permdock 0.6.0 → 0.8.0

package/dist/postgres-store-DcyrPS-r.js

@@ -0,0 +1,1028 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { o as quoteSqlIdent, u as sqlRows } from "./sql-0WjxIp9g.js";
+//#region src/scim/types.ts
+const SCIM_CONTENT_TYPE = "application/scim+json";
+const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+/** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
+const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
+/**
+* The extension that carries the application's own data (`x`) on a User or a
+* Group.
+*/
+const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
+var DirectoryUniquenessError = class extends Error {
+	name = "DirectoryUniquenessError";
+	code = "uniqueness";
+	constructor(message = "uniqueness") {
+		super(message);
+	}
+};
+var DirectoryNotFoundError = class extends Error {
+	name = "DirectoryNotFoundError";
+	code = "not-found";
+	constructor(message = "not found") {
+		super(message);
+	}
+};
+function isNamedError(error, name, code) {
+	return error instanceof Error && error.name === name && Reflect.get(error, "code") === code;
+}
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
+function isDirectoryUniquenessError(error) {
+	return isNamedError(error, "DirectoryUniquenessError", "uniqueness");
+}
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
+function isDirectoryNotFoundError(error) {
+	return isNamedError(error, "DirectoryNotFoundError", "not-found");
+}
+//#endregion
+//#region src/scim/filter.ts
+const COMPARE = /* @__PURE__ */ new Set([
+	"eq",
+	"ne",
+	"co",
+	"sw"
+]);
+function skipSpace(input, index) {
+	let cursor = index;
+	while (cursor < input.length && input[cursor] === " ") cursor += 1;
+	return cursor;
+}
+function readIdent(input, index) {
+	const start = skipSpace(input, index);
+	if (!/[A-Za-z]/u.test(input[start] ?? "")) return;
+	let cursor = start;
+	while (cursor < input.length && /[A-Za-z0-9._]/u.test(input[cursor] ?? "")) cursor += 1;
+	return {
+		value: input.slice(start, cursor),
+		next: cursor
+	};
+}
+function readString(input, index) {
+	const start = skipSpace(input, index);
+	if (input[start] !== "\"") return;
+	let cursor = start + 1;
+	let value = "";
+	while (cursor < input.length) {
+		const char = input[cursor];
+		if (char === "\\") {
+			value += input[cursor + 1] ?? "";
+			cursor += 2;
+			continue;
+		}
+		if (char === "\"") return {
+			value,
+			next: cursor + 1
+		};
+		value += char;
+		cursor += 1;
+	}
+}
+function readLiteral(input, index) {
+	const quoted = readString(input, index);
+	if (quoted !== void 0) return quoted;
+	const ident = readIdent(input, index);
+	if (ident === void 0) return;
+	if (ident.value.toLowerCase() === "true") return {
+		value: true,
+		next: ident.next
+	};
+	if (ident.value.toLowerCase() === "false") return {
+		value: false,
+		next: ident.next
+	};
+	return {
+		value: ident.value,
+		next: ident.next
+	};
+}
+function parsePrimary(input, index) {
+	const start = skipSpace(input, index);
+	if (input[start] === "(") {
+		const inner = parseOr(input, start + 1);
+		if (inner === void 0) return;
+		const close = skipSpace(input, inner.next);
+		if (input[close] !== ")") return;
+		return {
+			filter: inner.filter,
+			next: close + 1
+		};
+	}
+	const attribute = readIdent(input, start);
+	if (attribute === void 0) return;
+	const opToken = readIdent(input, attribute.next);
+	if (opToken === void 0) return;
+	const op = opToken.value.toLowerCase();
+	if (op === "pr") return {
+		filter: {
+			op: "pr",
+			attribute: attribute.value
+		},
+		next: opToken.next
+	};
+	if (!COMPARE.has(op)) return;
+	const value = readLiteral(input, opToken.next);
+	if (value === void 0) return;
+	return {
+		filter: {
+			op,
+			attribute: attribute.value,
+			value: value.value
+		},
+		next: value.next
+	};
+}
+function parseAnd(input, index) {
+	const first = parsePrimary(input, index);
+	if (first === void 0) return;
+	const filters = [first.filter];
+	let cursor = first.next;
+	for (;;) {
+		const nextOp = readIdent(input, cursor);
+		if (nextOp?.value.toLowerCase() !== "and") break;
+		const next = parsePrimary(input, nextOp.next);
+		if (next === void 0) return;
+		filters.push(next.filter);
+		cursor = next.next;
+	}
+	if (filters.length === 1) return {
+		filter: first.filter,
+		next: cursor
+	};
+	return {
+		filter: {
+			op: "and",
+			filters
+		},
+		next: cursor
+	};
+}
+function parseOr(input, index) {
+	const first = parseAnd(input, index);
+	if (first === void 0) return;
+	const filters = [first.filter];
+	let cursor = first.next;
+	for (;;) {
+		const nextOp = readIdent(input, cursor);
+		if (nextOp?.value.toLowerCase() !== "or") break;
+		const next = parseAnd(input, nextOp.next);
+		if (next === void 0) return;
+		filters.push(next.filter);
+		cursor = next.next;
+	}
+	if (filters.length === 1) return {
+		filter: first.filter,
+		next: cursor
+	};
+	return {
+		filter: {
+			op: "or",
+			filters
+		},
+		next: cursor
+	};
+}
+function parseScimFilter(input) {
+	const trimmed = input.trim();
+	if (trimmed === "") return;
+	const parsed = parseOr(trimmed, 0);
+	if (parsed === void 0) return;
+	if (skipSpace(trimmed, parsed.next) !== trimmed.length) return;
+	return parsed.filter;
+}
+function readAttribute(target, attribute) {
+	if (attribute === "members.value") {
+		const members = target["members"];
+		if (!Array.isArray(members)) return;
+		return members.map((member) => {
+			if (member !== null && typeof member === "object" && "value" in member) return member.value;
+		});
+	}
+	const parts = attribute.split(".");
+	let current = target;
+	for (const part of parts) {
+		if (current === null || typeof current !== "object") return;
+		current = current[part];
+	}
+	return current;
+}
+function asString(value) {
+	if (typeof value === "boolean") return value ? "true" : "false";
+	return String(value);
+}
+function matchCompare(actual, op, expected) {
+	if (Array.isArray(actual)) return actual.some((item) => matchCompare(item, op, expected));
+	if (actual === void 0 || actual === null) return op === "ne";
+	if (typeof expected === "boolean" || typeof actual === "boolean") {
+		const left = asString(actual).toLowerCase();
+		const right = asString(expected).toLowerCase();
+		return op === "eq" ? left === right : op === "ne" ? left !== right : false;
+	}
+	const left = asString(actual);
+	const right = asString(expected);
+	switch (op) {
+		case "eq": return left === right;
+		case "ne": return left !== right;
+		case "co": return left.includes(right);
+		case "sw": return left.startsWith(right);
+		default: return op;
+	}
+}
+/**
+* RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an
+* item.
+*/
+function present(value) {
+	if (Array.isArray(value)) return value.some(present);
+	return value !== void 0 && value !== null && value !== "";
+}
+function matchFilter(target, filter) {
+	if (filter === void 0) return true;
+	const record = target;
+	switch (filter.op) {
+		case "and": return filter.filters.every((item) => matchFilter(target, item));
+		case "or": return filter.filters.some((item) => matchFilter(target, item));
+		case "pr": return present(readAttribute(record, filter.attribute));
+		case "eq":
+		case "ne":
+		case "co":
+		case "sw": return matchCompare(readAttribute(record, filter.attribute), filter.op, filter.value);
+		default: return filter;
+	}
+}
+const SUPPORTED_FILTER_ATTRIBUTES = /* @__PURE__ */ new Set([
+	"id",
+	"userName",
+	"externalId",
+	"active",
+	"displayName",
+	"members.value"
+]);
+function filterSupported(filter) {
+	switch (filter.op) {
+		case "and":
+		case "or": return filter.filters.every(filterSupported);
+		case "pr":
+		case "eq":
+		case "ne":
+		case "co":
+		case "sw": return SUPPORTED_FILTER_ATTRIBUTES.has(filter.attribute);
+		default: return filter;
+	}
+}
+//#endregion
+//#region src/scim/store.ts
+const DEFAULT_COUNT$1 = 100;
+function now() {
+	return isoNow();
+}
+function createdAt(at, ...candidates) {
+	return candidates.find((value) => value !== void 0 && value !== "") ?? at;
+}
+function randomId$1(prefix) {
+	const bytes = /* @__PURE__ */ new Uint8Array(8);
+	crypto.getRandomValues(bytes);
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return `${prefix}${hex}`;
+}
+function directoryKey(tenant, id) {
+	return `${tenant}\0${id}`;
+}
+function asError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+function pageOf(items, page) {
+	const count = page.count ?? DEFAULT_COUNT$1;
+	let start = 0;
+	if (page.cursor !== void 0 && page.cursor !== "") {
+		const decoded = Math.trunc(Number(page.cursor));
+		start = Number.isFinite(decoded) && decoded > 0 ? decoded : 0;
+	} else if (page.startIndex !== void 0 && page.startIndex > 0) start = page.startIndex - 1;
+	const slice = items.slice(start, start + count);
+	const nextIndex = start + slice.length;
+	return compact({
+		Resources: slice,
+		totalResults: items.length,
+		startIndex: start + 1,
+		itemsPerPage: slice.length,
+		nextCursor: nextIndex < items.length ? String(nextIndex) : void 0
+	});
+}
+function emailsOf(value) {
+	if (!Array.isArray(value)) return;
+	return value.flatMap((item) => {
+		if (item === null || typeof item !== "object") return [];
+		const record = item;
+		if (typeof record.value !== "string") return [];
+		return [compact({
+			value: record.value,
+			primary: typeof record.primary === "boolean" ? record.primary : void 0,
+			type: typeof record.type === "string" ? record.type : void 0
+		})];
+	});
+}
+function membersOf(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => {
+		if (item === null || typeof item !== "object") return [];
+		const record = item;
+		return typeof record.value === "string" ? [{ value: record.value }] : [];
+	});
+}
+function rolesOf(value) {
+	if (!Array.isArray(value)) return;
+	return value.filter((item) => typeof item === "string");
+}
+function memberValues(value) {
+	return membersOf(value).map((member) => member.value);
+}
+function applyUserOp(user, op) {
+	const path = op.path ?? "";
+	if (path === "active" && typeof op.value === "boolean") return {
+		...user,
+		active: op.value
+	};
+	if (path === "userName" && typeof op.value === "string") return {
+		...user,
+		userName: op.value
+	};
+	if (path === "externalId") return compact({
+		...user,
+		externalId: typeof op.value === "string" ? op.value : void 0
+	});
+	if (path === "emails") return compact({
+		...user,
+		emails: emailsOf(op.value)
+	});
+	return user;
+}
+function applyGroupOp(group, op) {
+	const path = op.path ?? "";
+	if (path === "displayName" && typeof op.value === "string") return {
+		...group,
+		displayName: op.value
+	};
+	if (path === "externalId") return compact({
+		...group,
+		externalId: typeof op.value === "string" ? op.value : void 0
+	});
+	if (path === "roles") return compact({
+		...group,
+		roles: rolesOf(op.value)
+	});
+	if (path !== "members") return group;
+	const incoming = memberValues(op.value);
+	const current = group.members.map((member) => member.value);
+	if (op.op === "replace") return {
+		...group,
+		members: incoming.map((value) => ({ value }))
+	};
+	if (op.op === "add") {
+		const next = [...current];
+		for (const value of incoming) if (!next.includes(value)) next.push(value);
+		return {
+			...group,
+			members: next.map((value) => ({ value }))
+		};
+	}
+	return {
+		...group,
+		members: current.filter((value) => !incoming.includes(value)).map((value) => ({ value }))
+	};
+}
+function stampUser(user, created) {
+	const at = now();
+	return freezeDeep({
+		...user,
+		meta: compact({
+			created: createdAt(at, created, user.meta.created),
+			lastModified: at,
+			resourceType: "User",
+			location: user.meta.location
+		})
+	});
+}
+function stampGroup(group, created) {
+	const at = now();
+	return freezeDeep({
+		...group,
+		meta: compact({
+			created: createdAt(at, created, group.meta.created),
+			lastModified: at,
+			resourceType: "Group",
+			location: group.meta.location
+		})
+	});
+}
+function memoryDirectoryStore() {
+	const users = /* @__PURE__ */ new Map();
+	const groups = /* @__PURE__ */ new Map();
+	function usersIn(tenant) {
+		const found = [];
+		for (const [key, user] of users) if (key.startsWith(`${tenant}\0`)) found.push(user);
+		return found;
+	}
+	function groupsIn(tenant) {
+		const found = [];
+		for (const [key, group] of groups) if (key.startsWith(`${tenant}\0`)) found.push(group);
+		return found;
+	}
+	function assertUserUnique(tenant, user, ignoreId) {
+		for (const existing of usersIn(tenant)) {
+			if (existing.id === ignoreId) continue;
+			if (existing.userName === user.userName) throw new DirectoryUniquenessError("userName");
+			if (user.externalId !== void 0 && existing.externalId === user.externalId) throw new DirectoryUniquenessError("externalId");
+		}
+	}
+	function assertGroupUnique(tenant, group, ignoreId) {
+		for (const existing of groupsIn(tenant)) {
+			if (existing.id === ignoreId) continue;
+			if (group.externalId !== void 0 && existing.externalId === group.externalId) throw new DirectoryUniquenessError("externalId");
+		}
+	}
+	return {
+		getUser(tenant, id) {
+			return Promise.resolve(users.get(directoryKey(tenant, id)) ?? null);
+		},
+		findUsers(tenant, filter, page) {
+			const matched = usersIn(tenant).filter((user) => matchFilter(user, filter));
+			return Promise.resolve(pageOf(matched, page));
+		},
+		putUser(tenant, user) {
+			try {
+				const id = user.id === "" ? randomId$1("u_") : user.id;
+				const existing = users.get(directoryKey(tenant, id));
+				const next = stampUser({
+					...user,
+					id
+				}, existing?.meta.created);
+				assertUserUnique(tenant, next, id);
+				users.set(directoryKey(tenant, id), next);
+				return Promise.resolve(next);
+			} catch (error) {
+				return Promise.reject(asError(error));
+			}
+		},
+		patchUser(tenant, id, ops) {
+			try {
+				const existing = users.get(directoryKey(tenant, id));
+				if (existing === void 0) throw new DirectoryNotFoundError();
+				let next = existing;
+				for (const op of ops) next = applyUserOp(next, op);
+				next = stampUser(next, existing.meta.created);
+				assertUserUnique(tenant, next, id);
+				users.set(directoryKey(tenant, id), next);
+				return Promise.resolve(next);
+			} catch (error) {
+				return Promise.reject(asError(error));
+			}
+		},
+		deleteUser(tenant, id) {
+			if (!users.delete(directoryKey(tenant, id))) return Promise.reject(new DirectoryNotFoundError());
+			for (const group of groupsIn(tenant)) {
+				if (!group.members.some((member) => member.value === id)) continue;
+				groups.set(directoryKey(tenant, group.id), stampGroup({
+					...group,
+					members: group.members.filter((member) => member.value !== id)
+				}, group.meta.created));
+			}
+			return Promise.resolve();
+		},
+		getGroup(tenant, id) {
+			return Promise.resolve(groups.get(directoryKey(tenant, id)) ?? null);
+		},
+		findGroups(tenant, filter, page) {
+			const matched = groupsIn(tenant).filter((group) => matchFilter(group, filter));
+			return Promise.resolve(pageOf(matched, page));
+		},
+		putGroup(tenant, group) {
+			try {
+				const id = group.id === "" ? randomId$1("g_") : group.id;
+				const existing = groups.get(directoryKey(tenant, id));
+				const next = stampGroup({
+					...group,
+					id,
+					members: group.members
+				}, existing?.meta.created);
+				assertGroupUnique(tenant, next, id);
+				groups.set(directoryKey(tenant, id), next);
+				return Promise.resolve(next);
+			} catch (error) {
+				return Promise.reject(asError(error));
+			}
+		},
+		patchGroup(tenant, id, ops) {
+			try {
+				const existing = groups.get(directoryKey(tenant, id));
+				if (existing === void 0) throw new DirectoryNotFoundError();
+				let next = existing;
+				for (const op of ops) next = applyGroupOp(next, op);
+				next = stampGroup(next, existing.meta.created);
+				assertGroupUnique(tenant, next, id);
+				groups.set(directoryKey(tenant, id), next);
+				return Promise.resolve(next);
+			} catch (error) {
+				return Promise.reject(asError(error));
+			}
+		},
+		deleteGroup(tenant, id) {
+			if (!groups.delete(directoryKey(tenant, id))) return Promise.reject(new DirectoryNotFoundError());
+			return Promise.resolve();
+		},
+		groupsFor(tenant, userId) {
+			return Promise.resolve(groupsIn(tenant).filter((group) => group.members.some((member) => member.value === userId)));
+		}
+	};
+}
+//#endregion
+//#region src/scim/postgres-store.ts
+/**
+* The tables `permdock scim generate` writes; their names are the contract this
+* store reads.
+*/
+const SCIM_TABLES = {
+	users: "scim_users",
+	groups: "scim_groups",
+	members: "scim_group_members"
+};
+/**
+* The constraints whose violation is a SCIM `409 uniqueness`, by the attribute
+* they cover.
+*/
+const SCIM_UNIQUE = {
+	userName: "scim_users_user_name_key",
+	userExternalId: "scim_users_external_id_key",
+	groupExternalId: "scim_groups_external_id_key"
+};
+const SCIM_SCHEMA = "permdock";
+const DEFAULT_COUNT = 100;
+/** A PATCH re-reads and retries when another write changed the row in between. */
+const PATCH_ATTEMPTS = 8;
+const iso = (column) => `to_char(${column} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`;
+function userJson(alias) {
+	return `jsonb_build_object(
+    'id', ${alias}.id, 'userName', ${alias}.user_name, 'externalId', ${alias}.external_id,
+    'active', ${alias}.active, 'emails', ${alias}.emails, 'x', ${alias}.x,
+    'created', ${iso(`${alias}.created_at`)}, 'lastModified', ${iso(`${alias}.updated_at`)},
+    'revision', ${alias}.revision)`;
+}
+function groupJson(alias, members) {
+	return `jsonb_build_object(
+    'id', ${alias}.id, 'displayName', ${alias}.display_name, 'externalId', ${alias}.external_id,
+    'roles', to_jsonb(${alias}.roles), 'x', ${alias}.x, 'members', ${members},
+    'created', ${iso(`${alias}.created_at`)}, 'lastModified', ${iso(`${alias}.updated_at`)},
+    'revision', ${alias}.revision)`;
+}
+function membersOfGroup(tables, alias) {
+	return `coalesce((select jsonb_agg(m.user_id order by m.position) from ${tables.members} m
+    where m.tenant = ${alias}.tenant and m.group_id = ${alias}.id), '[]'::jsonb)`;
+}
+function parsed(value) {
+	return typeof value === "string" ? JSON.parse(value) : value;
+}
+function text(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function appData(value) {
+	return isRecord(value) ? value : void 0;
+}
+function storedUser(value) {
+	const row = parsed(value);
+	if (!isRecord(row)) throw new Error("PermDock: postgresDirectoryStore read a malformed user");
+	return {
+		revision: Number(row["revision"]),
+		resource: compact({
+			id: String(row["id"]),
+			userName: String(row["userName"]),
+			externalId: text(row["externalId"]),
+			active: row["active"] === true,
+			emails: emailsOf(row["emails"]),
+			x: appData(row["x"]),
+			meta: {
+				created: String(row["created"]),
+				lastModified: String(row["lastModified"]),
+				resourceType: "User"
+			}
+		})
+	};
+}
+function storedGroup(value) {
+	const row = parsed(value);
+	if (!isRecord(row)) throw new Error("PermDock: postgresDirectoryStore read a malformed group");
+	const members = Array.isArray(row["members"]) ? row["members"] : [];
+	const roles = row["roles"];
+	return {
+		revision: Number(row["revision"]),
+		resource: compact({
+			id: String(row["id"]),
+			displayName: String(row["displayName"]),
+			externalId: text(row["externalId"]),
+			members: members.flatMap((member) => typeof member === "string" ? [{ value: member }] : []),
+			roles: Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : void 0,
+			x: appData(row["x"]),
+			meta: {
+				created: String(row["created"]),
+				lastModified: String(row["lastModified"]),
+				resourceType: "Group"
+			}
+		})
+	};
+}
+/**
+* A stored or IdP-sent `meta.created` the database can read; anything else is
+* "now".
+*/
+function createdParam(created) {
+	return created !== "" && !Number.isNaN(Date.parse(created)) ? created : null;
+}
+function json(value) {
+	return value === void 0 ? null : JSON.stringify(value);
+}
+function randomId(prefix) {
+	const bytes = /* @__PURE__ */ new Uint8Array(8);
+	crypto.getRandomValues(bytes);
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return `${prefix}${hex}`;
+}
+/** Each value once, first occurrence first: one member row per user. */
+function uniqueMembers(group) {
+	return [...new Set(group.members.map((member) => member.value))];
+}
+function constraintOf(error) {
+	for (const key of [
+		"constraint",
+		"constraint_name",
+		"detail",
+		"message"
+	]) {
+		const value = error[key];
+		if (typeof value === "string" && value !== "") return value;
+	}
+	return "";
+}
+/**
+* A unique violation (`23505`) as `DirectoryUniquenessError`; any other error
+* is rethrown.
+*/
+function uniqueness(error, kind) {
+	if (isRecord(error) && error["code"] === "23505") {
+		const constraint = constraintOf(error);
+		throw new DirectoryUniquenessError(kind === "user" && (constraint.includes(SCIM_UNIQUE.userName) || constraint.includes("user_name")) ? "userName" : "externalId");
+	}
+	throw error;
+}
+const COLUMNS = {
+	user: {
+		id: "u.id",
+		userName: "u.user_name",
+		externalId: "u.external_id",
+		active: "u.active::text"
+	},
+	group: {
+		id: "g.id",
+		displayName: "g.display_name",
+		externalId: "g.external_id"
+	}
+};
+function asText(value) {
+	return typeof value === "boolean" ? String(value) : value;
+}
+/**
+* The SQL twin of `matchFilter`: a missing attribute matches only `ne`, and
+* booleans compare case-insensitively and only with `eq` / `ne`.
+*/
+function compare(column, op, value, bind, caseless) {
+	if (caseless && (op === "co" || op === "sw")) return "false";
+	const left = caseless ? `lower(${column})` : column;
+	const right = bind(caseless ? asText(value).toLowerCase() : value);
+	switch (op) {
+		case "eq": return `${left} = ${right}`;
+		case "ne": return `${left} is distinct from ${right}`;
+		case "co": return `strpos(${left}, ${right}) > 0`;
+		case "sw": return `starts_with(${left}, ${right})`;
+		default: return op;
+	}
+}
+function compileFilter(filter, kind, tables, bind) {
+	switch (filter.op) {
+		case "and":
+		case "or": return `(${filter.filters.map((item) => compileFilter(item, kind, tables, bind)).join(` ${filter.op} `)})`;
+		case "pr":
+		case "eq":
+		case "ne":
+		case "co":
+		case "sw": {
+			if (filter.attribute === "members.value") {
+				if (kind !== "group") return filter.op === "ne" ? "true" : "false";
+				const member = filter.op === "pr" ? "true" : compare("m.user_id", filter.op, filter.value, bind, false);
+				return `exists (select 1 from ${tables.members} m where m.tenant = g.tenant and m.group_id = g.id and ${member})`;
+			}
+			const column = COLUMNS[kind][filter.attribute];
+			if (column === void 0) return filter.op === "ne" ? "true" : "false";
+			if (filter.op === "pr") return `coalesce(${column}, '') <> ''`;
+			const caseless = typeof filter.value === "boolean" || filter.attribute === "active";
+			return compare(column, filter.op, filter.value, bind, caseless);
+		}
+		default: return filter;
+	}
+}
+function where(tenant, filter, kind, tables) {
+	const params = [tenant];
+	const bind = (value) => {
+		params.push(value);
+		return `$${String(params.length)}`;
+	};
+	return {
+		sql: `${kind === "group" ? "g" : "u"}.tenant = $1 and ${filter === void 0 ? "true" : compileFilter(filter, kind, tables, bind)}`,
+		params
+	};
+}
+/** A non-negative safe integer from `value`, or `fallback`. */
+function wholeOr(value, fallback) {
+	const whole = value === void 0 ? NaN : Math.trunc(value);
+	return Number.isSafeInteger(whole) && whole >= 0 ? whole : fallback;
+}
+function window(page) {
+	const count = page.count !== void 0 && page.count < 0 ? 0 : wholeOr(page.count, DEFAULT_COUNT);
+	if (page.cursor !== void 0 && page.cursor !== "") return {
+		offset: wholeOr(Number(page.cursor), 0),
+		count
+	};
+	return {
+		offset: Math.max(0, wholeOr(page.startIndex, 1) - 1),
+		count
+	};
+}
+function pageResult(items, total, offset) {
+	const next = offset + items.length;
+	return compact({
+		Resources: items,
+		totalResults: total,
+		startIndex: offset + 1,
+		itemsPerPage: items.length,
+		nextCursor: next < total ? String(next) : void 0
+	});
+}
+function userParams(tenant, user, createdOrRevision, now) {
+	return [
+		tenant,
+		user.id,
+		user.userName,
+		user.externalId ?? null,
+		user.active,
+		json(user.emails),
+		json(user.x),
+		createdOrRevision,
+		now
+	];
+}
+function groupParams(tenant, group, createdOrRevision, now) {
+	return [
+		tenant,
+		group.id,
+		group.displayName,
+		group.externalId ?? null,
+		group.roles === void 0 ? null : [...group.roles],
+		json(group.x),
+		createdOrRevision,
+		now,
+		uniqueMembers(group)
+	];
+}
+/**
+* Reads the row, applies the operations and writes only if no other write
+* landed in between; `write` answers `null` then.
+*/
+async function patch(read, ops, step, write, label) {
+	for (let attempt = 0; attempt < PATCH_ATTEMPTS; attempt += 1) {
+		const current = await read();
+		if (current === null) throw new DirectoryNotFoundError();
+		let next = current.resource;
+		for (const op of ops) next = step(next, op);
+		const written = await write(next, current.revision);
+		if (written !== null) return written;
+	}
+	throw new Error(`PermDock: postgresDirectoryStore: ${label} kept changing during a PATCH`);
+}
+function statements(tables) {
+	const upsertUser = `insert into ${tables.users} as u
+    (tenant, id, user_name, external_id, active, emails, x, created_at, updated_at)
+    values ($1, $2, $3, $4, $5, $6::jsonb, $7::jsonb, coalesce($8::timestamptz, $9::timestamptz), $9::timestamptz)
+    on conflict (tenant, id) do update set
+      user_name = excluded.user_name, external_id = excluded.external_id, active = excluded.active,
+      emails = excluded.emails, x = excluded.x, updated_at = excluded.updated_at, revision = u.revision + 1
+    returning ${userJson("u")} as resource`;
+	const updateUser = `update ${tables.users} as u set
+      user_name = $3, external_id = $4, active = $5, emails = $6::jsonb, x = $7::jsonb,
+      updated_at = $9::timestamptz, revision = u.revision + 1
+    where u.tenant = $1 and u.id = $2 and u.revision = $8
+    returning ${userJson("u")} as resource`;
+	const members = `dropped as (
+      delete from ${tables.members} m using g
+      where m.tenant = g.tenant and m.group_id = g.id and not (m.user_id = any($9::text[]))
+    ),
+    kept as (
+      insert into ${tables.members} (tenant, group_id, user_id, position)
+      select g.tenant, g.id, v.user_id, v.position::integer
+      from g cross join unnest($9::text[]) with ordinality as v(user_id, position)
+      on conflict (tenant, group_id, user_id) do update set position = excluded.position
+    )
+    select ${groupJson("g", "to_jsonb($9::text[])")} as resource from g`;
+	const upsertGroup = `with g as (
+      insert into ${tables.groups} as t
+        (tenant, id, display_name, external_id, roles, x, created_at, updated_at)
+      values ($1, $2, $3, $4, $5::text[], $6::jsonb, coalesce($7::timestamptz, $8::timestamptz), $8::timestamptz)
+      on conflict (tenant, id) do update set
+        display_name = excluded.display_name, external_id = excluded.external_id, roles = excluded.roles,
+        x = excluded.x, updated_at = excluded.updated_at, revision = t.revision + 1
+      returning t.*
+    ),
+    ${members}`;
+	const updateGroup = `with g as (
+      update ${tables.groups} as t set
+        display_name = $3, external_id = $4, roles = $5::text[], x = $6::jsonb,
+        updated_at = $8::timestamptz, revision = t.revision + 1
+      where t.tenant = $1 and t.id = $2 and t.revision = $7
+      returning t.*
+    ),
+    ${members}`;
+	return {
+		getUser: `select ${userJson("u")} as resource from ${tables.users} u where u.tenant = $1 and u.id = $2`,
+		getGroup: `select ${groupJson("g", membersOfGroup(tables, "g"))} as resource
+      from ${tables.groups} g where g.tenant = $1 and g.id = $2`,
+		upsertUser,
+		updateUser,
+		upsertGroup,
+		updateGroup,
+		deleteUser: `with d as (
+        delete from ${tables.users} where tenant = $1 and id = $2 returning tenant, id
+      ),
+      m as (
+        delete from ${tables.members} mm using d
+        where mm.tenant = d.tenant and mm.user_id = d.id returning mm.group_id
+      ),
+      touched as (
+        update ${tables.groups} t set updated_at = $3::timestamptz, revision = t.revision + 1
+        where t.tenant = $1 and t.id in (select group_id from m)
+      )
+      select count(*)::integer as deleted from d`,
+		deleteGroup: `delete from ${tables.groups} where tenant = $1 and id = $2 returning id`,
+		groupsFor: `select ${groupJson("g", membersOfGroup(tables, "g"))} as resource
+      from ${tables.groups} g
+      where g.tenant = $1 and exists (
+        select 1 from ${tables.members} m where m.tenant = g.tenant and m.group_id = g.id and m.user_id = $2
+      )
+      order by g.seq`
+	};
+}
+function findSql(kind, tables, clause, page) {
+	const table = kind === "user" ? tables.users : tables.groups;
+	const alias = kind === "user" ? "u" : "g";
+	const resource = kind === "user" ? userJson(alias) : groupJson(alias, membersOfGroup(tables, alias));
+	return `with matched as (
+      select ${alias}.seq from ${table} ${alias} where ${clause}
+    ),
+    paged as (
+      select seq from matched order by seq offset ${page.offset}::bigint limit ${page.count}::bigint
+    )
+    select (select count(*)::integer from matched) as total,
+      coalesce((
+        select jsonb_agg(${resource} order by ${alias}.seq)
+        from ${table} ${alias} join paged p on p.seq = ${alias}.seq
+      ), '[]'::jsonb) as resources`;
+}
+/**
+* A `DirectoryStore` over the tables `permdock scim generate` writes, called
+* through a `SqlQuery` that may read and write them (the table owner, or a role
+* granted on them). Every method is one statement, so a pool needs no
+* transaction: a group and its members change together, and a PATCH that races
+* another write re-reads the row and applies its operations again.
+*/
+function postgresDirectoryStore(query, options = {}) {
+	const schema = quoteSqlIdent(options.schema ?? "permdock");
+	const tables = {
+		users: `${schema}.${quoteSqlIdent(SCIM_TABLES.users)}`,
+		groups: `${schema}.${quoteSqlIdent(SCIM_TABLES.groups)}`,
+		members: `${schema}.${quoteSqlIdent(SCIM_TABLES.members)}`
+	};
+	const sql = statements(tables);
+	const rows = async (statement, values) => sqlRows(await query(statement, values));
+	async function readUser(tenant, id) {
+		const [row] = await rows(sql.getUser, [tenant, id]);
+		return row === void 0 ? null : storedUser(row["resource"]);
+	}
+	async function readGroup(tenant, id) {
+		const [row] = await rows(sql.getGroup, [tenant, id]);
+		return row === void 0 ? null : storedGroup(row["resource"]);
+	}
+	async function find(kind, tenant, filter, page, read) {
+		const paging = window(page);
+		const clause = where(tenant, filter, kind, tables);
+		const next = clause.params.length;
+		const [row] = await rows(findSql(kind, tables, clause.sql, {
+			offset: `$${String(next + 1)}`,
+			count: `$${String(next + 2)}`
+		}), [
+			...clause.params,
+			paging.offset,
+			paging.count
+		]);
+		const resources = parsed(row?.["resources"]);
+		return pageResult(Array.isArray(resources) ? resources.map((item) => read(item).resource) : [], Number(row?.["total"] ?? 0), paging.offset);
+	}
+	return {
+		name: "postgres",
+		async getUser(tenant, id) {
+			return (await readUser(tenant, id))?.resource ?? null;
+		},
+		findUsers(tenant, filter, page) {
+			return find("user", tenant, filter, page, storedUser);
+		},
+		async putUser(tenant, user) {
+			const id = user.id === "" ? randomId("u_") : user.id;
+			try {
+				const [row] = await rows(sql.upsertUser, userParams(tenant, {
+					...user,
+					id
+				}, createdParam(user.meta.created), isoNow()));
+				return storedUser(row?.["resource"]).resource;
+			} catch (error) {
+				return uniqueness(error, "user");
+			}
+		},
+		patchUser(tenant, id, ops) {
+			return patch(() => readUser(tenant, id), ops, applyUserOp, async (next, revision) => {
+				try {
+					const [row] = await rows(sql.updateUser, userParams(tenant, {
+						...next,
+						id
+					}, revision, isoNow()));
+					return row === void 0 ? null : storedUser(row["resource"]).resource;
+				} catch (error) {
+					return uniqueness(error, "user");
+				}
+			}, `user ${id}`);
+		},
+		async deleteUser(tenant, id) {
+			const [row] = await rows(sql.deleteUser, [
+				tenant,
+				id,
+				isoNow()
+			]);
+			if (Number(row?.["deleted"] ?? 0) === 0) throw new DirectoryNotFoundError();
+		},
+		async getGroup(tenant, id) {
+			return (await readGroup(tenant, id))?.resource ?? null;
+		},
+		findGroups(tenant, filter, page) {
+			return find("group", tenant, filter, page, storedGroup);
+		},
+		async putGroup(tenant, group) {
+			const id = group.id === "" ? randomId("g_") : group.id;
+			try {
+				const [row] = await rows(sql.upsertGroup, groupParams(tenant, {
+					...group,
+					id
+				}, createdParam(group.meta.created), isoNow()));
+				return storedGroup(row?.["resource"]).resource;
+			} catch (error) {
+				return uniqueness(error, "group");
+			}
+		},
+		patchGroup(tenant, id, ops) {
+			return patch(() => readGroup(tenant, id), ops, applyGroupOp, async (next, revision) => {
+				try {
+					const [row] = await rows(sql.updateGroup, groupParams(tenant, {
+						...next,
+						id
+					}, revision, isoNow()));
+					return row === void 0 ? null : storedGroup(row["resource"]).resource;
+				} catch (error) {
+					return uniqueness(error, "group");
+				}
+			}, `group ${id}`);
+		},
+		async deleteGroup(tenant, id) {
+			if ((await rows(sql.deleteGroup, [tenant, id])).length === 0) throw new DirectoryNotFoundError();
+		},
+		async groupsFor(tenant, userId) {
+			return (await rows(sql.groupsFor, [tenant, userId])).map((row) => storedGroup(row["resource"]).resource);
+		}
+	};
+}
+//#endregion
+export { SCIM_CONTENT_TYPE as _, memoryDirectoryStore as a, isDirectoryUniquenessError as b, parseScimFilter as c, DirectoryUniquenessError as d, ERROR_SCHEMA as f, ROLES_EXTENSION as g, PATCH_SCHEMA as h, postgresDirectoryStore as i, APP_DATA_EXTENSION as l, LIST_SCHEMA as m, SCIM_TABLES as n, filterSupported as o, GROUP_SCHEMA as p, SCIM_UNIQUE as r, matchFilter as s, SCIM_SCHEMA as t, DirectoryNotFoundError as u, USER_SCHEMA as v, isDirectoryNotFoundError as y };