@objectstack/spec 3.0.4 → 3.0.6

package/dist/identity/index.mjs

@@ -0,0 +1,956 @@
+import { z } from 'zod';
+
+// src/identity/identity.zod.ts
+var UserSchema = z.object({
+  /**
+   * Unique user identifier
+   */
+  id: z.string().describe("Unique user identifier"),
+  /**
+   * User's email address (primary identifier)
+   */
+  email: z.string().email().describe("User email address"),
+  /**
+   * Email verification status
+   */
+  emailVerified: z.boolean().default(false).describe("Whether email is verified"),
+  /**
+   * User's display name
+   */
+  name: z.string().optional().describe("User display name"),
+  /**
+   * User's profile image URL
+   */
+  image: z.string().url().optional().describe("Profile image URL"),
+  /**
+   * Account creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Account creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp")
+});
+var AccountSchema = z.object({
+  /**
+   * Unique account identifier
+   */
+  id: z.string().describe("Unique account identifier"),
+  /**
+   * Associated user ID
+   */
+  userId: z.string().describe("Associated user ID"),
+  /**
+   * Account type/provider
+   */
+  type: z.enum([
+    "oauth",
+    "oidc",
+    "email",
+    "credentials",
+    "saml",
+    "ldap"
+  ]).describe("Account type"),
+  /**
+   * Provider name (e.g., 'google', 'github', 'okta')
+   */
+  provider: z.string().describe("Provider name"),
+  /**
+   * Provider account ID
+   */
+  providerAccountId: z.string().describe("Provider account ID"),
+  /**
+   * OAuth refresh token
+   */
+  refreshToken: z.string().optional().describe("OAuth refresh token"),
+  /**
+   * OAuth access token
+   */
+  accessToken: z.string().optional().describe("OAuth access token"),
+  /**
+   * Token expiry timestamp
+   */
+  expiresAt: z.number().optional().describe("Token expiry timestamp (Unix)"),
+  /**
+   * OAuth token type
+   */
+  tokenType: z.string().optional().describe("OAuth token type"),
+  /**
+   * OAuth scope
+   */
+  scope: z.string().optional().describe("OAuth scope"),
+  /**
+   * OAuth ID token
+   */
+  idToken: z.string().optional().describe("OAuth ID token"),
+  /**
+   * Session state
+   */
+  sessionState: z.string().optional().describe("Session state"),
+  /**
+   * Account creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Account creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp")
+});
+var SessionSchema = z.object({
+  /**
+   * Unique session identifier
+   */
+  id: z.string().describe("Unique session identifier"),
+  /**
+   * Session token
+   */
+  sessionToken: z.string().describe("Session token"),
+  /**
+   * Associated user ID
+   */
+  userId: z.string().describe("Associated user ID"),
+  /**
+   * Active organization ID for this session
+   * Used for context switching in multi-tenant applications
+   */
+  activeOrganizationId: z.string().optional().describe("Active organization ID for context switching"),
+  /**
+   * Session expiry timestamp
+   */
+  expires: z.string().datetime().describe("Session expiry timestamp"),
+  /**
+   * Session creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Session creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp"),
+  /**
+   * IP address of the session
+   */
+  ipAddress: z.string().optional().describe("IP address"),
+  /**
+   * User agent string
+   */
+  userAgent: z.string().optional().describe("User agent string"),
+  /**
+   * Device fingerprint
+   */
+  fingerprint: z.string().optional().describe("Device fingerprint")
+});
+var VerificationTokenSchema = z.object({
+  /**
+   * Token identifier (email or phone)
+   */
+  identifier: z.string().describe("Token identifier (email or phone)"),
+  /**
+   * Verification token
+   */
+  token: z.string().describe("Verification token"),
+  /**
+   * Token expiry timestamp
+   */
+  expires: z.string().datetime().describe("Token expiry timestamp"),
+  /**
+   * Token creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Token creation timestamp")
+});
+var ApiKeySchema = z.object({
+  /**
+   * Unique API key identifier
+   */
+  id: z.string().describe("API key identifier"),
+  /**
+   * Human-readable name for the key
+   */
+  name: z.string().describe("API key display name"),
+  /**
+   * Key prefix (visible portion for identification, e.g., "os_pk_ab")
+   */
+  start: z.string().optional().describe("Key prefix for identification"),
+  /**
+   * Custom prefix for the key (e.g., "os_pk_")
+   */
+  prefix: z.string().optional().describe("Custom key prefix"),
+  /**
+   * User ID of the key owner
+   */
+  userId: z.string().describe("Owner user ID"),
+  /**
+   * Organization ID the key is scoped to (optional)
+   */
+  organizationId: z.string().optional().describe("Scoped organization ID"),
+  /**
+   * Key expiration timestamp (null = never expires)
+   */
+  expiresAt: z.string().datetime().optional().describe("Expiration timestamp"),
+  /**
+   * Creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp"),
+  /**
+   * Last used timestamp
+   */
+  lastUsedAt: z.string().datetime().optional().describe("Last used timestamp"),
+  /**
+   * Last refetch timestamp (for cached permission checks)
+   */
+  lastRefetchAt: z.string().datetime().optional().describe("Last refetch timestamp"),
+  /**
+   * Whether this key is enabled
+   */
+  enabled: z.boolean().default(true).describe("Whether the key is active"),
+  /**
+   * Rate limiting: enabled flag
+   */
+  rateLimitEnabled: z.boolean().optional().describe("Whether rate limiting is enabled"),
+  /**
+   * Rate limiting: time window in milliseconds
+   */
+  rateLimitTimeWindow: z.number().int().min(0).optional().describe("Rate limit window (ms)"),
+  /**
+   * Rate limiting: max requests per window
+   */
+  rateLimitMax: z.number().int().min(0).optional().describe("Max requests per window"),
+  /**
+   * Rate limiting: remaining requests in current window
+   */
+  remaining: z.number().int().min(0).optional().describe("Remaining requests"),
+  /**
+   * Permissions assigned to this key (granular access control)
+   */
+  permissions: z.record(z.string(), z.boolean()).optional().describe("Granular permission flags"),
+  /**
+   * Scopes assigned to this key (high-level access categories)
+   */
+  scopes: z.array(z.string()).optional().describe("High-level access scopes"),
+  /**
+   * Custom metadata
+   */
+  metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata")
+});
+
+// src/identity/protocol.ts
+var AUTH_CONSTANTS = {
+  /**
+   * HTTP header key for authentication tokens
+   */
+  HEADER_KEY: "Authorization",
+  /**
+   * Token prefix for Bearer authentication
+   */
+  TOKEN_PREFIX: "Bearer ",
+  /**
+   * Cookie prefix for ObjectStack auth cookies
+   */
+  COOKIE_PREFIX: "os_",
+  /**
+   * CSRF token header name
+   */
+  CSRF_HEADER: "x-os-csrf-token",
+  /**
+   * Default session cookie name
+   */
+  SESSION_COOKIE: "os_session_token",
+  /**
+   * Default CSRF cookie name
+   */
+  CSRF_COOKIE: "os_csrf_token",
+  /**
+   * Refresh token cookie name
+   */
+  REFRESH_TOKEN_COOKIE: "os_refresh_token"
+};
+var AUTH_ERROR_CODES = {
+  INVALID_CREDENTIALS: "invalid_credentials",
+  INVALID_TOKEN: "invalid_token",
+  TOKEN_EXPIRED: "token_expired",
+  INSUFFICIENT_PERMISSIONS: "insufficient_permissions",
+  ACCOUNT_LOCKED: "account_locked",
+  ACCOUNT_NOT_VERIFIED: "account_not_verified",
+  TOO_MANY_REQUESTS: "too_many_requests",
+  INVALID_CSRF_TOKEN: "invalid_csrf_token",
+  SESSION_EXPIRED: "session_expired",
+  OAUTH_ERROR: "oauth_error",
+  PROVIDER_ERROR: "provider_error"
+};
+z.string().min(2, { message: "System identifier must be at least 2 characters" }).regex(/^[a-z][a-z0-9_.]*$/, {
+  message: 'System identifier must be lowercase, starting with a letter, and may contain letters, numbers, underscores, or dots (e.g., "user_profile" or "order.created")'
+}).describe("System identifier (lowercase with underscores or dots)");
+var SnakeCaseIdentifierSchema = z.string().min(2, { message: "Identifier must be at least 2 characters" }).regex(/^[a-z][a-z0-9_]*$/, {
+  message: 'Identifier must be lowercase snake_case, starting with a letter, and may contain only letters, numbers, and underscores (e.g., "user_profile")'
+}).describe("Snake case identifier (lowercase with underscores only)");
+z.string().min(3, { message: "Event name must be at least 3 characters" }).regex(/^[a-z][a-z0-9_.]*$/, {
+  message: 'Event name must be lowercase with dots for namespacing (e.g., "user.created", "order.paid")'
+}).describe("Event name (lowercase with dot notation for namespacing)");
+
+// src/identity/role.zod.ts
+var RoleSchema = z.object({
+  /** Identity */
+  name: SnakeCaseIdentifierSchema.describe("Unique role name (lowercase snake_case)"),
+  label: z.string().describe("Display label (e.g. VP of Sales)"),
+  /** Hierarchy */
+  parent: z.string().optional().describe("Parent Role ID (Reports To)"),
+  /** Description */
+  description: z.string().optional()
+});
+var OrganizationSchema = z.object({
+  /**
+   * Unique organization identifier
+   */
+  id: z.string().describe("Unique organization identifier"),
+  /**
+   * Organization name (display name)
+   */
+  name: z.string().describe("Organization display name"),
+  /**
+   * Organization slug (URL-friendly identifier)
+   * Must be unique across all organizations
+   */
+  slug: z.string().regex(/^[a-z0-9_-]+$/).describe("Unique URL-friendly slug (lowercase alphanumeric, hyphens, underscores)"),
+  /**
+   * Organization logo URL
+   */
+  logo: z.string().url().optional().describe("Organization logo URL"),
+  /**
+   * Custom metadata for the organization
+   * Can store additional configuration, settings, or custom fields
+   */
+  metadata: z.record(z.string(), z.unknown()).optional().describe("Custom metadata"),
+  /**
+   * Organization creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Organization creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp")
+});
+var MemberSchema = z.object({
+  /**
+   * Unique member identifier
+   */
+  id: z.string().describe("Unique member identifier"),
+  /**
+   * Organization ID this membership belongs to
+   */
+  organizationId: z.string().describe("Organization ID"),
+  /**
+   * User ID of the member
+   */
+  userId: z.string().describe("User ID"),
+  /**
+   * Member's role within the organization
+   * Common roles: 'owner', 'admin', 'member', 'guest'
+   * Can be customized per application
+   */
+  role: z.string().describe("Member role (e.g., owner, admin, member, guest)"),
+  /**
+   * Member creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Member creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp")
+});
+var InvitationStatus = z.enum(["pending", "accepted", "rejected", "expired"]);
+var InvitationSchema = z.object({
+  /**
+   * Unique invitation identifier
+   */
+  id: z.string().describe("Unique invitation identifier"),
+  /**
+   * Organization ID the invitation is for
+   */
+  organizationId: z.string().describe("Organization ID"),
+  /**
+   * Email address of the invitee
+   */
+  email: z.string().email().describe("Invitee email address"),
+  /**
+   * Role the invitee will receive upon accepting
+   * Common roles: 'admin', 'member', 'guest'
+   */
+  role: z.string().describe("Role to assign upon acceptance"),
+  /**
+   * Invitation status
+   */
+  status: InvitationStatus.default("pending").describe("Invitation status"),
+  /**
+   * Invitation expiration timestamp
+   */
+  expiresAt: z.string().datetime().describe("Invitation expiry timestamp"),
+  /**
+   * User ID of the person who sent the invitation
+   */
+  inviterId: z.string().describe("User ID of the inviter"),
+  /**
+   * Invitation creation timestamp
+   */
+  createdAt: z.string().datetime().describe("Invitation creation timestamp"),
+  /**
+   * Last update timestamp
+   */
+  updatedAt: z.string().datetime().describe("Last update timestamp")
+});
+var SCIM_SCHEMAS = {
+  USER: "urn:ietf:params:scim:schemas:core:2.0:User",
+  GROUP: "urn:ietf:params:scim:schemas:core:2.0:Group",
+  ENTERPRISE_USER: "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
+  RESOURCE_TYPE: "urn:ietf:params:scim:schemas:core:2.0:ResourceType",
+  SERVICE_PROVIDER_CONFIG: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",
+  SCHEMA: "urn:ietf:params:scim:schemas:core:2.0:Schema",
+  LIST_RESPONSE: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
+  PATCH_OP: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
+  BULK_REQUEST: "urn:ietf:params:scim:api:messages:2.0:BulkRequest",
+  BULK_RESPONSE: "urn:ietf:params:scim:api:messages:2.0:BulkResponse",
+  ERROR: "urn:ietf:params:scim:api:messages:2.0:Error"
+};
+var SCIMMetaSchema = z.object({
+  /**
+   * Resource type name
+   * @example "User", "Group"
+   */
+  resourceType: z.string().optional().describe("Resource type"),
+  /**
+   * Resource creation timestamp (ISO 8601)
+   */
+  created: z.string().datetime().optional().describe("Creation timestamp"),
+  /**
+   * Last modification timestamp (ISO 8601)
+   */
+  lastModified: z.string().datetime().optional().describe("Last modification timestamp"),
+  /**
+   * Resource location URI
+   * Absolute URL to the resource
+   */
+  location: z.string().url().optional().describe("Resource location URI"),
+  /**
+   * Entity tag for optimistic concurrency control
+   * Used with If-Match header for conditional updates
+   */
+  version: z.string().optional().describe("Entity tag (ETag) for concurrency control")
+});
+var SCIMNameSchema = z.object({
+  /**
+   * Full name formatted for display
+   * @example "Ms. Barbara Jane Jensen III"
+   */
+  formatted: z.string().optional().describe("Formatted full name"),
+  /**
+   * Family name (surname)
+   * @example "Jensen"
+   */
+  familyName: z.string().optional().describe("Family name (last name)"),
+  /**
+   * Given name (first name)
+   * @example "Barbara"
+   */
+  givenName: z.string().optional().describe("Given name (first name)"),
+  /**
+   * Middle name
+   * @example "Jane"
+   */
+  middleName: z.string().optional().describe("Middle name"),
+  /**
+   * Honorific prefix
+   * @example "Ms.", "Dr.", "Prof."
+   */
+  honorificPrefix: z.string().optional().describe("Honorific prefix (Mr., Ms., Dr.)"),
+  /**
+   * Honorific suffix
+   * @example "III", "Jr.", "Sr."
+   */
+  honorificSuffix: z.string().optional().describe("Honorific suffix (Jr., Sr.)")
+});
+var SCIMEmailSchema = z.object({
+  /**
+   * Email address value
+   */
+  value: z.string().email().describe("Email address"),
+  /**
+   * Email type
+   * @example "work", "home", "other"
+   */
+  type: z.enum(["work", "home", "other"]).optional().describe("Email type"),
+  /**
+   * Display label for the email
+   */
+  display: z.string().optional().describe("Display label"),
+  /**
+   * Whether this is the primary email
+   */
+  primary: z.boolean().optional().default(false).describe("Primary email indicator")
+});
+var SCIMPhoneNumberSchema = z.object({
+  /**
+   * Phone number value
+   * Format is not enforced to support international numbers
+   */
+  value: z.string().describe("Phone number"),
+  /**
+   * Phone type
+   */
+  type: z.enum(["work", "home", "mobile", "fax", "pager", "other"]).optional().describe("Phone number type"),
+  /**
+   * Display label for the phone number
+   */
+  display: z.string().optional().describe("Display label"),
+  /**
+   * Whether this is the primary phone
+   */
+  primary: z.boolean().optional().default(false).describe("Primary phone indicator")
+});
+var SCIMAddressSchema = z.object({
+  /**
+   * Full mailing address formatted for display
+   */
+  formatted: z.string().optional().describe("Formatted address"),
+  /**
+   * Full street address
+   */
+  streetAddress: z.string().optional().describe("Street address"),
+  /**
+   * City or locality
+   */
+  locality: z.string().optional().describe("City/Locality"),
+  /**
+   * State or region
+   */
+  region: z.string().optional().describe("State/Region"),
+  /**
+   * Zip code or postal code
+   */
+  postalCode: z.string().optional().describe("Postal code"),
+  /**
+   * Country
+   */
+  country: z.string().optional().describe("Country"),
+  /**
+   * Address type
+   */
+  type: z.enum(["work", "home", "other"]).optional().describe("Address type"),
+  /**
+   * Whether this is the primary address
+   */
+  primary: z.boolean().optional().default(false).describe("Primary address indicator")
+});
+var SCIMGroupReferenceSchema = z.object({
+  /**
+   * Group identifier
+   */
+  value: z.string().describe("Group ID"),
+  /**
+   * Direct reference to the group resource
+   */
+  $ref: z.string().url().optional().describe("URI reference to the group"),
+  /**
+   * Human-readable group name
+   */
+  display: z.string().optional().describe("Group display name"),
+  /**
+   * Type of group
+   */
+  type: z.enum(["direct", "indirect"]).optional().describe("Membership type")
+});
+var SCIMEnterpriseUserSchema = z.object({
+  /**
+   * Employee number
+   */
+  employeeNumber: z.string().optional().describe("Employee number"),
+  /**
+   * Cost center
+   */
+  costCenter: z.string().optional().describe("Cost center"),
+  /**
+   * Organization unit
+   */
+  organization: z.string().optional().describe("Organization"),
+  /**
+   * Division
+   */
+  division: z.string().optional().describe("Division"),
+  /**
+   * Department
+   */
+  department: z.string().optional().describe("Department"),
+  /**
+   * Manager reference
+   */
+  manager: z.object({
+    value: z.string().describe("Manager ID"),
+    $ref: z.string().url().optional().describe("Manager URI"),
+    displayName: z.string().optional().describe("Manager name")
+  }).optional().describe("Manager reference")
+});
+var SCIMUserSchema = z.object({
+  /**
+   * SCIM schema URIs
+   * Must include at minimum the core User schema URI
+   */
+  schemas: z.array(z.string()).min(1).refine(
+    (schemas) => schemas.includes(SCIM_SCHEMAS.USER),
+    "Must include core User schema URI"
+  ).default([SCIM_SCHEMAS.USER]).describe("SCIM schema URIs (must include User schema)"),
+  /**
+   * Unique identifier
+   */
+  id: z.string().optional().describe("Unique resource identifier"),
+  /**
+   * External identifier
+   * Identifier from the provisioning client
+   */
+  externalId: z.string().optional().describe("External identifier from client system"),
+  /**
+   * Unique username
+   * REQUIRED for user creation
+   */
+  userName: z.string().describe("Unique username (REQUIRED)"),
+  /**
+   * Structured name
+   */
+  name: SCIMNameSchema.optional().describe("Structured name components"),
+  /**
+   * Display name
+   */
+  displayName: z.string().optional().describe("Display name for UI"),
+  /**
+   * Nickname or casual name
+   */
+  nickName: z.string().optional().describe("Nickname"),
+  /**
+   * Profile URL
+   */
+  profileUrl: z.string().url().optional().describe("Profile page URL"),
+  /**
+   * Job title
+   */
+  title: z.string().optional().describe("Job title"),
+  /**
+   * User type (employee, contractor, etc.)
+   */
+  userType: z.string().optional().describe("User type (employee, contractor)"),
+  /**
+   * Preferred language (ISO 639-1)
+   */
+  preferredLanguage: z.string().optional().describe("Preferred language (ISO 639-1)"),
+  /**
+   * Locale (e.g., en-US)
+   */
+  locale: z.string().optional().describe("Locale (e.g., en-US)"),
+  /**
+   * Timezone (e.g., America/Los_Angeles)
+   */
+  timezone: z.string().optional().describe("Timezone"),
+  /**
+   * Account active status
+   */
+  active: z.boolean().optional().default(true).describe("Account active status"),
+  /**
+   * Password (write-only, never returned)
+   */
+  password: z.string().optional().describe("Password (write-only)"),
+  /**
+   * Email addresses (multi-valued)
+   */
+  emails: z.array(SCIMEmailSchema).optional().describe("Email addresses"),
+  /**
+   * Phone numbers (multi-valued)
+   */
+  phoneNumbers: z.array(SCIMPhoneNumberSchema).optional().describe("Phone numbers"),
+  /**
+   * Instant messaging addresses
+   */
+  ims: z.array(z.object({
+    value: z.string(),
+    type: z.string().optional(),
+    primary: z.boolean().optional()
+  })).optional().describe("IM addresses"),
+  /**
+   * Photos (profile pictures)
+   */
+  photos: z.array(z.object({
+    value: z.string().url(),
+    type: z.enum(["photo", "thumbnail"]).optional(),
+    primary: z.boolean().optional()
+  })).optional().describe("Photo URLs"),
+  /**
+   * Physical addresses
+   */
+  addresses: z.array(SCIMAddressSchema).optional().describe("Physical addresses"),
+  /**
+   * Group memberships
+   */
+  groups: z.array(SCIMGroupReferenceSchema).optional().describe("Group memberships"),
+  /**
+   * User entitlements
+   */
+  entitlements: z.array(z.object({
+    value: z.string(),
+    type: z.string().optional(),
+    primary: z.boolean().optional()
+  })).optional().describe("Entitlements"),
+  /**
+   * User roles
+   */
+  roles: z.array(z.object({
+    value: z.string(),
+    type: z.string().optional(),
+    primary: z.boolean().optional()
+  })).optional().describe("Roles"),
+  /**
+   * X509 certificates
+   */
+  x509Certificates: z.array(z.object({
+    value: z.string(),
+    type: z.string().optional(),
+    primary: z.boolean().optional()
+  })).optional().describe("X509 certificates"),
+  /**
+   * Resource metadata
+   */
+  meta: SCIMMetaSchema.optional().describe("Resource metadata"),
+  /**
+   * Enterprise user extension
+   * Only present when enterprise extension is used
+   */
+  [SCIM_SCHEMAS.ENTERPRISE_USER]: SCIMEnterpriseUserSchema.optional().describe("Enterprise user attributes")
+}).superRefine((data, ctx) => {
+  const hasEnterpriseExtension = data[SCIM_SCHEMAS.ENTERPRISE_USER] != null;
+  if (!hasEnterpriseExtension) {
+    return;
+  }
+  const schemas = data.schemas || [];
+  if (!schemas.includes(SCIM_SCHEMAS.ENTERPRISE_USER)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["schemas"],
+      message: `schemas must include "${SCIM_SCHEMAS.ENTERPRISE_USER}" when enterprise user extension attributes are present`
+    });
+  }
+});
+var SCIMMemberReferenceSchema = z.object({
+  /**
+   * Member identifier
+   */
+  value: z.string().describe("Member ID"),
+  /**
+   * Direct reference to the member resource
+   */
+  $ref: z.string().url().optional().describe("URI reference to the member"),
+  /**
+   * Member type (User or Group for nested groups)
+   */
+  type: z.enum(["User", "Group"]).optional().describe("Member type"),
+  /**
+   * Human-readable member name
+   */
+  display: z.string().optional().describe("Member display name")
+});
+var SCIMGroupSchema = z.object({
+  /**
+   * SCIM schema URIs
+   * Must include at minimum the core Group schema URI
+   */
+  schemas: z.array(z.string()).min(1).refine(
+    (schemas) => schemas.includes(SCIM_SCHEMAS.GROUP),
+    "Must include core Group schema URI"
+  ).default([SCIM_SCHEMAS.GROUP]).describe("SCIM schema URIs (must include Group schema)"),
+  /**
+   * Unique identifier
+   */
+  id: z.string().optional().describe("Unique resource identifier"),
+  /**
+   * External identifier
+   */
+  externalId: z.string().optional().describe("External identifier from client system"),
+  /**
+   * Group display name
+   * REQUIRED for group creation
+   */
+  displayName: z.string().describe("Group display name (REQUIRED)"),
+  /**
+   * Group members
+   */
+  members: z.array(SCIMMemberReferenceSchema).optional().describe("Group members"),
+  /**
+   * Resource metadata
+   */
+  meta: SCIMMetaSchema.optional().describe("Resource metadata")
+});
+var SCIMListResponseSchema = z.object({
+  /**
+   * SCIM schema URI
+   */
+  schemas: z.array(z.string()).min(1).refine(
+    (schemas) => schemas.includes(SCIM_SCHEMAS.LIST_RESPONSE),
+    { message: `schemas must include ${SCIM_SCHEMAS.LIST_RESPONSE}` }
+  ).default([SCIM_SCHEMAS.LIST_RESPONSE]).describe("SCIM schema URIs"),
+  /**
+   * Total number of results matching the query
+   */
+  totalResults: z.number().int().min(0).describe("Total results count"),
+  /**
+   * Resources returned in this response
+   * Use SCIMListResponseOf<T> for type-safe responses
+   */
+  Resources: z.array(z.union([SCIMUserSchema, SCIMGroupSchema, z.record(z.string(), z.unknown())])).describe("Resources array (Users, Groups, or custom resources)"),
+  /**
+   * 1-based index of the first result
+   */
+  startIndex: z.number().int().min(1).optional().describe("Start index (1-based)"),
+  /**
+   * Number of resources per page
+   */
+  itemsPerPage: z.number().int().min(0).optional().describe("Items per page")
+});
+var SCIMErrorSchema = z.object({
+  /**
+   * SCIM schema URI
+   */
+  schemas: z.array(z.string()).min(1).refine(
+    (schemas) => schemas.includes(SCIM_SCHEMAS.ERROR),
+    { message: `schemas must include ${SCIM_SCHEMAS.ERROR}` }
+  ).default([SCIM_SCHEMAS.ERROR]).describe("SCIM schema URIs"),
+  /**
+   * HTTP status code
+   */
+  status: z.number().int().min(400).max(599).describe("HTTP status code"),
+  /**
+   * SCIM error type
+   */
+  scimType: z.enum([
+    "invalidFilter",
+    "tooMany",
+    "uniqueness",
+    "mutability",
+    "invalidSyntax",
+    "invalidPath",
+    "noTarget",
+    "invalidValue",
+    "invalidVers",
+    "sensitive"
+  ]).optional().describe("SCIM error type"),
+  /**
+   * Human-readable error description
+   */
+  detail: z.string().optional().describe("Error detail message")
+});
+var SCIMPatchOperationSchema = z.object({
+  /**
+   * Operation type
+   */
+  op: z.enum(["add", "remove", "replace"]).describe("Operation type"),
+  /**
+   * Attribute path to modify
+   */
+  path: z.string().optional().describe("Attribute path (optional for add)"),
+  /**
+   * Value to set
+   */
+  value: z.unknown().optional().describe("Value to set")
+});
+var SCIMPatchRequestSchema = z.object({
+  /**
+   * SCIM schema URI
+   */
+  schemas: z.array(z.string()).min(1).refine(
+    (schemas) => schemas.includes(SCIM_SCHEMAS.PATCH_OP),
+    { message: "SCIM PATCH requests must include the PatchOp schema URI" }
+  ).default([SCIM_SCHEMAS.PATCH_OP]).describe("SCIM schema URIs"),
+  /**
+   * Array of patch operations
+   */
+  Operations: z.array(SCIMPatchOperationSchema).min(1).describe("Patch operations")
+});
+var SCIM = {
+  /**
+   * Create a basic SCIM user
+   */
+  user: (userName, email, givenName, familyName) => ({
+    schemas: [SCIM_SCHEMAS.USER],
+    userName,
+    emails: [{ value: email, type: "work", primary: true }],
+    name: {
+      givenName,
+      familyName
+    },
+    active: true
+  }),
+  /**
+   * Create a SCIM group
+   */
+  group: (displayName, members) => ({
+    schemas: [SCIM_SCHEMAS.GROUP],
+    displayName,
+    members: members || []
+  }),
+  /**
+   * Create a list response
+   */
+  listResponse: (resources, totalResults) => ({
+    schemas: [SCIM_SCHEMAS.LIST_RESPONSE],
+    totalResults: totalResults ?? resources.length,
+    Resources: resources,
+    startIndex: 1,
+    itemsPerPage: resources.length
+  }),
+  /**
+   * Create an error response
+   */
+  error: (status, detail, scimType) => ({
+    schemas: [SCIM_SCHEMAS.ERROR],
+    status,
+    detail,
+    scimType
+  })
+};
+var SCIMBulkOperationSchema = z.object({
+  /** HTTP method for this operation */
+  method: z.enum(["POST", "PUT", "PATCH", "DELETE"]).describe("HTTP method for the bulk operation"),
+  /** Resource path (e.g. /Users, /Groups/{id}) */
+  path: z.string().describe("Resource endpoint path (e.g. /Users, /Groups/{id})"),
+  /** Client-assigned identifier for cross-referencing operations */
+  bulkId: z.string().optional().describe("Client-assigned ID for cross-referencing between operations"),
+  /** Request body for POST/PUT/PATCH operations */
+  data: z.record(z.string(), z.unknown()).optional().describe("Request body for POST/PUT/PATCH operations"),
+  /** ETag value for optimistic concurrency control */
+  version: z.string().optional().describe("ETag for optimistic concurrency control")
+});
+var SCIMBulkRequestSchema = z.object({
+  /** SCIM schema URI for bulk request */
+  schemas: z.array(z.literal(SCIM_SCHEMAS.BULK_REQUEST)).default([SCIM_SCHEMAS.BULK_REQUEST]).describe("SCIM schema URIs (BulkRequest)"),
+  /** Array of operations to execute */
+  operations: z.array(SCIMBulkOperationSchema).min(1).describe("Bulk operations to execute (minimum 1)"),
+  /** Stop processing after N errors */
+  failOnErrors: z.number().int().optional().describe("Stop processing after this many errors")
+});
+var SCIMBulkResponseOperationSchema = z.object({
+  /** HTTP method that was executed */
+  method: z.enum(["POST", "PUT", "PATCH", "DELETE"]).describe("HTTP method that was executed"),
+  /** Client-assigned bulk operation ID */
+  bulkId: z.string().optional().describe("Client-assigned bulk operation ID"),
+  /** URL of the created/modified resource */
+  location: z.string().optional().describe("URL of the created or modified resource"),
+  /** HTTP status code as string */
+  status: z.string().describe('HTTP status code as string (e.g. "201", "400")'),
+  /** Response body, typically present for errors */
+  response: z.unknown().optional().describe("Response body (typically present for errors)")
+});
+var SCIMBulkResponseSchema = z.object({
+  /** SCIM schema URI for bulk response */
+  schemas: z.array(z.literal(SCIM_SCHEMAS.BULK_RESPONSE)).default([SCIM_SCHEMAS.BULK_RESPONSE]).describe("SCIM schema URIs (BulkResponse)"),
+  /** Array of operation results */
+  operations: z.array(SCIMBulkResponseOperationSchema).describe("Results for each bulk operation")
+});
+
+export { AUTH_CONSTANTS, AUTH_ERROR_CODES, AccountSchema, ApiKeySchema, InvitationSchema, InvitationStatus, MemberSchema, OrganizationSchema, RoleSchema, SCIM, SCIMAddressSchema, SCIMBulkOperationSchema, SCIMBulkRequestSchema, SCIMBulkResponseOperationSchema, SCIMBulkResponseSchema, SCIMEmailSchema, SCIMEnterpriseUserSchema, SCIMErrorSchema, SCIMGroupReferenceSchema, SCIMGroupSchema, SCIMListResponseSchema, SCIMMemberReferenceSchema, SCIMMetaSchema, SCIMNameSchema, SCIMPatchOperationSchema, SCIMPatchRequestSchema, SCIMPhoneNumberSchema, SCIMUserSchema, SCIM_SCHEMAS, SessionSchema, UserSchema, VerificationTokenSchema };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map