@voltro/plugin-scim 0.85.0 → 0.86.0

package/dist/index.js

@@ -1,503 +1,81 @@
-import { Effect as e } from "effect";
-import { definePlugin as t, pluginInstanceName as n, tsMs as r } from "@voltro/protocol";
-import { checkBearer as i } from "@voltro/protocol/session";
-import { boolean as a, eq as o, generateId as s, id as c, json as l, queryFor as u, table as d, text as f, timestamp as p } from "@voltro/database";
-//#region src/scim.ts
-var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:schemas:core:2.0:Group", g = "urn:ietf:params:scim:api:messages:2.0:ListResponse", _ = "urn:ietf:params:scim:api:messages:2.0:Error", v = (e) => new Date(e).toISOString(), y = (e, t) => {
-	if (typeof e == "boolean") return e;
-	if (typeof e == "number") return Number.isFinite(e) && e !== 0;
-	if (typeof e == "string") {
-		let t = e.trim().toLowerCase();
-		if (t === "true" || t === "1") return !0;
-		if (t === "false" || t === "0" || t === "") return !1;
-	}
-	return t;
-}, b = (e) => {
-	let t = (e ?? "").trim();
-	return (t.toLowerCase().startsWith("urn:") ? t.slice(t.lastIndexOf(":") + 1) : t).toLowerCase();
-}, x = (e, t) => ({
-	schemas: [m],
-	id: e.id,
-	...e.externalId ? { externalId: e.externalId } : {},
-	userName: e.userName,
-	name: {
-		givenName: e.givenName ?? "",
-		familyName: e.familyName ?? ""
-	},
-	...e.email ? { emails: [{
-		value: e.email,
-		primary: !0
-	}] } : {},
-	active: e.active,
-	meta: {
-		resourceType: "User",
-		created: v(e.createdAt),
-		lastModified: v(e.updatedAt),
-		location: `${t}/${e.id}`
-	}
-}), S = (e) => {
-	let t = e.name ?? {}, n = e.emails ?? [], r = n.find((e) => e.primary)?.value ?? n[0]?.value ?? null;
-	return {
-		userName: String(e.userName ?? ""),
-		givenName: t.givenName ?? null,
-		familyName: t.familyName ?? null,
-		email: r,
-		active: e.active === void 0 || e.active === null || y(e.active, !1),
-		externalId: e.externalId ?? null
-	};
-}, C = (e, t) => {
-	let n = t.Operations ?? t.operations ?? [], r = { ...e };
-	for (let e of n) {
-		let t = (e.op ?? "").toLowerCase();
-		if (t !== "replace" && t !== "add") continue;
-		let n = b(e.path);
-		if (n === "active") r = {
-			...r,
-			active: y(e.value, !1)
-		};
-		else if (n === "username") r = {
-			...r,
-			userName: String(e.value)
-		};
-		else if (n === "" && e.value && typeof e.value == "object") for (let [t, n] of Object.entries(e.value)) {
-			let e = t.toLowerCase();
-			e === "active" ? r = {
-				...r,
-				active: y(n, !1)
-			} : e === "username" && (r = {
-				...r,
-				userName: String(n)
-			});
-		}
-	}
-	return r;
-}, w = (e, t) => ({
-	schemas: [g],
-	totalResults: t?.totalResults ?? e.length,
-	startIndex: t?.startIndex ?? 1,
-	itemsPerPage: e.length,
-	Resources: e
-}), T = (e, t, n) => ({
-	schemas: [_],
-	status: String(e),
-	...n ? { scimType: n } : {},
-	detail: t
-}), E = (e, t) => {
-	if (!e) return { kind: "none" };
-	let n = /^\s*([A-Za-z][A-Za-z0-9]*)\s+eq\s+"([^"]*)"\s*$/i.exec(e);
-	if (!n) return { kind: "invalid" };
-	let r = t.find((e) => e.toLowerCase() === n[1].toLowerCase());
-	return r === void 0 ? { kind: "invalid" } : {
-		kind: "filter",
-		attribute: r,
-		value: n[2]
-	};
-}, D = (e) => {
-	let t = Number(e.get("startIndex")), n = Number(e.get("count"));
-	return {
-		startIndex: Number.isSafeInteger(t) && t >= 1 ? t : 1,
-		count: e.get("count") !== null && Number.isSafeInteger(n) && n >= 0 ? n : null
-	};
-}, O = (e, t) => {
-	let n = t.Operations ?? t.operations ?? [], r = (e) => (Array.isArray(e) ? e : e === void 0 ? [] : [e]).map((e) => String(e?.value ?? e)).filter((e) => e !== "" && e !== "undefined"), i = e;
-	for (let e of n) {
-		let t = (e.op ?? "").toLowerCase(), n = e.path ?? "", a = /^members\[value\s+eq\s+"([^"]*)"\]$/i.exec(n);
-		if (t === "add" && n.toLowerCase() === "members") {
-			let t = r(e.value), n = t.length > 4 ? new Set(i.members) : void 0, a = t.filter((e) => !(n === void 0 ? i.members.includes(e) : n.has(e)));
-			i = {
-				...i,
-				members: [...i.members, ...a]
-			};
-		} else if (t === "remove" && a) i = {
-			...i,
-			members: i.members.filter((e) => e !== a[1])
-		};
-		else if (t === "remove" && n.toLowerCase() === "members") {
-			let t = new Set(r(e.value));
-			i = {
-				...i,
-				members: t.size === 0 ? [] : i.members.filter((e) => !t.has(e))
-			};
-		} else if (t === "replace" && n.toLowerCase() === "members") i = {
-			...i,
-			members: [...r(e.value)]
-		};
-		else if (t === "replace" && n === "displayName") i = {
-			...i,
-			displayName: String(e.value)
-		};
-		else if (t === "replace" && n === "" && e.value && typeof e.value == "object") {
-			let t = e.value;
-			"displayName" in t && (i = {
-				...i,
-				displayName: String(t.displayName)
-			}), "members" in t && (i = {
-				...i,
-				members: [...r(t.members)]
-			});
-		}
-	}
-	return i;
-}, k = (e) => ({
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
-	documentationUri: "https://voltro.dev",
-	patch: { supported: !0 },
-	bulk: {
-		supported: !1,
-		maxOperations: 0,
-		maxPayloadSize: 0
-	},
-	filter: {
-		supported: !0,
-		maxResults: 200
-	},
-	changePassword: { supported: !1 },
-	sort: { supported: !1 },
-	etag: { supported: !1 },
-	authenticationSchemes: [{
-		type: "oauthbearertoken",
-		name: "Bearer token",
-		description: "Static bearer token configured in the IdP SCIM settings"
-	}],
-	meta: {
-		resourceType: "ServiceProviderConfig",
-		location: e
-	}
-}), A = (e, t = {}) => ({
-	name: e,
-	type: "string",
-	multiValued: !1,
-	required: !1,
-	caseExact: !1,
-	mutability: "readWrite",
-	returned: "default",
-	uniqueness: "none",
-	...t
-}), j = (e) => [{
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
-	id: m,
-	name: "User",
-	description: "SCIM core User",
-	attributes: [
-		A("userName", {
-			required: !0,
-			uniqueness: "server"
-		}),
-		A("name", {
-			type: "complex",
-			subAttributes: [A("givenName"), A("familyName")]
-		}),
-		A("emails", {
-			type: "complex",
-			multiValued: !0,
-			subAttributes: [A("value"), A("primary", { type: "boolean" })]
-		}),
-		A("active", { type: "boolean" }),
-		A("externalId")
-	],
-	meta: {
-		resourceType: "Schema",
-		location: `${e}/${m}`
-	}
-}, {
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
-	id: h,
-	name: "Group",
-	description: "SCIM core Group",
-	attributes: [
-		A("displayName", { required: !0 }),
-		A("members", {
-			type: "complex",
-			multiValued: !0,
-			subAttributes: [A("value")]
-		}),
-		A("externalId")
-	],
-	meta: {
-		resourceType: "Schema",
-		location: `${e}/${h}`
-	}
-}], M = (e) => [{
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
-	id: "User",
-	name: "User",
-	endpoint: "/Users",
-	schema: m,
-	meta: {
-		resourceType: "ResourceType",
-		location: `${e}/ResourceTypes/User`
-	}
-}, {
-	schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
-	id: "Group",
-	name: "Group",
-	endpoint: "/Groups",
-	schema: h,
-	meta: {
-		resourceType: "ResourceType",
-		location: `${e}/ResourceTypes/Group`
-	}
-}], N = d("_voltro_scim_users", {
-	id: c({ prefix: "scimuser" }),
-	userName: f(),
-	givenName: f().nullable(),
-	familyName: f().nullable(),
-	email: f().nullable(),
-	active: a().default(!0),
-	externalId: f().nullable(),
-	createdAt: p().default("now"),
-	updatedAt: p().default("now").onUpdate("now")
-}).renamedFrom("scim_users").unique("byScimUserName", ["userName"]), P = d("_voltro_scim_groups", {
-	id: c({ prefix: "scimgroup" }),
-	displayName: f(),
-	externalId: f().nullable(),
-	members: l().nullable(),
-	createdAt: p().default("now"),
-	updatedAt: p().default("now").onUpdate("now")
-}).renamedFrom("scim_groups"), F = (e) => {
-	if (!Number.isSafeInteger(e.startIndex) || e.startIndex < 1 || !Number.isSafeInteger(e.count) || e.count < 0) throw RangeError("SCIM pages require a positive startIndex and a non-negative count, both safe integers");
-}, I = (e, t) => t === null || e[t.attribute] === t.value, L = (e = Date.now) => {
-	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0, i = 0, a = (e) => `${e}_${++r}`, o = (e) => {
-		let t = -1, n = [];
-		return (r, a) => {
-			F(a), t !== i && (n = [...e.keys()].sort(), t = i);
-			let o = [], s = 0;
-			for (let t of n) {
-				let n = e.get(t);
-				I(n, r) && (s >= a.startIndex - 1 && o.length < a.count && o.push(n), s++);
-			}
-			return {
-				rows: o,
-				totalResults: s
-			};
-		};
-	}, s = o(t), c = o(n);
-	return {
-		listUsers: async (e) => [...t.values()].filter((t) => I(t, e)),
-		pageUsers: async (e, t) => s(e, t),
-		getUser: async (e) => t.get(e) ?? null,
-		createUser: async (n) => {
-			let r = {
-				...n,
-				id: a("user"),
-				createdAt: e(),
-				updatedAt: e()
-			};
-			return t.set(r.id, r), i++, r;
-		},
-		putUser: async (n, r) => {
-			if (!t.has(n)) return null;
-			let i = {
-				...r,
-				id: n,
-				updatedAt: e()
-			};
-			return t.set(n, i), i;
-		},
-		deleteUser: async (e) => {
-			let n = t.delete(e);
-			return n && i++, n;
-		},
-		listGroups: async (e) => [...n.values()].filter((t) => I(t, e)),
-		pageGroups: async (e, t) => c(e, t),
-		getGroup: async (e) => n.get(e) ?? null,
-		createGroup: async (t) => {
-			let r = {
-				...t,
-				id: a("group"),
-				createdAt: e(),
-				updatedAt: e()
-			};
-			return n.set(r.id, r), i++, r;
-		},
-		putGroup: async (t, r) => {
-			if (!n.has(t)) return null;
-			let i = {
-				...r,
-				id: t,
-				updatedAt: e()
-			};
-			return n.set(t, i), i;
-		},
-		deleteGroup: async (e) => {
-			let t = n.delete(e);
-			return t && i++, t;
-		}
-	};
-}, R = (e) => {
-	let t = async (t, n) => {
-		let r = u(t);
-		return e.query((n ? r.where(n) : r).descriptor);
-	}, n = (e) => ({
-		id: String(e.id),
-		userName: String(e.userName),
-		givenName: e.givenName ?? null,
-		familyName: e.familyName ?? null,
-		email: e.email ?? null,
-		active: !!e.active,
-		externalId: e.externalId ?? null,
-		createdAt: r(e.createdAt),
-		updatedAt: r(e.updatedAt)
-	}), i = (e) => ({
-		id: String(e.id),
-		displayName: String(e.displayName),
-		externalId: e.externalId ?? null,
-		members: e.members ?? [],
-		createdAt: r(e.createdAt),
-		updatedAt: r(e.updatedAt)
-	}), a = async (t, n, r, i) => {
-		F(r);
-		let a = u(t), s = n === null ? a : a.where(o(n.attribute, n.value)), [c, l] = await Promise.all([e.query(s.count().descriptor), r.count === 0 ? Promise.resolve([]) : e.query(s.orderBy("id", "asc").offset(r.startIndex - 1).limit(r.count).descriptor)]);
-		return {
-			rows: l.map(i),
-			totalResults: Number(c[0]?.count ?? 0)
-		};
-	};
-	return {
-		listUsers: async (e) => (await t(N, e ? o(e.attribute, e.value) : void 0)).map(n),
-		pageUsers: (e, t) => a(N, e, t, n),
-		getUser: async (e) => {
-			let r = await t(N, o("id", e));
-			return r[0] ? n(r[0]) : null;
-		},
-		createUser: async (t) => {
-			let n = s({
-				kind: "typeid",
-				prefix: "scimuser"
-			}, "_voltro_scim_users"), r = /* @__PURE__ */ new Date(), i = {
-				id: n,
-				...t,
-				createdAt: r,
-				updatedAt: r
-			};
-			return await e.insert("_voltro_scim_users", i), {
-				...t,
-				id: n,
-				createdAt: r.getTime(),
-				updatedAt: r.getTime()
-			};
-		},
-		putUser: async (n, r) => (await t(N, o("id", n)))[0] ? (await e.update("_voltro_scim_users", n, {
-			userName: r.userName,
-			givenName: r.givenName,
-			familyName: r.familyName,
-			email: r.email,
-			active: r.active,
-			externalId: r.externalId,
-			updatedAt: /* @__PURE__ */ new Date()
-		}), {
-			...r,
-			id: n,
-			updatedAt: Date.now()
-		}) : null,
-		deleteUser: async (n) => (await t(N, o("id", n)))[0] ? (await e.delete("_voltro_scim_users", n), !0) : !1,
-		listGroups: async (e) => (await t(P, e ? o(e.attribute, e.value) : void 0)).map(i),
-		pageGroups: (e, t) => a(P, e, t, i),
-		getGroup: async (e) => {
-			let n = await t(P, o("id", e));
-			return n[0] ? i(n[0]) : null;
-		},
-		createGroup: async (t) => {
-			let n = s({
-				kind: "typeid",
-				prefix: "scimgroup"
-			}, "_voltro_scim_groups"), r = /* @__PURE__ */ new Date(), i = {
-				id: n,
-				...t,
-				createdAt: r,
-				updatedAt: r
-			};
-			return await e.insert("_voltro_scim_groups", i), {
-				...t,
-				id: n,
-				createdAt: r.getTime(),
-				updatedAt: r.getTime()
-			};
-		},
-		putGroup: async (n, r) => (await t(P, o("id", n)))[0] ? (await e.update("_voltro_scim_groups", n, {
-			displayName: r.displayName,
-			externalId: r.externalId,
-			members: r.members,
-			updatedAt: /* @__PURE__ */ new Date()
-		}), {
-			...r,
-			id: n,
-			updatedAt: Date.now()
-		}) : null,
-		deleteGroup: async (n) => (await t(P, o("id", n)))[0] ? (await e.delete("_voltro_scim_groups", n), !0) : !1
-	};
-}, z = (e, t) => ({
+import { SCIM_ERROR_SCHEMA as e, SCIM_GROUP_SCHEMA as t, SCIM_LIST_SCHEMA as n, SCIM_USER_SCHEMA as r, applyScimGroupPatch as i, applyScimPatch as a, fromScimUser as o, parsePagination as s, parseScimFilter as c, resourceTypes as l, scimError as u, scimList as d, scimSchemas as f, serviceProviderConfig as p, toScimUser as m } from "./scim.js";
+import { dataStoreScimStore as h, memoryScimStore as g, scimGroupsTable as _, scimUsersTable as v } from "./store.js";
+import { Effect as y } from "effect";
+import { definePlugin as b, pluginInstanceName as x } from "@voltro/protocol";
+import { checkBearer as S } from "@voltro/protocol/session";
+//#region src/index.ts
+var C = (e, t) => ({
 	status: e,
 	body: JSON.stringify(t),
 	contentType: "application/scim+json"
-}), B = (e) => {
+}), w = (e) => {
 	try {
 		return JSON.parse(new TextDecoder().decode(e.rawBody) || "{}");
 	} catch {
 		return {};
 	}
-}, V = () => z(400, T(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), H = async (e, t, n) => (await e.listUsers({
+}, T = () => C(400, u(400, "unsupported filter — only `<attribute> eq \"value\"` on the indexed attributes", "invalidFilter")), E = async (e, t, n) => (await e.listUsers({
 	attribute: "userName",
 	value: t
-})).some((e) => e.id !== n), U = (e) => z(409, T(409, `a user with userName '${e}' already exists`, "uniqueness")), W = async (e, t, n, r) => {
-	if (!i(r.headers, t)) return z(401, T(401, "invalid or missing bearer token"));
-	let [, a, o] = r.path.slice(n.length).replace(/\/+$/, "").split("/"), s = r.method.toUpperCase(), c = new URLSearchParams(r.query), l = `${n}/Users`;
-	if (s === "GET" && !o) {
-		if (a === "ServiceProviderConfig") return z(200, k(`${n}/ServiceProviderConfig`));
-		if (a === "Schemas") return z(200, w(j(`${n}/Schemas`)));
-		if (a === "ResourceTypes") return z(200, w(M(n)));
+})).some((e) => e.id !== n), D = (e) => C(409, u(409, `a user with userName '${e}' already exists`, "uniqueness")), O = async (e, t, n, r) => {
+	if (!S(r.headers, t)) return C(401, u(401, "invalid or missing bearer token"));
+	let [, h, g] = r.path.slice(n.length).replace(/\/+$/, "").split("/"), _ = r.method.toUpperCase(), v = new URLSearchParams(r.query), y = `${n}/Users`;
+	if (_ === "GET" && !g) {
+		if (h === "ServiceProviderConfig") return C(200, p(`${n}/ServiceProviderConfig`));
+		if (h === "Schemas") return C(200, d(f(`${n}/Schemas`)));
+		if (h === "ResourceTypes") return C(200, d(l(n)));
 	}
-	if (a === "Users") {
-		if (s === "GET" && !o) {
-			let t = E(c.get("filter"), ["userName", "externalId"]);
-			if (t.kind === "invalid") return V();
-			let { startIndex: n, count: r } = D(c), i = await e.pageUsers(t.kind === "filter" ? t : null, {
+	if (h === "Users") {
+		if (_ === "GET" && !g) {
+			let t = c(v.get("filter"), ["userName", "externalId"]);
+			if (t.kind === "invalid") return T();
+			let { startIndex: n, count: r } = s(v), i = await e.pageUsers(t.kind === "filter" ? t : null, {
 				startIndex: n,
 				count: Math.min(r ?? 100, 1e3)
 			});
-			return z(200, w(i.rows.map((e) => x(e, l)), {
+			return C(200, d(i.rows.map((e) => m(e, y)), {
 				totalResults: i.totalResults,
 				startIndex: n
 			}));
 		}
-		if (s === "GET" && o) {
-			let t = await e.getUser(o);
-			return t ? z(200, x(t, l)) : z(404, T(404, "user not found"));
+		if (_ === "GET" && g) {
+			let t = await e.getUser(g);
+			return t ? C(200, m(t, y)) : C(404, u(404, "user not found"));
 		}
-		if (s === "POST" && !o) {
-			let t = S(B(r));
-			if (t.userName === "") return z(400, T(400, "userName is required", "invalidValue"));
-			if (await H(e, t.userName)) return U(t.userName);
+		if (_ === "POST" && !g) {
+			let t = o(w(r));
+			if (t.userName === "") return C(400, u(400, "userName is required", "invalidValue"));
+			if (await E(e, t.userName)) return D(t.userName);
 			try {
-				return z(201, x(await e.createUser(t), l));
+				return C(201, m(await e.createUser(t), y));
 			} catch (n) {
-				if (await H(e, t.userName)) return U(t.userName);
+				if (await E(e, t.userName)) return D(t.userName);
 				throw n;
 			}
 		}
-		if (s === "PUT" && o) {
-			let t = await e.getUser(o);
-			if (!t) return z(404, T(404, "user not found"));
+		if (_ === "PUT" && g) {
+			let t = await e.getUser(g);
+			if (!t) return C(404, u(404, "user not found"));
 			let n = {
 				...t,
-				...S(B(r))
+				...o(w(r))
 			};
-			if (await H(e, n.userName, o)) return U(n.userName);
-			let i = await e.putUser(o, n);
-			return i ? z(200, x(i, l)) : z(404, T(404, "user not found"));
+			if (await E(e, n.userName, g)) return D(n.userName);
+			let i = await e.putUser(g, n);
+			return i ? C(200, m(i, y)) : C(404, u(404, "user not found"));
 		}
-		if (s === "PATCH" && o) {
-			let t = await e.getUser(o);
-			if (!t) return z(404, T(404, "user not found"));
-			let n = C(t, B(r));
-			if (n.userName !== t.userName && await H(e, n.userName, o)) return U(n.userName);
-			let i = await e.putUser(o, n);
-			return i ? z(200, x(i, l)) : z(404, T(404, "user not found"));
+		if (_ === "PATCH" && g) {
+			let t = await e.getUser(g);
+			if (!t) return C(404, u(404, "user not found"));
+			let n = a(t, w(r));
+			if (n.userName !== t.userName && await E(e, n.userName, g)) return D(n.userName);
+			let i = await e.putUser(g, n);
+			return i ? C(200, m(i, y)) : C(404, u(404, "user not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteUser(o) ? { status: 204 } : z(404, T(404, "user not found"));
+		if (_ === "DELETE" && g) return await e.deleteUser(g) ? { status: 204 } : C(404, u(404, "user not found"));
 	}
-	if (a === "Groups") {
-		let t = `${n}/Groups`, i = (e) => ({
+	if (h === "Groups") {
+		let t = `${n}/Groups`, a = (e) => ({
 			schemas: ["urn:ietf:params:scim:schemas:core:2.0:Group"],
 			id: e.id,
 			displayName: e.displayName,
@@ -508,76 +86,76 @@ var m = "urn:ietf:params:scim:schemas:core:2.0:User", h = "urn:ietf:params:scim:
 				location: `${t}/${e.id}`
 			}
 		});
-		if (s === "GET" && !o) {
-			let t = E(c.get("filter"), ["displayName", "externalId"]);
-			if (t.kind === "invalid") return V();
-			let { startIndex: n, count: r } = D(c), a = await e.pageGroups(t.kind === "filter" ? t : null, {
+		if (_ === "GET" && !g) {
+			let t = c(v.get("filter"), ["displayName", "externalId"]);
+			if (t.kind === "invalid") return T();
+			let { startIndex: n, count: r } = s(v), i = await e.pageGroups(t.kind === "filter" ? t : null, {
 				startIndex: n,
 				count: Math.min(r ?? 100, 1e3)
 			});
-			return z(200, w(a.rows.map(i), {
-				totalResults: a.totalResults,
+			return C(200, d(i.rows.map(a), {
+				totalResults: i.totalResults,
 				startIndex: n
 			}));
 		}
-		if (s === "GET" && o) {
-			let t = await e.getGroup(o);
-			return t ? z(200, i(t)) : z(404, T(404, "group not found"));
+		if (_ === "GET" && g) {
+			let t = await e.getGroup(g);
+			return t ? C(200, a(t)) : C(404, u(404, "group not found"));
 		}
-		if (s === "POST" && !o) {
-			let t = B(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
-			return z(201, i(await e.createGroup({
+		if (_ === "POST" && !g) {
+			let t = w(r), n = (t.members ?? []).map((e) => String(e.value)).filter(Boolean);
+			return C(201, a(await e.createGroup({
 				displayName: String(t.displayName ?? ""),
 				externalId: t.externalId ?? null,
 				members: n
 			})));
 		}
-		if (s === "PUT" && o) {
-			let t = await e.getGroup(o);
-			if (!t) return z(404, T(404, "group not found"));
-			let n = B(r), a = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), s = await e.putGroup(o, {
+		if (_ === "PUT" && g) {
+			let t = await e.getGroup(g);
+			if (!t) return C(404, u(404, "group not found"));
+			let n = w(r), i = (n.members ?? []).map((e) => String(e.value)).filter(Boolean), o = await e.putGroup(g, {
 				...t,
 				displayName: String(n.displayName ?? t.displayName),
 				externalId: n.externalId ?? t.externalId,
-				members: a
+				members: i
 			});
-			return s ? z(200, i(s)) : z(404, T(404, "group not found"));
+			return o ? C(200, a(o)) : C(404, u(404, "group not found"));
 		}
-		if (s === "PATCH" && o) {
-			let t = await e.getGroup(o);
-			if (!t) return z(404, T(404, "group not found"));
-			let n = await e.putGroup(o, O(t, B(r)));
-			return n ? z(200, i(n)) : z(404, T(404, "group not found"));
+		if (_ === "PATCH" && g) {
+			let t = await e.getGroup(g);
+			if (!t) return C(404, u(404, "group not found"));
+			let n = await e.putGroup(g, i(t, w(r)));
+			return n ? C(200, a(n)) : C(404, u(404, "group not found"));
 		}
-		if (s === "DELETE" && o) return await e.deleteGroup(o) ? { status: 204 } : z(404, T(404, "group not found"));
+		if (_ === "DELETE" && g) return await e.deleteGroup(g) ? { status: 204 } : C(404, u(404, "group not found"));
 	}
-	return z(404, T(404, "unsupported SCIM endpoint"));
-}, G = "@voltro/plugin-scim", K = (r) => {
-	if (r.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
-	let i = r.basePath ?? "/scim/v2", a = n({
-		base: G,
-		alias: r.alias,
-		instance: r.name
-	}), o;
-	return t({
-		name: a,
-		baseName: G,
+	return C(404, u(404, "unsupported SCIM endpoint"));
+}, k = "@voltro/plugin-scim", A = (e) => {
+	if (e.token.trim() === "") throw Error("scimPlugin({ token }) requires a non-empty bearer token — got an empty string. SCIM exposes the full user + group directory and can deactivate accounts, so it is never mounted ungated. Set the environment variable your IdP presents (e.g. SCIM_TOKEN) and pass it through, or remove scimPlugin() from the plugin list.");
+	let t = e.basePath ?? "/scim/v2", n = x({
+		base: k,
+		alias: e.alias,
+		instance: e.name
+	}), r;
+	return b({
+		name: n,
+		baseName: k,
 		description: "SCIM 2.0 Users + Groups provisioning endpoints.",
 		permissions: ["store:write"],
-		extendSchema: { tables: [N, P] },
+		extendSchema: { tables: [v, _] },
 		httpRoutes: [{
 			method: "*",
-			path: i,
+			path: t,
 			originGuard: "exempt",
-			handle: async (e) => o ? W(o, r.token, i, e) : z(503, T(503, "scim store not bound"))
+			handle: async (n) => r ? O(r, e.token, t, n) : C(503, u(503, "scim store not bound"))
 		}],
 		bindDataStore: (e) => {
-			o = R(e);
+			r = h(e);
 		},
-		onActivate: (t) => e.sync(() => {
-			t.logger.info("scim active", { basePath: i });
+		onActivate: (e) => y.sync(() => {
+			e.logger.info("scim active", { basePath: t });
 		})
 	});
 };
 //#endregion
-export { _ as SCIM_ERROR_SCHEMA, h as SCIM_GROUP_SCHEMA, g as SCIM_LIST_SCHEMA, m as SCIM_USER_SCHEMA, O as applyScimGroupPatch, C as applyScimPatch, R as dataStoreScimStore, S as fromScimUser, W as handleScim, W as handleScimRequest, L as memoryScimStore, D as parsePagination, E as parseScimFilter, M as resourceTypes, T as scimError, w as scimList, K as scimPlugin, j as scimSchemas, k as serviceProviderConfig, x as toScimUser };
+export { e as SCIM_ERROR_SCHEMA, t as SCIM_GROUP_SCHEMA, n as SCIM_LIST_SCHEMA, r as SCIM_USER_SCHEMA, i as applyScimGroupPatch, a as applyScimPatch, h as dataStoreScimStore, o as fromScimUser, O as handleScim, O as handleScimRequest, g as memoryScimStore, s as parsePagination, c as parseScimFilter, l as resourceTypes, u as scimError, d as scimList, A as scimPlugin, f as scimSchemas, p as serviceProviderConfig, m as toScimUser };