permdock 0.6.0 → 0.8.0

package/dist/{scim-ClHtpyV3.js → scim-jJBJ7g1Z.js}

@@ -1,12 +1,12 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { n as sha256, r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { d as membershipEvent, f as memoryDecisionSink } from "./sink-BEZSlMS_.js";
-import { n as readBodyText, t as MAX_BODY_BYTES } from "./body-text-QcXok_SI.js";
-import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { n as sha256, r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { d as membershipEvent, f as memoryDecisionSink } from "./sink-D9_vh372.js";
+import { n as readBodyText, t as MAX_BODY_BYTES } from "./body-text-DQhcmqdY.js";
+import { t as readClaim } from "./claims-map-CKkoAAYF.js";
+import { _ as SCIM_CONTENT_TYPE, b as isDirectoryUniquenessError, c as parseScimFilter, f as ERROR_SCHEMA, g as ROLES_EXTENSION, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "./postgres-store-DcyrPS-r.js";
 //#region src/scim/auth.ts
 function hexToBytes(hex) {
 	if (hex.length % 2 !== 0) return;
@@ -85,43 +85,6 @@ function sha256Hex(value) {
 	return hex;
 }
 //#endregion
-//#region src/scim/types.ts
-const SCIM_CONTENT_TYPE = "application/scim+json";
-const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
-const GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
-const LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
-const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
-const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
-/** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
-const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
-const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
-var DirectoryUniquenessError = class extends Error {
-	name = "DirectoryUniquenessError";
-	code = "uniqueness";
-	constructor(message = "uniqueness") {
-		super(message);
-	}
-};
-var DirectoryNotFoundError = class extends Error {
-	name = "DirectoryNotFoundError";
-	code = "not-found";
-	constructor(message = "not found") {
-		super(message);
-	}
-};
-function isNamedError(error, name, code) {
-	return error instanceof Error && error.name === name && Reflect.get(error, "code") === code;
-}
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
-function isDirectoryUniquenessError(error) {
-	return isNamedError(error, "DirectoryUniquenessError", "uniqueness");
-}
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
-function isDirectoryNotFoundError(error) {
-	return isNamedError(error, "DirectoryNotFoundError", "not-found");
-}
-//#endregion
 //#region src/scim/discovery.ts
 const SCHEMA_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Schema";
 function serviceProviderConfig() {
@@ -240,240 +203,11 @@ function schemas() {
 	];
 }
 //#endregion
-//#region src/scim/filter.ts
-const COMPARE = /* @__PURE__ */ new Set([
-	"eq",
-	"ne",
-	"co",
-	"sw"
-]);
-function skipSpace(input, index) {
-	let cursor = index;
-	while (cursor < input.length && input[cursor] === " ") cursor += 1;
-	return cursor;
-}
-function readIdent(input, index) {
-	const start = skipSpace(input, index);
-	if (!/[A-Za-z]/u.test(input[start] ?? "")) return;
-	let cursor = start;
-	while (cursor < input.length && /[A-Za-z0-9._]/u.test(input[cursor] ?? "")) cursor += 1;
-	return {
-		value: input.slice(start, cursor),
-		next: cursor
-	};
-}
-function readString(input, index) {
-	const start = skipSpace(input, index);
-	if (input[start] !== "\"") return;
-	let cursor = start + 1;
-	let value = "";
-	while (cursor < input.length) {
-		const char = input[cursor];
-		if (char === "\\") {
-			value += input[cursor + 1] ?? "";
-			cursor += 2;
-			continue;
-		}
-		if (char === "\"") return {
-			value,
-			next: cursor + 1
-		};
-		value += char;
-		cursor += 1;
-	}
-}
-function readLiteral(input, index) {
-	const quoted = readString(input, index);
-	if (quoted !== void 0) return quoted;
-	const ident = readIdent(input, index);
-	if (ident === void 0) return;
-	if (ident.value.toLowerCase() === "true") return {
-		value: true,
-		next: ident.next
-	};
-	if (ident.value.toLowerCase() === "false") return {
-		value: false,
-		next: ident.next
-	};
-	return {
-		value: ident.value,
-		next: ident.next
-	};
-}
-function parsePrimary(input, index) {
-	const start = skipSpace(input, index);
-	if (input[start] === "(") {
-		const inner = parseOr(input, start + 1);
-		if (inner === void 0) return;
-		const close = skipSpace(input, inner.next);
-		if (input[close] !== ")") return;
-		return {
-			filter: inner.filter,
-			next: close + 1
-		};
-	}
-	const attribute = readIdent(input, start);
-	if (attribute === void 0) return;
-	const opToken = readIdent(input, attribute.next);
-	if (opToken === void 0) return;
-	const op = opToken.value.toLowerCase();
-	if (op === "pr") return {
-		filter: {
-			op: "pr",
-			attribute: attribute.value
-		},
-		next: opToken.next
-	};
-	if (!COMPARE.has(op)) return;
-	const value = readLiteral(input, opToken.next);
-	if (value === void 0) return;
-	return {
-		filter: {
-			op,
-			attribute: attribute.value,
-			value: value.value
-		},
-		next: value.next
-	};
-}
-function parseAnd(input, index) {
-	const first = parsePrimary(input, index);
-	if (first === void 0) return;
-	const filters = [first.filter];
-	let cursor = first.next;
-	for (;;) {
-		const nextOp = readIdent(input, cursor);
-		if (nextOp?.value.toLowerCase() !== "and") break;
-		const next = parsePrimary(input, nextOp.next);
-		if (next === void 0) return;
-		filters.push(next.filter);
-		cursor = next.next;
-	}
-	if (filters.length === 1) return {
-		filter: first.filter,
-		next: cursor
-	};
-	return {
-		filter: {
-			op: "and",
-			filters
-		},
-		next: cursor
-	};
-}
-function parseOr(input, index) {
-	const first = parseAnd(input, index);
-	if (first === void 0) return;
-	const filters = [first.filter];
-	let cursor = first.next;
-	for (;;) {
-		const nextOp = readIdent(input, cursor);
-		if (nextOp?.value.toLowerCase() !== "or") break;
-		const next = parseAnd(input, nextOp.next);
-		if (next === void 0) return;
-		filters.push(next.filter);
-		cursor = next.next;
-	}
-	if (filters.length === 1) return {
-		filter: first.filter,
-		next: cursor
-	};
-	return {
-		filter: {
-			op: "or",
-			filters
-		},
-		next: cursor
-	};
-}
-function parseScimFilter(input) {
-	const trimmed = input.trim();
-	if (trimmed === "") return;
-	const parsed = parseOr(trimmed, 0);
-	if (parsed === void 0) return;
-	if (skipSpace(trimmed, parsed.next) !== trimmed.length) return;
-	return parsed.filter;
-}
-function readAttribute(target, attribute) {
-	if (attribute === "members.value") {
-		const members = target["members"];
-		if (!Array.isArray(members)) return;
-		return members.map((member) => {
-			if (member !== null && typeof member === "object" && "value" in member) return member.value;
-		});
-	}
-	const parts = attribute.split(".");
-	let current = target;
-	for (const part of parts) {
-		if (current === null || typeof current !== "object") return;
-		current = current[part];
-	}
-	return current;
-}
-function asString(value) {
-	if (typeof value === "boolean") return value ? "true" : "false";
-	return String(value);
-}
-function matchCompare(actual, op, expected) {
-	if (Array.isArray(actual)) return actual.some((item) => matchCompare(item, op, expected));
-	if (actual === void 0 || actual === null) return op === "ne";
-	if (typeof expected === "boolean" || typeof actual === "boolean") {
-		const left = asString(actual).toLowerCase();
-		const right = asString(expected).toLowerCase();
-		return op === "eq" ? left === right : op === "ne" ? left !== right : false;
-	}
-	const left = asString(actual);
-	const right = asString(expected);
-	switch (op) {
-		case "eq": return left === right;
-		case "ne": return left !== right;
-		case "co": return left.includes(right);
-		case "sw": return left.startsWith(right);
-		default: return op;
-	}
-}
-/** RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an item. */
-function present(value) {
-	if (Array.isArray(value)) return value.some(present);
-	return value !== void 0 && value !== null && value !== "";
-}
-function matchFilter(target, filter) {
-	if (filter === void 0) return true;
-	const record = target;
-	switch (filter.op) {
-		case "and": return filter.filters.every((item) => matchFilter(target, item));
-		case "or": return filter.filters.some((item) => matchFilter(target, item));
-		case "pr": return present(readAttribute(record, filter.attribute));
-		case "eq":
-		case "ne":
-		case "co":
-		case "sw": return matchCompare(readAttribute(record, filter.attribute), filter.op, filter.value);
-		default: return filter;
-	}
-}
-const SUPPORTED_FILTER_ATTRIBUTES = /* @__PURE__ */ new Set([
-	"id",
-	"userName",
-	"externalId",
-	"active",
-	"displayName",
-	"members.value"
-]);
-function filterSupported(filter) {
-	switch (filter.op) {
-		case "and":
-		case "or": return filter.filters.every(filterSupported);
-		case "pr":
-		case "eq":
-		case "ne":
-		case "co":
-		case "sw": return SUPPORTED_FILTER_ATTRIBUTES.has(filter.attribute);
-		default: return filter;
-	}
-}
-//#endregion
 //#region src/scim/body.ts
-/** The parsed body; `undefined` for an empty or unreadable one. Invalid JSON throws a `SyntaxError`. */
+/**
+* The parsed body; `undefined` for an empty or unreadable one. Invalid JSON
+* throws a `SyntaxError`.
+*/
 async function readJson(request) {
 	const read = await readBodyText(request);
 	if (!read.ok) return read.cause === "too-large" ? { tooLarge: true } : {
@@ -499,7 +233,10 @@ function readRoles(body) {
 	if (!isRecord(extension) || !Array.isArray(extension["roles"])) return;
 	return extension["roles"].filter((item) => typeof item === "string");
 }
-/** `x` from the `AppData` extension; a value that is not a plain JSON object is dropped. */
+/**
+* `x` from the `AppData` extension; a value that is not a plain JSON object is
+* dropped.
+*/
 function readX(body) {
 	const extension = body[APP_DATA_EXTENSION];
 	return isRecord(extension) && extension["x"] !== void 0 ? readAppData(void 0, extension["x"]) : void 0;
@@ -782,7 +519,10 @@ function scimResponse(status, body, extra) {
 		}
 	});
 }
-/** RFC 7644 section 3.12: `scimType` is defined for `400` and `409` only, so other statuses omit it. */
+/**
+* RFC 7644 section 3.12: `scimType` is defined for `400` and `409` only, so
+* other statuses omit it.
+*/
 function scimError(status, scimType, detail, extra) {
 	return scimResponse(status, compact({
 		schemas: [ERROR_SCHEMA],
@@ -798,8 +538,8 @@ function forbidden() {
 	return scimError(403, "", "the credential may not provision this tenant", { "www-authenticate": "Bearer error=\"insufficient_scope\"" });
 }
 /**
-* RFC 7644 section 3.14 `meta.version`: a weak entity tag over the
-* resource as rendered, `meta.location` excluded so every URL agrees.
+* RFC 7644 section 3.14 `meta.version`: a weak entity tag over the resource as
+* rendered, `meta.location` excluded so every URL agrees.
 */
 function withVersion(resource, meta) {
 	const { location: _location, ...stable } = meta;
@@ -823,14 +563,20 @@ function versionOf(rendered) {
 function entityTags(field) {
 	return field.split(",").map((tag) => tag.trim().replace(/^W\//u, "")).filter((tag) => tag !== "");
 }
-/** RFC 9110 section 13.1.1 `If-Match` against a weak `meta.version`: `true` when the request may proceed. */
+/**
+* RFC 9110 section 13.1.1 `If-Match` against a weak `meta.version`: `true` when
+* the request may proceed.
+*/
 function ifMatchHolds(request, version) {
 	const field = request.headers.get("if-match");
 	if (field === null) return true;
 	const tags = entityTags(field);
 	return tags.includes("*") || tags.includes(version.replace(/^W\//u, ""));
 }
-/** RFC 9110 section 13.1.2 `If-None-Match`: `true` when the client holds `version`. */
+/**
+* RFC 9110 section 13.1.2 `If-None-Match`: `true` when the client holds
+* `version`.
+*/
 function ifNoneMatchHolds(request, version) {
 	const field = request.headers.get("if-none-match");
 	if (field === null) return false;
@@ -989,7 +735,10 @@ function resourceResponse(status, rendered, location) {
 function renderedOf(request, resource) {
 	return "userName" in resource ? renderUser(resource, locationOf(request, "Users", resource.id)) : renderGroup(resource, locationOf(request, "Groups", resource.id));
 }
-/** `false` when `If-Match` names a version other than `current`'s; a missing resource passes to the store. */
+/**
+* `false` when `If-Match` names a version other than `current`'s; a missing
+* resource passes to the store.
+*/
 function matches(request, current) {
 	return current === null || ifMatchHolds(request, versionOf(renderedOf(request, current)));
 }
@@ -1303,269 +1052,4 @@ function directoryMembershipSource(store, options = {}) {
 	} };
 }
 //#endregion
-//#region src/scim/store.ts
-const DEFAULT_COUNT = 100;
-function now() {
-	return isoNow();
-}
-function createdAt(at, ...candidates) {
-	return candidates.find((value) => value !== void 0 && value !== "") ?? at;
-}
-function randomId(prefix) {
-	const bytes = /* @__PURE__ */ new Uint8Array(8);
-	crypto.getRandomValues(bytes);
-	let hex = "";
-	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-	return `${prefix}${hex}`;
-}
-function directoryKey(tenant, id) {
-	return `${tenant}\0${id}`;
-}
-function asError(error) {
-	return error instanceof Error ? error : new Error(String(error));
-}
-function pageOf(items, page) {
-	const count = page.count ?? DEFAULT_COUNT;
-	let start = 0;
-	if (page.cursor !== void 0 && page.cursor !== "") {
-		const decoded = Math.trunc(Number(page.cursor));
-		start = Number.isFinite(decoded) && decoded > 0 ? decoded : 0;
-	} else if (page.startIndex !== void 0 && page.startIndex > 0) start = page.startIndex - 1;
-	const slice = items.slice(start, start + count);
-	const nextIndex = start + slice.length;
-	return compact({
-		Resources: slice,
-		totalResults: items.length,
-		startIndex: start + 1,
-		itemsPerPage: slice.length,
-		nextCursor: nextIndex < items.length ? String(nextIndex) : void 0
-	});
-}
-function emailsOf(value) {
-	if (!Array.isArray(value)) return;
-	return value.flatMap((item) => {
-		if (item === null || typeof item !== "object") return [];
-		const record = item;
-		if (typeof record.value !== "string") return [];
-		return [compact({
-			value: record.value,
-			primary: typeof record.primary === "boolean" ? record.primary : void 0,
-			type: typeof record.type === "string" ? record.type : void 0
-		})];
-	});
-}
-function membersOf(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((item) => {
-		if (item === null || typeof item !== "object") return [];
-		const record = item;
-		return typeof record.value === "string" ? [{ value: record.value }] : [];
-	});
-}
-function rolesOf(value) {
-	if (!Array.isArray(value)) return;
-	return value.filter((item) => typeof item === "string");
-}
-function memberValues(value) {
-	return membersOf(value).map((member) => member.value);
-}
-function applyUserOp(user, op) {
-	const path = op.path ?? "";
-	if (path === "active" && typeof op.value === "boolean") return {
-		...user,
-		active: op.value
-	};
-	if (path === "userName" && typeof op.value === "string") return {
-		...user,
-		userName: op.value
-	};
-	if (path === "externalId") return compact({
-		...user,
-		externalId: typeof op.value === "string" ? op.value : void 0
-	});
-	if (path === "emails") return compact({
-		...user,
-		emails: emailsOf(op.value)
-	});
-	return user;
-}
-function applyGroupOp(group, op) {
-	const path = op.path ?? "";
-	if (path === "displayName" && typeof op.value === "string") return {
-		...group,
-		displayName: op.value
-	};
-	if (path === "externalId") return compact({
-		...group,
-		externalId: typeof op.value === "string" ? op.value : void 0
-	});
-	if (path === "roles") return compact({
-		...group,
-		roles: rolesOf(op.value)
-	});
-	if (path !== "members") return group;
-	const incoming = memberValues(op.value);
-	const current = group.members.map((member) => member.value);
-	if (op.op === "replace") return {
-		...group,
-		members: incoming.map((value) => ({ value }))
-	};
-	if (op.op === "add") {
-		const next = [...current];
-		for (const value of incoming) if (!next.includes(value)) next.push(value);
-		return {
-			...group,
-			members: next.map((value) => ({ value }))
-		};
-	}
-	return {
-		...group,
-		members: current.filter((value) => !incoming.includes(value)).map((value) => ({ value }))
-	};
-}
-function stampUser(user, created) {
-	const at = now();
-	return freezeDeep({
-		...user,
-		meta: compact({
-			created: createdAt(at, created, user.meta.created),
-			lastModified: at,
-			resourceType: "User",
-			location: user.meta.location
-		})
-	});
-}
-function stampGroup(group, created) {
-	const at = now();
-	return freezeDeep({
-		...group,
-		meta: compact({
-			created: createdAt(at, created, group.meta.created),
-			lastModified: at,
-			resourceType: "Group",
-			location: group.meta.location
-		})
-	});
-}
-function memoryDirectoryStore() {
-	const users = /* @__PURE__ */ new Map();
-	const groups = /* @__PURE__ */ new Map();
-	function usersIn(tenant) {
-		const found = [];
-		for (const [key, user] of users) if (key.startsWith(`${tenant}\0`)) found.push(user);
-		return found;
-	}
-	function groupsIn(tenant) {
-		const found = [];
-		for (const [key, group] of groups) if (key.startsWith(`${tenant}\0`)) found.push(group);
-		return found;
-	}
-	function assertUserUnique(tenant, user, ignoreId) {
-		for (const existing of usersIn(tenant)) {
-			if (existing.id === ignoreId) continue;
-			if (existing.userName === user.userName) throw new DirectoryUniquenessError("userName");
-			if (user.externalId !== void 0 && existing.externalId === user.externalId) throw new DirectoryUniquenessError("externalId");
-		}
-	}
-	function assertGroupUnique(tenant, group, ignoreId) {
-		for (const existing of groupsIn(tenant)) {
-			if (existing.id === ignoreId) continue;
-			if (group.externalId !== void 0 && existing.externalId === group.externalId) throw new DirectoryUniquenessError("externalId");
-		}
-	}
-	return {
-		getUser(tenant, id) {
-			return Promise.resolve(users.get(directoryKey(tenant, id)) ?? null);
-		},
-		findUsers(tenant, filter, page) {
-			const matched = usersIn(tenant).filter((user) => matchFilter(user, filter));
-			return Promise.resolve(pageOf(matched, page));
-		},
-		putUser(tenant, user) {
-			try {
-				const id = user.id === "" ? randomId("u_") : user.id;
-				const existing = users.get(directoryKey(tenant, id));
-				const next = stampUser({
-					...user,
-					id
-				}, existing?.meta.created);
-				assertUserUnique(tenant, next, id);
-				users.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		patchUser(tenant, id, ops) {
-			try {
-				const existing = users.get(directoryKey(tenant, id));
-				if (existing === void 0) throw new DirectoryNotFoundError();
-				let next = existing;
-				for (const op of ops) next = applyUserOp(next, op);
-				next = stampUser(next, existing.meta.created);
-				assertUserUnique(tenant, next, id);
-				users.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		deleteUser(tenant, id) {
-			if (!users.delete(directoryKey(tenant, id))) return Promise.reject(new DirectoryNotFoundError());
-			for (const group of groupsIn(tenant)) {
-				if (!group.members.some((member) => member.value === id)) continue;
-				groups.set(directoryKey(tenant, group.id), stampGroup({
-					...group,
-					members: group.members.filter((member) => member.value !== id)
-				}, group.meta.created));
-			}
-			return Promise.resolve();
-		},
-		getGroup(tenant, id) {
-			return Promise.resolve(groups.get(directoryKey(tenant, id)) ?? null);
-		},
-		findGroups(tenant, filter, page) {
-			const matched = groupsIn(tenant).filter((group) => matchFilter(group, filter));
-			return Promise.resolve(pageOf(matched, page));
-		},
-		putGroup(tenant, group) {
-			try {
-				const id = group.id === "" ? randomId("g_") : group.id;
-				const existing = groups.get(directoryKey(tenant, id));
-				const next = stampGroup({
-					...group,
-					id,
-					members: group.members
-				}, existing?.meta.created);
-				assertGroupUnique(tenant, next, id);
-				groups.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		patchGroup(tenant, id, ops) {
-			try {
-				const existing = groups.get(directoryKey(tenant, id));
-				if (existing === void 0) throw new DirectoryNotFoundError();
-				let next = existing;
-				for (const op of ops) next = applyGroupOp(next, op);
-				next = stampGroup(next, existing.meta.created);
-				assertGroupUnique(tenant, next, id);
-				groups.set(directoryKey(tenant, id), next);
-				return Promise.resolve(next);
-			} catch (error) {
-				return Promise.reject(asError(error));
-			}
-		},
-		deleteGroup(tenant, id) {
-			if (!groups.delete(directoryKey(tenant, id))) return Promise.reject(new DirectoryNotFoundError());
-			return Promise.resolve();
-		},
-		groupsFor(tenant, userId) {
-			return Promise.resolve(groupsIn(tenant).filter((group) => group.members.some((member) => member.value === userId)));
-		}
-	};
-}
-//#endregion
-export { isDirectoryUniquenessError as C, isDirectoryNotFoundError as S, sha256Hex as T, LIST_SCHEMA as _, normalizePatchOps as a, SCIM_CONTENT_TYPE as b, parseScimFilter as c, serviceProviderConfig as d, APP_DATA_EXTENSION as f, GROUP_SCHEMA as g, ERROR_SCHEMA as h, tenantFromPath as i, resourceTypes as l, DirectoryUniquenessError as m, directoryMembershipSource as n, filterSupported as o, DirectoryNotFoundError as p, scimHandler as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, PATCH_SCHEMA as v, authenticateScim as w, USER_SCHEMA as x, ROLES_EXTENSION as y };
+export { resourceTypes as a, authenticateScim as c, normalizePatchOps as i, sha256Hex as l, scimHandler as n, schemas as o, tenantFromPath as r, serviceProviderConfig as s, directoryMembershipSource as t };