@voltro/plugin-scim 0.84.0 → 0.86.0

package/dist/index.js

@@ -1,474 +1,81 @@
-import { Effect as e } from "effect";
-import { definePlugin as t, pluginInstanceName as n, tsMs as r } from "@voltro/protocol";
-import { checkBearer as i } from "@voltro/protocol/session";
-import { boolean as a, eq as o, generateId as s, id as c, json as l, queryFor as u, table as d, text as f, timestamp as p } from "@voltro/database";
-//#region src/scim.ts
-var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:schemas:core:2.0:Group", g = "urn:ietf:params:scim:api:messages:2.0:ListResponse", _ = "urn:ietf:params:scim:api:messages:2.0:Error", v = (e) => new Date(e).toISOString(), y = (e, t) => {
-	if (typeof e == "boolean") return e;
-	if (typeof e == "number") return Number.isFinite(e) && e !== 0;
-	if (typeof e == "string") {
-		let t = e.trim().toLowerCase();
-		if (t === "true" || t === "1") return !0;
-		if (t === "false" || t === "0" || t === "") return !1;
-	}
-	return t;
-}, b = (e) => {
-	let t = (e ?? "").trim();
-	return (t.toLowerCase().startsWith("urn:") ? t.slice(t.lastIndexOf(":") + 1) : t).toLowerCase();
-}, x = (e, t) => ({
-	schemas: [m],
-	id: e.id,
-	...e.externalId ? { externalId: e.externalId } : {},
-	userName: e.userName,
-	name: {
-		givenName: e.givenName ?? "",
-		familyName: e.familyName ?? ""
-	},
-	...e.email ? { emails: [{
-		value: e.email,
-		primary: !0
-	}] } : {},
-	active: e.active,
-	meta: {
-		resourceType: "User",
-		created: v(e.createdAt),
-		lastModified: v(e.updatedAt),
-		location: `${t}/${e.id}`
-	}
-}), S = (e) => {
-	let t = e.name ?? {}, n = e.emails ?? [], r = n.find((e) => e.primary)?.value ?? n[0]?.value ?? null;
-	return {
-		userName: String(e.userName ?? ""),
-		givenName: t.givenName ?? null,
-		familyName: t.familyName ?? null,
-		email: r,
-		active: e.active === void 0 || e.active === null || y(e.active, !1),
-		externalId: e.externalId ?? null
-	};
-}, C = (e, t) => {
-	let n = t.Operations ?? t.operations ?? [], r = { ...e };
-	for (let e of n) {
-		let t = (e.op ?? "").toLowerCase();
-		if (t !== "replace" && t !== "add") continue;
-		let n = b(e.path);
-		if (n === "active") r = {
-			...r,
-			active: y(e.value, !1)
-		};
-		else if (n === "username") r = {
-			...r,
-			userName: String(e.value)
-		};
-		else if (n === "" && e.value && typeof e.value == "object") for (let [t, n] of Object.entries(e.value)) {
-			let e = t.toLowerCase();
-			e === "active" ? r = {
-				...r,
-				active: y(n, !1)
-			} : e === "username" && (r = {
-				...r,
-				userName: String(n)
-			});
-		}
-	}
-	return r;
-}, w = (e, t) => ({
-	schemas: [g],
-	totalResults: t?.totalResults ?? e.length,
-	startIndex: t?.startIndex ?? 1,
-	itemsPerPage: e.length,
-	Resources: e
-}), T = (e, t, n) => ({
-	schemas: [_],
-	status: String(e),
-	...n ? { scimType: n } : {},
-	detail: t
-}), E = (e, t) => {
-	if (!e) return { kind: "none" };
-	let n = /^\s*([A-Za-z][A-Za-z0-9]*)\s+eq\s+"([^"]*)"\s*$/i.exec(e);
-	if (!n) return { kind: "invalid" };
-	let r = t.find((e) => e.toLowerCase() === n[1].toLowerCase());
-	return r === void 0 ? { kind: "invalid" } : {
-		kind: "filter",
-		attribute: r,
-		value: n[2]
-	};
-}, D = (e) => {
-	let t = Number(e.get("startIndex")), n = Number(e.get("count"));
-	return {
-		startIndex: Number.isInteger(t) && t >= 1 ? t : 1,
-		count: e.get("count") !== null && Number.isInteger(n) && n >= 0 ? n : null
-	};
-}, O = (e, t) => {
-	let n = t.Operations ?? t.operations ?? [], r = (e) => (Array.isArray(e) ? e : e === void 0 ? [] : [e]).map((e) => String(e?.value ?? e)).filter((e) => e !== "" && e !== "undefined"), i = e;
-	for (let e of n) {
-		let t = (e.op ?? "").toLowerCase(), n = e.path ?? "", a = /^members\[value\s+eq\s+"([^"]*)"\]$/i.exec(n);
-		if (t === "add" && n.toLowerCase() === "members") {
-			let t = r(e.value).filter((e) => !i.members.includes(e));
-			i = {
-				...i,
-				members: [...i.members, ...t]
-			};
-		} else if (t === "remove" && a) i = {
-			...i,
-			members: i.members.filter((e) => e !== a[1])
-		};
-		else if (t === "remove" && n.toLowerCase() === "members") {
-			let t = new Set(r(e.value));
-			i = {
-				...i,
-				members: t.size === 0 ? [] : i.members.filter((e) => !t.has(e))
-			};
-		} else if (t === "replace" && n.toLowerCase() === "members") i = {
-			...i,
-			members: [...r(e.value)]
-		};
-		else if (t === "replace" && n === "displayName") i = {
-			...i,
-			displayName: String(e.value)
-		};
-		else if (t === "replace" && n === "" && e.value && typeof e.value == "object") {
-			let t = e.value;
-			"displayName" in t && (i = {
-				...i,
-				displayName: String(t.displayName)
-			}), "members" in t && (i = {
-				...i,
-				members: [...r(t.members)]
-			});
-		}
-	}
-	return i;
-}, k = (e) => ({
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
-	documentationUri: "https://voltro.dev",
-	patch: { supported: !0 },
-	bulk: {
-		supported: !1,
-		maxOperations: 0,
-		maxPayloadSize: 0
-	},
-	filter: {
-		supported: !0,
-		maxResults: 200
-	},
-	changePassword: { supported: !1 },
-	sort: { supported: !1 },
-	etag: { supported: !1 },
-	authenticationSchemes: [{
-		type: "oauthbearertoken",
-		name: "Bearer token",
-		description: "Static bearer token configured in the IdP SCIM settings"
-	}],
-	meta: {
-		resourceType: "ServiceProviderConfig",
-		location: e
-	}
-}), A = (e, t = {}) => ({
-	name: e,
-	type: "string",
-	multiValued: !1,
-	required: !1,
-	caseExact: !1,
-	mutability: "readWrite",
-	returned: "default",
-	uniqueness: "none",
-	...t
-}), j = (e) => [{
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
-	id: m,
-	name: "User",
-	description: "SCIM core User",
-	attributes: [
-		A("userName", {
-			required: !0,
-			uniqueness: "server"
-		}),
-		A("name", {
-			type: "complex",
-			subAttributes: [A("givenName"), A("familyName")]
-		}),
-		A("emails", {
-			type: "complex",
-			multiValued: !0,
-			subAttributes: [A("value"), A("primary", { type: "boolean" })]
-		}),
-		A("active", { type: "boolean" }),
-		A("externalId")
-	],
-	meta: {
-		resourceType: "Schema",
-		location: `${e}/${m}`
-	}
-}, {
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
-	id: h,
-	name: "Group",
-	description: "SCIM core Group",
-	attributes: [
-		A("displayName", { required: !0 }),
-		A("members", {
-			type: "complex",
-			multiValued: !0,
-			subAttributes: [A("value")]
-		}),
-		A("externalId")
-	],
-	meta: {
-		resourceType: "Schema",
-		location: `${e}/${h}`
-	}
-}], M = (e) => [{
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
-	id: "User",
-	name: "User",
-	endpoint: "/Users",
-	schema: m,
-	meta: {
-		resourceType: "ResourceType",
-		location: `${e}/ResourceTypes/User`
-	}
-}, {
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
-	id: "Group",
-	name: "Group",
-	endpoint: "/Groups",
-	schema: h,
-	meta: {
-		resourceType: "ResourceType",
-		location: `${e}/ResourceTypes/Group`
-	}
-}], N = d("_voltro_scim_users", {
-	id: c({ prefix: "scimuser" }),
-	userName: f(),
-	givenName: f().nullable(),
-	familyName: f().nullable(),
-	email: f().nullable(),
-	active: a().default(!0),
-	externalId: f().nullable(),
-	createdAt: p().default("now"),
-	updatedAt: p().default("now").onUpdate("now")
-}).renamedFrom("scim_users").unique("byScimUserName", ["userName"]), P = d("_voltro_scim_groups", {
-	id: c({ prefix: "scimgroup" }),
-	displayName: f(),
-	externalId: f().nullable(),
-	members: l().nullable(),
-	createdAt: p().default("now"),
-	updatedAt: p().default("now").onUpdate("now")
-}).renamedFrom("scim_groups"), F = (e, t) => t === null || e[t.attribute] === t.value, I = (e = Date.now) => {
-	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0, i = (e) => `${e}_${++r}`;
-	return {
-		listUsers: async (e) => [...t.values()].filter((t) => F(t, e)),
-		getUser: async (e) => t.get(e) ?? null,
-		createUser: async (n) => {
-			let r = {
-				...n,
-				id: i("user"),
-				createdAt: e(),
-				updatedAt: e()
-			};
-			return t.set(r.id, r), r;
-		},
-		putUser: async (n, r) => {
-			if (!t.has(n)) return null;
-			let i = {
-				...r,
-				id: n,
-				updatedAt: e()
-			};
-			return t.set(n, i), i;
-		},
-		deleteUser: async (e) => t.delete(e),
-		listGroups: async (e) => [...n.values()].filter((t) => F(t, e)),
-		getGroup: async (e) => n.get(e) ?? null,
-		createGroup: async (t) => {
-			let r = {
-				...t,
-				id: i("group"),
-				createdAt: e(),
-				updatedAt: e()
-			};
-			return n.set(r.id, r), r;
-		},
-		putGroup: async (t, r) => {
-			if (!n.has(t)) return null;
-			let i = {
-				...r,
-				id: t,
-				updatedAt: e()
-			};
-			return n.set(t, i), i;
-		},
-		deleteGroup: async (e) => n.delete(e)
-	};
-}, L = (e) => {
-	let t = async (t, n) => {
-		let r = u(t);
-		return e.query((n ? r.where(n) : r).descriptor);
-	}, n = (e) => ({
-		id: String(e.id),
-		userName: String(e.userName),
-		givenName: e.givenName ?? null,
-		familyName: e.familyName ?? null,
-		email: e.email ?? null,
-		active: !!e.active,
-		externalId: e.externalId ?? null,
-		createdAt: r(e.createdAt),
-		updatedAt: r(e.updatedAt)
-	}), i = (e) => ({
-		id: String(e.id),
-		displayName: String(e.displayName),
-		externalId: e.externalId ?? null,
-		members: e.members ?? [],
-		createdAt: r(e.createdAt),
-		updatedAt: r(e.updatedAt)
-	});
-	return {
-		listUsers: async (e) => (await t(N, e ? o(e.attribute, e.value) : void 0)).map(n),
-		getUser: async (e) => {
-			let r = await t(N, o("id", e));
-			return r[0] ? n(r[0]) : null;
-		},
-		createUser: async (t) => {
-			let n = s({
-				kind: "typeid",
-				prefix: "scimuser"
-			}, "_voltro_scim_users"), r = /* @__PURE__ */ new Date(), i = {
-				id: n,
-				...t,
-				createdAt: r,
-				updatedAt: r
-			};
-			return await e.insert("_voltro_scim_users", i), {
-				...t,
-				id: n,
-				createdAt: r.getTime(),
-				updatedAt: r.getTime()
-			};
-		},
-		putUser: async (n, r) => (await t(N, o("id", n)))[0] ? (await e.update("_voltro_scim_users", n, {
-			userName: r.userName,
-			givenName: r.givenName,
-			familyName: r.familyName,
-			email: r.email,
-			active: r.active,
-			externalId: r.externalId,
-			updatedAt: /* @__PURE__ */ new Date()
-		}), {
-			...r,
-			id: n,
-			updatedAt: Date.now()
-		}) : null,
-		deleteUser: async (n) => (await t(N, o("id", n)))[0] ? (await e.delete("_voltro_scim_users", n), !0) : !1,
-		listGroups: async (e) => (await t(P, e ? o(e.attribute, e.value) : void 0)).map(i),
-		getGroup: async (e) => {
-			let n = await t(P, o("id", e));
-			return n[0] ? i(n[0]) : null;
-		},
-		createGroup: async (t) => {
-			let n = s({
-				kind: "typeid",
-				prefix: "scimgroup"
-			}, "_voltro_scim_groups"), r = /* @__PURE__ */ new Date(), i = {
-				id: n,
-				...t,
-				createdAt: r,
-				updatedAt: r
-			};
-			return await e.insert("_voltro_scim_groups", i), {
-				...t,
-				id: n,
-				createdAt: r.getTime(),
-				updatedAt: r.getTime()
-			};
-		},
-		putGroup: async (n, r) => (await t(P, o("id", n)))[0] ? (await e.update("_voltro_scim_groups", n, {
-			displayName: r.displayName,
-			externalId: r.externalId,
-			members: r.members,
-			updatedAt: /* @__PURE__ */ new Date()
-		}), {
-			...r,
-			id: n,
-			updatedAt: Date.now()
-		}) : null,
-		deleteGroup: async (n) => (await t(P, o("id", n)))[0] ? (await e.delete("_voltro_scim_groups", n), !0) : !1
-	};
-}, R = (e, t) => ({
+import { SCIM_ERROR_SCHEMA as e, SCIM_GROUP_SCHEMA as t, SCIM_LIST_SCHEMA as n, SCIM_USER_SCHEMA as r, applyScimGroupPatch as i, applyScimPatch as a, fromScimUser as o, parsePagination as s, parseScimFilter as c, resourceTypes as l, scimError as u, scimList as d, scimSchemas as f, serviceProviderConfig as p, toScimUser as m } from "./scim.js";
+import { dataStoreScimStore as h, memoryScimStore as g, scimGroupsTable as _, scimUsersTable as v } from "./store.js";
+import { Effect as y } from "effect";
+import { definePlugin as b, pluginInstanceName as x } from "@voltro/protocol";
+import { checkBearer as S } from "@voltro/protocol/session";
+//#region src/index.ts
+var C = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/scim+json"
-}), z = (e) => {
+}), w = (e) => {
 	try {
 		return JSON.parse(new TextDecoder().decode(e.rawBody) || "{}");
 	} catch {
 		return {};
 	}
-}, B = (e, t) => {
-	let { startIndex: n, count: r } = D(t), i = n - 1;
-	return {
-		page: e.slice(i, r === null ? void 0 : i + r),
-		total: e.length,
-		startIndex: n
-	};
-}, V = () => R(400, T(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), H = async (e, t, n) => (await e.listUsers({
+}, T = () => C(400, u(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), E = async (e, t, n) => (await e.listUsers({
 	attribute: "userName",
 	value: t
-})).some((e) => e.id !== n), U = (e) => R(409, T(409, `a user with userName '${e}' already exists`, "uniqueness")), W = async (e, t, n, r) => {
-	if (!i(r.headers, t)) return R(401, T(401, "invalid or missing bearer token"));
-	let [, a, o] = r.path.slice(n.length).replace(/\/+$/, "").split("/"), s = r.method.toUpperCase(), c = new URLSearchParams(r.query), l = `${n}/Users`;
-	if (s === "GET" && !o) {
-		if (a === "ServiceProviderConfig") return R(200, k(`${n}/ServiceProviderConfig`));
-		if (a === "Schemas") return R(200, w(j(`${n}/Schemas`)));
-		if (a === "ResourceTypes") return R(200, w(M(n)));
+})).some((e) => e.id !== n), D = (e) => C(409, u(409, `a user with userName '${e}' already exists`, "uniqueness")), O = async (e, t, n, r) => {
+	if (!S(r.headers, t)) return C(401, u(401, "invalid or missing bearer token"));
+	let [, h, g] = r.path.slice(n.length).replace(/\/+$/, "").split("/"), _ = r.method.toUpperCase(), v = new URLSearchParams(r.query), y = `${n}/Users`;
+	if (_ === "GET" && !g) {
+		if (h === "ServiceProviderConfig") return C(200, p(`${n}/ServiceProviderConfig`));
+		if (h === "Schemas") return C(200, d(f(`${n}/Schemas`)));
+		if (h === "ResourceTypes") return C(200, d(l(n)));
 	}
-	if (a === "Users") {
-		if (s === "GET" && !o) {
-			let t = E(c.get("filter"), ["userName", "externalId"]);
-			if (t.kind === "invalid") return V();
-			let { page: n, total: r, startIndex: i } = B(await e.listUsers(t.kind === "filter" ? t : null), c);
-			return R(200, w(n.map((e) => x(e, l)), {
-				totalResults: r,
-				startIndex: i
+	if (h === "Users") {
+		if (_ === "GET" && !g) {
+			let t = c(v.get("filter"), ["userName", "externalId"]);
+			if (t.kind === "invalid") return T();
+			let { startIndex: n, count: r } = s(v), i = await e.pageUsers(t.kind === "filter" ? t : null, {
+				startIndex: n,
+				count: Math.min(r ?? 100, 1e3)
+			});
+			return C(200, d(i.rows.map((e) => m(e, y)), {
+				totalResults: i.totalResults,
+				startIndex: n
 			}));
 		}
-		if (s === "GET" && o) {
-			let t = await e.getUser(o);
-			return t ? R(200, x(t, l)) : R(404, T(404, "user not found"));
+		if (_ === "GET" && g) {
+			let t = await e.getUser(g);
+			return t ? C(200, m(t, y)) : C(404, u(404, "user not found"));
 		}
-		if (s === "POST" && !o) {
-			let t = S(z(r));
-			if (t.userName === "") return R(400, T(400, "userName is required", "invalidValue"));
-			if (await H(e, t.userName)) return U(t.userName);
+		if (_ === "POST" && !g) {
+			let t = o(w(r));
+			if (t.userName === "") return C(400, u(400, "userName is required", "invalidValue"));
+			if (await E(e, t.userName)) return D(t.userName);
 			try {
-				return R(201, x(await e.createUser(t), l));
+				return C(201, m(await e.createUser(t), y));
 			} catch (n) {
-				if (await H(e, t.userName)) return U(t.userName);
+				if (await E(e, t.userName)) return D(t.userName);
 				throw n;
 			}
 		}
-		if (s === "PUT" && o) {
-			let t = await e.getUser(o);
-			if (!t) return R(404, T(404, "user not found"));
+		if (_ === "PUT" && g) {
+			let t = await e.getUser(g);
+			if (!t) return C(404, u(404, "user not found"));
 			let n = {
 				...t,
-				...S(z(r))
+				...o(w(r))
 			};
-			if (await H(e, n.userName, o)) return U(n.userName);
-			let i = await e.putUser(o, n);
-			return i ? R(200, x(i, l)) : R(404, T(404, "user not found"));
+			if (await E(e, n.userName, g)) return D(n.userName);
+			let i = await e.putUser(g, n);
+			return i ? C(200, m(i, y)) : C(404, u(404, "user not found"));
 		}
-		if (s === "PATCH" && o) {
-			let t = await e.getUser(o);
-			if (!t) return R(404, T(404, "user not found"));
-			let n = C(t, z(r));
-			if (n.userName !== t.userName && await H(e, n.userName, o)) return U(n.userName);
-			let i = await e.putUser(o, n);
-			return i ? R(200, x(i, l)) : R(404, T(404, "user not found"));
+		if (_ === "PATCH" && g) {
+			let t = await e.getUser(g);
+			if (!t) return C(404, u(404, "user not found"));
+			let n = a(t, w(r));
+			if (n.userName !== t.userName && await E(e, n.userName, g)) return D(n.userName);
+			let i = await e.putUser(g, n);
+			return i ? C(200, m(i, y)) : C(404, u(404, "user not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteUser(o) ? { status: 204 } : R(404, T(404, "user not found"));
+		if (_ === "DELETE" && g) return await e.deleteUser(g) ? { status: 204 } : C(404, u(404, "user not found"));
 	}
-	if (a === "Groups") {
-		let t = `${n}/Groups`, i = (e) => ({
+	if (h === "Groups") {
+		let t = `${n}/Groups`, a = (e) => ({
 			schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
 			id: e.id,
 			displayName: e.displayName,
@@ -479,73 +86,76 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 				location: `${t}/${e.id}`
 			}
 		});
-		if (s === "GET" && !o) {
-			let t = E(c.get("filter"), ["displayName", "externalId"]);
-			if (t.kind === "invalid") return V();
-			let { page: n, total: r, startIndex: a } = B(await e.listGroups(t.kind === "filter" ? t : null), c);
-			return R(200, w(n.map(i), {
-				totalResults: r,
-				startIndex: a
+		if (_ === "GET" && !g) {
+			let t = c(v.get("filter"), ["displayName", "externalId"]);
+			if (t.kind === "invalid") return T();
+			let { startIndex: n, count: r } = s(v), i = await e.pageGroups(t.kind === "filter" ? t : null, {
+				startIndex: n,
+				count: Math.min(r ?? 100, 1e3)
+			});
+			return C(200, d(i.rows.map(a), {
+				totalResults: i.totalResults,
+				startIndex: n
 			}));
 		}
-		if (s === "GET" && o) {
-			let t = await e.getGroup(o);
-			return t ? R(200, i(t)) : R(404, T(404, "group not found"));
+		if (_ === "GET" && g) {
+			let t = await e.getGroup(g);
+			return t ? C(200, a(t)) : C(404, u(404, "group not found"));
 		}
-		if (s === "POST" && !o) {
-			let t = z(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
-			return R(201, i(await e.createGroup({
+		if (_ === "POST" && !g) {
+			let t = w(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
+			return C(201, a(await e.createGroup({
 				displayName: String(t.displayName ?? ""),
 				externalId: t.externalId ?? null,
 				members: n
 			})));
 		}
-		if (s === "PUT" && o) {
-			let t = await e.getGroup(o);
-			if (!t) return R(404, T(404, "group not found"));
-			let n = z(r), a = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), s = await e.putGroup(o, {
+		if (_ === "PUT" && g) {
+			let t = await e.getGroup(g);
+			if (!t) return C(404, u(404, "group not found"));
+			let n = w(r), i = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), o = await e.putGroup(g, {
 				...t,
 				displayName: String(n.displayName ?? t.displayName),
 				externalId: n.externalId ?? t.externalId,
-				members: a
+				members: i
 			});
-			return s ? R(200, i(s)) : R(404, T(404, "group not found"));
+			return o ? C(200, a(o)) : C(404, u(404, "group not found"));
 		}
-		if (s === "PATCH" && o) {
-			let t = await e.getGroup(o);
-			if (!t) return R(404, T(404, "group not found"));
-			let n = await e.putGroup(o, O(t, z(r)));
-			return n ? R(200, i(n)) : R(404, T(404, "group not found"));
+		if (_ === "PATCH" && g) {
+			let t = await e.getGroup(g);
+			if (!t) return C(404, u(404, "group not found"));
+			let n = await e.putGroup(g, i(t, w(r)));
+			return n ? C(200, a(n)) : C(404, u(404, "group not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteGroup(o) ? { status: 204 } : R(404, T(404, "group not found"));
+		if (_ === "DELETE" && g) return await e.deleteGroup(g) ? { status: 204 } : C(404, u(404, "group not found"));
 	}
-	return R(404, T(404, "unsupported SCIM endpoint"));
-}, G = "@voltro/plugin-scim", K = (r) => {
-	if (r.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
-	let i = r.basePath ?? "/scim/v2", a = n({
-		base: G,
-		alias: r.alias,
-		instance: r.name
-	}), o;
-	return t({
-		name: a,
-		baseName: G,
+	return C(404, u(404, "unsupported SCIM endpoint"));
+}, k = "@voltro/plugin-scim", A = (e) => {
+	if (e.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
+	let t = e.basePath ?? "/scim/v2", n = x({
+		base: k,
+		alias: e.alias,
+		instance: e.name
+	}), r;
+	return b({
+		name: n,
+		baseName: k,
 		description: "SCIM 2.0 Users + Groups provisioning endpoints.",
 		permissions: ["store:write"],
-		extendSchema: { tables: [N, P] },
+		extendSchema: { tables: [v, _] },
 		httpRoutes: [{
 			method: "*",
-			path: i,
+			path: t,
 			originGuard: "exempt",
-			handle: async (e) => o ? W(o, r.token, i, e) : R(503, T(503, "scim store not bound"))
+			handle: async (n) => r ? O(r, e.token, t, n) : C(503, u(503, "scim store not bound"))
 		}],
 		bindDataStore: (e) => {
-			o = L(e);
+			r = h(e);
 		},
-		onActivate: (t) => e.sync(() => {
-			t.logger.info("scim active", { basePath: i });
+		onActivate: (e) => y.sync(() => {
+			e.logger.info("scim active", { basePath: t });
 		})
 	});
 };
 //#endregion
-export { _ as SCIM_ERROR_SCHEMA, h as SCIM_GROUP_SCHEMA, g as SCIM_LIST_SCHEMA, m as SCIM_USER_SCHEMA, O as applyScimGroupPatch, C as applyScimPatch, L as dataStoreScimStore, S as fromScimUser, W as handleScim, W as handleScimRequest, I as memoryScimStore, D as parsePagination, E as parseScimFilter, M as resourceTypes, T as scimError, w as scimList, K as scimPlugin, j as scimSchemas, k as serviceProviderConfig, x as toScimUser };
+export { e as SCIM_ERROR_SCHEMA, t as SCIM_GROUP_SCHEMA, n as SCIM_LIST_SCHEMA, r as SCIM_USER_SCHEMA, i as applyScimGroupPatch, a as applyScimPatch, h as dataStoreScimStore, o as fromScimUser, O as handleScim, O as handleScimRequest, g as memoryScimStore, s as parsePagination, c as parseScimFilter, l as resourceTypes, u as scimError, d as scimList, A as scimPlugin, f as scimSchemas, p as serviceProviderConfig, m as toScimUser };