_PROGRESS") return status;
+			if (Date.now() - startedAt >= timeoutMs) throw new DirectoryError(`waitForAccountCreation(${id}) timed out after ${timeoutMs}ms`, "AWS_ACCOUNT_CREATION_TIMEOUT", "aws");
+			await sleep(pollIntervalMs);
+		}
+	}
+	async getAccountParent(accountId) {
+		try {
+			const parent = (await this.orgs.send(new ListParentsCommand({ ChildId: accountId }))).Parents?.[0];
+			if (!parent?.Id) return null;
+			return {
+				id: parent.Id,
+				type: parent.Type ? String(parent.Type) : ""
+			};
+		} catch (error) {
+			handleAwsError(error, `getAccountParent(${accountId})`);
+		}
+	}
+	async ensureAccountInOrganizationalUnit(accountId, destinationParentId) {
+		const currentParent = await this.getAccountParent(accountId);
+		if (currentParent?.id === destinationParentId) return;
+		if (!currentParent?.id) throw new DirectoryError(`ensureAccountInOrganizationalUnit(${accountId}) could not determine the current account parent`, "AWS_ACCOUNT_PARENT_MISSING", "aws");
+		await this.moveAccount(accountId, currentParent.id, destinationParentId);
+	}
+	async moveAccount(accountId, sourceParentId, destParentId) {
+		try {
+			await this.orgs.send(new MoveAccountCommand({
+				AccountId: accountId,
+				SourceParentId: sourceParentId,
+				DestinationParentId: destParentId
+			}));
+		} catch (error) {
+			handleAwsError(error, `moveAccount(${accountId}, ${sourceParentId} -> ${destParentId})`);
+		}
+	}
+	async tagAwsOrganizationsResource(resourceId, tags) {
+		const awsTags = toAwsTags(tags);
+		if (!awsTags) return;
+		try {
+			await this.orgs.send(new TagResourceCommand({
+				ResourceId: resourceId,
+				Tags: awsTags
+			}));
+		} catch (error) {
+			handleAwsError(error, `tagAwsOrganizationsResource(${resourceId})`);
+		}
+	}
+	async assumeAwsRole(input) {
+		try {
+			const result = await this.sts.send(new AssumeRoleCommand({
+				RoleArn: input.roleArn,
+				RoleSessionName: input.sessionName,
+				...input.externalId ? { ExternalId: input.externalId } : {},
+				...input.durationSeconds ? { DurationSeconds: input.durationSeconds } : {}
+			}));
+			const credentials = result.Credentials;
+			if (!credentials?.AccessKeyId || !credentials.SecretAccessKey || !credentials.SessionToken) throw new DirectoryError(`assumeAwsRole(${input.roleArn}) returned incomplete credentials`, "AWS_ASSUME_ROLE_INCOMPLETE_CREDENTIALS", "aws");
+			return {
+				accessKeyId: credentials.AccessKeyId,
+				secretAccessKey: credentials.SecretAccessKey,
+				sessionToken: credentials.SessionToken,
+				expiration: credentials.Expiration,
+				assumedRoleArn: result.AssumedRoleUser?.Arn,
+				assumedRoleId: result.AssumedRoleUser?.AssumedRoleId
+			};
+		} catch (error) {
+			handleAwsError(error, `assumeAwsRole(${input.roleArn})`);
+		}
+	}
+	async getIamRole(roleName) {
+		try {
+			return mapAwsIamRole((await this.iam.send(new GetRoleCommand({ RoleName: roleName }))).Role ?? {});
+		} catch (error) {
+			handleAwsError(error, `getIamRole(${roleName})`);
+		}
+	}
+	async ensureIamRole(input) {
+		try {
+			await this.getIamRole(input.roleName);
+			await this.iam.send(new UpdateAssumeRolePolicyCommand({
+				RoleName: input.roleName,
+				PolicyDocument: input.assumeRolePolicyDocument
+			}));
+			if (input.description !== void 0) await this.iam.send(new UpdateRoleCommand({
+				RoleName: input.roleName,
+				Description: input.description
+			}));
+			const tags = toAwsTags(input.tags);
+			if (tags) await this.iam.send(new TagRoleCommand({
+				RoleName: input.roleName,
+				Tags: tags
+			}));
+			return this.getIamRole(input.roleName);
+		} catch (error) {
+			if (!(error instanceof NotFoundError)) throw error;
+		}
+		try {
+			return mapAwsIamRole((await this.iam.send(new CreateRoleCommand({
+				RoleName: input.roleName,
+				AssumeRolePolicyDocument: input.assumeRolePolicyDocument,
+				...input.description ? { Description: input.description } : {},
+				...input.path ? { Path: input.path } : {},
+				Tags: toAwsTags(input.tags)
+			}))).Role ?? {});
+		} catch (error) {
+			handleAwsError(error, `ensureIamRole(${input.roleName})`);
+		}
+	}
+	async putIamRolePolicy(input) {
+		try {
+			await this.iam.send(new PutRolePolicyCommand({
+				RoleName: input.roleName,
+				PolicyName: input.policyName,
+				PolicyDocument: input.policyDocument
+			}));
+		} catch (error) {
+			handleAwsError(error, `putIamRolePolicy(${input.roleName})`);
+		}
+	}
+	async createIamUser(input) {
+		try {
+			return mapIamUserToAwsIamUser((await this.iam.send(new CreateUserCommand({
+				UserName: input.username,
+				...input.path ? { Path: input.path } : {}
+			}))).User ?? {});
+		} catch (error) {
+			handleAwsError(error, `createIamUser(${input.username})`);
+		}
+	}
+	async getIamUser(username) {
+		try {
+			return mapIamUserToAwsIamUser((await this.iam.send(new GetUserCommand({ UserName: username }))).User ?? {});
+		} catch (error) {
+			handleAwsError(error, `getIamUser(${username})`);
+		}
+	}
+	async deleteIamUser(username) {
+		try {
+			await this.iam.send(new DeleteUserCommand({ UserName: username }));
+		} catch (error) {
+			handleAwsError(error, `deleteIamUser(${username})`);
+		}
+	}
+	async listIamUsers() {
+		try {
+			return ((await this.iam.send(new ListUsersCommand({}))).Users ?? []).map((u) => mapIamUserToAwsIamUser(u));
+		} catch (error) {
+			handleAwsError(error, "listIamUsers");
+		}
+	}
+	async attachUserPolicy(username, policyArn) {
+		try {
+			await this.iam.send(new AttachUserPolicyCommand({
+				UserName: username,
+				PolicyArn: policyArn
+			}));
+		} catch (error) {
+			handleAwsError(error, `attachUserPolicy(${username}, ${policyArn})`);
+		}
+	}
+	async detachUserPolicy(username, policyArn) {
+		try {
+			await this.iam.send(new DetachUserPolicyCommand({
+				UserName: username,
+				PolicyArn: policyArn
+			}));
+		} catch (error) {
+			handleAwsError(error, `detachUserPolicy(${username}, ${policyArn})`);
+		}
+	}
+	async createAccessKey(username) {
+		try {
+			const key = (await this.iam.send(new CreateAccessKeyCommand({ UserName: username }))).AccessKey;
+			return {
+				accessKeyId: key?.AccessKeyId ?? "",
+				secretAccessKey: key?.SecretAccessKey ?? "",
+				username: key?.UserName ?? username,
+				createDate: key?.CreateDate
+			};
+		} catch (error) {
+			handleAwsError(error, `createAccessKey(${username})`);
+		}
+	}
+	async deleteAccessKey(username, accessKeyId) {
+		try {
+			await this.iam.send(new DeleteAccessKeyCommand({
+				UserName: username,
+				AccessKeyId: accessKeyId
+			}));
+		} catch (error) {
+			handleAwsError(error, `deleteAccessKey(${username}, ${accessKeyId})`);
+		}
+	}
+};
+//#endregion
+//#region src/adapters/kanidm.ts
+/**
+* Kanidm directory adapter
+*
+* Implements KanidmDirectoryAdapter using the Kanidm REST API v1.
+* Provides user/group CRUD, membership management, and OAuth2 client operations.
+* Uses native fetch with AbortSignal.timeout() for all HTTP requests.
+*/
+var kanidm_exports = /* @__PURE__ */ __exportAll({ KanidmAdapter: () => KanidmAdapter });
+var KanidmAdapter = class {
+	options;
+	baseUrl;
+	timeout;
+	adminToken = null;
+	adminTokenExpiry = 0;
+	constructor(options) {
+		this.options = options;
+		if (!options.apiToken && (!options.adminUsername || !options.adminPassword)) throw new ValidationError("KanidmAdapter requires either apiToken or both adminUsername and adminPassword", "kanidm");
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.timeout = options.timeout ?? 3e4;
+	}
+	async getAdminToken() {
+		if (this.options.apiToken) return this.options.apiToken;
+		if (this.adminToken && Date.now() < this.adminTokenExpiry) return this.adminToken;
+		const authUrl = `${this.baseUrl}/v1/auth`;
+		const initResponse = await fetch(authUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ step: { init2: {
+				username: this.options.adminUsername,
+				issue: "token",
+				privileged: true
+			} } }),
+			signal: AbortSignal.timeout(this.timeout)
+		});
+		if (!initResponse.ok) throw new AuthenticationError("Failed to initialize admin authentication", "kanidm");
+		const cookies = initResponse.headers.get("set-cookie");
+		if (!(await fetch(authUrl, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...cookies ? { Cookie: cookies } : {}
+			},
+			body: JSON.stringify({ step: { begin: "password" } }),
+			signal: AbortSignal.timeout(this.timeout)
+		})).ok) throw new AuthenticationError("Failed to begin password authentication", "kanidm");
+		const credResponse = await fetch(authUrl, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...cookies ? { Cookie: cookies } : {}
+			},
+			body: JSON.stringify({ step: { cred: { password: this.options.adminPassword } } }),
+			signal: AbortSignal.timeout(this.timeout)
+		});
+		if (!credResponse.ok) throw new AuthenticationError("Invalid admin credentials", "kanidm");
+		const result = await credResponse.json();
+		const token = result.state?.success || result.token;
+		if (!token) throw new AuthenticationError("Failed to obtain admin token", "kanidm");
+		this.adminToken = token;
+		this.adminTokenExpiry = Date.now() + 36e5;
+		return this.adminToken;
+	}
+	async request(method, path, body) {
+		const token = await this.getAdminToken();
+		const url = `${this.baseUrl}${path}`;
+		let response;
+		try {
+			response = await fetch(url, {
+				method,
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${token}`
+				},
+				...body !== void 0 ? { body: JSON.stringify(body) } : {},
+				signal: AbortSignal.timeout(this.timeout)
+			});
+		} catch (error) {
+			if (error instanceof TypeError) throw new ConnectionError(`Failed to connect to Kanidm at ${this.baseUrl}`, "kanidm", error);
+			throw error;
+		}
+		if (response.ok) {
+			const text = await response.text();
+			if (!text) return void 0;
+			return JSON.parse(text);
+		}
+		const errorBody = await response.text().catch(() => "");
+		switch (response.status) {
+			case 401:
+			case 403:
+				this.adminToken = null;
+				this.adminTokenExpiry = 0;
+				throw new AuthenticationError(errorBody || `Authentication failed: ${response.status}`, "kanidm");
+			case 404: throw new NotFoundError("resource", path, "kanidm");
+			case 409: throw new ConflictError("resource", path, "kanidm");
+			default: throw new DirectoryError(errorBody || `Request failed: ${response.status} ${response.statusText}`, "REQUEST_ERROR", "kanidm");
+		}
+	}
+	mapPersonToUser(data) {
+		const attrs = data.attrs;
+		return {
+			id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "name") ?? "",
+			username: this.attrFirst(attrs, "name") ?? "",
+			displayName: this.attrFirst(attrs, "displayname"),
+			email: this.attrFirst(attrs, "mail"),
+			active: this.attrFirst(attrs, "class") ? !attrs.class?.includes("recycled") : true,
+			groups: attrs.memberof,
+			metadata: { attrs }
+		};
+	}
+	mapGroupToDirectoryGroup(data) {
+		const attrs = data.attrs;
+		return {
+			id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "name") ?? "",
+			name: this.attrFirst(attrs, "name") ?? "",
+			displayName: this.attrFirst(attrs, "displayname"),
+			description: this.attrFirst(attrs, "description"),
+			members: attrs.member,
+			metadata: { attrs }
+		};
+	}
+	mapOAuth2Client(data) {
+		const attrs = data.attrs;
+		return {
+			id: this.attrFirst(attrs, "uuid") ?? this.attrFirst(attrs, "oauth2_rs_name") ?? "",
+			name: this.attrFirst(attrs, "oauth2_rs_name") ?? "",
+			displayName: this.attrFirst(attrs, "displayname"),
+			redirectUris: attrs.oauth2_rs_origin ?? [],
+			scopes: attrs.oauth2_rs_scope_map ? attrs.oauth2_rs_scope_map : void 0,
+			metadata: { attrs }
+		};
+	}
+	attrFirst(attrs, key) {
+		return attrs[key]?.[0];
+	}
+	async testConnection() {
+		try {
+			await this.getAdminToken();
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async disconnect() {
+		this.adminToken = null;
+		this.adminTokenExpiry = 0;
+	}
+	async createUser(input) {
+		const body = { attrs: {
+			name: [input.username],
+			...input.displayName ? { displayname: [input.displayName] } : {},
+			...input.email ? { mail: [input.email] } : {},
+			...input.metadata ?? {}
+		} };
+		await this.request("POST", "/v1/person", body);
+		return this.getUser(input.username);
+	}
+	async getUser(id) {
+		const data = await this.request("GET", `/v1/person/${encodeURIComponent(id)}`);
+		return this.mapPersonToUser(data);
+	}
+	async updateUser(id, input) {
+		const attrs = {};
+		if (input.displayName !== void 0) attrs.displayname = [input.displayName];
+		if (input.email !== void 0) attrs.mail = [input.email];
+		await this.request("PATCH", `/v1/person/${encodeURIComponent(id)}`, { attrs });
+		return this.getUser(id);
+	}
+	async deleteUser(id) {
+		await this.request("DELETE", `/v1/person/${encodeURIComponent(id)}`);
+	}
+	async listUsers() {
+		return (await this.request("GET", "/v1/person") ?? []).map((entry) => this.mapPersonToUser(entry));
+	}
+	async createGroup(input) {
+		const body = { attrs: {
+			name: [input.name],
+			...input.displayName ? { displayname: [input.displayName] } : {},
+			...input.description ? { description: [input.description] } : {},
+			...input.members ? { member: input.members } : {},
+			...input.metadata ?? {}
+		} };
+		await this.request("POST", "/v1/group", body);
+		return this.getGroup(input.name);
+	}
+	async getGroup(id) {
+		const data = await this.request("GET", `/v1/group/${encodeURIComponent(id)}`);
+		return this.mapGroupToDirectoryGroup(data);
+	}
+	async updateGroup(id, input) {
+		const attrs = {};
+		if (input.displayName !== void 0) attrs.displayname = [input.displayName];
+		if (input.description !== void 0) attrs.description = [input.description];
+		await this.request("PATCH", `/v1/group/${encodeURIComponent(id)}`, { attrs });
+		return this.getGroup(id);
+	}
+	async deleteGroup(id) {
+		await this.request("DELETE", `/v1/group/${encodeURIComponent(id)}`);
+	}
+	async listGroups() {
+		return (await this.request("GET", "/v1/group") ?? []).map((entry) => this.mapGroupToDirectoryGroup(entry));
+	}
+	async addUserToGroup(userId, groupId) {
+		await this.request("POST", `/v1/group/${encodeURIComponent(groupId)}/_attr/member`, [userId]);
+	}
+	async removeUserFromGroup(userId, groupId) {
+		await this.request("DELETE", `/v1/group/${encodeURIComponent(groupId)}/_attr/member`, [userId]);
+	}
+	async getGroupMembers(groupId) {
+		const group = await this.getGroup(groupId);
+		if (!group.members || group.members.length === 0) return [];
+		const users = [];
+		for (const memberId of group.members) try {
+			const user = await this.getUser(memberId);
+			users.push(user);
+		} catch (error) {
+			if (!(error instanceof NotFoundError)) throw error;
+		}
+		return users;
+	}
+	async getUserGroups(userId) {
+		const user = await this.getUser(userId);
+		if (!user.groups || user.groups.length === 0) return [];
+		const groups = [];
+		for (const groupId of user.groups) try {
+			const group = await this.getGroup(groupId);
+			groups.push(group);
+		} catch (error) {
+			if (!(error instanceof NotFoundError)) throw error;
+		}
+		return groups;
+	}
+	async createOAuth2Client(input) {
+		const body = { attrs: {
+			oauth2_rs_name: [input.name],
+			...input.displayName ? { displayname: [input.displayName] } : {},
+			oauth2_rs_origin: input.redirectUris,
+			...input.scopes ? { oauth2_rs_scope_map: input.scopes } : {}
+		} };
+		await this.request("POST", "/v1/oauth2", body);
+		return this.getOAuth2Client(input.name);
+	}
+	async getOAuth2Client(id) {
+		const data = await this.request("GET", `/v1/oauth2/${encodeURIComponent(id)}`);
+		return this.mapOAuth2Client(data);
+	}
+	async updateOAuth2Client(id, input) {
+		const attrs = {};
+		if (input.displayName !== void 0) attrs.displayname = [input.displayName];
+		if (input.redirectUris !== void 0) attrs.oauth2_rs_origin = input.redirectUris;
+		if (input.scopes !== void 0) attrs.oauth2_rs_scope_map = input.scopes;
+		await this.request("PATCH", `/v1/oauth2/${encodeURIComponent(id)}`, { attrs });
+		return this.getOAuth2Client(id);
+	}
+	async deleteOAuth2Client(id) {
+		await this.request("DELETE", `/v1/oauth2/${encodeURIComponent(id)}`);
+	}
+	async listOAuth2Clients() {
+		return (await this.request("GET", "/v1/oauth2") ?? []).map((entry) => this.mapOAuth2Client(entry));
+	}
+	async getOAuth2ClientSecret(id) {
+		return await this.request("GET", `/v1/oauth2/${encodeURIComponent(id)}/_basic_secret`);
+	}
+	async createCredentialResetIntent(userId, options) {
+		const ttl = options?.ttl ?? 3600;
+		const token = await this.request("GET", `/v1/person/${encodeURIComponent(userId)}/_credential/_update_intent/${ttl}`);
+		return {
+			token,
+			url: `${this.baseUrl}/ui/reset?token=${encodeURIComponent(token)}`,
+			ttl
+		};
+	}
+};
+//#endregion
+//#region src/adapters/postgres.ts
+/**
+* PostgreSQL directory adapter for @happyvertical/directory
+*
+* Maps PostgreSQL roles and databases to the DirectoryAdapter interface.
+* Uses the CNPG cluster admin role for provisioning operations.
+*
+* Concept mapping:
+* - DirectoryUser -> PostgreSQL role WITH LOGIN
+* - DirectoryGroup -> PostgreSQL role WITHOUT LOGIN (NOLOGIN)
+* - Membership -> GRANT role TO role
+* - PgDatabase -> PostgreSQL database
+* - PgRole -> PostgreSQL role (any)
+*/
+var postgres_exports = /* @__PURE__ */ __exportAll({ PostgresAdapter: () => PostgresAdapter });
+var { Client } = pg;
+var PROVIDER$1 = "postgres";
+/**
+* System roles excluded from list operations.
+* Includes PostgreSQL internal roles (pg_*) and the default superuser.
+*/
+var SYSTEM_ROLE_PREFIX = "pg_";
+var SYSTEM_ROLES = /* @__PURE__ */ new Set(["postgres"]);
+/**
+* System databases excluded from list operations.
+*/
+var SYSTEM_DATABASES = /* @__PURE__ */ new Set([
+	"template0",
+	"template1",
+	"postgres"
+]);
+var PostgresAdapter = class {
+	options;
+	client = null;
+	constructor(options) {
+		this.options = options;
+	}
+	/**
+	* Escape a SQL identifier by wrapping in double quotes and escaping
+	* any embedded double quotes. Used for DDL statements where
+	* parameterized queries are not supported.
+	*/
+	escapeIdentifier(name) {
+		return `"${name.replace(/"/g, "\"\"")}"`;
+	}
+	/**
+	* Escape a SQL string literal by wrapping in single quotes and escaping
+	* any embedded single quotes. Used for DDL statements (e.g., passwords)
+	* where parameterized queries are not supported.
+	*/
+	escapeLiteral(value) {
+		return `'${value.replace(/'/g, "''")}'`;
+	}
+	/**
+	* Get or create the pg.Client instance. Connects lazily on first use.
+	*/
+	async getClient() {
+		if (this.client) return this.client;
+		try {
+			this.client = new Client({
+				host: this.options.host,
+				port: this.options.port ?? 5432,
+				user: this.options.adminUser,
+				password: this.options.adminPassword,
+				database: this.options.database ?? "postgres",
+				ssl: this.options.ssl ? typeof this.options.ssl === "object" ? this.options.ssl : { rejectUnauthorized: false } : void 0
+			});
+			await this.client.connect();
+			return this.client;
+		} catch (error) {
+			this.client = null;
+			throw this.mapError(error);
+		}
+	}
+	/**
+	* Check if a role name is a system role that should be excluded from lists.
+	*/
+	isSystemRole(rolname) {
+		return rolname.startsWith(SYSTEM_ROLE_PREFIX) || SYSTEM_ROLES.has(rolname);
+	}
+	/**
+	* Map a pg_roles row to a DirectoryUser.
+	*/
+	rowToUser(row) {
+		return {
+			id: row.rolname,
+			username: row.rolname,
+			active: true,
+			metadata: {
+				superuser: row.rolsuper,
+				createDb: row.rolcreatedb,
+				createRole: row.rolcreaterole
+			}
+		};
+	}
+	/**
+	* Map a pg_roles row to a DirectoryGroup.
+	*/
+	rowToGroup(row) {
+		return {
+			id: row.rolname,
+			name: row.rolname,
+			metadata: {
+				superuser: row.rolsuper,
+				createDb: row.rolcreatedb,
+				createRole: row.rolcreaterole
+			}
+		};
+	}
+	/**
+	* Map a pg_roles row to a PgRole.
+	*/
+	rowToPgRole(row) {
+		return {
+			name: row.rolname,
+			login: row.rolcanlogin,
+			superuser: row.rolsuper,
+			createDb: row.rolcreatedb,
+			createRole: row.rolcreaterole
+		};
+	}
+	/**
+	* Map a pg_database row to a PgDatabase.
+	*/
+	rowToDatabase(row) {
+		return {
+			name: row.datname,
+			owner: row.owner,
+			encoding: row.encoding,
+			size: row.size
+		};
+	}
+	/**
+	* Map PostgreSQL errors to directory error classes.
+	*/
+	mapError(error) {
+		if (error instanceof DirectoryError) return error;
+		const pgError = error;
+		switch (pgError.code) {
+			case "42710": return new ConflictError("role", pgError.message ?? "unknown", PROVIDER$1, error);
+			case "42704": return new NotFoundError("role", pgError.message ?? "unknown", PROVIDER$1, error);
+			case "28P01": return new AuthenticationError(pgError.message ?? "Invalid password", PROVIDER$1, error);
+			default: break;
+		}
+		const message = pgError.message ?? (error instanceof Error ? error.message : String(error));
+		if (message.includes("ECONNREFUSED") || message.includes("connect ETIMEDOUT") || message.includes("getaddrinfo")) return new ConnectionError(`Failed to connect to PostgreSQL: ${message}`, PROVIDER$1, error);
+		return new DirectoryError(message, "UNKNOWN_ERROR", PROVIDER$1, error);
+	}
+	async testConnection() {
+		try {
+			await (await this.getClient()).query("SELECT 1");
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async disconnect() {
+		if (this.client) {
+			await this.client.end();
+			this.client = null;
+		}
+	}
+	async createUser(input) {
+		const client = await this.getClient();
+		try {
+			let sql = `CREATE ROLE ${this.escapeIdentifier(input.username)} WITH LOGIN`;
+			if (input.password) sql += ` PASSWORD ${this.escapeLiteral(input.password)}`;
+			await client.query(sql);
+			return this.getUser(input.username);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async getUser(id) {
+		const client = await this.getClient();
+		try {
+			const result = await client.query(`SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
          FROM pg_roles
-         WHERE rolname = $1 AND rolcanlogin = true`,
-        [id]
-      );
-      if (result.rows.length === 0) {
-        throw new NotFoundError("user", id, PROVIDER$1);
-      }
-      return this.rowToUser(result.rows[0]);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async updateUser(id, input) {
-    const client = await this.getClient();
-    try {
-      await this.getUser(id);
-      const alterClauses = [];
-      if (input.password !== void 0) {
-        alterClauses.push(`PASSWORD ${this.escapeLiteral(input.password)}`);
-      }
-      if (alterClauses.length > 0) {
-        const sql = `ALTER ROLE ${this.escapeIdentifier(id)} WITH ${alterClauses.join(" ")}`;
-        await client.query(sql);
-      }
-      return this.getUser(id);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async deleteUser(id) {
-    const client = await this.getClient();
-    try {
-      await this.getUser(id);
-      await client.query(`DROP ROLE ${this.escapeIdentifier(id)}`);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async listUsers() {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         WHERE rolname = $1 AND rolcanlogin = true`, [id]);
+			if (result.rows.length === 0) throw new NotFoundError("user", id, PROVIDER$1);
+			return this.rowToUser(result.rows[0]);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async updateUser(id, input) {
+		const client = await this.getClient();
+		try {
+			await this.getUser(id);
+			const alterClauses = [];
+			if (input.password !== void 0) alterClauses.push(`PASSWORD ${this.escapeLiteral(input.password)}`);
+			if (alterClauses.length > 0) {
+				const sql = `ALTER ROLE ${this.escapeIdentifier(id)} WITH ${alterClauses.join(" ")}`;
+				await client.query(sql);
+			}
+			return this.getUser(id);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async deleteUser(id) {
+		const client = await this.getClient();
+		try {
+			await this.getUser(id);
+			await client.query(`DROP ROLE ${this.escapeIdentifier(id)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async listUsers() {
+		const client = await this.getClient();
+		try {
+			return (await client.query(`SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
          FROM pg_roles
          WHERE rolcanlogin = true
-         ORDER BY rolname`
-      );
-      return result.rows.filter(
-        (row) => !this.isSystemRole(row.rolname)
-      ).map((row) => this.rowToUser(row));
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  // ==========================================================================
-  // Group CRUD (PostgreSQL roles WITHOUT LOGIN)
-  // ==========================================================================
-  async createGroup(input) {
-    const client = await this.getClient();
-    try {
-      await client.query(
-        `CREATE ROLE ${this.escapeIdentifier(input.name)} NOLOGIN`
-      );
-      if (input.members) {
-        for (const member of input.members) {
-          await this.addUserToGroup(member, input.name);
-        }
-      }
-      return this.getGroup(input.name);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async getGroup(id) {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         ORDER BY rolname`)).rows.filter((row) => !this.isSystemRole(row.rolname)).map((row) => this.rowToUser(row));
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async createGroup(input) {
+		const client = await this.getClient();
+		try {
+			await client.query(`CREATE ROLE ${this.escapeIdentifier(input.name)} NOLOGIN`);
+			if (input.members) for (const member of input.members) await this.addUserToGroup(member, input.name);
+			return this.getGroup(input.name);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async getGroup(id) {
+		const client = await this.getClient();
+		try {
+			const result = await client.query(`SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
          FROM pg_roles
-         WHERE rolname = $1 AND rolcanlogin = false`,
-        [id]
-      );
-      if (result.rows.length === 0) {
-        throw new NotFoundError("group", id, PROVIDER$1);
-      }
-      return this.rowToGroup(result.rows[0]);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async updateGroup(id, _input) {
-    return this.getGroup(id);
-  }
-  async deleteGroup(id) {
-    const client = await this.getClient();
-    try {
-      await this.getGroup(id);
-      await client.query(`DROP ROLE ${this.escapeIdentifier(id)}`);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async listGroups() {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
+         WHERE rolname = $1 AND rolcanlogin = false`, [id]);
+			if (result.rows.length === 0) throw new NotFoundError("group", id, PROVIDER$1);
+			return this.rowToGroup(result.rows[0]);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async updateGroup(id, _input) {
+		return this.getGroup(id);
+	}
+	async deleteGroup(id) {
+		const client = await this.getClient();
+		try {
+			await this.getGroup(id);
+			await client.query(`DROP ROLE ${this.escapeIdentifier(id)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async listGroups() {
+		const client = await this.getClient();
+		try {
+			return (await client.query(`SELECT rolname, rolsuper, rolcreatedb, rolcreaterole, rolcanlogin
          FROM pg_roles
          WHERE rolcanlogin = false
-         ORDER BY rolname`
-      );
-      return result.rows.filter(
-        (row) => !this.isSystemRole(row.rolname)
-      ).map((row) => this.rowToGroup(row));
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  // ==========================================================================
-  // Membership (GRANT/REVOKE role TO/FROM role)
-  // ==========================================================================
-  async addUserToGroup(userId, groupId) {
-    const client = await this.getClient();
-    try {
-      await client.query(
-        `GRANT ${this.escapeIdentifier(groupId)} TO ${this.escapeIdentifier(userId)}`
-      );
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async removeUserFromGroup(userId, groupId) {
-    const client = await this.getClient();
-    try {
-      await client.query(
-        `REVOKE ${this.escapeIdentifier(groupId)} FROM ${this.escapeIdentifier(userId)}`
-      );
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async getGroupMembers(groupId) {
-    const client = await this.getClient();
-    try {
-      await this.getGroup(groupId);
-      const result = await client.query(
-        `SELECT r.rolname, r.rolsuper, r.rolcreatedb, r.rolcreaterole, r.rolcanlogin
+         ORDER BY rolname`)).rows.filter((row) => !this.isSystemRole(row.rolname)).map((row) => this.rowToGroup(row));
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async addUserToGroup(userId, groupId) {
+		const client = await this.getClient();
+		try {
+			await client.query(`GRANT ${this.escapeIdentifier(groupId)} TO ${this.escapeIdentifier(userId)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async removeUserFromGroup(userId, groupId) {
+		const client = await this.getClient();
+		try {
+			await client.query(`REVOKE ${this.escapeIdentifier(groupId)} FROM ${this.escapeIdentifier(userId)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async getGroupMembers(groupId) {
+		const client = await this.getClient();
+		try {
+			await this.getGroup(groupId);
+			return (await client.query(`SELECT r.rolname, r.rolsuper, r.rolcreatedb, r.rolcreaterole, r.rolcanlogin
          FROM pg_auth_members m
          JOIN pg_roles g ON g.oid = m.roleid
          JOIN pg_roles r ON r.oid = m.member
          WHERE g.rolname = $1 AND r.rolcanlogin = true
-         ORDER BY r.rolname`,
-        [groupId]
-      );
-      return result.rows.map(
-        (row) => this.rowToUser(row)
-      );
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async getUserGroups(userId) {
-    const client = await this.getClient();
-    try {
-      await this.getUser(userId);
-      const result = await client.query(
-        `SELECT g.rolname, g.rolsuper, g.rolcreatedb, g.rolcreaterole, g.rolcanlogin
+         ORDER BY r.rolname`, [groupId])).rows.map((row) => this.rowToUser(row));
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async getUserGroups(userId) {
+		const client = await this.getClient();
+		try {
+			await this.getUser(userId);
+			return (await client.query(`SELECT g.rolname, g.rolsuper, g.rolcreatedb, g.rolcreaterole, g.rolcanlogin
          FROM pg_auth_members m
          JOIN pg_roles g ON g.oid = m.roleid
          JOIN pg_roles r ON r.oid = m.member
          WHERE r.rolname = $1 AND g.rolcanlogin = false
-         ORDER BY g.rolname`,
-        [userId]
-      );
-      return result.rows.map(
-        (row) => this.rowToGroup(row)
-      );
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  // ==========================================================================
-  // Database Provisioning
-  // ==========================================================================
-  async createDatabase(input) {
-    const client = await this.getClient();
-    try {
-      let sql = `CREATE DATABASE ${this.escapeIdentifier(input.name)} OWNER ${this.escapeIdentifier(input.owner)}`;
-      if (input.encoding) {
-        sql += ` ENCODING ${this.escapeLiteral(input.encoding)}`;
-      }
-      await client.query(sql);
-      return this.getDatabase(input.name);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async getDatabase(name) {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT
+         ORDER BY g.rolname`, [userId])).rows.map((row) => this.rowToGroup(row));
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async createDatabase(input) {
+		const client = await this.getClient();
+		try {
+			let sql = `CREATE DATABASE ${this.escapeIdentifier(input.name)} OWNER ${this.escapeIdentifier(input.owner)}`;
+			if (input.encoding) sql += ` ENCODING ${this.escapeLiteral(input.encoding)}`;
+			await client.query(sql);
+			return this.getDatabase(input.name);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async getDatabase(name) {
+		const client = await this.getClient();
+		try {
+			const result = await client.query(`SELECT
            d.datname,
            pg_catalog.pg_get_userbyid(d.datdba) AS owner,
            pg_encoding_to_char(d.encoding) AS encoding,
            pg_database_size(d.datname)::text AS size
          FROM pg_database d
-         WHERE d.datname = $1`,
-        [name]
-      );
-      if (result.rows.length === 0) {
-        throw new NotFoundError("database", name, PROVIDER$1);
-      }
-      return this.rowToDatabase(result.rows[0]);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async dropDatabase(name) {
-    const client = await this.getClient();
-    try {
-      await this.getDatabase(name);
-      await client.query(`DROP DATABASE ${this.escapeIdentifier(name)}`);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async listDatabases() {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT
+         WHERE d.datname = $1`, [name]);
+			if (result.rows.length === 0) throw new NotFoundError("database", name, PROVIDER$1);
+			return this.rowToDatabase(result.rows[0]);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async dropDatabase(name) {
+		const client = await this.getClient();
+		try {
+			await this.getDatabase(name);
+			await client.query(`DROP DATABASE ${this.escapeIdentifier(name)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async listDatabases() {
+		const client = await this.getClient();
+		try {
+			return (await client.query(`SELECT
            d.datname,
            pg_catalog.pg_get_userbyid(d.datdba) AS owner,
            pg_encoding_to_char(d.encoding) AS encoding,
            pg_database_size(d.datname)::text AS size
          FROM pg_database d
-         ORDER BY d.datname`
-      );
-      return result.rows.filter(
-        (row) => !SYSTEM_DATABASES.has(row.datname)
-      ).map((row) => this.rowToDatabase(row));
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  // ==========================================================================
-  // Role Provisioning
-  // ==========================================================================
-  async createRole(input) {
-    const client = await this.getClient();
-    try {
-      const options = [];
-      if (input.login !== void 0) {
-        options.push(input.login ? "LOGIN" : "NOLOGIN");
-      }
-      if (input.password) {
-        options.push(`PASSWORD ${this.escapeLiteral(input.password)}`);
-      }
-      if (input.superuser !== void 0) {
-        options.push(input.superuser ? "SUPERUSER" : "NOSUPERUSER");
-      }
-      if (input.createDb !== void 0) {
-        options.push(input.createDb ? "CREATEDB" : "NOCREATEDB");
-      }
-      if (input.createRole !== void 0) {
-        options.push(input.createRole ? "CREATEROLE" : "NOCREATEROLE");
-      }
-      let sql = `CREATE ROLE ${this.escapeIdentifier(input.name)}`;
-      if (options.length > 0) {
-        sql += ` WITH ${options.join(" ")}`;
-      }
-      await client.query(sql);
-      return this.getRole(input.name);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async getRole(name) {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT rolname, rolcanlogin, rolsuper, rolcreatedb, rolcreaterole
+         ORDER BY d.datname`)).rows.filter((row) => !SYSTEM_DATABASES.has(row.datname)).map((row) => this.rowToDatabase(row));
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async createRole(input) {
+		const client = await this.getClient();
+		try {
+			const options = [];
+			if (input.login !== void 0) options.push(input.login ? "LOGIN" : "NOLOGIN");
+			if (input.password) options.push(`PASSWORD ${this.escapeLiteral(input.password)}`);
+			if (input.superuser !== void 0) options.push(input.superuser ? "SUPERUSER" : "NOSUPERUSER");
+			if (input.createDb !== void 0) options.push(input.createDb ? "CREATEDB" : "NOCREATEDB");
+			if (input.createRole !== void 0) options.push(input.createRole ? "CREATEROLE" : "NOCREATEROLE");
+			let sql = `CREATE ROLE ${this.escapeIdentifier(input.name)}`;
+			if (options.length > 0) sql += ` WITH ${options.join(" ")}`;
+			await client.query(sql);
+			return this.getRole(input.name);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async getRole(name) {
+		const client = await this.getClient();
+		try {
+			const result = await client.query(`SELECT rolname, rolcanlogin, rolsuper, rolcreatedb, rolcreaterole
          FROM pg_roles
-         WHERE rolname = $1`,
-        [name]
-      );
-      if (result.rows.length === 0) {
-        throw new NotFoundError("role", name, PROVIDER$1);
-      }
-      return this.rowToPgRole(result.rows[0]);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async dropRole(name) {
-    const client = await this.getClient();
-    try {
-      await this.getRole(name);
-      await client.query(`DROP ROLE ${this.escapeIdentifier(name)}`);
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async listRoles() {
-    const client = await this.getClient();
-    try {
-      const result = await client.query(
-        `SELECT rolname, rolcanlogin, rolsuper, rolcreatedb, rolcreaterole
+         WHERE rolname = $1`, [name]);
+			if (result.rows.length === 0) throw new NotFoundError("role", name, PROVIDER$1);
+			return this.rowToPgRole(result.rows[0]);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async dropRole(name) {
+		const client = await this.getClient();
+		try {
+			await this.getRole(name);
+			await client.query(`DROP ROLE ${this.escapeIdentifier(name)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async listRoles() {
+		const client = await this.getClient();
+		try {
+			return (await client.query(`SELECT rolname, rolcanlogin, rolsuper, rolcreatedb, rolcreaterole
          FROM pg_roles
-         ORDER BY rolname`
-      );
-      return result.rows.filter(
-        (row) => !this.isSystemRole(row.rolname)
-      ).map((row) => this.rowToPgRole(row));
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  // ==========================================================================
-  // Access Control (GRANT/REVOKE on databases)
-  // ==========================================================================
-  async grantAccess(roleName, databaseName) {
-    const client = await this.getClient();
-    try {
-      await client.query(
-        `GRANT ALL ON DATABASE ${this.escapeIdentifier(databaseName)} TO ${this.escapeIdentifier(roleName)}`
-      );
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-  async revokeAccess(roleName, databaseName) {
-    const client = await this.getClient();
-    try {
-      await client.query(
-        `REVOKE ALL ON DATABASE ${this.escapeIdentifier(databaseName)} FROM ${this.escapeIdentifier(roleName)}`
-      );
-    } catch (error) {
-      throw this.mapError(error);
-    }
-  }
-}
-const postgres = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  PostgresAdapter
-}, Symbol.toStringTag, { value: "Module" }));
-const PROVIDER = "stalwart";
-const DEFAULT_TIMEOUT = 3e4;
-class StalwartAdapter {
-  options;
-  authHeader;
-  constructor(options) {
-    this.options = options;
-    this.authHeader = `Basic ${btoa(`${options.username}:${options.password}`)}`;
-  }
-  get timeout() {
-    return this.options.timeout ?? DEFAULT_TIMEOUT;
-  }
-  // ==========================================================================
-  // HTTP Helper
-  // ==========================================================================
-  async request(method, path, body) {
-    const url = `${this.options.baseUrl}${path}`;
-    const headers = {
-      Authorization: this.authHeader,
-      Accept: "application/json"
-    };
-    if (body !== void 0) {
-      headers["Content-Type"] = "application/json";
-    }
-    let response;
-    try {
-      response = await fetch(url, {
-        method,
-        headers,
-        body: body !== void 0 ? JSON.stringify(body) : void 0,
-        signal: AbortSignal.timeout(this.timeout)
-      });
-    } catch (error) {
-      if (error instanceof DOMException && error.name === "TimeoutError") {
-        throw new ConnectionError(
-          `Request timed out after ${this.timeout}ms: ${method} ${path}`,
-          PROVIDER,
-          error
-        );
-      }
-      throw new ConnectionError(
-        `Failed to connect to Stalwart: ${error.message}`,
-        PROVIDER,
-        error
-      );
-    }
-    if (response.ok) {
-      const text = await response.text();
-      if (!text) return void 0;
-      try {
-        return JSON.parse(text);
-      } catch {
-        return text;
-      }
-    }
-    const errorBody = await response.text().catch(() => "");
-    switch (response.status) {
-      case 401:
-      case 403:
-        throw new AuthenticationError(
-          `Authentication failed: ${response.status} ${response.statusText}`,
-          PROVIDER
-        );
-      case 404:
-        throw new NotFoundError("resource", path, PROVIDER);
-      case 409:
-        throw new ConflictError("resource", path, PROVIDER);
-      default:
-        throw new DirectoryError(
-          `Stalwart API error: ${response.status} ${response.statusText}${errorBody ? ` - ${errorBody}` : ""}`,
-          "API_ERROR",
-          PROVIDER
-        );
-    }
-  }
-  // ==========================================================================
-  // Connection
-  // ==========================================================================
-  async testConnection() {
-    try {
-      await this.request("GET", "/api/principal?type=individual&limit=1");
-      return true;
-    } catch (error) {
-      if (error instanceof AuthenticationError) {
-        throw error;
-      }
-      return false;
-    }
-  }
-  async disconnect() {
-  }
-  // ==========================================================================
-  // User CRUD
-  // ==========================================================================
-  async createUser(input) {
-    const principal = {
-      name: input.username,
-      type: "individual",
-      description: input.displayName,
-      emails: input.email ? [input.email] : [],
-      secrets: input.password ? [input.password] : void 0
-    };
-    await this.request("POST", "/api/principal", principal);
-    return this.getUser(input.username);
-  }
-  async getUser(id) {
-    const principal = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(id)}`
-    );
-    return this.principalToUser(principal);
-  }
-  async updateUser(id, input) {
-    const patch = {};
-    if (input.displayName !== void 0) patch.description = input.displayName;
-    if (input.email !== void 0) patch.emails = [input.email];
-    if (input.password !== void 0) patch.secrets = [input.password];
-    await this.request(
-      "PATCH",
-      `/api/principal/${encodeURIComponent(id)}`,
-      patch
-    );
-    return this.getUser(id);
-  }
-  async deleteUser(id) {
-    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
-  }
-  async listUsers() {
-    const names = await this.request(
-      "GET",
-      "/api/principal?type=individual"
-    );
-    const users = await Promise.all(
-      (names ?? []).map((name) => this.getUser(name))
-    );
-    return users;
-  }
-  // ==========================================================================
-  // Group CRUD
-  // ==========================================================================
-  async createGroup(input) {
-    const principal = {
-      name: input.name,
-      type: "group",
-      description: input.description ?? input.displayName,
-      members: input.members
-    };
-    await this.request("POST", "/api/principal", principal);
-    return this.getGroup(input.name);
-  }
-  async getGroup(id) {
-    const principal = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(id)}`
-    );
-    return this.principalToGroup(principal);
-  }
-  async updateGroup(id, input) {
-    const patch = {};
-    if (input.displayName !== void 0) patch.description = input.displayName;
-    if (input.description !== void 0) patch.description = input.description;
-    await this.request(
-      "PATCH",
-      `/api/principal/${encodeURIComponent(id)}`,
-      patch
-    );
-    return this.getGroup(id);
-  }
-  async deleteGroup(id) {
-    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
-  }
-  async listGroups() {
-    const names = await this.request(
-      "GET",
-      "/api/principal?type=group"
-    );
-    const groups = await Promise.all(
-      (names ?? []).map((name) => this.getGroup(name))
-    );
-    return groups;
-  }
-  // ==========================================================================
-  // Membership
-  // ==========================================================================
-  async addUserToGroup(userId, groupId) {
-    const group = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(groupId)}`
-    );
-    const members = group.members ?? [];
-    if (!members.includes(userId)) {
-      members.push(userId);
-    }
-    await this.request(
-      "PATCH",
-      `/api/principal/${encodeURIComponent(groupId)}`,
-      { members }
-    );
-  }
-  async removeUserFromGroup(userId, groupId) {
-    const group = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(groupId)}`
-    );
-    const members = (group.members ?? []).filter((m) => m !== userId);
-    await this.request(
-      "PATCH",
-      `/api/principal/${encodeURIComponent(groupId)}`,
-      { members }
-    );
-  }
-  async getGroupMembers(groupId) {
-    const group = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(groupId)}`
-    );
-    const members = group.members ?? [];
-    const users = await Promise.all(members.map((name) => this.getUser(name)));
-    return users;
-  }
-  async getUserGroups(userId) {
-    const user = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(userId)}`
-    );
-    const groupNames = user.memberOf ?? [];
-    const groups = await Promise.all(
-      groupNames.map((name) => this.getGroup(name))
-    );
-    return groups;
-  }
-  // ==========================================================================
-  // Domain CRUD
-  // ==========================================================================
-  async createDomain(input) {
-    const principal = {
-      name: input.name,
-      type: "domain"
-    };
-    await this.request("POST", "/api/principal", principal);
-    return this.getDomain(input.name);
-  }
-  async getDomain(id) {
-    const principal = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(id)}`
-    );
-    return {
-      id: principal.name,
-      name: principal.name,
-      active: true
-    };
-  }
-  async deleteDomain(id) {
-    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
-  }
-  async listDomains() {
-    const names = await this.request(
-      "GET",
-      "/api/principal?type=domain"
-    );
-    const domains = await Promise.all(
-      (names ?? []).map((name) => this.getDomain(name))
-    );
-    return domains;
-  }
-  // ==========================================================================
-  // DKIM
-  // ==========================================================================
-  async createDkimKey(input) {
-    const result = await this.request("POST", "/api/dkim", {
-      domain: input.domain,
-      selector: input.selector
-    });
-    return {
-      id: result?.id ?? `${input.selector}._domainkey.${input.domain}`,
-      domain: input.domain,
-      selector: input.selector,
-      publicKey: result?.publicKey
-    };
-  }
-  // ==========================================================================
-  // DNS Records
-  // ==========================================================================
-  async getDnsRecords(domain) {
-    const records = await this.request(
-      "GET",
-      `/api/dns/records/${encodeURIComponent(domain)}`
-    );
-    return records ?? [];
-  }
-  // ==========================================================================
-  // Mailbox CRUD
-  // ==========================================================================
-  async createMailbox(input) {
-    const atIndex = input.email.indexOf("@");
-    const localPart = atIndex >= 0 ? input.email.slice(0, atIndex) : input.email;
-    const principal = {
-      name: localPart,
-      type: "individual",
-      description: input.name,
-      emails: [input.email],
-      secrets: [input.password],
-      quota: input.quota
-    };
-    await this.request("POST", "/api/principal", principal);
-    return this.getMailbox(localPart);
-  }
-  async getMailbox(id) {
-    const principal = await this.request(
-      "GET",
-      `/api/principal/${encodeURIComponent(id)}`
-    );
-    return this.principalToMailbox(principal);
-  }
-  async updateMailbox(id, input) {
-    const patch = {};
-    if (input.name !== void 0) patch.description = input.name;
-    if (input.password !== void 0) patch.secrets = [input.password];
-    if (input.quota !== void 0) patch.quota = input.quota;
-    await this.request(
-      "PATCH",
-      `/api/principal/${encodeURIComponent(id)}`,
-      patch
-    );
-    return this.getMailbox(id);
-  }
-  async deleteMailbox(id) {
-    await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
-  }
-  async listMailboxes() {
-    const names = await this.request(
-      "GET",
-      "/api/principal?type=individual"
-    );
-    const mailboxes = await Promise.all(
-      (names ?? []).map((name) => this.getMailbox(name))
-    );
-    return mailboxes;
-  }
-  // ==========================================================================
-  // Principal Mapping Helpers
-  // ==========================================================================
-  principalToUser(principal) {
-    return {
-      id: principal.name,
-      username: principal.name,
-      displayName: principal.description,
-      email: principal.emails?.[0],
-      active: true,
-      groups: principal.memberOf
-    };
-  }
-  principalToGroup(principal) {
-    return {
-      id: principal.name,
-      name: principal.name,
-      displayName: principal.description,
-      description: principal.description,
-      members: principal.members
-    };
-  }
-  principalToMailbox(principal) {
-    return {
-      id: principal.name,
-      name: principal.description ?? principal.name,
-      email: principal.emails?.[0] ?? "",
-      quota: principal.quota,
-      active: true
-    };
-  }
-}
-const stalwart = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  StalwartAdapter
-}, Symbol.toStringTag, { value: "Module" }));
+         ORDER BY rolname`)).rows.filter((row) => !this.isSystemRole(row.rolname)).map((row) => this.rowToPgRole(row));
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async grantAccess(roleName, databaseName) {
+		const client = await this.getClient();
+		try {
+			await client.query(`GRANT ALL ON DATABASE ${this.escapeIdentifier(databaseName)} TO ${this.escapeIdentifier(roleName)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+	async revokeAccess(roleName, databaseName) {
+		const client = await this.getClient();
+		try {
+			await client.query(`REVOKE ALL ON DATABASE ${this.escapeIdentifier(databaseName)} FROM ${this.escapeIdentifier(roleName)}`);
+		} catch (error) {
+			throw this.mapError(error);
+		}
+	}
+};
+//#endregion
+//#region src/adapters/stalwart.ts
+/**
+* Stalwart mail server directory adapter
+*
+* Implements StalwartDirectoryAdapter using the Stalwart REST API
+* with HTTP Basic authentication. Manages users, groups, domains,
+* DKIM keys, DNS records, and mailboxes via the principals API.
+*/
+var stalwart_exports = /* @__PURE__ */ __exportAll({ StalwartAdapter: () => StalwartAdapter });
+var PROVIDER = "stalwart";
+var DEFAULT_TIMEOUT = 3e4;
+var StalwartAdapter = class {
+	options;
+	authHeader;
+	constructor(options) {
+		this.options = options;
+		this.authHeader = `Basic ${btoa(`${options.username}:${options.password}`)}`;
+	}
+	get timeout() {
+		return this.options.timeout ?? DEFAULT_TIMEOUT;
+	}
+	async request(method, path, body) {
+		const url = `${this.options.baseUrl}${path}`;
+		const headers = {
+			Authorization: this.authHeader,
+			Accept: "application/json"
+		};
+		if (body !== void 0) headers["Content-Type"] = "application/json";
+		let response;
+		try {
+			response = await fetch(url, {
+				method,
+				headers,
+				body: body !== void 0 ? JSON.stringify(body) : void 0,
+				signal: AbortSignal.timeout(this.timeout)
+			});
+		} catch (error) {
+			if (error instanceof DOMException && error.name === "TimeoutError") throw new ConnectionError(`Request timed out after ${this.timeout}ms: ${method} ${path}`, PROVIDER, error);
+			throw new ConnectionError(`Failed to connect to Stalwart: ${error.message}`, PROVIDER, error);
+		}
+		if (response.ok) {
+			const text = await response.text();
+			if (!text) return void 0;
+			try {
+				return JSON.parse(text);
+			} catch {
+				return text;
+			}
+		}
+		const errorBody = await response.text().catch(() => "");
+		switch (response.status) {
+			case 401:
+			case 403: throw new AuthenticationError(`Authentication failed: ${response.status} ${response.statusText}`, PROVIDER);
+			case 404: throw new NotFoundError("resource", path, PROVIDER);
+			case 409: throw new ConflictError("resource", path, PROVIDER);
+			default: throw new DirectoryError(`Stalwart API error: ${response.status} ${response.statusText}${errorBody ? ` - ${errorBody}` : ""}`, "API_ERROR", PROVIDER);
+		}
+	}
+	async testConnection() {
+		try {
+			await this.request("GET", "/api/principal?type=individual&limit=1");
+			return true;
+		} catch (error) {
+			if (error instanceof AuthenticationError) throw error;
+			return false;
+		}
+	}
+	async disconnect() {}
+	async createUser(input) {
+		const principal = {
+			name: input.username,
+			type: "individual",
+			description: input.displayName,
+			emails: input.email ? [input.email] : [],
+			secrets: input.password ? [input.password] : void 0
+		};
+		await this.request("POST", "/api/principal", principal);
+		return this.getUser(input.username);
+	}
+	async getUser(id) {
+		const principal = await this.request("GET", `/api/principal/${encodeURIComponent(id)}`);
+		return this.principalToUser(principal);
+	}
+	async updateUser(id, input) {
+		const patch = {};
+		if (input.displayName !== void 0) patch.description = input.displayName;
+		if (input.email !== void 0) patch.emails = [input.email];
+		if (input.password !== void 0) patch.secrets = [input.password];
+		await this.request("PATCH", `/api/principal/${encodeURIComponent(id)}`, patch);
+		return this.getUser(id);
+	}
+	async deleteUser(id) {
+		await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+	}
+	async listUsers() {
+		const names = await this.request("GET", "/api/principal?type=individual");
+		return await Promise.all((names ?? []).map((name) => this.getUser(name)));
+	}
+	async createGroup(input) {
+		const principal = {
+			name: input.name,
+			type: "group",
+			description: input.description ?? input.displayName,
+			members: input.members
+		};
+		await this.request("POST", "/api/principal", principal);
+		return this.getGroup(input.name);
+	}
+	async getGroup(id) {
+		const principal = await this.request("GET", `/api/principal/${encodeURIComponent(id)}`);
+		return this.principalToGroup(principal);
+	}
+	async updateGroup(id, input) {
+		const patch = {};
+		if (input.displayName !== void 0) patch.description = input.displayName;
+		if (input.description !== void 0) patch.description = input.description;
+		await this.request("PATCH", `/api/principal/${encodeURIComponent(id)}`, patch);
+		return this.getGroup(id);
+	}
+	async deleteGroup(id) {
+		await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+	}
+	async listGroups() {
+		const names = await this.request("GET", "/api/principal?type=group");
+		return await Promise.all((names ?? []).map((name) => this.getGroup(name)));
+	}
+	async addUserToGroup(userId, groupId) {
+		const members = (await this.request("GET", `/api/principal/${encodeURIComponent(groupId)}`)).members ?? [];
+		if (!members.includes(userId)) members.push(userId);
+		await this.request("PATCH", `/api/principal/${encodeURIComponent(groupId)}`, { members });
+	}
+	async removeUserFromGroup(userId, groupId) {
+		const members = ((await this.request("GET", `/api/principal/${encodeURIComponent(groupId)}`)).members ?? []).filter((m) => m !== userId);
+		await this.request("PATCH", `/api/principal/${encodeURIComponent(groupId)}`, { members });
+	}
+	async getGroupMembers(groupId) {
+		const members = (await this.request("GET", `/api/principal/${encodeURIComponent(groupId)}`)).members ?? [];
+		return await Promise.all(members.map((name) => this.getUser(name)));
+	}
+	async getUserGroups(userId) {
+		const groupNames = (await this.request("GET", `/api/principal/${encodeURIComponent(userId)}`)).memberOf ?? [];
+		return await Promise.all(groupNames.map((name) => this.getGroup(name)));
+	}
+	async createDomain(input) {
+		const principal = {
+			name: input.name,
+			type: "domain"
+		};
+		await this.request("POST", "/api/principal", principal);
+		return this.getDomain(input.name);
+	}
+	async getDomain(id) {
+		const principal = await this.request("GET", `/api/principal/${encodeURIComponent(id)}`);
+		return {
+			id: principal.name,
+			name: principal.name,
+			active: true
+		};
+	}
+	async deleteDomain(id) {
+		await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+	}
+	async listDomains() {
+		const names = await this.request("GET", "/api/principal?type=domain");
+		return await Promise.all((names ?? []).map((name) => this.getDomain(name)));
+	}
+	async createDkimKey(input) {
+		const result = await this.request("POST", "/api/dkim", {
+			domain: input.domain,
+			selector: input.selector
+		});
+		return {
+			id: result?.id ?? `${input.selector}._domainkey.${input.domain}`,
+			domain: input.domain,
+			selector: input.selector,
+			publicKey: result?.publicKey
+		};
+	}
+	async getDnsRecords(domain) {
+		return await this.request("GET", `/api/dns/records/${encodeURIComponent(domain)}`) ?? [];
+	}
+	async createMailbox(input) {
+		const atIndex = input.email.indexOf("@");
+		const localPart = atIndex >= 0 ? input.email.slice(0, atIndex) : input.email;
+		const principal = {
+			name: localPart,
+			type: "individual",
+			description: input.name,
+			emails: [input.email],
+			secrets: [input.password],
+			quota: input.quota
+		};
+		await this.request("POST", "/api/principal", principal);
+		return this.getMailbox(localPart);
+	}
+	async getMailbox(id) {
+		const principal = await this.request("GET", `/api/principal/${encodeURIComponent(id)}`);
+		return this.principalToMailbox(principal);
+	}
+	async updateMailbox(id, input) {
+		const patch = {};
+		if (input.name !== void 0) patch.description = input.name;
+		if (input.password !== void 0) patch.secrets = [input.password];
+		if (input.quota !== void 0) patch.quota = input.quota;
+		await this.request("PATCH", `/api/principal/${encodeURIComponent(id)}`, patch);
+		return this.getMailbox(id);
+	}
+	async deleteMailbox(id) {
+		await this.request("DELETE", `/api/principal/${encodeURIComponent(id)}`);
+	}
+	async listMailboxes() {
+		const names = await this.request("GET", "/api/principal?type=individual");
+		return await Promise.all((names ?? []).map((name) => this.getMailbox(name)));
+	}
+	principalToUser(principal) {
+		return {
+			id: principal.name,
+			username: principal.name,
+			displayName: principal.description,
+			email: principal.emails?.[0],
+			active: true,
+			groups: principal.memberOf
+		};
+	}
+	principalToGroup(principal) {
+		return {
+			id: principal.name,
+			name: principal.name,
+			displayName: principal.description,
+			description: principal.description,
+			members: principal.members
+		};
+	}
+	principalToMailbox(principal) {
+		return {
+			id: principal.name,
+			name: principal.description ?? principal.name,
+			email: principal.emails?.[0] ?? "",
+			quota: principal.quota,
+			active: true
+		};
+	}
+};
+//#endregion
+//#region src/shared/factory.ts
 function isKanidmOptions(opts) {
-  return opts.type === "kanidm";
+	return opts.type === "kanidm";
 }
 function isStalwartOptions(opts) {
-  return opts.type === "stalwart";
+	return opts.type === "stalwart";
 }
 function isPostgresOptions(opts) {
-  return opts.type === "postgres";
+	return opts.type === "postgres";
 }
 function isAwsOptions(opts) {
-  return opts.type === "aws";
+	return opts.type === "aws";
 }
+/**
+* Create a directory adapter instance (returns base DirectoryAdapter)
+*
+* @example
+* ```typescript
+* const adapter = await getDirectoryAdapter({
+*   type: 'kanidm',
+*   baseUrl: 'https://idm.example.com',
+*   adminUsername: 'admin',
+*   adminPassword: 'secret',
+* });
+* ```
+*/
 async function getDirectoryAdapter(options) {
-  if (isKanidmOptions(options)) {
-    const { KanidmAdapter: KanidmAdapter2 } = await Promise.resolve().then(() => kanidm);
-    return new KanidmAdapter2(options);
-  }
-  if (isStalwartOptions(options)) {
-    const { StalwartAdapter: StalwartAdapter2 } = await Promise.resolve().then(() => stalwart);
-    return new StalwartAdapter2(options);
-  }
-  if (isPostgresOptions(options)) {
-    const { PostgresAdapter: PostgresAdapter2 } = await Promise.resolve().then(() => postgres);
-    return new PostgresAdapter2(options);
-  }
-  if (isAwsOptions(options)) {
-    const { AwsAdapter: AwsAdapter2 } = await Promise.resolve().then(() => aws);
-    return new AwsAdapter2(options);
-  }
-  throw new Error(
-    `Unknown directory adapter type: ${options.type}`
-  );
+	if (isKanidmOptions(options)) {
+		const { KanidmAdapter } = await Promise.resolve().then(() => kanidm_exports);
+		return new KanidmAdapter(options);
+	}
+	if (isStalwartOptions(options)) {
+		const { StalwartAdapter } = await Promise.resolve().then(() => stalwart_exports);
+		return new StalwartAdapter(options);
+	}
+	if (isPostgresOptions(options)) {
+		const { PostgresAdapter } = await Promise.resolve().then(() => postgres_exports);
+		return new PostgresAdapter(options);
+	}
+	if (isAwsOptions(options)) {
+		const { AwsAdapter } = await Promise.resolve().then(() => aws_exports);
+		return new AwsAdapter(options);
+	}
+	throw new Error(`Unknown directory adapter type: ${options.type}`);
 }
+/**
+* Create a Kanidm directory adapter with full OAuth2 support
+*/
 async function getKanidmAdapter(options) {
-  const { KanidmAdapter: KanidmAdapter2 } = await Promise.resolve().then(() => kanidm);
-  return new KanidmAdapter2({ type: "kanidm", ...options });
+	const { KanidmAdapter } = await Promise.resolve().then(() => kanidm_exports);
+	return new KanidmAdapter({
+		type: "kanidm",
+		...options
+	});
 }
+/**
+* Create a Stalwart directory adapter with domain/mailbox support
+*/
 async function getStalwartAdapter(options) {
-  const { StalwartAdapter: StalwartAdapter2 } = await Promise.resolve().then(() => stalwart);
-  return new StalwartAdapter2({ type: "stalwart", ...options });
+	const { StalwartAdapter } = await Promise.resolve().then(() => stalwart_exports);
+	return new StalwartAdapter({
+		type: "stalwart",
+		...options
+	});
 }
+/**
+* Create a PostgreSQL directory adapter with database/role provisioning
+*/
 async function getPostgresAdapter(options) {
-  const { PostgresAdapter: PostgresAdapter2 } = await Promise.resolve().then(() => postgres);
-  return new PostgresAdapter2({ type: "postgres", ...options });
+	const { PostgresAdapter } = await Promise.resolve().then(() => postgres_exports);
+	return new PostgresAdapter({
+		type: "postgres",
+		...options
+	});
 }
+/**
+* Create an AWS directory adapter with Organizations/IAM support
+*/
 async function getAwsAdapter(options) {
-  const { AwsAdapter: AwsAdapter2 } = await Promise.resolve().then(() => aws);
-  return new AwsAdapter2({ type: "aws", ...options });
+	const { AwsAdapter } = await Promise.resolve().then(() => aws_exports);
+	return new AwsAdapter({
+		type: "aws",
+		...options
+	});
 }
-export {
-  AuthenticationError,
-  AwsAdapter,
-  ConflictError,
-  ConnectionError,
-  DirectoryError,
-  KanidmAdapter,
-  NotFoundError,
-  PostgresAdapter,
-  RateLimitError,
-  StalwartAdapter,
-  ValidationError,
-  getAwsAdapter,
-  getDirectoryAdapter,
-  getKanidmAdapter,
-  getPostgresAdapter,
-  getStalwartAdapter,
-  isAwsOptions,
-  isKanidmOptions,
-  isPostgresOptions,
-  isStalwartOptions
-};
-//# sourceMappingURL=index.js.map
+//#endregion
+export { AuthenticationError, AwsAdapter, ConflictError, ConnectionError, DirectoryError, KanidmAdapter, NotFoundError, PostgresAdapter, RateLimitError, StalwartAdapter, ValidationError, getAwsAdapter, getDirectoryAdapter, getKanidmAdapter, getPostgresAdapter, getStalwartAdapter, isAwsOptions, isKanidmOptions, isPostgresOptions, isStalwartOptions };
+
+//# sourceMappingURL=index.js.map