lagora-cli 1.1.0

package/dist/scripts/keycloak-provision.js

@@ -0,0 +1,986 @@
+import {
+  parseVendorId
+} from "./chunk-QJPQHKIO.js";
+
+// scripts/keycloak-provision.ts
+import { pathToFileURL as packageFileUrl } from "node:url";
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+// scripts/keycloak-provision-state.ts
+import { createHash } from "node:crypto";
+
+// lib/server/managed-tenant-groups.ts
+var managedTenantGroupDefinitions = [
+  { path: "/tenants/admin", name: "admin", role: "admin" },
+  { path: "/tenants/hyperaccel", name: "hyperaccel", role: "hyperaccel" },
+  { path: "/tenants/dnotitia", name: "dnotitia", role: "vendor", vendorId: "dnotitia" },
+  { path: "/tenants/nota", name: "nota", role: "vendor", vendorId: "nota" },
+  { path: "/tenants/anybridge", name: "anybridge", role: "vendor", vendorId: "anybridge" }
+];
+var managedTenantGroupPaths = managedTenantGroupDefinitions.map((group) => group.path);
+var allManagedTenantGroupPaths = ["/tenants", ...managedTenantGroupPaths];
+
+// lib/server/tenant-principal.ts
+var managedTenantGroups = new Set(managedTenantGroupPaths);
+function parseTenantPrincipalClaims(claims) {
+  const role = parseTenantRole(claims.role);
+  if (!role) return void 0;
+  const subject = parseSubject(claims.sub);
+  if (!subject) return void 0;
+  const managedGroup = parseExactlyOneManagedGroup(claims.agora_groups);
+  if (!managedGroup) return void 0;
+  if (role === "admin" && managedGroup !== "/tenants/admin") return void 0;
+  if (role === "hyperaccel" && managedGroup !== "/tenants/hyperaccel") return void 0;
+  if (role === "vendor") {
+    const vendorId = parseVendorId(claims.vendor_id);
+    if (!vendorId || managedGroup !== `/tenants/${vendorId}`) return void 0;
+    return { role, vendorId, subject };
+  }
+  if (Object.hasOwn(claims, "vendor_id")) return void 0;
+  return { role, subject };
+}
+function parseExactlyOneManagedGroup(value) {
+  if (!Array.isArray(value)) return void 0;
+  const managed = value.filter((item) => typeof item === "string" && managedTenantGroups.has(item));
+  return managed.length === 1 ? managed[0] : void 0;
+}
+function parseTenantRole(value) {
+  if (value !== "admin" && value !== "hyperaccel" && value !== "vendor") return void 0;
+  return value;
+}
+function parseSubject(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed || void 0;
+}
+
+// scripts/keycloak-provision-state.ts
+var DEFAULT_KEYCLOAK_SERVER = "https://keycloak.hyperaccel.net";
+var DEFAULT_KEYCLOAK_REALM = "hyperaccel-account-system";
+var DEFAULT_APP_CLIENT_ID = "legato-dev-agora";
+var DEFAULT_APP_BASE_URL = "https://legato-dev-agora.hyperaccel.net/legato-dev-agora";
+var DEFAULT_CALLBACK_PATH = "/api/auth/keycloak/callback";
+var DEFAULT_INTERNAL_ORIGIN = "https://legato-dev-agora.hyperaccel.net";
+var DEFAULT_PUBLIC_CALLBACK = "https://public.hyperaccel.net/legato-dev-agora/oauth2/callback";
+var DEFAULT_PUBLIC_ORIGIN = "https://public.hyperaccel.net";
+var DEFAULT_MANAGED_GROUPS = allManagedTenantGroupPaths;
+var MAX_PLAN_TTL_MS = 15 * 60 * 1e3;
+var PLAN_CLOCK_SKEW_MS = 60 * 1e3;
+var managedGroupDefinitions = [
+  { path: "/tenants", name: "tenants", attributes: {} },
+  ...managedTenantGroupDefinitions.map((group) => ({
+    path: group.path,
+    name: group.name,
+    role: group.role,
+    attributes: group.role === "vendor" ? { agora_role: [group.role], vendor_id: [group.vendorId] } : { agora_role: [group.role] }
+  }))
+];
+function desiredKeycloakState(input = {}) {
+  const serverUrl = trimTrailingSlash(input.serverUrl ?? DEFAULT_KEYCLOAK_SERVER);
+  const realm = input.realm ?? DEFAULT_KEYCLOAK_REALM;
+  const appClientId = input.appClientId ?? DEFAULT_APP_CLIENT_ID;
+  const appBaseUrl = trimTrailingSlash(input.appBaseUrl ?? DEFAULT_APP_BASE_URL);
+  const redirectUri = `${appBaseUrl}${DEFAULT_CALLBACK_PATH}`;
+  const postLogoutRedirectUri = `${appBaseUrl}/login`;
+  return {
+    serverUrl,
+    realm,
+    appClientId,
+    appBaseUrl,
+    redirectUri,
+    webOrigin: DEFAULT_INTERNAL_ORIGIN,
+    postLogoutRedirectUri,
+    client: {
+      clientId: appClientId,
+      enabled: true,
+      protocol: "openid-connect",
+      publicClient: false,
+      bearerOnly: false,
+      standardFlowEnabled: true,
+      serviceAccountsEnabled: false,
+      directAccessGrantsEnabled: false,
+      implicitFlowEnabled: false,
+      redirectUris: [redirectUri, DEFAULT_PUBLIC_CALLBACK],
+      webOrigins: [DEFAULT_INTERNAL_ORIGIN, DEFAULT_PUBLIC_ORIGIN],
+      attributes: {
+        "access.token.lifespan": "7200",
+        "client_credentials.use_refresh_token": "false",
+        "oauth2.device.authorization.grant.enabled": "false",
+        "oidc.ciba.grant.enabled": "false",
+        "post.logout.redirect.uris": postLogoutRedirectUri,
+        "pkce.code.challenge.method": "S256"
+      }
+    },
+    roles: ["admin", "hyperaccel", "vendor"],
+    groups: managedGroupDefinitions,
+    protocolMappers: [
+      {
+        name: "legato-dev-agora-audience",
+        protocol: "openid-connect",
+        protocolMapper: "oidc-audience-mapper",
+        config: {
+          "access.token.claim": "true",
+          "id.token.claim": "true",
+          "included.client.audience": appClientId
+        }
+      },
+      {
+        name: "legato-dev-agora-role",
+        protocol: "openid-connect",
+        protocolMapper: "oidc-usermodel-attribute-mapper",
+        config: {
+          "access.token.claim": "true",
+          "aggregate.attrs": "true",
+          "claim.name": "role",
+          "id.token.claim": "true",
+          "jsonType.label": "String",
+          "multivalued": "false",
+          "user.attribute": "agora_role",
+          "userinfo.token.claim": "true"
+        }
+      },
+      {
+        name: "legato-dev-agora-vendor-id",
+        protocol: "openid-connect",
+        protocolMapper: "oidc-usermodel-attribute-mapper",
+        config: {
+          "access.token.claim": "true",
+          "aggregate.attrs": "true",
+          "claim.name": "vendor_id",
+          "id.token.claim": "true",
+          "jsonType.label": "String",
+          "multivalued": "false",
+          "user.attribute": "vendor_id",
+          "userinfo.token.claim": "true"
+        }
+      },
+      {
+        name: "legato-dev-agora-group-paths",
+        protocol: "openid-connect",
+        protocolMapper: "oidc-group-membership-mapper",
+        config: {
+          "access.token.claim": "true",
+          "claim.name": "agora_groups",
+          "full.path": "true",
+          "id.token.claim": "true",
+          "multivalued": "true",
+          "userinfo.token.claim": "true"
+        }
+      }
+    ]
+  };
+}
+function createProvisionPlan(state, desired = desiredKeycloakState(), options) {
+  const operations = [];
+  const groupAttributeUpdates = [];
+  const groupRoleMappings = [];
+  const mapperOperations = [];
+  const issues = [];
+  const client = findClient(state, desired.appClientId);
+  if (!client) {
+    operations.push({ kind: "create-client", target: desired.appClientId, description: `Create confidential OIDC client ${desired.appClientId}`, destructive: false, payload: desired.client });
+  } else {
+    const updatePayload = clientUpdatePayload(client, desired.client);
+    if (updatePayload) {
+      operations.push({ kind: "update-client", target: desired.appClientId, description: `Update managed settings for client ${desired.appClientId}`, destructive: false, payload: updatePayload });
+    }
+  }
+  const clientKey = client?.id ?? client?.clientId ?? desired.appClientId;
+  for (const role of desired.roles) {
+    if (!state.clientRoles[clientKey]?.some((item) => item.name === role)) {
+      operations.push({ kind: "create-role", target: role, description: `Create app client role ${role}`, destructive: false, payload: { name: role } });
+    }
+  }
+  for (const group of desired.groups) {
+    const actualGroup = findGroupByPath(state, group.path);
+    if (!actualGroup) {
+      operations.push({ kind: "create-group", target: group.path, description: `Create managed group ${group.path}`, destructive: false, payload: group });
+    } else {
+      const groupIssue = validateManagedGroupAttributes(actualGroup, group);
+      if (groupIssue) issues.push(groupIssue);
+      if (!managedAttributesEqual(normalizeAttributes(actualGroup.attributes), group.attributes)) {
+        groupAttributeUpdates.push({ kind: "update-group-attributes", target: group.path, description: `Update managed group attributes for ${group.path}`, destructive: false, payload: { attributes: group.attributes } });
+      }
+    }
+    if (!group.role) continue;
+    const mappings = actualGroup ? state.groupClientRoleMappings[actualGroup.id] ?? state.groupClientRoleMappings[group.path] ?? [] : [];
+    const managedMappedRoles = mappings.filter((mapping) => desired.roles.includes(mapping.name)).toSorted(compareByNameThenId);
+    if (managedMappedRoles.some((mapping) => mapping.name !== group.role)) {
+      issues.push({ severity: "error", code: "conflicting-managed-role-mapping", message: `${group.path} has extra managed app-role mapping(s): ${managedMappedRoles.map((mapping) => mapping.name).join(", ")}` });
+    }
+    if (!mappings.some((mapping) => mapping.name === group.role)) {
+      groupRoleMappings.push({ kind: "create-group-role-mapping", target: `${group.path}:${group.role}`, description: `Map ${group.path} to app role ${group.role}`, destructive: false, payload: { groupPath: group.path, role: group.role } });
+    }
+  }
+  operations.push(...groupAttributeUpdates, ...groupRoleMappings);
+  for (const conflict of findManagedMembershipConflicts(state, desired.groups)) {
+    issues.push({ severity: "error", code: "conflicting-managed-group-membership", message: `Managed Agora group membership is not exclusive for member fingerprint ${conflict.fingerprint} across ${conflict.groupPaths.join(", ")}` });
+  }
+  const mappers = state.protocolMappers[clientKey] ?? state.protocolMappers[desired.appClientId] ?? [];
+  for (const mapper of desired.protocolMappers) {
+    const actual = mappers.find((item) => item.name === mapper.name);
+    if (!actual) {
+      mapperOperations.push({ kind: "create-protocol-mapper", target: mapper.name, description: `Create protocol mapper ${mapper.name}`, destructive: false, payload: mapper });
+    } else if (!protocolMapperEqual(actual, mapper)) {
+      mapperOperations.push({ kind: "update-protocol-mapper", target: mapper.name, description: `Update protocol mapper ${mapper.name}`, destructive: false, payload: protocolMapperUpdatePayload(actual, mapper) });
+    }
+  }
+  operations.push(...mapperOperations);
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const ttlMs = Math.min(options.ttlMs ?? MAX_PLAN_TTL_MS, MAX_PLAN_TTL_MS);
+  const expiresAt = new Date(now.getTime() + ttlMs);
+  const stateHash = hashRealmState(state);
+  const desiredSummary = desiredSummaryFrom(desired);
+  const handoff = { ...desiredSummary, appClientSecretHandoff: "Vault -> Kubernetes Secret/legato-dev-agora-oidc for direct app OIDC; inactive oauth2-proxy may use oauth2-proxy-legato-dev-agora later" };
+  const planBody = { desired: desiredSummary, stateHash, operations, issues, handoff, mode: options.mode, createdAt: now.toISOString(), expiresAt: expiresAt.toISOString() };
+  const id = `kcplan-${hashJson(planBody).slice(0, 16)}`;
+  return redactSecrets({
+    schemaVersion: 1,
+    id,
+    createdAt: now.toISOString(),
+    expiresAt: expiresAt.toISOString(),
+    mode: options.mode,
+    desired: desiredSummary,
+    stateHash,
+    operations,
+    issues,
+    handoff
+  });
+}
+function assertPlanApplicable(plan, currentState, approval, now = /* @__PURE__ */ new Date()) {
+  assertSerializedPlanIntegrity(plan);
+  if (approval !== plan.id) throw new Error(`Approval mismatch: expected --approve ${plan.id}`);
+  if (Date.parse(plan.expiresAt) <= now.getTime()) throw new Error(`Plan ${plan.id} is stale; create a fresh plan`);
+  if (plan.issues.some((issue) => issue.severity === "error")) throw new Error(`Plan ${plan.id} contains blocking issues`);
+  const currentHash = hashRealmState(currentState);
+  if (currentHash !== plan.stateHash) throw new Error(`Plan ${plan.id} is stale; live state changed`);
+  for (const operation of plan.operations) {
+    if (operation.destructive !== false) throw new Error(`Plan ${plan.id} contains a destructive operation and is not supported`);
+    if (!isOperationKind(operation.kind)) throw new Error(`Plan ${plan.id} contains unsupported operation kind`);
+  }
+  const createdAt = new Date(plan.createdAt);
+  const ttlMs = Date.parse(plan.expiresAt) - createdAt.getTime();
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > MAX_PLAN_TTL_MS) throw new Error(`Plan ${plan.id} has invalid timestamps`);
+  if (createdAt.getTime() - now.getTime() > PLAN_CLOCK_SKEW_MS) throw new Error(`Plan ${plan.id} was created in the future`);
+  const expected = createProvisionPlan(currentState, desiredKeycloakState({ serverUrl: plan.desired.serverUrl, realm: plan.desired.realm, appClientId: plan.desired.clientId }), { mode: "live", now: createdAt, ttlMs });
+  if (expected.id !== plan.id || !canonicalEqual(planComparable(expected), planComparable(plan))) {
+    throw new Error(`Plan ${plan.id} contents do not match regenerated live plan`);
+  }
+}
+function verifyClaimFixtures(fixtures) {
+  if (!fixtures || typeof fixtures !== "object" || Array.isArray(fixtures)) {
+    return [{ severity: "error", code: "claims-fixture-shape", message: "Claims fixture must be an object keyed by case name" }];
+  }
+  const issues = [];
+  for (const [name, value] of Object.entries(fixtures)) {
+    const expected = typeof value === "object" && value && !Array.isArray(value) ? Reflect.get(value, "expected") : void 0;
+    const claims = typeof value === "object" && value && !Array.isArray(value) ? Reflect.get(value, "claims") : void 0;
+    const parsed = parseTenantPrincipalClaims(claims ?? value);
+    if (expected === "fail") {
+      if (parsed) issues.push({ severity: "error", code: "claim-expected-fail", message: `${name} unexpectedly parsed` });
+    } else if (!parsed) {
+      issues.push({ severity: "error", code: "claim-expected-pass", message: `${name} did not parse` });
+    }
+  }
+  return issues;
+}
+function redactSecrets(value) {
+  if (Array.isArray(value)) return value.map((item) => redactSecrets(item));
+  if (!value || typeof value !== "object") return value;
+  const output = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (isSecretKey(key)) {
+      output[key] = "[REDACTED]";
+    } else {
+      output[key] = redactSecrets(item);
+    }
+  }
+  return output;
+}
+function planHasBlockingIssues(plan) {
+  return plan.issues.some((issue) => issue.severity === "error");
+}
+function findClient(state, clientId) {
+  return state.clients.find((client) => client.clientId === clientId);
+}
+function findGroupByPath(state, path2) {
+  return state.groups.find((group) => group.path === path2);
+}
+function emptyRealmState() {
+  return { clients: [], clientRoles: {}, groups: [], groupClientRoleMappings: {}, protocolMappers: {} };
+}
+function hashRealmState(state) {
+  return hashJson(canonicalize(canonicalRealmState(redactSecrets(state))));
+}
+function clientUpdatePayload(actual, desired) {
+  const desiredAttrs = desired.attributes;
+  const actualAttrs = actual.attributes ?? {};
+  const mergedAttrs = { ...actual.attributes ?? {}, ...desiredAttrs };
+  const candidate = { ...desired, id: actual.id, attributes: mergedAttrs };
+  return clientManagedEqual(actual, desired, actualAttrs) ? void 0 : candidate;
+}
+function clientManagedEqual(actual, desired, actualAttrs) {
+  return actual.enabled === desired.enabled && actual.protocol === desired.protocol && actual.publicClient === desired.publicClient && actual.bearerOnly === desired.bearerOnly && actual.standardFlowEnabled === desired.standardFlowEnabled && actual.serviceAccountsEnabled === desired.serviceAccountsEnabled && actual.directAccessGrantsEnabled === desired.directAccessGrantsEnabled && actual.implicitFlowEnabled === desired.implicitFlowEnabled && arraysEqual(actual.redirectUris, desired.redirectUris) && arraysEqual(actual.webOrigins, desired.webOrigins) && Object.entries(desired.attributes).every(([key, value]) => actualAttrs[key] === value);
+}
+function validateManagedGroupAttributes(actual, desired) {
+  const attributes = normalizeAttributes(actual.attributes);
+  const role = attributes.agora_role ?? [];
+  const vendor = attributes.vendor_id ?? [];
+  const expectedRole = desired.attributes.agora_role ?? [];
+  if (!arraysEqual(role, expectedRole)) {
+    return { severity: "error", code: "malformed-managed-group-attributes", message: `${desired.path} must have agora_role=${expectedRole.join(",")}` };
+  }
+  const expectedVendor = desired.attributes.vendor_id ?? [];
+  if (!arraysEqual(vendor, expectedVendor)) {
+    return { severity: "error", code: "malformed-managed-group-attributes", message: `${desired.path} has invalid vendor_id attribute` };
+  }
+  return void 0;
+}
+function normalizeAttributes(input) {
+  const output = {};
+  for (const [key, value] of Object.entries(input ?? {})) {
+    output[key] = Array.isArray(value) ? value.map(String) : [String(value)];
+  }
+  return output;
+}
+function managedAttributesEqual(actual, desired) {
+  for (const key of ["agora_role", "vendor_id"]) {
+    if (!arraysEqual(actual[key] ?? [], desired[key] ?? [])) return false;
+  }
+  return true;
+}
+function protocolMapperEqual(actual, desired) {
+  return actual.protocol === desired.protocol && actual.protocolMapper === desired.protocolMapper && Object.entries(desired.config).every(([key, value]) => actual.config[key] === value);
+}
+function protocolMapperUpdatePayload(actual, desired) {
+  return { ...desired, id: actual.id, config: { ...actual.config, ...desired.config } };
+}
+function canonicalRealmState(state) {
+  return {
+    clients: state.clients.toSorted(compareClients),
+    clientRoles: sortRecordArrays(state.clientRoles, compareByNameThenId),
+    groups: state.groups.map((group) => ({ ...group, attributes: sortGroupAttributes(group.attributes), memberIds: group.memberIds?.toSorted() })).toSorted(compareGroups),
+    groupClientRoleMappings: sortRecordArrays(state.groupClientRoleMappings, compareByNameThenId),
+    protocolMappers: sortRecordArrays(state.protocolMappers, compareProtocolMappers)
+  };
+}
+function sortRecordArrays(record, compare) {
+  return Object.fromEntries(Object.entries(record).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, value.toSorted(compare)]));
+}
+function sortGroupAttributes(input) {
+  if (!input) return input;
+  return Object.fromEntries(Object.entries(input).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, value]) => [key, Array.isArray(value) ? value.map(String).toSorted() : String(value)]));
+}
+function compareClients(left, right) {
+  return compareStrings(left.clientId, right.clientId) || compareStrings(left.id ?? "", right.id ?? "");
+}
+function compareGroups(left, right) {
+  return compareStrings(left.path, right.path) || compareStrings(left.id, right.id);
+}
+function compareProtocolMappers(left, right) {
+  return compareStrings(left.name, right.name) || compareStrings(left.id ?? "", right.id ?? "");
+}
+function compareByNameThenId(left, right) {
+  return compareStrings(left.name, right.name) || compareStrings(left.id ?? "", right.id ?? "");
+}
+function compareStrings(left, right) {
+  return left.localeCompare(right);
+}
+function arraysEqual(left, right) {
+  return Array.isArray(left) && left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function findManagedMembershipConflicts(state, desiredGroups) {
+  const memberships = /* @__PURE__ */ new Map();
+  for (const desiredGroup of desiredGroups) {
+    if (!desiredGroup.role) continue;
+    const group = findGroupByPath(state, desiredGroup.path);
+    for (const memberId of group?.memberIds ?? []) {
+      const paths = memberships.get(memberId) ?? [];
+      paths.push(desiredGroup.path);
+      memberships.set(memberId, paths);
+    }
+  }
+  return [...memberships.entries()].filter(([, paths]) => paths.length > 1).map(([memberId, paths]) => ({ fingerprint: hashJson(memberId).slice(0, 16), groupPaths: paths.toSorted() }));
+}
+function desiredSummaryFrom(desired) {
+  return {
+    serverUrl: desired.serverUrl,
+    realm: desired.realm,
+    clientId: desired.appClientId,
+    issuer: `${desired.serverUrl}/realms/${encodeURIComponent(desired.realm)}`,
+    redirectUri: desired.redirectUri,
+    webOrigin: desired.webOrigin,
+    postLogoutRedirectUri: desired.postLogoutRedirectUri,
+    requiredClaims: ["sub", "scalar role", "scalar vendor_id only for vendor", "multivalued full-path agora_groups"],
+    managedGroups: desired.groups.map((group) => group.path)
+  };
+}
+function assertProvisionPlanSchema(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Plan schema is invalid");
+  if (Reflect.get(value, "schemaVersion") !== 1) throw new Error("Plan schema is invalid");
+  if (typeof Reflect.get(value, "id") !== "string") throw new Error("Plan schema is invalid");
+  if (Reflect.get(value, "mode") !== "live" && Reflect.get(value, "mode") !== "fixture") throw new Error("Plan schema is invalid");
+  const desired = Reflect.get(value, "desired");
+  if (!desired || typeof desired !== "object" || Array.isArray(desired)) throw new Error("Plan schema is invalid");
+  if (typeof Reflect.get(desired, "serverUrl") !== "string" || typeof Reflect.get(desired, "realm") !== "string" || typeof Reflect.get(desired, "clientId") !== "string") throw new Error("Plan schema is invalid");
+  if (typeof Reflect.get(value, "createdAt") !== "string" || typeof Reflect.get(value, "expiresAt") !== "string" || typeof Reflect.get(value, "stateHash") !== "string") throw new Error("Plan schema is invalid");
+  if (!Array.isArray(Reflect.get(value, "operations")) || !Array.isArray(Reflect.get(value, "issues"))) throw new Error("Plan schema is invalid");
+}
+function assertSerializedPlanIntegrity(value) {
+  assertProvisionPlanSchema(value);
+  if (value.mode !== "live") throw new Error(`Plan ${value.id} is ${value.mode}; apply requires a live plan`);
+  for (const operation of value.operations) {
+    if (operation.destructive !== false) throw new Error(`Plan ${value.id} contains a destructive operation and is not supported`);
+    if (!isOperationKind(operation.kind)) throw new Error(`Plan ${value.id} contains unsupported operation kind`);
+  }
+  const planBody = { desired: value.desired, stateHash: value.stateHash, operations: value.operations, issues: value.issues, handoff: value.handoff, mode: value.mode, createdAt: value.createdAt, expiresAt: value.expiresAt };
+  const expectedId = `kcplan-${hashJson(planBody).slice(0, 16)}`;
+  if (value.id !== expectedId) throw new Error(`Plan ${value.id} contents do not match its approval id`);
+}
+function isOperationKind(value) {
+  return value === "create-client" || value === "update-client" || value === "create-role" || value === "create-group" || value === "update-group-attributes" || value === "create-group-role-mapping" || value === "create-protocol-mapper" || value === "update-protocol-mapper";
+}
+function planComparable(plan) {
+  return {
+    schemaVersion: plan.schemaVersion,
+    id: plan.id,
+    createdAt: plan.createdAt,
+    expiresAt: plan.expiresAt,
+    mode: plan.mode,
+    desired: plan.desired,
+    stateHash: plan.stateHash,
+    operations: plan.operations,
+    issues: plan.issues,
+    handoff: plan.handoff
+  };
+}
+function canonicalEqual(left, right) {
+  return JSON.stringify(canonicalize(left)) === JSON.stringify(canonicalize(right));
+}
+function hashJson(value) {
+  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, canonicalize(item)]));
+}
+function isSecretKey(key) {
+  const normalized = key.toLowerCase();
+  if (normalized === "appclientsecrethandoff") return false;
+  if (normalized === "authorization" || normalized.endsWith("authorization")) return true;
+  if (normalized === "token" || normalized === "access_token" || normalized === "refresh_token" || normalized === "id_token") return true;
+  if (normalized === "password" || normalized.endsWith("password")) return true;
+  if (normalized === "credential" || normalized.endsWith("credential")) return true;
+  return normalized === "secret" || normalized.endsWith("secret") || normalized.endsWith("clientsecret") || normalized.endsWith("client_secret");
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+
+// scripts/keycloak-admin-api.ts
+var KeycloakAdminError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.name = "KeycloakAdminError";
+    this.status = status;
+  }
+};
+var KeycloakAdminApi = class {
+  constructor(options) {
+    this.discoveryValidated = false;
+    this.serverUrl = options.serverUrl.replace(/\/+$/, "");
+    this.realm = options.realm;
+    this.credentials = options.credentials;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async readRealmState(appClientId) {
+    await this.validateDiscovery();
+    const clients = await this.lookupClients(appClientId);
+    const client = clients.find((item) => item.clientId === appClientId);
+    const groups = await this.listKnownGroupsWithMembers();
+    if (!client?.id) return { clients, clientRoles: {}, groups, groupClientRoleMappings: {}, protocolMappers: {} };
+    const roles = await this.listClientRoles(client.id);
+    const roleMappings = {};
+    for (const group of groups) {
+      roleMappings[group.id] = await this.listGroupClientRoleMappings(group.id, client.id);
+    }
+    const protocolMappers = await this.listProtocolMappers(client.id);
+    return {
+      clients,
+      clientRoles: { [client.id]: roles, [client.clientId]: roles },
+      groups,
+      groupClientRoleMappings: roleMappings,
+      protocolMappers: { [client.id]: protocolMappers, [client.clientId]: protocolMappers }
+    };
+  }
+  async applyOperation(operation, desired) {
+    const client = (await this.lookupClients(desired.appClientId)).find((item) => item.clientId === desired.appClientId);
+    if (operation.kind === "create-client") {
+      await this.createClient(desired.client);
+      return;
+    }
+    if (!client?.id) throw new KeycloakAdminError(`Client ${desired.appClientId} is required before ${operation.kind}`);
+    if (operation.kind === "update-client") {
+      await this.updateClient(client.id, operation.payload);
+      return;
+    }
+    if (operation.kind === "create-role") {
+      await this.createClientRole(client.id, { name: String(Reflect.get(operation.payload, "name")) });
+      return;
+    }
+    if (operation.kind === "create-group") {
+      await this.createGroup(operation.payload);
+      return;
+    }
+    if (operation.kind === "update-group-attributes") {
+      const group = await this.requireGroup(operation.target);
+      const attributes = Reflect.get(operation.payload, "attributes");
+      await this.updateGroup(group.id, { ...group, attributes: { ...group.attributes ?? {}, ...attributes } }, operation.target, attributes);
+      return;
+    }
+    if (operation.kind === "create-group-role-mapping") {
+      const payload = operation.payload;
+      const group = await this.requireGroup(payload.groupPath);
+      const role = await this.requireClientRole(client.id, payload.role);
+      await this.addGroupClientRoleMapping(group.id, client.id, role);
+      return;
+    }
+    if (operation.kind === "create-protocol-mapper") {
+      await this.createProtocolMapper(client.id, operation.payload);
+      return;
+    }
+    if (operation.kind === "update-protocol-mapper") {
+      const mapper = operation.payload;
+      if (!mapper.id) throw new KeycloakAdminError(`Mapper ${mapper.name} is missing an id`);
+      await this.updateProtocolMapper(client.id, mapper.id, mapper);
+      return;
+    }
+  }
+  async validateDiscovery() {
+    if (this.discoveryValidated) return;
+    const expectedIssuer = `${this.serverUrl}/realms/${encodeURIComponent(this.realm)}`;
+    const expectedTokenEndpoint = `${expectedIssuer}/protocol/openid-connect/token`;
+    const response = await this.fetchImpl(`${expectedIssuer}/.well-known/openid-configuration`, { method: "GET", redirect: "manual" });
+    if (!response.ok) throw await this.errorFromResponse(response);
+    const metadata = await response.json();
+    const issuer = metadata.issuer;
+    const tokenEndpoint = metadata.token_endpoint;
+    const grants = metadata.grant_types_supported;
+    const pkce = metadata.code_challenge_methods_supported;
+    if (issuer !== expectedIssuer) throw new KeycloakAdminError("Keycloak discovery issuer does not match configured realm");
+    if (tokenEndpoint !== expectedTokenEndpoint) throw new KeycloakAdminError("Keycloak discovery token endpoint does not match configured realm");
+    if (!Array.isArray(grants) || !grants.includes("client_credentials") || !grants.includes("authorization_code")) throw new KeycloakAdminError("Keycloak discovery is missing required grant support");
+    if (!Array.isArray(pkce) || !pkce.includes("S256")) throw new KeycloakAdminError("Keycloak discovery is missing S256 PKCE support");
+    this.discoveryValidated = true;
+  }
+  async lookupClients(clientId) {
+    return readArray(await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/clients?clientId=${encodeURIComponent(clientId)}`, "GET"), "clients", isClient);
+  }
+  async createClient(client) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/clients`, "POST", client);
+    } catch (error) {
+      if (!(error instanceof KeycloakAdminError) || error.status !== 409) throw error;
+      if ((await this.lookupClients(client.clientId)).some((item) => clientManagedConverged(item, client))) return;
+      throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "client create conflict did not converge", clientId: client.clientId }))}`, 409);
+    }
+  }
+  async updateClient(id, client) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(id)}`, "PUT", client);
+    } catch (error) {
+      if (!(error instanceof KeycloakAdminError) || error.status !== 409) throw error;
+      if ((await this.lookupClients(client.clientId)).some((item) => clientManagedConverged(item, client))) return;
+      throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "client update conflict did not converge", clientId: client.clientId }))}`, 409);
+    }
+  }
+  async listClientRoles(clientUuid) {
+    return readArray(await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(clientUuid)}/roles`, "GET"), "client roles", isRole);
+  }
+  async createClientRole(clientUuid, role) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(clientUuid)}/roles`, "POST", role);
+    } catch (error) {
+      if (error instanceof KeycloakAdminError && error.status === 409 && (await this.listClientRoles(clientUuid)).some((item) => item.name === role.name)) return;
+      throw error;
+    }
+  }
+  async requireClientRole(clientUuid, name) {
+    const role = await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(clientUuid)}/roles/${encodeURIComponent(name)}`, "GET");
+    if (!isRole(role) || !role.id) throw new KeycloakAdminError(`Client role ${name} response is missing required id/name`);
+    return role;
+  }
+  async groupByPath(path2) {
+    try {
+      const group = await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/group-by-path/${encodeURIComponent(path2)}`, "GET");
+      if (!isGroup(group)) throw new KeycloakAdminError(`Group ${path2} response is missing required id/name/path`);
+      return group;
+    } catch (error) {
+      if (error instanceof KeycloakAdminError && error.status === 404) return void 0;
+      throw error;
+    }
+  }
+  async createGroup(group) {
+    const existing = await this.groupByPath(group.path);
+    if (existing) {
+      if (groupAttributesConverged(existing, group)) return;
+      throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "group create conflict did not converge", path: group.path }))}`, 409);
+    }
+    const parentPath = group.path.split("/").slice(0, -1).join("/") || "/";
+    const parent = parentPath === "/" ? void 0 : await this.groupByPath(parentPath);
+    if (parentPath !== "/" && !parent) throw new KeycloakAdminError(`Parent group ${parentPath} is required before creating ${group.path}`);
+    const endpoint = parent ? `/admin/realms/${encodeURIComponent(this.realm)}/groups/${encodeURIComponent(parent.id)}/children` : `/admin/realms/${encodeURIComponent(this.realm)}/groups`;
+    try {
+      await this.requestNoContent(endpoint, "POST", { name: group.name, attributes: group.attributes });
+    } catch (error) {
+      const converged = error instanceof KeycloakAdminError && error.status === 409 ? await this.groupByPath(group.path) : void 0;
+      if (converged && groupAttributesConverged(converged, group)) return;
+      if (error instanceof KeycloakAdminError && error.status === 409) throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "group create conflict did not converge", path: group.path }))}`, 409);
+      throw error;
+    }
+  }
+  async updateGroup(groupId, group, path2 = group.path, desiredAttributes = normalizeGroupAttributes(group.attributes)) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/groups/${encodeURIComponent(groupId)}`, "PUT", group);
+    } catch (error) {
+      if (!(error instanceof KeycloakAdminError) || error.status !== 409) throw error;
+      const converged = await this.groupByPath(path2);
+      if (converged && groupAttributesConverged(converged, { path: path2, name: group.name, attributes: desiredAttributes })) return;
+      throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "group update conflict did not converge", path: path2 }))}`, 409);
+    }
+  }
+  async listGroupClientRoleMappings(groupId, clientUuid) {
+    return readArray(await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/groups/${encodeURIComponent(groupId)}/role-mappings/clients/${encodeURIComponent(clientUuid)}`, "GET"), "group client role mappings", isRole);
+  }
+  async addGroupClientRoleMapping(groupId, clientUuid, role) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/groups/${encodeURIComponent(groupId)}/role-mappings/clients/${encodeURIComponent(clientUuid)}`, "POST", [role]);
+    } catch (error) {
+      if (error instanceof KeycloakAdminError && error.status === 409 && (await this.listGroupClientRoleMappings(groupId, clientUuid)).some((item) => item.name === role.name)) return;
+      throw error;
+    }
+  }
+  async listProtocolMappers(clientUuid) {
+    return readArray(await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(clientUuid)}/protocol-mappers/models`, "GET"), "protocol mappers", isProtocolMapper);
+  }
+  async listGroupMemberIds(groupId) {
+    const memberIds = [];
+    for (let first = 0; ; first += 100) {
+      const members = readArray(await this.requestJson(`/admin/realms/${encodeURIComponent(this.realm)}/groups/${encodeURIComponent(groupId)}/members?first=${first}&max=100`, "GET"), "group members", isUserSummary);
+      memberIds.push(...members.map((member) => member.id));
+      if (members.length < 100) return memberIds;
+    }
+  }
+  async createProtocolMapper(clientUuid, mapper) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(clientUuid)}/protocol-mappers/models`, "POST", mapper);
+    } catch (error) {
+      if (error instanceof KeycloakAdminError && error.status === 409 && (await this.listProtocolMappers(clientUuid)).some((item) => protocolMapperConverged(item, mapper))) return;
+      if (error instanceof KeycloakAdminError && error.status === 409) throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "protocol mapper create conflict did not converge", name: mapper.name }))}`, 409);
+      throw error;
+    }
+  }
+  async updateProtocolMapper(clientUuid, mapperId, mapper) {
+    try {
+      await this.requestNoContent(`/admin/realms/${encodeURIComponent(this.realm)}/clients/${encodeURIComponent(clientUuid)}/protocol-mappers/models/${encodeURIComponent(mapperId)}`, "PUT", mapper);
+    } catch (error) {
+      if (!(error instanceof KeycloakAdminError) || error.status !== 409) throw error;
+      if ((await this.listProtocolMappers(clientUuid)).some((item) => protocolMapperConverged(item, mapper))) return;
+      throw new KeycloakAdminError(`Keycloak Admin API HTTP 409: ${JSON.stringify(redactSecrets({ message: "protocol mapper update conflict did not converge", name: mapper.name }))}`, 409);
+    }
+  }
+  async listKnownGroupsWithMembers() {
+    const groups = [];
+    for (const path2 of DEFAULT_MANAGED_GROUPS) {
+      const group = await this.groupByPath(path2);
+      if (group) groups.push({ ...group, memberIds: path2 === "/tenants" ? [] : await this.listGroupMemberIds(group.id) });
+    }
+    return groups;
+  }
+  async requireGroup(path2) {
+    const group = await this.groupByPath(path2);
+    if (!group) throw new KeycloakAdminError(`Group ${path2} is required before mapping`);
+    return group;
+  }
+  async requestJson(path2, method, body) {
+    const response = await this.request(path2, method, body);
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async requestNoContent(path2, method, body) {
+    const response = await this.request(path2, method, body);
+    if (response.status >= 200 && response.status < 300) return;
+    throw await this.errorFromResponse(response);
+  }
+  async request(path2, method, body) {
+    const token = await this.accessToken();
+    const response = await this.fetchImpl(`${this.serverUrl}${path2}`, {
+      method,
+      redirect: "manual",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        ...body === void 0 ? {} : { "Content-Type": "application/json" }
+      },
+      body: body === void 0 ? void 0 : JSON.stringify(assertNoSecretPayload(body))
+    });
+    if (response.ok || response.status === 409) return response;
+    throw await this.errorFromResponse(response);
+  }
+  async accessToken() {
+    if (this.token) return this.token;
+    const body = new URLSearchParams({ grant_type: "client_credentials", client_id: this.credentials.clientId, client_secret: this.credentials.clientSecret });
+    const response = await this.fetchImpl(`${this.serverUrl}/realms/${encodeURIComponent(this.realm)}/protocol/openid-connect/token`, {
+      method: "POST",
+      redirect: "manual",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    });
+    if (!response.ok) throw await this.errorFromResponse(response);
+    const payload = await response.json();
+    if (typeof payload.access_token !== "string" || !payload.access_token) throw new KeycloakAdminError("Token response did not include an access token");
+    this.token = payload.access_token;
+    return this.token;
+  }
+  async errorFromResponse(response) {
+    const text = await response.text().catch(() => "");
+    const redactedBody = redactErrorText(text).slice(0, 500);
+    const redacted = JSON.stringify(redactSecrets({ message: redactedBody, authorization: response.headers.get("authorization") }));
+    return new KeycloakAdminError(`Keycloak Admin API HTTP ${response.status}: ${redacted}`, response.status);
+  }
+};
+function readProvisionerCredentials(env = process.env) {
+  const clientId = env.KEYCLOAK_PROVISION_CLIENT_ID?.trim();
+  const clientSecret = env.KEYCLOAK_PROVISION_CLIENT_SECRET?.trim();
+  if (!clientId || !clientSecret) throw new Error("KEYCLOAK_PROVISION_CLIENT_ID and KEYCLOAK_PROVISION_CLIENT_SECRET are required for live/apply");
+  return { clientId, clientSecret };
+}
+function redactErrorText(text) {
+  try {
+    return JSON.stringify(redactSecrets(JSON.parse(text)));
+  } catch {
+    return text.replace(/(secret|token|authorization|credential|password)[^\s,;}]{0,80}/gi, "$1=[REDACTED]");
+  }
+}
+function assertNoSecretPayload(payload) {
+  if (containsSecretKey(payload)) throw new KeycloakAdminError("Managed Keycloak payload contains a secret-shaped field");
+  return payload;
+}
+function readArray(value, label, guard) {
+  if (!Array.isArray(value)) throw new KeycloakAdminError(`Keycloak ${label} response was not an array`);
+  if (!value.every(guard)) throw new KeycloakAdminError(`Keycloak ${label} response has an unsupported shape`);
+  return value;
+}
+function isClient(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && typeof Reflect.get(value, "clientId") === "string";
+}
+function isRole(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && typeof Reflect.get(value, "name") === "string";
+}
+function isGroup(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && typeof Reflect.get(value, "id") === "string" && typeof Reflect.get(value, "name") === "string" && typeof Reflect.get(value, "path") === "string";
+}
+function isProtocolMapper(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && typeof Reflect.get(value, "name") === "string" && typeof Reflect.get(value, "protocol") === "string" && typeof Reflect.get(value, "protocolMapper") === "string" && !!Reflect.get(value, "config") && typeof Reflect.get(value, "config") === "object";
+}
+function isUserSummary(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && typeof Reflect.get(value, "id") === "string";
+}
+function clientManagedConverged(actual, desired) {
+  const desiredAttrs = desired.attributes ?? {};
+  const actualAttrs = actual.attributes ?? {};
+  return actual.clientId === desired.clientId && actual.enabled === desired.enabled && actual.protocol === desired.protocol && actual.publicClient === desired.publicClient && actual.bearerOnly === desired.bearerOnly && actual.standardFlowEnabled === desired.standardFlowEnabled && actual.serviceAccountsEnabled === desired.serviceAccountsEnabled && actual.directAccessGrantsEnabled === desired.directAccessGrantsEnabled && actual.implicitFlowEnabled === desired.implicitFlowEnabled && stringArraysEqual(actual.redirectUris, desired.redirectUris ?? []) && stringArraysEqual(actual.webOrigins, desired.webOrigins ?? []) && Object.entries(desiredAttrs).every(([key, value]) => actualAttrs[key] === value);
+}
+function groupAttributesConverged(actual, desired) {
+  return managedRecordsOfStringArraysEqual(normalizeGroupAttributes(actual.attributes), desired.attributes);
+}
+function protocolMapperConverged(actual, desired) {
+  return actual.name === desired.name && actual.protocol === desired.protocol && actual.protocolMapper === desired.protocolMapper && stringRecordsEqual(actual.config, desired.config);
+}
+function normalizeGroupAttributes(input) {
+  return Object.fromEntries(Object.entries(input ?? {}).map(([key, value]) => [key, Array.isArray(value) ? value.map(String) : [String(value)]]));
+}
+function managedRecordsOfStringArraysEqual(left, right) {
+  for (const key of ["agora_role", "vendor_id"]) {
+    if (!stringArraysEqual(left[key] ?? [], right[key] ?? [])) return false;
+  }
+  return true;
+}
+function stringArraysEqual(left, right) {
+  return Array.isArray(left) && left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function stringRecordsEqual(left, right) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(left), ...Object.keys(right)]);
+  for (const key of keys) {
+    if (left[key] !== right[key]) return false;
+  }
+  return true;
+}
+function containsSecretKey(value) {
+  if (Array.isArray(value)) return value.some(containsSecretKey);
+  if (!value || typeof value !== "object") return false;
+  for (const [key, item] of Object.entries(value)) {
+    if (isOutboundSecretKey(key) || containsSecretKey(item)) return true;
+  }
+  return false;
+}
+function isOutboundSecretKey(key) {
+  const normalized = key.toLowerCase();
+  return normalized === "secret" || normalized.endsWith("secret") || normalized.endsWith("clientsecret") || normalized.endsWith("client_secret") || normalized === "password" || normalized.endsWith("password") || normalized === "credential" || normalized.endsWith("credential") || normalized === "authorization";
+}
+
+// scripts/keycloak-provision.ts
+function parseArgs(argv) {
+  const args = { command: argv[0] };
+  for (let index = 1; index < argv.length; index += 1) {
+    const token = argv[index] ?? "";
+    if (token === "--live") {
+      args.live = true;
+      continue;
+    }
+    if (!token.startsWith("--")) throw new Error(`Unexpected positional argument: ${token}`);
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) throw new Error(`${token} requires a value`);
+    index += 1;
+    const key = {
+      "--state-fixture": "stateFixture",
+      "--claims-fixture": "claimsFixture",
+      "--out": "out",
+      "--plan": "plan",
+      "--approve": "approve",
+      "--server": "server",
+      "--realm": "realm"
+    }[token];
+    if (!key) throw new Error(`Unsupported option: ${token}`);
+    args[key] = value;
+  }
+  return args;
+}
+async function runKeycloakProvision(argv, env = process.env) {
+  const args = parseArgs(argv);
+  if (args.command === "plan") return planCommand(args, env);
+  if (args.command === "apply") return applyCommand(args, env);
+  if (args.command === "verify") return verifyCommand(args);
+  throw new Error("Usage: keycloak-provision plan|apply|verify [--state-fixture path|--live] [--out path] [--plan path --approve id] [--claims-fixture path] [--server url --realm realm]");
+}
+async function planCommand(args, env) {
+  const mode = args.live ? "live" : "fixture";
+  const desired = args.live ? desiredKeycloakState({ serverUrl: normalizeTrustedServerUrl(args.server ?? DEFAULT_KEYCLOAK_SERVER), realm: args.realm }) : desiredKeycloakState({ serverUrl: args.server, realm: args.realm });
+  const state = args.live ? await liveState(desired, env) : await fixtureState(args.stateFixture);
+  const plan = createProvisionPlan(state, desired, { mode });
+  const serialized = `${JSON.stringify(redactSecrets(plan), null, 2)}
+`;
+  if (args.out) {
+    await writeFile(path.resolve(args.out), serialized, "utf8");
+    console.log(`Wrote Keycloak plan ${plan.id} to ${path.resolve(args.out)}`);
+  } else {
+    console.log(serialized.trimEnd());
+  }
+  if (planHasBlockingIssues(plan)) process.exitCode = 2;
+}
+async function applyCommand(args, env) {
+  const planPath = requireArg(args.plan, "--plan");
+  const approval = requireArg(args.approve, "--approve");
+  const plan = JSON.parse(await readFile(path.resolve(planPath), "utf8"));
+  assertSerializedPlanIntegrity(plan);
+  assertPlanPreflight(plan, approval);
+  const trustedServerUrl = normalizeTrustedServerUrl(args.server ?? DEFAULT_KEYCLOAK_SERVER);
+  const trustedRealm = args.realm ?? DEFAULT_KEYCLOAK_REALM;
+  if (plan.desired.serverUrl !== trustedServerUrl) throw new Error("Plan server does not match trusted --server/default destination");
+  if (plan.desired.realm !== trustedRealm) throw new Error("Plan realm does not match trusted --realm/default destination");
+  const desired = desiredKeycloakState({ serverUrl: trustedServerUrl, realm: trustedRealm, appClientId: plan.desired.clientId });
+  const credentials = readProvisionerCredentials(env);
+  const api = new KeycloakAdminApi({ serverUrl: desired.serverUrl, realm: desired.realm, credentials });
+  await api.validateDiscovery();
+  const state = await api.readRealmState(desired.appClientId);
+  assertPlanApplicable(plan, state, approval);
+  for (const operation of plan.operations) {
+    await api.applyOperation(operation, desired);
+  }
+  console.log(`Applied Keycloak plan ${plan.id}: ${plan.operations.length} operation(s)`);
+}
+function assertPlanPreflight(plan, approval, now = /* @__PURE__ */ new Date()) {
+  if (approval !== plan.id) throw new Error(`Approval mismatch: expected --approve ${plan.id}`);
+  if (Date.parse(plan.expiresAt) <= now.getTime()) throw new Error(`Plan ${plan.id} is stale; create a fresh plan`);
+  if (plan.issues.some((issue) => issue.severity === "error")) throw new Error(`Plan ${plan.id} contains blocking issues`);
+  const createdAt = new Date(plan.createdAt);
+  const ttlMs = Date.parse(plan.expiresAt) - createdAt.getTime();
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > MAX_PLAN_TTL_MS2) throw new Error(`Plan ${plan.id} has invalid timestamps`);
+  if (createdAt.getTime() - now.getTime() > PLAN_CLOCK_SKEW_MS2) throw new Error(`Plan ${plan.id} was created in the future`);
+}
+var MAX_PLAN_TTL_MS2 = 15 * 60 * 1e3;
+var PLAN_CLOCK_SKEW_MS2 = 60 * 1e3;
+var LIVE_VERIFY_TIMEOUT_MS = 1e4;
+function normalizeTrustedServerUrl(value) {
+  const normalized = value.trim().replace(/\/+$/, "");
+  const url = new URL(normalized);
+  if (url.username || url.password || url.search || url.hash) throw new Error("Trusted Keycloak server URL must not include credentials, query, or fragment");
+  if (url.pathname !== "/") throw new Error("Trusted Keycloak server URL must not include a non-root path");
+  if (url.protocol === "https:" && isDefaultKeycloakOrigin(url)) return url.origin;
+  if (url.protocol === "http:" && isLoopbackHost(url.hostname)) return url.origin;
+  throw new Error("Trusted Keycloak server URL must be the configured default HTTPS origin or loopback HTTP");
+}
+function isDefaultKeycloakOrigin(url) {
+  const defaultUrl = new URL(DEFAULT_KEYCLOAK_SERVER);
+  return url.protocol === defaultUrl.protocol && url.hostname === defaultUrl.hostname && url.port === defaultUrl.port;
+}
+function isLoopbackHost(hostname) {
+  return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "[::1]" || hostname === "::1";
+}
+async function verifyCommand(args) {
+  if (args.claimsFixture) {
+    const fixture = JSON.parse(await readFile(path.resolve(args.claimsFixture), "utf8"));
+    const issues = verifyClaimFixtures(fixture);
+    if (issues.length > 0) {
+      console.log(JSON.stringify({ ok: false, issues }, null, 2));
+      process.exitCode = 2;
+      return;
+    }
+    console.log("Claim fixture verification passed");
+    return;
+  }
+  if (args.live) {
+    const desired = desiredKeycloakState({ serverUrl: normalizeTrustedServerUrl(args.server ?? DEFAULT_KEYCLOAK_SERVER), realm: args.realm });
+    await verifyLivePostLogoutRedirect(desired);
+    console.log("Live Keycloak post-logout redirect verification passed");
+    return;
+  }
+  const state = await fixtureState(args.stateFixture);
+  const plan = createProvisionPlan(state, desiredKeycloakState({ serverUrl: args.server, realm: args.realm }), { mode: "fixture" });
+  console.log(JSON.stringify({ ok: !planHasBlockingIssues(plan), planId: plan.id, operationCount: plan.operations.length, issues: plan.issues }, null, 2));
+  if (planHasBlockingIssues(plan)) process.exitCode = 2;
+}
+async function verifyLivePostLogoutRedirect(desired) {
+  const url = new URL(`${desired.serverUrl}/realms/${encodeURIComponent(desired.realm)}/protocol/openid-connect/logout`);
+  url.searchParams.set("client_id", desired.appClientId);
+  url.searchParams.set("post_logout_redirect_uri", desired.postLogoutRedirectUri);
+  const response = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(LIVE_VERIFY_TIMEOUT_MS) });
+  if (response.status >= 400) {
+    throw new Error(`Keycloak post-logout redirect validation failed with HTTP ${response.status} for Keycloak client ${desired.appClientId}. Ensure the client post.logout.redirect.uris setting includes ${desired.postLogoutRedirectUri}.`);
+  }
+}
+async function liveState(desired, env) {
+  const api = new KeycloakAdminApi({ serverUrl: desired.serverUrl, realm: desired.realm, credentials: readProvisionerCredentials(env) });
+  await api.validateDiscovery();
+  return await api.readRealmState(desired.appClientId);
+}
+async function fixtureState(file) {
+  if (!file) return emptyRealmState();
+  return JSON.parse(await readFile(path.resolve(file), "utf8"));
+}
+function requireArg(value, name) {
+  const trimmed = value?.trim();
+  if (!trimmed) throw new Error(`${name} is required`);
+  return trimmed;
+}
+if (import.meta.url === packageFileUrl(process.argv[1]).href) {
+  runKeycloakProvision(process.argv.slice(2)).catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+  });
+}
+export {
+  parseArgs,
+  runKeycloakProvision
+};