@voltro/plugin-scim 0.32.0 → 0.34.0

package/dist/index.d.ts

@@ -9,7 +9,8 @@ import { VoltroPlugin } from '@voltro/protocol';
 export declare const applyScimGroupPatch: <G extends GroupLike>(group: G, body: Record<string, unknown>) => G;
 
 /** Apply a SCIM PATCH (the `active=false` deactivation IdPs send is the case
- *  that matters most). Supports `replace` ops on `active` / `userName` / name. */
+ *  that matters most). Supports `replace`/`add` ops on `active` / `userName`,
+ *  path-targeted or as a pathless partial resource. */
 export declare const applyScimPatch: (row: ScimUserRow, body: Record<string, unknown>) => ScimUserRow;
 
 export declare const dataStoreScimStore: (store: DataStore) => ScimStore;
@@ -96,6 +97,19 @@ export declare interface ScimPluginOptions {
     readonly token: string;
     /** Mount prefix. Default `/scim/v2`. */
     readonly basePath?: string;
+    /**
+     * Namespace for this plugin's HTTP mount + inspect surface. Default `scim`.
+     *
+     * Set it when your app already publishes under that name — an exact tag
+     * collision is fatal at codegen, and this is the way out. Orthogonal to
+     * `name` below: `alias` REPLACES the namespace, `name` distinguishes two
+     * installations within it.
+     */
+    readonly alias?: string;
+    /**
+     * Discriminator for a SECOND installation of this plugin, when one app runs
+     * two (`@voltro/plugin-scim#eu`). Not a rename — for that use `alias`.
+     */
     readonly name?: string;
 }
 

package/dist/index.js

@@ -1,10 +1,22 @@
 import { Effect as e } from "effect";
-import { definePlugin as t, tsMs as n } from "@voltro/protocol";
-import { checkBearer as r } from "@voltro/protocol/session";
-import { boolean as i, eq as a, generateId as o, id as s, json as c, queryFor as l, table as u, text as d, timestamp as f } from "@voltro/database";
+import { definePlugin as t, pluginInstanceName as n, tsMs as r } from "@voltro/protocol";
+import { checkBearer as i } from "@voltro/protocol/session";
+import { boolean as a, eq as o, generateId as s, id as c, json as l, queryFor as u, table as d, text as f, timestamp as p } from "@voltro/database";
 //#region src/scim.ts
-var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:schemas:core:2.0:Group", h = "urn:ietf:params:scim:api:messages:2.0:ListResponse", g = "urn:ietf:params:scim:api:messages:2.0:Error", _ = (e) => new Date(e).toISOString(), v = (e, t) => ({
-	schemas: [p],
+var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:schemas:core:2.0:Group", g = "urn:ietf:params:scim:api:messages:2.0:ListResponse", _ = "urn:ietf:params:scim:api:messages:2.0:Error", v = (e) => new Date(e).toISOString(), y = (e, t) => {
+	if (typeof e == "boolean") return e;
+	if (typeof e == "number") return Number.isFinite(e) && e !== 0;
+	if (typeof e == "string") {
+		let t = e.trim().toLowerCase();
+		if (t === "true" || t === "1") return !0;
+		if (t === "false" || t === "0" || t === "") return !1;
+	}
+	return t;
+}, b = (e) => {
+	let t = (e ?? "").trim();
+	return (t.toLowerCase().startsWith("urn:") ? t.slice(t.lastIndexOf(":") + 1) : t).toLowerCase();
+}, x = (e, t) => ({
+	schemas: [m],
 	id: e.id,
 	...e.externalId ? { externalId: e.externalId } : {},
 	userName: e.userName,
@@ -19,55 +31,58 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 	active: e.active,
 	meta: {
 		resourceType: "User",
-		created: _(e.createdAt),
-		lastModified: _(e.updatedAt),
+		created: v(e.createdAt),
+		lastModified: v(e.updatedAt),
 		location: `${t}/${e.id}`
 	}
-}), y = (e) => {
+}), S = (e) => {
 	let t = e.name ?? {}, n = e.emails ?? [], r = n.find((e) => e.primary)?.value ?? n[0]?.value ?? null;
 	return {
 		userName: String(e.userName ?? ""),
 		givenName: t.givenName ?? null,
 		familyName: t.familyName ?? null,
 		email: r,
-		active: e.active === void 0 || !!e.active,
+		active: e.active === void 0 || e.active === null || y(e.active, !1),
 		externalId: e.externalId ?? null
 	};
-}, b = (e, t) => {
+}, C = (e, t) => {
 	let n = t.Operations ?? t.operations ?? [], r = { ...e };
-	for (let e of n) if ((e.op ?? "").toLowerCase() === "replace") {
-		if (e.path === "active") r = {
+	for (let e of n) {
+		let t = (e.op ?? "").toLowerCase();
+		if (t !== "replace" && t !== "add") continue;
+		let n = b(e.path);
+		if (n === "active") r = {
 			...r,
-			active: !!e.value
+			active: y(e.value, !1)
 		};
-		else if (e.path === "userName") r = {
+		else if (n === "username") r = {
 			...r,
 			userName: String(e.value)
 		};
-		else if (e.path === void 0 && e.value && typeof e.value == "object") {
-			let t = e.value;
-			"active" in t && (r = {
+		else if (n === "" && e.value && typeof e.value == "object") for (let [t, n] of Object.entries(e.value)) {
+			let e = t.toLowerCase();
+			e === "active" ? r = {
 				...r,
-				active: !!t.active
-			}), "userName" in t && (r = {
+				active: y(n, !1)
+			} : e === "username" && (r = {
 				...r,
-				userName: String(t.userName)
+				userName: String(n)
 			});
 		}
 	}
 	return r;
-}, x = (e, t) => ({
-	schemas: [h],
+}, w = (e, t) => ({
+	schemas: [g],
 	totalResults: t?.totalResults ?? e.length,
 	startIndex: t?.startIndex ?? 1,
 	itemsPerPage: e.length,
 	Resources: e
-}), S = (e, t, n) => ({
-	schemas: [g],
+}), T = (e, t, n) => ({
+	schemas: [_],
 	status: String(e),
 	...n ? { scimType: n } : {},
 	detail: t
-}), C = (e, t) => {
+}), E = (e, t) => {
 	if (!e) return { kind: "none" };
 	let n = /^\s*([A-Za-z][A-Za-z0-9]*)\s+eq\s+"([^"]*)"\s*$/i.exec(e);
 	if (!n) return { kind: "invalid" };
@@ -77,13 +92,13 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 		attribute: r,
 		value: n[2]
 	};
-}, w = (e) => {
+}, D = (e) => {
 	let t = Number(e.get("startIndex")), n = Number(e.get("count"));
 	return {
 		startIndex: Number.isInteger(t) && t >= 1 ? t : 1,
 		count: e.get("count") !== null && Number.isInteger(n) && n >= 0 ? n : null
 	};
-}, T = (e, t) => {
+}, O = (e, t) => {
 	let n = t.Operations ?? t.operations ?? [], r = (e) => (Array.isArray(e) ? e : e === void 0 ? [] : [e]).map((e) => String(e?.value ?? e)).filter((e) => e !== "" && e !== "undefined"), i = e;
 	for (let e of n) {
 		let t = (e.op ?? "").toLowerCase(), n = e.path ?? "", a = /^members\[value\s+eq\s+"([^"]*)"\]$/i.exec(n);
@@ -123,7 +138,7 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 		}
 	}
 	return i;
-}, E = (e) => ({
+}, k = (e) => ({
 	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
 	documentationUri: "https://voltro.dev",
 	patch: { supported: !0 },
@@ -148,7 +163,7 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 		resourceType: "ServiceProviderConfig",
 		location: e
 	}
-}), D = (e, t = {}) => ({
+}), A = (e, t = {}) => ({
 	name: e,
 	type: "string",
 	multiValued: !1,
@@ -158,56 +173,56 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 	returned: "default",
 	uniqueness: "none",
 	...t
-}), O = (e) => [{
+}), j = (e) => [{
 	schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
-	id: p,
+	id: m,
 	name: "User",
 	description: "SCIM core User",
 	attributes: [
-		D("userName", {
+		A("userName", {
 			required: !0,
 			uniqueness: "server"
 		}),
-		D("name", {
+		A("name", {
 			type: "complex",
-			subAttributes: [D("givenName"), D("familyName")]
+			subAttributes: [A("givenName"), A("familyName")]
 		}),
-		D("emails", {
+		A("emails", {
 			type: "complex",
 			multiValued: !0,
-			subAttributes: [D("value"), D("primary", { type: "boolean" })]
+			subAttributes: [A("value"), A("primary", { type: "boolean" })]
 		}),
-		D("active", { type: "boolean" }),
-		D("externalId")
+		A("active", { type: "boolean" }),
+		A("externalId")
 	],
 	meta: {
 		resourceType: "Schema",
-		location: `${e}/${p}`
+		location: `${e}/${m}`
 	}
 }, {
 	schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
-	id: m,
+	id: h,
 	name: "Group",
 	description: "SCIM core Group",
 	attributes: [
-		D("displayName", { required: !0 }),
-		D("members", {
+		A("displayName", { required: !0 }),
+		A("members", {
 			type: "complex",
 			multiValued: !0,
-			subAttributes: [D("value")]
+			subAttributes: [A("value")]
 		}),
-		D("externalId")
+		A("externalId")
 	],
 	meta: {
 		resourceType: "Schema",
-		location: `${e}/${m}`
+		location: `${e}/${h}`
 	}
-}], k = (e) => [{
+}], M = (e) => [{
 	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
 	id: "User",
 	name: "User",
 	endpoint: "/Users",
-	schema: p,
+	schema: m,
 	meta: {
 		resourceType: "ResourceType",
 		location: `${e}/ResourceTypes/User`
@@ -217,32 +232,32 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 	id: "Group",
 	name: "Group",
 	endpoint: "/Groups",
-	schema: m,
+	schema: h,
 	meta: {
 		resourceType: "ResourceType",
 		location: `${e}/ResourceTypes/Group`
 	}
-}], A = u("_voltro_scim_users", {
-	id: s({ prefix: "scimuser" }),
-	userName: d(),
-	givenName: d().nullable(),
-	familyName: d().nullable(),
-	email: d().nullable(),
-	active: i().default(!0),
-	externalId: d().nullable(),
-	createdAt: f().default("now"),
-	updatedAt: f().default("now").onUpdate("now")
-}).renamedFrom("scim_users").unique("byScimUserName", ["userName"]), j = u("_voltro_scim_groups", {
-	id: s({ prefix: "scimgroup" }),
-	displayName: d(),
-	externalId: d().nullable(),
-	members: c().nullable(),
-	createdAt: f().default("now"),
-	updatedAt: f().default("now").onUpdate("now")
-}).renamedFrom("scim_groups"), M = (e, t) => t === null || e[t.attribute] === t.value, N = (e = Date.now) => {
+}], N = d("_voltro_scim_users", {
+	id: c({ prefix: "scimuser" }),
+	userName: f(),
+	givenName: f().nullable(),
+	familyName: f().nullable(),
+	email: f().nullable(),
+	active: a().default(!0),
+	externalId: f().nullable(),
+	createdAt: p().default("now"),
+	updatedAt: p().default("now").onUpdate("now")
+}).renamedFrom("scim_users").unique("byScimUserName", ["userName"]), P = d("_voltro_scim_groups", {
+	id: c({ prefix: "scimgroup" }),
+	displayName: f(),
+	externalId: f().nullable(),
+	members: l().nullable(),
+	createdAt: p().default("now"),
+	updatedAt: p().default("now").onUpdate("now")
+}).renamedFrom("scim_groups"), F = (e, t) => t === null || e[t.attribute] === t.value, I = (e = Date.now) => {
 	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0, i = (e) => `${e}_${++r}`;
 	return {
-		listUsers: async (e) => [...t.values()].filter((t) => M(t, e)),
+		listUsers: async (e) => [...t.values()].filter((t) => F(t, e)),
 		getUser: async (e) => t.get(e) ?? null,
 		createUser: async (n) => {
 			let r = {
@@ -263,7 +278,7 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 			return t.set(n, i), i;
 		},
 		deleteUser: async (e) => t.delete(e),
-		listGroups: async (e) => [...n.values()].filter((t) => M(t, e)),
+		listGroups: async (e) => [...n.values()].filter((t) => F(t, e)),
 		getGroup: async (e) => n.get(e) ?? null,
 		createGroup: async (t) => {
 			let r = {
@@ -285,11 +300,11 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 		},
 		deleteGroup: async (e) => n.delete(e)
 	};
-}, P = (e) => {
+}, L = (e) => {
 	let t = async (t, n) => {
-		let r = l(t);
+		let r = u(t);
 		return e.query((n ? r.where(n) : r).descriptor);
-	}, r = (e) => ({
+	}, n = (e) => ({
 		id: String(e.id),
 		userName: String(e.userName),
 		givenName: e.givenName ?? null,
@@ -297,24 +312,24 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 		email: e.email ?? null,
 		active: !!e.active,
 		externalId: e.externalId ?? null,
-		createdAt: n(e.createdAt),
-		updatedAt: n(e.updatedAt)
+		createdAt: r(e.createdAt),
+		updatedAt: r(e.updatedAt)
 	}), i = (e) => ({
 		id: String(e.id),
 		displayName: String(e.displayName),
 		externalId: e.externalId ?? null,
 		members: e.members ?? [],
-		createdAt: n(e.createdAt),
-		updatedAt: n(e.updatedAt)
+		createdAt: r(e.createdAt),
+		updatedAt: r(e.updatedAt)
 	});
 	return {
-		listUsers: async (e) => (await t(A, e ? a(e.attribute, e.value) : void 0)).map(r),
+		listUsers: async (e) => (await t(N, e ? o(e.attribute, e.value) : void 0)).map(n),
 		getUser: async (e) => {
-			let n = await t(A, a("id", e));
-			return n[0] ? r(n[0]) : null;
+			let r = await t(N, o("id", e));
+			return r[0] ? n(r[0]) : null;
 		},
 		createUser: async (t) => {
-			let n = o({
+			let n = s({
 				kind: "typeid",
 				prefix: "scimuser"
 			}, "_voltro_scim_users"), r = /* @__PURE__ */ new Date(), i = {
@@ -330,7 +345,7 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 				updatedAt: r.getTime()
 			};
 		},
-		putUser: async (n, r) => (await t(A, a("id", n)))[0] ? (await e.update("_voltro_scim_users", n, {
+		putUser: async (n, r) => (await t(N, o("id", n)))[0] ? (await e.update("_voltro_scim_users", n, {
 			userName: r.userName,
 			givenName: r.givenName,
 			familyName: r.familyName,
@@ -343,14 +358,14 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 			id: n,
 			updatedAt: Date.now()
 		}) : null,
-		deleteUser: async (n) => (await t(A, a("id", n)))[0] ? (await e.delete("_voltro_scim_users", n), !0) : !1,
-		listGroups: async (e) => (await t(j, e ? a(e.attribute, e.value) : void 0)).map(i),
+		deleteUser: async (n) => (await t(N, o("id", n)))[0] ? (await e.delete("_voltro_scim_users", n), !0) : !1,
+		listGroups: async (e) => (await t(P, e ? o(e.attribute, e.value) : void 0)).map(i),
 		getGroup: async (e) => {
-			let n = await t(j, a("id", e));
+			let n = await t(P, o("id", e));
 			return n[0] ? i(n[0]) : null;
 		},
 		createGroup: async (t) => {
-			let n = o({
+			let n = s({
 				kind: "typeid",
 				prefix: "scimgroup"
 			}, "_voltro_scim_groups"), r = /* @__PURE__ */ new Date(), i = {
@@ -366,7 +381,7 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 				updatedAt: r.getTime()
 			};
 		},
-		putGroup: async (n, r) => (await t(j, a("id", n)))[0] ? (await e.update("_voltro_scim_groups", n, {
+		putGroup: async (n, r) => (await t(P, o("id", n)))[0] ? (await e.update("_voltro_scim_groups", n, {
 			displayName: r.displayName,
 			externalId: r.externalId,
 			members: r.members,
@@ -376,84 +391,84 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 			id: n,
 			updatedAt: Date.now()
 		}) : null,
-		deleteGroup: async (n) => (await t(j, a("id", n)))[0] ? (await e.delete("_voltro_scim_groups", n), !0) : !1
+		deleteGroup: async (n) => (await t(P, o("id", n)))[0] ? (await e.delete("_voltro_scim_groups", n), !0) : !1
 	};
-}, F = (e, t) => ({
+}, R = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/scim+json"
-}), I = (e) => {
+}), z = (e) => {
 	try {
 		return JSON.parse(new TextDecoder().decode(e.rawBody) || "{}");
 	} catch {
 		return {};
 	}
-}, L = (e, t) => {
-	let { startIndex: n, count: r } = w(t), i = n - 1;
+}, B = (e, t) => {
+	let { startIndex: n, count: r } = D(t), i = n - 1;
 	return {
 		page: e.slice(i, r === null ? void 0 : i + r),
 		total: e.length,
 		startIndex: n
 	};
-}, R = () => F(400, S(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), z = async (e, t, n) => (await e.listUsers({
+}, V = () => R(400, T(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), H = async (e, t, n) => (await e.listUsers({
 	attribute: "userName",
 	value: t
-})).some((e) => e.id !== n), B = (e) => F(409, S(409, `a user with userName '${e}' already exists`, "uniqueness")), V = async (e, t, n, i) => {
-	if (!r(i.headers, t)) return F(401, S(401, "invalid or missing bearer token"));
-	let [, a, o] = i.path.slice(n.length).replace(/\/+$/, "").split("/"), s = i.method.toUpperCase(), c = new URLSearchParams(i.query), l = `${n}/Users`;
+})).some((e) => e.id !== n), U = (e) => R(409, T(409, `a user with userName '${e}' already exists`, "uniqueness")), W = async (e, t, n, r) => {
+	if (!i(r.headers, t)) return R(401, T(401, "invalid or missing bearer token"));
+	let [, a, o] = r.path.slice(n.length).replace(/\/+$/, "").split("/"), s = r.method.toUpperCase(), c = new URLSearchParams(r.query), l = `${n}/Users`;
 	if (s === "GET" && !o) {
-		if (a === "ServiceProviderConfig") return F(200, E(`${n}/ServiceProviderConfig`));
-		if (a === "Schemas") return F(200, x(O(`${n}/Schemas`)));
-		if (a === "ResourceTypes") return F(200, x(k(n)));
+		if (a === "ServiceProviderConfig") return R(200, k(`${n}/ServiceProviderConfig`));
+		if (a === "Schemas") return R(200, w(j(`${n}/Schemas`)));
+		if (a === "ResourceTypes") return R(200, w(M(n)));
 	}
 	if (a === "Users") {
 		if (s === "GET" && !o) {
-			let t = C(c.get("filter"), ["userName", "externalId"]);
-			if (t.kind === "invalid") return R();
-			let { page: n, total: r, startIndex: i } = L(await e.listUsers(t.kind === "filter" ? t : null), c);
-			return F(200, x(n.map((e) => v(e, l)), {
+			let t = E(c.get("filter"), ["userName", "externalId"]);
+			if (t.kind === "invalid") return V();
+			let { page: n, total: r, startIndex: i } = B(await e.listUsers(t.kind === "filter" ? t : null), c);
+			return R(200, w(n.map((e) => x(e, l)), {
 				totalResults: r,
 				startIndex: i
 			}));
 		}
 		if (s === "GET" && o) {
 			let t = await e.getUser(o);
-			return t ? F(200, v(t, l)) : F(404, S(404, "user not found"));
+			return t ? R(200, x(t, l)) : R(404, T(404, "user not found"));
 		}
 		if (s === "POST" && !o) {
-			let t = y(I(i));
-			if (t.userName === "") return F(400, S(400, "userName is required", "invalidValue"));
-			if (await z(e, t.userName)) return B(t.userName);
+			let t = S(z(r));
+			if (t.userName === "") return R(400, T(400, "userName is required", "invalidValue"));
+			if (await H(e, t.userName)) return U(t.userName);
 			try {
-				return F(201, v(await e.createUser(t), l));
+				return R(201, x(await e.createUser(t), l));
 			} catch (n) {
-				if (await z(e, t.userName)) return B(t.userName);
+				if (await H(e, t.userName)) return U(t.userName);
 				throw n;
 			}
 		}
 		if (s === "PUT" && o) {
 			let t = await e.getUser(o);
-			if (!t) return F(404, S(404, "user not found"));
+			if (!t) return R(404, T(404, "user not found"));
 			let n = {
 				...t,
-				...y(I(i))
+				...S(z(r))
 			};
-			if (await z(e, n.userName, o)) return B(n.userName);
-			let r = await e.putUser(o, n);
-			return r ? F(200, v(r, l)) : F(404, S(404, "user not found"));
+			if (await H(e, n.userName, o)) return U(n.userName);
+			let i = await e.putUser(o, n);
+			return i ? R(200, x(i, l)) : R(404, T(404, "user not found"));
 		}
 		if (s === "PATCH" && o) {
 			let t = await e.getUser(o);
-			if (!t) return F(404, S(404, "user not found"));
-			let n = b(t, I(i));
-			if (n.userName !== t.userName && await z(e, n.userName, o)) return B(n.userName);
-			let r = await e.putUser(o, n);
-			return r ? F(200, v(r, l)) : F(404, S(404, "user not found"));
+			if (!t) return R(404, T(404, "user not found"));
+			let n = C(t, z(r));
+			if (n.userName !== t.userName && await H(e, n.userName, o)) return U(n.userName);
+			let i = await e.putUser(o, n);
+			return i ? R(200, x(i, l)) : R(404, T(404, "user not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteUser(o) ? { status: 204 } : F(404, S(404, "user not found"));
+		if (s === "DELETE" && o) return await e.deleteUser(o) ? { status: 204 } : R(404, T(404, "user not found"));
 	}
 	if (a === "Groups") {
-		let t = `${n}/Groups`, r = (e) => ({
+		let t = `${n}/Groups`, i = (e) => ({
 			schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
 			id: e.id,
 			displayName: e.displayName,
@@ -465,21 +480,21 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 			}
 		});
 		if (s === "GET" && !o) {
-			let t = C(c.get("filter"), ["displayName", "externalId"]);
-			if (t.kind === "invalid") return R();
-			let { page: n, total: i, startIndex: a } = L(await e.listGroups(t.kind === "filter" ? t : null), c);
-			return F(200, x(n.map(r), {
-				totalResults: i,
+			let t = E(c.get("filter"), ["displayName", "externalId"]);
+			if (t.kind === "invalid") return V();
+			let { page: n, total: r, startIndex: a } = B(await e.listGroups(t.kind === "filter" ? t : null), c);
+			return R(200, w(n.map(i), {
+				totalResults: r,
 				startIndex: a
 			}));
 		}
 		if (s === "GET" && o) {
 			let t = await e.getGroup(o);
-			return t ? F(200, r(t)) : F(404, S(404, "group not found"));
+			return t ? R(200, i(t)) : R(404, T(404, "group not found"));
 		}
 		if (s === "POST" && !o) {
-			let t = I(i), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
-			return F(201, r(await e.createGroup({
+			let t = z(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
+			return R(201, i(await e.createGroup({
 				displayName: String(t.displayName ?? ""),
 				externalId: t.externalId ?? null,
 				members: n
@@ -487,44 +502,50 @@ var p = "urn:ietf:params:scim:schemas:core:2.0:User", m = "urn:ietf:params:scim:
 		}
 		if (s === "PUT" && o) {
 			let t = await e.getGroup(o);
-			if (!t) return F(404, S(404, "group not found"));
-			let n = I(i), a = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), s = await e.putGroup(o, {
+			if (!t) return R(404, T(404, "group not found"));
+			let n = z(r), a = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), s = await e.putGroup(o, {
 				...t,
 				displayName: String(n.displayName ?? t.displayName),
 				externalId: n.externalId ?? t.externalId,
 				members: a
 			});
-			return s ? F(200, r(s)) : F(404, S(404, "group not found"));
+			return s ? R(200, i(s)) : R(404, T(404, "group not found"));
 		}
 		if (s === "PATCH" && o) {
 			let t = await e.getGroup(o);
-			if (!t) return F(404, S(404, "group not found"));
-			let n = await e.putGroup(o, T(t, I(i)));
-			return n ? F(200, r(n)) : F(404, S(404, "group not found"));
+			if (!t) return R(404, T(404, "group not found"));
+			let n = await e.putGroup(o, O(t, z(r)));
+			return n ? R(200, i(n)) : R(404, T(404, "group not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteGroup(o) ? { status: 204 } : F(404, S(404, "group not found"));
+		if (s === "DELETE" && o) return await e.deleteGroup(o) ? { status: 204 } : R(404, T(404, "group not found"));
 	}
-	return F(404, S(404, "unsupported SCIM endpoint"));
-}, H = (n) => {
-	if (n.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
-	let r = n.basePath ?? "/scim/v2", i = n.name ? `@voltro/plugin-scim#${n.name}` : "@voltro/plugin-scim", a;
+	return R(404, T(404, "unsupported SCIM endpoint"));
+}, G = "@voltro/plugin-scim", K = (r) => {
+	if (r.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
+	let i = r.basePath ?? "/scim/v2", a = n({
+		base: G,
+		alias: r.alias,
+		instance: r.name
+	}), o;
 	return t({
-		name: i,
+		name: a,
+		baseName: G,
 		description: "SCIM 2.0 Users + Groups provisioning endpoints.",
 		permissions: ["store:write"],
-		extendSchema: { tables: [A, j] },
+		extendSchema: { tables: [N, P] },
 		httpRoutes: [{
 			method: "*",
-			path: r,
-			handle: async (e) => a ? V(a, n.token, r, e) : F(503, S(503, "scim store not bound"))
+			path: i,
+			originGuard: "exempt",
+			handle: async (e) => o ? W(o, r.token, i, e) : R(503, T(503, "scim store not bound"))
 		}],
 		bindDataStore: (e) => {
-			a = P(e);
+			o = L(e);
 		},
 		onActivate: (t) => e.sync(() => {
-			t.logger.info("scim active", { basePath: r });
+			t.logger.info("scim active", { basePath: i });
 		})
 	});
 };
 //#endregion
-export { g as SCIM_ERROR_SCHEMA, m as SCIM_GROUP_SCHEMA, h as SCIM_LIST_SCHEMA, p as SCIM_USER_SCHEMA, T as applyScimGroupPatch, b as applyScimPatch, P as dataStoreScimStore, y as fromScimUser, V as handleScim, V as handleScimRequest, N as memoryScimStore, w as parsePagination, C as parseScimFilter, k as resourceTypes, S as scimError, x as scimList, H as scimPlugin, O as scimSchemas, E as serviceProviderConfig, v as toScimUser };
+export { _ as SCIM_ERROR_SCHEMA, h as SCIM_GROUP_SCHEMA, g as SCIM_LIST_SCHEMA, m as SCIM_USER_SCHEMA, O as applyScimGroupPatch, C as applyScimPatch, L as dataStoreScimStore, S as fromScimUser, W as handleScim, W as handleScimRequest, I as memoryScimStore, D as parsePagination, E as parseScimFilter, M as resourceTypes, T as scimError, w as scimList, K as scimPlugin, j as scimSchemas, k as serviceProviderConfig, x as toScimUser };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-scim",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "SCIM 2.0 provisioning — Users + Groups REST endpoints (/scim/v2) so an enterprise IdP (Okta, Entra, OneLogin) can create/update/deactivate users in your app. Bearer-token gated; the SCIM envelope + filtering handled for you.",
   "keywords": [
     "voltro",
@@ -22,7 +22,8 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -32,8 +33,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.32.0",
-    "@voltro/protocol": "0.32.0"
+    "@voltro/database": "0.34.0",
+    "@voltro/protocol": "0.34.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"