better-supabase 0.5.0 → 0.6.0

package/dist/blocks/sso/index.js

@@ -0,0 +1,1297 @@
+import { n as dbError } from "../../errors-B11Duf73.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
+import { D as stringsOf, O as textOf, c as errorText, d as isRecord, h as optionalText, i as blockCall, k as toInstant, m as optionalInstant, n as applyTemporal, x as recordsOf, y as recordOf } from "../../block-helpers-DWHxHsEQ.js";
+//#region src/blocks/sso/sso.ts
+function recordOfDomain(value) {
+	const row = recordOf(value, "organization_domains.record");
+	return {
+		type: "TXT",
+		name: textOf(row["name"]),
+		value: textOf(row["value"])
+	};
+}
+function domainOf(value) {
+	const row = recordOf(value, "organization_domains");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		domain: textOf(row["domain"]),
+		verifiedAt: optionalInstant(row["verified_at"]),
+		autoJoinRole: optionalText(row["auto_join_role"]),
+		enforceSso: row["enforce_sso"] === true,
+		createdBy: optionalText(row["created_by"]),
+		createdAt: toInstant(textOf(row["created_at"])),
+		record: recordOfDomain(row["record"])
+	};
+}
+function providerOf(value) {
+	const row = recordOf(value, "organization_sso_providers");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		type: "saml",
+		metadataUrl: optionalText(row["metadata_url"]),
+		domains: stringsOf(row["domains"]),
+		createdAt: toInstant(textOf(row["created_at"]))
+	};
+}
+function ssoDomainOf(value) {
+	if (!isRecord(value)) return void 0;
+	return {
+		domain: textOf(value["domain"]),
+		organizationId: textOf(value["organizationId"]),
+		providerId: textOf(value["providerId"]),
+		enforceSso: value["enforceSso"] === true
+	};
+}
+/** Organization domains and SSO lookups as the caller. */
+function createSso(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	return {
+		addDomain: (organizationId, domain) => call("add_organization_domain", {
+			tenant: organizationId,
+			domain
+		}, domainOf),
+		domains: (organizationId) => call("list_organization_domains", { tenant: organizationId }, (value) => recordsOf(value, "list_organization_domains").map(domainOf)),
+		updateDomain: (domainId, settings) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (current) => current === void 0 ? err(dbError("not_found", "No domain you manage has this id", { hint: "SSO_DOMAIN_NOT_FOUND" })) : call("update_organization_domain", {
+			id: domainId,
+			auto_join_role: settings.autoJoinRole === void 0 ? current.autoJoinRole ?? null : settings.autoJoinRole,
+			enforce_sso: settings.enforceSso ?? current.enforceSso
+		}, domainOf)),
+		removeDomain: (domainId) => call("remove_organization_domain", { id: domainId }, (value) => value === true),
+		providers: (organizationId) => call("list_sso_providers", { tenant: organizationId }, (value) => recordsOf(value, "list_sso_providers").map(providerOf)),
+		domainFor: (email) => call("sso_domain_for", { email }, ssoDomainOf)
+	};
+}
+const NXDOMAIN = 3;
+const TXT = 16;
+/** TXT lookups over DNS-over-HTTPS (the `application/dns-json` API). */
+function dohResolver(options = {}) {
+	const endpoint = options.endpoint ?? "https://cloudflare-dns.com/dns-query";
+	const fetcher = options.fetch ?? fetch;
+	return async (name, signal) => {
+		const url = new URL(endpoint);
+		url.searchParams.set("name", name);
+		url.searchParams.set("type", "TXT");
+		const response = await fetcher(url, {
+			headers: { accept: "application/dns-json" },
+			...signal ? { signal } : {}
+		});
+		if (!response.ok) throw new Error(`DNS lookup of ${name} failed with ${response.status}`);
+		const body = await response.json();
+		if (!isRecord(body)) throw new Error(`DNS lookup of ${name} returned no JSON`);
+		if (body["Status"] === NXDOMAIN) return [];
+		if (body["Status"] !== 0) throw new Error(`DNS lookup of ${name} failed with status ${String(body["Status"])}`);
+		return (Array.isArray(body["Answer"]) ? body["Answer"] : []).filter((answer) => isRecord(answer) && answer["type"] === TXT).map((answer) => txtValue(textOf(isRecord(answer) ? answer["data"] : "")));
+	};
+}
+/** `"abc" "def"` (one record split into strings) gives `abcdef`. */
+function txtValue(data) {
+	const parts = [...data.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((match) => (match[1] ?? "").replaceAll(/\\(.)/g, "$1"));
+	return parts.length === 0 ? data : parts.join("");
+}
+function authStatusError(status, message) {
+	if (status === 400 || status === 422) return dbError("invalid_input", message);
+	if (status === 401) return dbError("unauthorized", message);
+	if (status === 403) return dbError("forbidden", message);
+	if (status === 404) return dbError("not_found", message);
+	if (status === 409) return dbError("conflict", message);
+	if (status === 429) return dbError("rate_limited", message);
+	return dbError("network", message);
+}
+/** Domain verification and SAML providers with a service-role client. */
+function createSsoAdmin(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const resolver = options.resolver ?? dohResolver();
+	const auth = (method, path, body) => AsyncResult.from(async () => {
+		const admin = options.auth;
+		if (!admin) return err(dbError("invalid_request", "Pass auth to createSsoAdmin to manage SAML providers"));
+		const fetcher = admin.fetch ?? fetch;
+		let response;
+		try {
+			response = await fetcher(`${admin.url.replace(/\/+$/, "")}/auth/v1/admin/sso/providers${path}`, {
+				method,
+				headers: {
+					apikey: admin.secretKey,
+					authorization: `Bearer ${admin.secretKey}`,
+					"content-type": "application/json"
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch (cause) {
+			return err(dbError("network", errorText(cause)));
+		}
+		const text = await response.text();
+		let json;
+		try {
+			json = text.length > 0 ? JSON.parse(text) : {};
+		} catch {
+			json = {};
+		}
+		if (!response.ok) {
+			const message = isRecord(json) ? optionalText(json["msg"]) ?? optionalText(json["message"]) ?? optionalText(json["error_description"]) : void 0;
+			return err(authStatusError(response.status, message ?? `Supabase Auth answered ${response.status}`));
+		}
+		return ok(isRecord(json) ? json : {});
+	});
+	const providerBody = (input) => ({
+		type: "saml",
+		...input.metadataUrl === void 0 ? {} : { metadata_url: input.metadataUrl },
+		...input.metadataXml === void 0 ? {} : { metadata_xml: input.metadataXml },
+		...input.domains === void 0 ? {} : { domains: [...input.domains] },
+		...input.attributeMapping === void 0 ? {} : { attribute_mapping: input.attributeMapping },
+		...input.nameIdFormat === void 0 ? {} : { name_id_format: input.nameIdFormat }
+	});
+	const register = (organizationId, providerId, domains, metadataUrl, actor) => call("register_sso_provider", {
+		tenant: organizationId,
+		provider: providerId,
+		domains,
+		metadata_url: metadataUrl ?? null,
+		actor: actor.actorId ?? null
+	}, providerOf);
+	const providerFor = (providerId, actor) => call("sso_provider", {
+		provider: providerId,
+		actor: actor.actorId ?? null
+	}, (value) => isRecord(value) ? providerOf(value) : void 0);
+	const missing = () => err(dbError("not_found", "No SSO provider has this id", { hint: "SSO_PROVIDER_NOT_FOUND" }));
+	const path = (providerId) => `/${encodeURIComponent(providerId)}`;
+	return {
+		verifyDomain: (domainId, request = {}) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (found) => {
+			if (found === void 0) return err(dbError("not_found", "No domain has this id", { hint: "SSO_DOMAIN_NOT_FOUND" }));
+			if (found.verifiedAt === void 0) {
+				let values;
+				try {
+					values = await resolver(found.record.name, request.signal);
+				} catch (cause) {
+					return err(dbError("network", errorText(cause)));
+				}
+				if (!values.includes(found.record.value)) return err(dbError("invalid_request", `No TXT record ${found.record.name} with the verification value yet`, { hint: "SSO_DOMAIN_RECORD_MISSING" }));
+			}
+			return call("verify_organization_domain", {
+				id: domainId,
+				actor: request.actorId ?? null
+			}, domainOf);
+		}),
+		addSamlProvider: (organizationId, input, actor = {}) => call("check_sso_provider", {
+			tenant: organizationId,
+			domains: input.domains,
+			actor: actor.actorId ?? null
+		}, () => void 0).andThen(() => auth("POST", "", providerBody(input))).andThen(async (created) => {
+			const providerId = textOf(created["id"]);
+			const recorded = await register(organizationId, providerId, input.domains, input.metadataUrl, actor);
+			if (!recorded.ok) await auth("DELETE", path(providerId));
+			return recorded;
+		}),
+		updateSamlProvider: (providerId, input, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return missing();
+			const checked = await call("check_sso_provider", {
+				tenant: found.organizationId,
+				domains: input.domains,
+				actor: actor.actorId ?? null
+			}, () => void 0);
+			if (!checked.ok) return checked;
+			const updated = await auth("PUT", path(providerId), providerBody(input));
+			if (!updated.ok) return updated;
+			const metadataUrl = input.metadataXml === void 0 ? input.metadataUrl ?? found.metadataUrl : void 0;
+			return register(found.organizationId, providerId, input.domains, metadataUrl, actor);
+		}),
+		removeSamlProvider: (providerId, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return ok(void 0);
+			const deleted = await auth("DELETE", path(providerId));
+			if (!deleted.ok && deleted.error.kind !== "not_found") return deleted;
+			return call("unregister_sso_provider", {
+				provider: providerId,
+				actor: actor.actorId ?? null
+			}, () => found);
+		})
+	};
+}
+//#endregion
+//#region src/blocks/sso/scim-filter.ts
+/** SCIM filters (RFC 7644 §3.4.2.2): parsing and evaluation over resource JSON. */
+/** A filter the service provider can't parse or apply: 400 `invalidFilter`. */
+var ScimFilterError = class extends Error {
+	name = "ScimFilterError";
+};
+const COMPARE = [
+	"eq",
+	"ne",
+	"co",
+	"sw",
+	"ew",
+	"gt",
+	"ge",
+	"lt",
+	"le"
+];
+function tokenize(input) {
+	const tokens = [];
+	let i = 0;
+	while (i < input.length) {
+		const char = input.charAt(i);
+		if (/\s/.test(char)) i += 1;
+		else if (char === "(" || char === ")" || char === "[" || char === "]") {
+			tokens.push({
+				kind: "punct",
+				value: char
+			});
+			i += 1;
+		} else if (char === "\"") {
+			let end = i + 1;
+			while (end < input.length && input.charAt(end) !== "\"") end += input.charAt(end) === "\\" ? 2 : 1;
+			if (end >= input.length) throw new ScimFilterError("Unterminated string");
+			const raw = input.slice(i, end + 1);
+			let value;
+			try {
+				value = JSON.parse(raw);
+			} catch {
+				throw new ScimFilterError(`Invalid string ${raw}`);
+			}
+			tokens.push({
+				kind: "string",
+				value: String(value)
+			});
+			i = end + 1;
+		} else {
+			let end = i;
+			while (end < input.length && !/[\s()[\]"]/.test(input.charAt(end))) end += 1;
+			tokens.push({
+				kind: "word",
+				value: input.slice(i, end)
+			});
+			i = end;
+		}
+	}
+	return tokens;
+}
+const ATTR_PATH = /^(?:urn:[^\s]+:)?[A-Za-z$][\w$-]*(?:\.[A-Za-z$][\w$-]*)?$/;
+/** Parses a SCIM filter; throws `ScimFilterError`. */
+function parseFilter(input) {
+	const tokens = tokenize(input);
+	let position = 0;
+	const peek = () => tokens[position];
+	const keyword = (word) => {
+		const token = peek();
+		return token?.kind === "word" && token.value.toLowerCase() === word.toLowerCase();
+	};
+	const expect = (value) => {
+		const token = peek();
+		if (token?.kind !== "punct" || token.value !== value) throw new ScimFilterError(`Expected ${value}`);
+		position += 1;
+	};
+	const orExpression = () => {
+		let left = andExpression();
+		while (keyword("or")) {
+			position += 1;
+			left = {
+				op: "or",
+				left,
+				right: andExpression()
+			};
+		}
+		return left;
+	};
+	const andExpression = () => {
+		let left = notExpression();
+		while (keyword("and")) {
+			position += 1;
+			left = {
+				op: "and",
+				left,
+				right: notExpression()
+			};
+		}
+		return left;
+	};
+	const notExpression = () => {
+		if (keyword("not")) {
+			position += 1;
+			const open = peek();
+			if (open?.kind !== "punct" || open.value !== "(") throw new ScimFilterError("Expected ( after not");
+			position += 1;
+			const filter = orExpression();
+			expect(")");
+			return {
+				op: "not",
+				filter
+			};
+		}
+		return atom();
+	};
+	const atom = () => {
+		const token = peek();
+		if (token?.kind === "punct" && token.value === "(") {
+			position += 1;
+			const filter = orExpression();
+			expect(")");
+			return filter;
+		}
+		if (token?.kind !== "word" || !ATTR_PATH.test(token.value)) throw new ScimFilterError("Expected an attribute path");
+		position += 1;
+		const path = token.value;
+		const next = peek();
+		if (next?.kind === "punct" && next.value === "[") {
+			position += 1;
+			const filter = orExpression();
+			expect("]");
+			return {
+				op: "value",
+				path,
+				filter
+			};
+		}
+		if (next?.kind !== "word") throw new ScimFilterError(`Expected an operator after ${path}`);
+		const op = next.value.toLowerCase();
+		position += 1;
+		if (op === "pr") return {
+			op: "pr",
+			path
+		};
+		const compare = COMPARE.find((candidate) => candidate === op);
+		if (compare === void 0) throw new ScimFilterError(`Unknown operator ${next.value}`);
+		return {
+			op: compare,
+			path,
+			value: literal()
+		};
+	};
+	const literal = () => {
+		const token = peek();
+		position += 1;
+		if (token?.kind === "string") return token.value;
+		if (token?.kind === "word") {
+			const word = token.value.toLowerCase();
+			if (word === "true") return true;
+			if (word === "false") return false;
+			if (word === "null") return null;
+			if (/^-?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(token.value)) return Number(token.value);
+		}
+		throw new ScimFilterError("Expected a value");
+	};
+	if (tokens.length === 0) throw new ScimFilterError("Empty filter");
+	const filter = orExpression();
+	if (position !== tokens.length) throw new ScimFilterError("Unexpected input after the filter");
+	return filter;
+}
+/** The attribute paths compared case-sensitively (RFC 7643 `caseExact`). */
+const CASE_EXACT = /* @__PURE__ */ new Set([
+	"id",
+	"externalid",
+	"meta.version"
+]);
+const DATES = /* @__PURE__ */ new Set(["meta.created", "meta.lastmodified"]);
+function lookup(record, name) {
+	const lower = name.toLowerCase();
+	for (const [key, value] of Object.entries(record)) if (key.toLowerCase() === lower) return value;
+}
+/** The URN prefix of `path` when it names one of the resource's schemas, and the rest. */
+function relative(resource, path) {
+	const colon = path.lastIndexOf(":");
+	if (colon === -1) return path;
+	const urn = path.slice(0, colon).toLowerCase();
+	return (Array.isArray(resource["schemas"]) ? resource["schemas"].map((schema) => String(schema).toLowerCase()) : []).includes(urn) ? path.slice(colon + 1) : void 0;
+}
+/** The values at `path`; multi-valued complex attributes give their `value`s. */
+function valuesAt(resource, path) {
+	const local = relative(resource, path);
+	if (local === void 0) return [];
+	const [attribute = "", sub] = local.split(".");
+	const value = lookup(resource, attribute);
+	if (value === void 0 || value === null) return [];
+	if (Array.isArray(value)) return value.map((item) => isRecord(item) ? lookup(item, sub ?? "value") : sub ? void 0 : item).filter((item) => item !== void 0 && item !== null);
+	if (isRecord(value)) {
+		if (sub === void 0) return [];
+		const inner = lookup(value, sub);
+		return inner === void 0 || inner === null ? [] : [inner];
+	}
+	return sub === void 0 ? [value] : [];
+}
+function compare(op, actual, expected, path) {
+	const key = path.slice(path.lastIndexOf(":") + 1).toLowerCase();
+	if (typeof actual === "boolean" || typeof expected === "boolean") {
+		if (op !== "eq" && op !== "ne") throw new ScimFilterError(`${op} does not apply to booleans`);
+		return op === "eq" ? actual === expected : actual !== expected;
+	}
+	if (expected === null) return op === "ne" ? actual !== null : actual === null;
+	if (typeof actual === "number" && typeof expected === "number") return order(op, actual - expected);
+	if (typeof actual !== "string") return op === "ne";
+	if (typeof expected !== "string") return op === "ne";
+	if (DATES.has(key)) {
+		const left = Date.parse(actual);
+		const right = Date.parse(expected);
+		if (!Number.isNaN(left) && !Number.isNaN(right)) return order(op, left - right);
+	}
+	const exact = CASE_EXACT.has(key);
+	const a = exact ? actual : actual.toLowerCase();
+	const b = exact ? expected : expected.toLowerCase();
+	switch (op) {
+		case "co": return a.includes(b);
+		case "sw": return a.startsWith(b);
+		case "ew": return a.endsWith(b);
+		case "eq":
+		case "ne":
+		case "gt":
+		case "ge":
+		case "lt":
+		case "le": return order(op, a < b ? -1 : a > b ? 1 : 0);
+		default: throw new ScimFilterError(`Unknown operator ${String(op)}`);
+	}
+}
+function order(op, difference) {
+	switch (op) {
+		case "eq": return difference === 0;
+		case "ne": return difference !== 0;
+		case "gt": return difference > 0;
+		case "ge": return difference >= 0;
+		case "lt": return difference < 0;
+		case "le": return difference <= 0;
+		case "co":
+		case "sw":
+		case "ew": throw new ScimFilterError(`${op} applies to strings`);
+		default: throw new ScimFilterError(`Unknown operator ${String(op)}`);
+	}
+}
+/** Whether `resource` matches; a multi-valued attribute matches when any value does. */
+function matches(resource, filter) {
+	switch (filter.op) {
+		case "and": return matches(resource, filter.left) && matches(resource, filter.right);
+		case "or": return matches(resource, filter.left) || matches(resource, filter.right);
+		case "not": return !matches(resource, filter.filter);
+		case "pr": return valuesAt(resource, filter.path).some((value) => value !== "" && !(Array.isArray(value) && value.length === 0));
+		case "value": {
+			const local = relative(resource, filter.path);
+			const items = local === void 0 ? void 0 : lookup(resource, local);
+			return Array.isArray(items) && items.some((item) => isRecord(item) && matches(item, filter.filter));
+		}
+		case "eq":
+		case "ne":
+		case "co":
+		case "sw":
+		case "ew":
+		case "gt":
+		case "ge":
+		case "lt":
+		case "le": {
+			const values = valuesAt(resource, filter.path);
+			if (values.length === 0) return filter.op === "ne";
+			return values.some((value) => compare(filter.op, value, filter.value, filter.path));
+		}
+		default: throw new ScimFilterError(`Unknown filter ${JSON.stringify(filter)}`);
+	}
+}
+//#endregion
+//#region src/blocks/sso/scim-patch.ts
+/** A PATCH the service provider rejects, with its `scimType`. */
+var ScimPatchError = class extends Error {
+	name = "ScimPatchError";
+	scimType;
+	constructor(scimType, message) {
+		super(message);
+		this.scimType = scimType;
+	}
+};
+const PATH = /^([A-Za-z$][\w$-]*)(?:\[(.*)\])?(?:\.([A-Za-z$][\w$-]*))?$/s;
+const find = (attributes, name) => attributes?.find((a) => a.name.toLowerCase() === name.toLowerCase());
+function parsePath(raw, urn, attributes) {
+	const prefix = `${urn.toLowerCase()}:`;
+	const local = raw.toLowerCase().startsWith(prefix) ? raw.slice(prefix.length) : raw;
+	const match = PATH.exec(local);
+	if (!match) throw new ScimPatchError("invalidPath", `Invalid path ${raw}`);
+	const [, name = "", filterText, subName] = match;
+	const attribute = find(attributes, name);
+	if (!attribute) throw new ScimPatchError("invalidPath", `Unknown attribute ${name}`);
+	if (attribute.mutability === "readOnly") throw new ScimPatchError("mutability", `${attribute.name} is read-only`);
+	let filter;
+	if (filterText !== void 0) {
+		if (!attribute.multiValued) throw new ScimPatchError("invalidPath", `${attribute.name} is not multi-valued`);
+		try {
+			filter = parseFilter(filterText);
+		} catch (cause) {
+			throw new ScimPatchError("invalidFilter", cause instanceof Error ? cause.message : String(cause));
+		}
+	}
+	let sub;
+	if (subName !== void 0) {
+		sub = find(attribute.subAttributes, subName);
+		if (!sub) throw new ScimPatchError("invalidPath", `Unknown attribute ${attribute.name}.${subName}`);
+	}
+	return {
+		attribute,
+		filter,
+		sub
+	};
+}
+const itemsOf = (value) => {
+	return (Array.isArray(value) ? value : [value]).map((item) => isRecord(item) ? { ...item } : { value: item });
+};
+const without = (item, key) => Object.fromEntries(Object.entries(item).filter(([name]) => name !== key));
+const sameValue = (a, b) => String(a["value"]).toLowerCase() === String(b["value"]).toLowerCase();
+/** Keeps one `primary: true` value: the last one set. */
+function onePrimary(items) {
+	const last = items.findLastIndex((item) => item["primary"] === true);
+	return items.map((item, index) => index !== last && item["primary"] === true ? {
+		...item,
+		primary: false
+	} : item);
+}
+function apply(doc, op, path, value) {
+	const { attribute, filter, sub } = path;
+	const key = attribute.name;
+	if (attribute.multiValued) {
+		const current = Array.isArray(doc[key]) ? itemsOf(doc[key]) : [];
+		if (filter === void 0) {
+			if (sub !== void 0) {
+				if (op === "remove") doc[key] = current.map((item) => without(item, sub.name));
+				else doc[key] = current.length === 0 ? [{ [sub.name]: value }] : current.map((item) => ({
+					...item,
+					[sub.name]: value
+				}));
+				return;
+			}
+			if (op === "remove") {
+				if (value === void 0) delete doc[key];
+				else {
+					const gone = itemsOf(value);
+					doc[key] = current.filter((item) => !gone.some((other) => sameValue(item, other)));
+				}
+				return;
+			}
+			const added = itemsOf(value);
+			doc[key] = onePrimary(op === "replace" ? added : [...current, ...added.filter((item) => !current.some((other) => sameValue(item, other)))]);
+			return;
+		}
+		const hit = (item) => matches(item, filter);
+		if (op === "remove") {
+			doc[key] = sub === void 0 ? current.filter((item) => !hit(item)) : current.map((item) => hit(item) ? without(item, sub.name) : item);
+			return;
+		}
+		if (!current.some(hit)) throw new ScimPatchError("noTarget", `No ${key} value matches the filter`);
+		doc[key] = onePrimary(current.map((item) => {
+			if (!hit(item)) return item;
+			if (sub !== void 0) return {
+				...item,
+				[sub.name]: value
+			};
+			if (!isRecord(value)) throw new ScimPatchError("invalidValue", `${key} values are objects`);
+			return op === "replace" ? { ...value } : {
+				...item,
+				...value
+			};
+		}));
+		return;
+	}
+	if (sub !== void 0) {
+		const inner = isRecord(doc[key]) ? { ...doc[key] } : {};
+		if (op === "remove") delete inner[sub.name];
+		else inner[sub.name] = value;
+		doc[key] = inner;
+		return;
+	}
+	if (op === "remove") {
+		if (attribute.required) throw new ScimPatchError("mutability", `${key} is required`);
+		delete doc[key];
+		return;
+	}
+	if (attribute.type === "complex") {
+		if (!isRecord(value)) throw new ScimPatchError("invalidValue", `${key} is an object`);
+		doc[key] = op === "add" && isRecord(doc[key]) ? {
+			...doc[key],
+			...value
+		} : { ...value };
+		return;
+	}
+	doc[key] = value;
+}
+const OPS = [
+	"add",
+	"replace",
+	"remove"
+];
+/**
+* Applies a PatchOp body's `Operations` to a copy of `resource`, in order.
+* Throws `ScimPatchError`; the original is never changed.
+*/
+function applyPatch(resource, body, urn, attributes, patchUrn) {
+	if (!isRecord(body) || !Array.isArray(body["schemas"]) || !body["schemas"].includes(patchUrn) || !Array.isArray(body["Operations"])) throw new ScimPatchError("invalidSyntax", `A PATCH body has schemas [${patchUrn}] and Operations`);
+	const doc = structuredClone(resource);
+	for (const operation of body["Operations"]) {
+		if (!isRecord(operation)) throw new ScimPatchError("invalidSyntax", "Each operation is an object");
+		const name = String(operation["op"]).toLowerCase();
+		const op = OPS.find((candidate) => candidate === name);
+		if (op === void 0) throw new ScimPatchError("invalidSyntax", `Unknown op ${String(operation["op"])}`);
+		const value = operation["value"];
+		const raw = operation["path"];
+		if (raw !== void 0 && typeof raw !== "string") throw new ScimPatchError("invalidPath", "path is a string");
+		if (raw !== void 0 && raw.length > 0) {
+			apply(doc, op, parsePath(raw, urn, attributes), value);
+			continue;
+		}
+		if (op === "remove") throw new ScimPatchError("noTarget", "remove needs a path");
+		if (!isRecord(value)) throw new ScimPatchError("invalidValue", "Without a path the value is an object of attributes");
+		for (const [key, inner] of Object.entries(value)) if (key.toLowerCase() === urn.toLowerCase() && isRecord(inner)) for (const [nested, nestedValue] of Object.entries(inner)) apply(doc, op, parsePath(nested, urn, attributes), nestedValue);
+		else if (key.toLowerCase() !== "schemas") apply(doc, op, parsePath(key, urn, attributes), inner);
+	}
+	return doc;
+}
+//#endregion
+//#region src/blocks/sso/scim-schema.ts
+/** SCIM 2.0 schema URIs and the attributes this service provider supports (RFC 7643). */
+const SCIM_USER = "urn:ietf:params:scim:schemas:core:2.0:User";
+const SCIM_GROUP = "urn:ietf:params:scim:schemas:core:2.0:Group";
+const SCIM_LIST = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+const SCIM_ERROR = "urn:ietf:params:scim:api:messages:2.0:Error";
+const SCIM_PATCH = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+const SCIM_SEARCH = "urn:ietf:params:scim:api:messages:2.0:SearchRequest";
+const SCIM_SERVICE_PROVIDER_CONFIG = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+const SCIM_RESOURCE_TYPE = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
+const SCIM_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Schema";
+const text = (name, description, extra = {}) => ({
+	name,
+	type: "string",
+	multiValued: false,
+	description,
+	required: false,
+	caseExact: false,
+	mutability: "readWrite",
+	returned: "default",
+	uniqueness: "none",
+	...extra
+});
+const reference = (mutability) => ({
+	name: "$ref",
+	type: "reference",
+	referenceTypes: ["User", "Group"],
+	multiValued: false,
+	description: "The URI of the resource.",
+	required: false,
+	caseExact: false,
+	mutability,
+	returned: "default",
+	uniqueness: "none"
+});
+const USER_ATTRIBUTES = [
+	text("userName", "Unique identifier for the User within the organization.", {
+		required: true,
+		uniqueness: "server"
+	}),
+	{
+		name: "name",
+		type: "complex",
+		multiValued: false,
+		description: "The components of the user's name.",
+		required: false,
+		mutability: "readWrite",
+		returned: "default",
+		uniqueness: "none",
+		subAttributes: [
+			text("formatted", "The full name."),
+			text("familyName", "The family name."),
+			text("givenName", "The given name.")
+		]
+	},
+	text("displayName", "The name of the User, suitable for display."),
+	{
+		name: "emails",
+		type: "complex",
+		multiValued: true,
+		description: "Email addresses for the user. The primary address links the User to an account at a verified domain.",
+		required: false,
+		mutability: "readWrite",
+		returned: "default",
+		uniqueness: "none",
+		subAttributes: [
+			text("value", "The email address."),
+			text("display", "A label for display."),
+			text("type", "The kind of address.", { canonicalValues: [
+				"work",
+				"home",
+				"other"
+			] }),
+			{
+				name: "primary",
+				type: "boolean",
+				multiValued: false,
+				description: "Whether this is the primary address.",
+				required: false,
+				mutability: "readWrite",
+				returned: "default"
+			}
+		]
+	},
+	{
+		name: "active",
+		type: "boolean",
+		multiValued: false,
+		description: "Whether the user may use the organization. False removes the membership.",
+		required: false,
+		mutability: "readWrite",
+		returned: "default"
+	},
+	{
+		name: "groups",
+		type: "complex",
+		multiValued: true,
+		description: "The groups the user belongs to, through Group membership.",
+		required: false,
+		mutability: "readOnly",
+		returned: "default",
+		subAttributes: [
+			text("value", "The id of the Group.", { mutability: "readOnly" }),
+			reference("readOnly"),
+			text("display", "The displayName of the Group.", { mutability: "readOnly" })
+		]
+	}
+];
+const GROUP_ATTRIBUTES = [text("displayName", "A name for the Group. Groups named like a role, or mapped in groupRoles, grant that role.", { required: true }), {
+	name: "members",
+	type: "complex",
+	multiValued: true,
+	description: "The Users in the Group.",
+	required: false,
+	mutability: "readWrite",
+	returned: "default",
+	subAttributes: [
+		text("value", "The id of the User.", { mutability: "immutable" }),
+		reference("immutable"),
+		text("type", "The kind of member.", {
+			canonicalValues: ["User"],
+			mutability: "immutable"
+		})
+	]
+}];
+/** The writable attribute names of each resource, for PATCH paths. */
+const ATTRIBUTES = {
+	User: [...USER_ATTRIBUTES, text("externalId", "The client's identifier for the resource.", { caseExact: true })],
+	Group: [...GROUP_ATTRIBUTES, text("externalId", "The client's identifier for the resource.", { caseExact: true })]
+};
+/** `/ServiceProviderConfig` (RFC 7643 §5). */
+function serviceProviderConfig(base, options) {
+	return {
+		schemas: [SCIM_SERVICE_PROVIDER_CONFIG],
+		...options.documentationUri === void 0 ? {} : { documentationUri: options.documentationUri },
+		patch: { supported: true },
+		bulk: {
+			supported: false,
+			maxOperations: 0,
+			maxPayloadSize: 0
+		},
+		filter: {
+			supported: true,
+			maxResults: options.maxResults
+		},
+		changePassword: { supported: false },
+		sort: { supported: false },
+		etag: { supported: true },
+		authenticationSchemes: [{
+			type: "oauthbearertoken",
+			name: "OAuth Bearer Token",
+			description: "An organization API key with the scim scope, sent as a bearer token.",
+			primary: true
+		}],
+		meta: {
+			resourceType: "ServiceProviderConfig",
+			location: `${base}/ServiceProviderConfig`
+		}
+	};
+}
+/** `/ResourceTypes` entries (RFC 7643 §6). */
+function resourceTypes(base) {
+	return [{
+		schemas: [SCIM_RESOURCE_TYPE],
+		id: "User",
+		name: "User",
+		endpoint: "/Users",
+		description: "A member of the organization",
+		schema: SCIM_USER,
+		schemaExtensions: [],
+		meta: {
+			resourceType: "ResourceType",
+			location: `${base}/ResourceTypes/User`
+		}
+	}, {
+		schemas: [SCIM_RESOURCE_TYPE],
+		id: "Group",
+		name: "Group",
+		endpoint: "/Groups",
+		description: "A group of members, mapped to a role",
+		schema: SCIM_GROUP,
+		schemaExtensions: [],
+		meta: {
+			resourceType: "ResourceType",
+			location: `${base}/ResourceTypes/Group`
+		}
+	}];
+}
+/** `/Schemas` entries (RFC 7643 §7). */
+function schemas(base) {
+	return [{
+		schemas: [SCIM_SCHEMA],
+		id: SCIM_USER,
+		name: "User",
+		description: "User Account",
+		attributes: USER_ATTRIBUTES,
+		meta: {
+			resourceType: "Schema",
+			location: `${base}/Schemas/${SCIM_USER}`
+		}
+	}, {
+		schemas: [SCIM_SCHEMA],
+		id: SCIM_GROUP,
+		name: "Group",
+		description: "Group",
+		attributes: GROUP_ATTRIBUTES,
+		meta: {
+			resourceType: "Schema",
+			location: `${base}/Schemas/${SCIM_GROUP}`
+		}
+	}];
+}
+//#endregion
+//#region src/blocks/sso/scim.ts
+const MEDIA_TYPE = "application/scim+json";
+const MAX_BODY = 1048576;
+var ScimError = class extends Error {
+	name = "ScimError";
+	status;
+	scimType;
+	headers;
+	constructor(status, detail, scimType, headers = {}) {
+		super(detail);
+		this.status = status;
+		this.scimType = scimType;
+		this.headers = headers;
+	}
+};
+function json(status, body, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: {
+			"content-type": MEDIA_TYPE,
+			...headers
+		}
+	});
+}
+function errorResponse(error) {
+	return json(error.status, {
+		schemas: [SCIM_ERROR],
+		status: String(error.status),
+		...error.scimType === void 0 ? {} : { scimType: error.scimType },
+		detail: error.message
+	}, error.headers);
+}
+function fromDbError(error) {
+	if (error.hint === "SCIM_NOT_FOUND") return new ScimError(404, error.message);
+	if (error.hint === "SCIM_PRECONDITION") return new ScimError(412, "The resource changed; read it again");
+	if (error.kind === "conflict") return new ScimError(409, "A resource with this value exists", "uniqueness");
+	if (error.hint === "SCIM_INVALID" || error.kind === "invalid_input" || error.kind === "check" || error.kind === "not_null") return new ScimError(400, error.message, "invalidValue");
+	return new ScimError(500, "The service provider failed");
+}
+const etag = (version) => `W/"${String(version)}"`;
+/** The version an `If-Match` header requires; `undefined` for none or `*`. */
+function ifMatch(request) {
+	const header = request.headers.get("if-match")?.trim();
+	if (!header || header === "*") return void 0;
+	const version = /^(?:W\/)?"(\d+)"$/.exec(header)?.[1];
+	if (version === void 0) throw new ScimError(412, "If-Match names no current version");
+	return Number(version);
+}
+function meta(row, kind, location) {
+	return {
+		resourceType: kind,
+		created: toInstant(textOf(row["created_at"])).toString(),
+		lastModified: toInstant(textOf(row["updated_at"])).toString(),
+		location,
+		version: etag(row["version"])
+	};
+}
+function compact(doc) {
+	return Object.fromEntries(Object.entries(doc).filter(([, value]) => value !== void 0));
+}
+function userOf(value, base) {
+	const row = recordOf(value, "scim_users");
+	const id = textOf(row["id"]);
+	const givenName = optionalText(row["given_name"]);
+	const familyName = optionalText(row["family_name"]);
+	return compact({
+		schemas: [SCIM_USER],
+		id,
+		externalId: optionalText(row["external_id"]),
+		userName: textOf(row["user_name"]),
+		name: givenName === void 0 && familyName === void 0 ? void 0 : compact({
+			givenName,
+			familyName,
+			formatted: [givenName, familyName].filter(Boolean).join(" ")
+		}),
+		displayName: optionalText(row["display_name"]),
+		emails: Array.isArray(row["emails"]) ? row["emails"] : [],
+		active: row["active"] !== false,
+		groups: recordsOf(row["groups"], "scim_users.groups").map((group) => ({
+			value: textOf(group["value"]),
+			display: textOf(group["display"]),
+			$ref: `${base}/Groups/${textOf(group["value"])}`
+		})),
+		meta: meta(row, "User", `${base}/Users/${id}`)
+	});
+}
+function groupOf(value, base) {
+	const row = recordOf(value, "scim_groups");
+	const id = textOf(row["id"]);
+	return compact({
+		schemas: [SCIM_GROUP],
+		id,
+		externalId: optionalText(row["external_id"]),
+		displayName: textOf(row["display_name"]),
+		members: recordsOf(row["members"], "scim_groups.members").map((member) => ({
+			value: textOf(member["value"]),
+			display: textOf(member["display"]),
+			type: "User",
+			$ref: `${base}/Users/${textOf(member["value"])}`
+		})),
+		meta: meta(row, "Group", `${base}/Groups/${id}`)
+	});
+}
+function stringField(doc, key) {
+	const value = doc[key];
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "string") throw new ScimError(400, `${key} is a string`, "invalidValue");
+	return value;
+}
+function booleanField(value) {
+	if (value === void 0 || value === null) return true;
+	if (typeof value === "boolean") return value;
+	if (typeof value === "string" && /^(true|false)$/i.test(value)) return value.toLowerCase() === "true";
+	throw new ScimError(400, "active is a boolean", "invalidValue");
+}
+/** Attribute names are case-insensitive: `UserName` reads as `userName`. */
+function canonical(doc, kind) {
+	const names = [
+		...ATTRIBUTES[kind].map((attribute) => attribute.name),
+		"schemas",
+		"id",
+		"meta"
+	];
+	const out = {};
+	for (const [key, value] of Object.entries(doc)) {
+		const name = names.find((n) => n.toLowerCase() === key.toLowerCase());
+		out[name ?? key] = value;
+	}
+	return out;
+}
+function userData(input) {
+	const doc = canonical(input, "User");
+	const userName = stringField(doc, "userName");
+	if (userName === void 0 || userName.trim() === "") throw new ScimError(400, "userName is required", "invalidValue");
+	const name = isRecord(doc["name"]) ? doc["name"] : {};
+	const raw = doc["emails"] ?? [];
+	const emails = Array.isArray(raw) ? raw.filter(isRecord) : [];
+	if (!Array.isArray(raw) || emails.length !== raw.length || !emails.every((email) => typeof email["value"] === "string")) throw new ScimError(400, "emails are objects with a value", "invalidValue");
+	return {
+		userName,
+		externalId: stringField(doc, "externalId") ?? null,
+		displayName: stringField(doc, "displayName") ?? null,
+		givenName: stringField(name, "givenName") ?? null,
+		familyName: stringField(name, "familyName") ?? null,
+		emails: emails.map((email) => compact({
+			value: email["value"],
+			type: optionalText(email["type"]),
+			display: optionalText(email["display"]),
+			primary: email["primary"] === true ? true : void 0
+		})),
+		active: booleanField(doc["active"])
+	};
+}
+function groupData(input) {
+	const doc = canonical(input, "Group");
+	const displayName = stringField(doc, "displayName");
+	if (displayName === void 0 || displayName.trim() === "") throw new ScimError(400, "displayName is required", "invalidValue");
+	const raw = doc["members"] ?? [];
+	const members = Array.isArray(raw) ? raw.filter(isRecord) : [];
+	if (!Array.isArray(raw) || members.length !== raw.length || !members.every((member) => typeof member["value"] === "string")) throw new ScimError(400, "members are objects with a value", "invalidValue");
+	return {
+		displayName,
+		externalId: stringField(doc, "externalId") ?? null,
+		members: members.map((member) => String(member["value"]))
+	};
+}
+/** `attributes` and `excludedAttributes` (RFC 7644 §3.4.2.5); `id` and `schemas` always stay. */
+function project(doc, attributes, excluded) {
+	const always = /* @__PURE__ */ new Set(["id", "schemas"]);
+	const top = (path) => {
+		const local = path.slice(path.lastIndexOf(":") + 1);
+		return (local.split(".")[0] ?? local).toLowerCase();
+	};
+	if (attributes && attributes.length > 0) {
+		const wanted = new Set(attributes.map(top));
+		return Object.fromEntries(Object.entries(doc).filter(([key]) => always.has(key) || wanted.has(key.toLowerCase())));
+	}
+	if (excluded && excluded.length > 0) {
+		const dropped = new Set(excluded.map(top));
+		return Object.fromEntries(Object.entries(doc).filter(([key]) => always.has(key) || !dropped.has(key.toLowerCase())));
+	}
+	return doc;
+}
+const list = (value) => value === null ? void 0 : value.split(",").map((part) => part.trim()).filter(Boolean);
+function integer(value) {
+	const number = typeof value === "string" ? Number(value) : value;
+	return typeof number === "number" && Number.isInteger(number) ? number : void 0;
+}
+function queryOf(source, maxResults) {
+	if (source.attributes?.length && source.excluded?.length) throw new ScimError(400, "attributes and excludedAttributes are mutually exclusive", "invalidSyntax");
+	let filter;
+	if (typeof source.filter === "string" && source.filter.trim() !== "") try {
+		filter = parseFilter(source.filter);
+	} catch (cause) {
+		throw new ScimError(400, cause instanceof Error ? cause.message : String(cause), "invalidFilter");
+	}
+	return {
+		filter,
+		startIndex: Math.max(1, integer(source.startIndex) ?? 1),
+		count: Math.min(maxResults, Math.max(0, integer(source.count) ?? maxResults)),
+		attributes: source.attributes,
+		excluded: source.excluded
+	};
+}
+async function readBody(request) {
+	const text = await request.text();
+	if (text.length > MAX_BODY) throw new ScimError(413, "The request body is too large");
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new ScimError(400, "The body is not JSON", "invalidSyntax");
+	}
+}
+function resourceBody(body, urn) {
+	if (!isRecord(body)) throw new ScimError(400, "The body is a JSON object", "invalidSyntax");
+	if (!(Array.isArray(body["schemas"]) ? body["schemas"] : []).some((schema) => String(schema).toLowerCase() === urn.toLowerCase())) throw new ScimError(400, `schemas must include ${urn}`, "invalidSyntax");
+	return body;
+}
+const KINDS = {
+	User: {
+		endpoint: "Users",
+		urn: SCIM_USER,
+		list: "scim_list_users",
+		get: "scim_get_user",
+		save: "scim_save_user",
+		remove: "scim_delete_user",
+		of: userOf,
+		data: userData
+	},
+	Group: {
+		endpoint: "Groups",
+		urn: SCIM_GROUP,
+		list: "scim_list_groups",
+		get: "scim_get_group",
+		save: "scim_save_group",
+		remove: "scim_delete_group",
+		of: groupOf,
+		data: groupData
+	}
+};
+/**
+* A SCIM 2.0 service provider (RFC 7644) as a web handler: `/Users` and
+* `/Groups` with filters, PATCH and ETags, plus the discovery endpoints.
+* Each request authenticates with an organization API key that has the
+* `scim` scope, and only touches that organization.
+*/
+function scimHandler(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema);
+	const basePath = (options.basePath ?? "").replace(/\/+$/, "");
+	const scope = options.scope ?? "scim";
+	const maxResults = options.maxResults ?? 100;
+	const discovery = {
+		maxResults,
+		...options.documentationUri === void 0 ? {} : { documentationUri: options.documentationUri }
+	};
+	const rpc = async (fn, args) => {
+		const result = await call(fn, args, (value) => value);
+		if (!result.ok) throw fromDbError(result.error);
+		return result.data;
+	};
+	const authenticate = async (request) => {
+		const challenge = { "www-authenticate": "Bearer realm=\"SCIM\"" };
+		const token = request.headers.get("authorization")?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
+		if (!token) throw new ScimError(401, "Send a bearer token", void 0, challenge);
+		const checked = await options.keys.verify(token);
+		if (!checked.ok) throw new ScimError(500, "Could not check the token");
+		const check = checked.data;
+		switch (check.status) {
+			case "invalid": throw new ScimError(401, "The token is not valid", void 0, challenge);
+			case "rate_limited": throw new ScimError(429, "Too many requests", void 0, { "retry-after": String(check.retryAfter) });
+			case "ok": {
+				const { key } = check;
+				if (key.organizationId === void 0) throw new ScimError(403, "SCIM needs an organization API key");
+				if (!key.scopes.includes(scope) && !key.scopes.includes("*")) throw new ScimError(403, `The key lacks the ${scope} scope`);
+				return key.organizationId;
+			}
+			default: return check;
+		}
+	};
+	const discover = (request, url, base, segments) => {
+		const [head, ...rest] = segments;
+		const ids = rest.join("/");
+		const listed = (items) => json(200, {
+			schemas: [SCIM_LIST],
+			totalResults: items.length,
+			startIndex: 1,
+			itemsPerPage: items.length,
+			Resources: items
+		});
+		const one = (items) => {
+			const found = items.find((item) => item["id"] === ids);
+			if (!found) throw new ScimError(404, `No ${head} ${ids}`);
+			return json(200, found);
+		};
+		if (head !== "ServiceProviderConfig" && head !== "ResourceTypes" && head !== "Schemas") return;
+		if (request.method !== "GET") throw new ScimError(405, `${head} is read-only`);
+		if (url.searchParams.has("filter")) throw new ScimError(403, "Discovery endpoints do not filter");
+		if (head === "ServiceProviderConfig") return json(200, serviceProviderConfig(base, discovery));
+		const items = head === "ResourceTypes" ? resourceTypes(base) : schemas(base);
+		return ids === "" ? listed(items) : one(items);
+	};
+	const fetchAll = async (kind, tenant, base) => {
+		const value = await rpc(KINDS[kind].list, { tenant });
+		return recordsOf(value, KINDS[kind].list).map((row) => KINDS[kind].of(row, base));
+	};
+	const fetchOne = async (kind, tenant, id, base) => {
+		if (!/^[0-9a-f-]{36}$/i.test(id)) throw new ScimError(404, `No ${kind} ${id}`);
+		const value = await rpc(KINDS[kind].get, {
+			tenant,
+			id
+		});
+		if (!isRecord(value)) throw new ScimError(404, `No ${kind} ${id}`);
+		return KINDS[kind].of(value, base);
+	};
+	const search = async (kind, tenant, base, query) => {
+		let all = await fetchAll(kind, tenant, base);
+		if (query.filter) {
+			const filter = query.filter;
+			try {
+				all = all.filter((doc) => matches(doc, filter));
+			} catch (cause) {
+				if (cause instanceof ScimFilterError) throw new ScimError(400, cause.message, "invalidFilter");
+				throw cause;
+			}
+		}
+		const page = all.slice(query.startIndex - 1, query.startIndex - 1 + query.count).map((doc) => project(doc, query.attributes, query.excluded));
+		return json(200, {
+			schemas: [SCIM_LIST],
+			totalResults: all.length,
+			startIndex: query.startIndex,
+			itemsPerPage: page.length,
+			Resources: page
+		});
+	};
+	const save = async (kind, tenant, id, doc, version, base) => {
+		const value = await rpc(KINDS[kind].save, {
+			tenant,
+			id,
+			data: KINDS[kind].data(doc),
+			version: version ?? null
+		});
+		return KINDS[kind].of(value, base);
+	};
+	const respond = (status, doc, url, extra = {}) => {
+		const metaOf = isRecord(doc["meta"]) ? doc["meta"] : {};
+		return json(status, project(doc, list(url.searchParams.get("attributes")), list(url.searchParams.get("excludedAttributes"))), {
+			etag: String(metaOf["version"]),
+			...extra
+		});
+	};
+	const resource = async (request, url, base, kind, id, tenant) => {
+		const spec = KINDS[kind];
+		const method = request.method;
+		if (id === void 0 || id === ".search") {
+			if (id === ".search") {
+				if (method !== "POST") throw new ScimError(405, "Use POST for .search");
+				const body = await readBody(request);
+				if (!isRecord(body) || !Array.isArray(body["schemas"]) || !body["schemas"].includes("urn:ietf:params:scim:api:messages:2.0:SearchRequest")) throw new ScimError(400, `schemas must include ${SCIM_SEARCH}`, "invalidSyntax");
+				const strings = (value) => Array.isArray(value) ? value.map(String) : void 0;
+				return search(kind, tenant, base, queryOf({
+					filter: body["filter"],
+					startIndex: body["startIndex"],
+					count: body["count"],
+					attributes: strings(body["attributes"]),
+					excluded: strings(body["excludedAttributes"])
+				}, maxResults));
+			}
+			if (method === "GET") return search(kind, tenant, base, queryOf({
+				filter: url.searchParams.get("filter") ?? void 0,
+				startIndex: url.searchParams.get("startIndex") ?? void 0,
+				count: url.searchParams.get("count") ?? void 0,
+				attributes: list(url.searchParams.get("attributes")),
+				excluded: list(url.searchParams.get("excludedAttributes"))
+			}, maxResults));
+			if (method === "POST") {
+				const doc = resourceBody(await readBody(request), spec.urn);
+				const created = await save(kind, tenant, null, doc, void 0, base);
+				const location = String(isRecord(created["meta"]) ? created["meta"]["location"] : "");
+				return respond(201, created, url, { location });
+			}
+			throw new ScimError(405, `${method} is not allowed on /${spec.endpoint}`);
+		}
+		const current = await fetchOne(kind, tenant, id, base);
+		const currentMeta = isRecord(current["meta"]) ? current["meta"] : {};
+		const currentVersion = Number(/\d+/.exec(String(currentMeta["version"]))?.[0]);
+		const required = ifMatch(request);
+		if (method !== "GET" && required !== void 0 && required !== currentVersion) throw new ScimError(412, "The resource changed; read it again");
+		switch (method) {
+			case "GET": {
+				const unchanged = request.headers.get("if-none-match")?.trim();
+				if (unchanged !== void 0 && unchanged === currentMeta["version"]) return new Response(null, {
+					status: 304,
+					headers: { etag: unchanged }
+				});
+				return respond(200, current, url);
+			}
+			case "PUT": {
+				const doc = resourceBody(await readBody(request), spec.urn);
+				return respond(200, await save(kind, tenant, id, doc, currentVersion, base), url);
+			}
+			case "PATCH": {
+				const body = await readBody(request);
+				let patched;
+				try {
+					patched = applyPatch(current, body, spec.urn, ATTRIBUTES[kind], SCIM_PATCH);
+				} catch (cause) {
+					if (cause instanceof ScimPatchError) throw new ScimError(400, cause.message, cause.scimType);
+					throw cause;
+				}
+				return respond(200, await save(kind, tenant, id, patched, currentVersion, base), url);
+			}
+			case "DELETE":
+				if (await rpc(spec.remove, {
+					tenant,
+					id
+				}) !== true) throw new ScimError(404, `No ${kind} ${id}`);
+				return new Response(null, { status: 204 });
+			default: throw new ScimError(405, `${method} is not allowed`);
+		}
+	};
+	return async (request) => {
+		try {
+			const url = new URL(request.url);
+			if (!url.pathname.startsWith(basePath)) throw new ScimError(404, "Not a SCIM endpoint");
+			const base = `${url.origin}${basePath}`;
+			const segments = url.pathname.slice(basePath.length).split("/").filter(Boolean).map(decodeURIComponent);
+			const [head, id, ...rest] = segments;
+			const discovered = discover(request, url, base, segments);
+			if (discovered) return discovered;
+			const tenant = await authenticate(request);
+			if (head === "Me") throw new ScimError(501, "/Me is not supported");
+			if (head === "Bulk") throw new ScimError(501, "Bulk operations are not supported");
+			if (rest.length > 0) throw new ScimError(404, "Not a SCIM endpoint");
+			if (head === "Users") return await resource(request, url, base, "User", id, tenant);
+			if (head === "Groups") return await resource(request, url, base, "Group", id, tenant);
+			throw new ScimError(404, "Not a SCIM endpoint");
+		} catch (cause) {
+			if (cause instanceof ScimError) return errorResponse(cause);
+			return errorResponse(new ScimError(500, "The service provider failed"));
+		}
+	};
+}
+//#endregion
+export { SCIM_GROUP, SCIM_USER, ScimFilterError, createSso, createSsoAdmin, dohResolver, matches as matchesScimFilter, parseFilter as parseScimFilter, rpcTransport, scimHandler, sqlTransport };