'use strict';

var zod = require('zod');

// src/identity/identity.zod.ts
var UserSchema = zod.z.object({
  /**
   * Unique user identifier
   */
  id: zod.z.string().describe("Unique user identifier"),
  /**
   * User's email address (primary identifier)
   */
  email: zod.z.string().email().describe("User email address"),
  /**
   * Email verification status
   */
  emailVerified: zod.z.boolean().default(false).describe("Whether email is verified"),
  /**
   * User's display name
   */
  name: zod.z.string().optional().describe("User display name"),
  /**
   * User's profile image URL
   */
  image: zod.z.string().url().optional().describe("Profile image URL"),
  /**
   * Account creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Account creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp")
});
var AccountSchema = zod.z.object({
  /**
   * Unique account identifier
   */
  id: zod.z.string().describe("Unique account identifier"),
  /**
   * Associated user ID
   */
  userId: zod.z.string().describe("Associated user ID"),
  /**
   * Account type/provider
   */
  type: zod.z.enum([
    "oauth",
    "oidc",
    "email",
    "credentials",
    "saml",
    "ldap"
  ]).describe("Account type"),
  /**
   * Provider name (e.g., 'google', 'github', 'okta')
   */
  provider: zod.z.string().describe("Provider name"),
  /**
   * Provider account ID
   */
  providerAccountId: zod.z.string().describe("Provider account ID"),
  /**
   * OAuth refresh token
   */
  refreshToken: zod.z.string().optional().describe("OAuth refresh token"),
  /**
   * OAuth access token
   */
  accessToken: zod.z.string().optional().describe("OAuth access token"),
  /**
   * Token expiry timestamp
   */
  expiresAt: zod.z.number().optional().describe("Token expiry timestamp (Unix)"),
  /**
   * OAuth token type
   */
  tokenType: zod.z.string().optional().describe("OAuth token type"),
  /**
   * OAuth scope
   */
  scope: zod.z.string().optional().describe("OAuth scope"),
  /**
   * OAuth ID token
   */
  idToken: zod.z.string().optional().describe("OAuth ID token"),
  /**
   * Session state
   */
  sessionState: zod.z.string().optional().describe("Session state"),
  /**
   * Account creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Account creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp")
});
var SessionSchema = zod.z.object({
  /**
   * Unique session identifier
   */
  id: zod.z.string().describe("Unique session identifier"),
  /**
   * Session token
   */
  sessionToken: zod.z.string().describe("Session token"),
  /**
   * Associated user ID
   */
  userId: zod.z.string().describe("Associated user ID"),
  /**
   * Active organization ID for this session
   * Used for context switching in multi-tenant applications
   */
  activeOrganizationId: zod.z.string().optional().describe("Active organization ID for context switching"),
  /**
   * Session expiry timestamp
   */
  expires: zod.z.string().datetime().describe("Session expiry timestamp"),
  /**
   * Session creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Session creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp"),
  /**
   * IP address of the session
   */
  ipAddress: zod.z.string().optional().describe("IP address"),
  /**
   * User agent string
   */
  userAgent: zod.z.string().optional().describe("User agent string"),
  /**
   * Device fingerprint
   */
  fingerprint: zod.z.string().optional().describe("Device fingerprint")
});
var VerificationTokenSchema = zod.z.object({
  /**
   * Token identifier (email or phone)
   */
  identifier: zod.z.string().describe("Token identifier (email or phone)"),
  /**
   * Verification token
   */
  token: zod.z.string().describe("Verification token"),
  /**
   * Token expiry timestamp
   */
  expires: zod.z.string().datetime().describe("Token expiry timestamp"),
  /**
   * Token creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Token creation timestamp")
});
var ApiKeySchema = zod.z.object({
  /**
   * Unique API key identifier
   */
  id: zod.z.string().describe("API key identifier"),
  /**
   * Human-readable name for the key
   */
  name: zod.z.string().describe("API key display name"),
  /**
   * Key prefix (visible portion for identification, e.g., "os_pk_ab")
   */
  start: zod.z.string().optional().describe("Key prefix for identification"),
  /**
   * Custom prefix for the key (e.g., "os_pk_")
   */
  prefix: zod.z.string().optional().describe("Custom key prefix"),
  /**
   * User ID of the key owner
   */
  userId: zod.z.string().describe("Owner user ID"),
  /**
   * Organization ID the key is scoped to (optional)
   */
  organizationId: zod.z.string().optional().describe("Scoped organization ID"),
  /**
   * Key expiration timestamp (null = never expires)
   */
  expiresAt: zod.z.string().datetime().optional().describe("Expiration timestamp"),
  /**
   * Creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp"),
  /**
   * Last used timestamp
   */
  lastUsedAt: zod.z.string().datetime().optional().describe("Last used timestamp"),
  /**
   * Last refetch timestamp (for cached permission checks)
   */
  lastRefetchAt: zod.z.string().datetime().optional().describe("Last refetch timestamp"),
  /**
   * Whether this key is enabled
   */
  enabled: zod.z.boolean().default(true).describe("Whether the key is active"),
  /**
   * Rate limiting: enabled flag
   */
  rateLimitEnabled: zod.z.boolean().optional().describe("Whether rate limiting is enabled"),
  /**
   * Rate limiting: time window in milliseconds
   */
  rateLimitTimeWindow: zod.z.number().int().min(0).optional().describe("Rate limit window (ms)"),
  /**
   * Rate limiting: max requests per window
   */
  rateLimitMax: zod.z.number().int().min(0).optional().describe("Max requests per window"),
  /**
   * Rate limiting: remaining requests in current window
   */
  remaining: zod.z.number().int().min(0).optional().describe("Remaining requests"),
  /**
   * Permissions assigned to this key (granular access control)
   */
  permissions: zod.z.record(zod.z.string(), zod.z.boolean()).optional().describe("Granular permission flags"),
  /**
   * Scopes assigned to this key (high-level access categories)
   */
  scopes: zod.z.array(zod.z.string()).optional().describe("High-level access scopes"),
  /**
   * Custom metadata
   */
  metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Custom metadata")
});

// src/identity/protocol.ts
var AUTH_CONSTANTS = {
  /**
   * HTTP header key for authentication tokens
   */
  HEADER_KEY: "Authorization",
  /**
   * Token prefix for Bearer authentication
   */
  TOKEN_PREFIX: "Bearer ",
  /**
   * Cookie prefix for ObjectStack auth cookies
   */
  COOKIE_PREFIX: "os_",
  /**
   * CSRF token header name
   */
  CSRF_HEADER: "x-os-csrf-token",
  /**
   * Default session cookie name
   */
  SESSION_COOKIE: "os_session_token",
  /**
   * Default CSRF cookie name
   */
  CSRF_COOKIE: "os_csrf_token",
  /**
   * Refresh token cookie name
   */
  REFRESH_TOKEN_COOKIE: "os_refresh_token"
};
var AUTH_ERROR_CODES = {
  INVALID_CREDENTIALS: "invalid_credentials",
  INVALID_TOKEN: "invalid_token",
  TOKEN_EXPIRED: "token_expired",
  INSUFFICIENT_PERMISSIONS: "insufficient_permissions",
  ACCOUNT_LOCKED: "account_locked",
  ACCOUNT_NOT_VERIFIED: "account_not_verified",
  TOO_MANY_REQUESTS: "too_many_requests",
  INVALID_CSRF_TOKEN: "invalid_csrf_token",
  SESSION_EXPIRED: "session_expired",
  OAUTH_ERROR: "oauth_error",
  PROVIDER_ERROR: "provider_error"
};
zod.z.string().min(2, { message: "System identifier must be at least 2 characters" }).regex(/^[a-z][a-z0-9_.]*$/, {
  message: 'System identifier must be lowercase, starting with a letter, and may contain letters, numbers, underscores, or dots (e.g., "user_profile" or "order.created")'
}).describe("System identifier (lowercase with underscores or dots)");
var SnakeCaseIdentifierSchema = zod.z.string().min(2, { message: "Identifier must be at least 2 characters" }).regex(/^[a-z][a-z0-9_]*$/, {
  message: 'Identifier must be lowercase snake_case, starting with a letter, and may contain only letters, numbers, and underscores (e.g., "user_profile")'
}).describe("Snake case identifier (lowercase with underscores only)");
zod.z.string().min(3, { message: "Event name must be at least 3 characters" }).regex(/^[a-z][a-z0-9_.]*$/, {
  message: 'Event name must be lowercase with dots for namespacing (e.g., "user.created", "order.paid")'
}).describe("Event name (lowercase with dot notation for namespacing)");

// src/identity/role.zod.ts
var RoleSchema = zod.z.object({
  /** Identity */
  name: SnakeCaseIdentifierSchema.describe("Unique role name (lowercase snake_case)"),
  label: zod.z.string().describe("Display label (e.g. VP of Sales)"),
  /** Hierarchy */
  parent: zod.z.string().optional().describe("Parent Role ID (Reports To)"),
  /** Description */
  description: zod.z.string().optional()
});
var OrganizationSchema = zod.z.object({
  /**
   * Unique organization identifier
   */
  id: zod.z.string().describe("Unique organization identifier"),
  /**
   * Organization name (display name)
   */
  name: zod.z.string().describe("Organization display name"),
  /**
   * Organization slug (URL-friendly identifier)
   * Must be unique across all organizations
   */
  slug: zod.z.string().regex(/^[a-z0-9_-]+$/).describe("Unique URL-friendly slug (lowercase alphanumeric, hyphens, underscores)"),
  /**
   * Organization logo URL
   */
  logo: zod.z.string().url().optional().describe("Organization logo URL"),
  /**
   * Custom metadata for the organization
   * Can store additional configuration, settings, or custom fields
   */
  metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Custom metadata"),
  /**
   * Organization creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Organization creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp")
});
var MemberSchema = zod.z.object({
  /**
   * Unique member identifier
   */
  id: zod.z.string().describe("Unique member identifier"),
  /**
   * Organization ID this membership belongs to
   */
  organizationId: zod.z.string().describe("Organization ID"),
  /**
   * User ID of the member
   */
  userId: zod.z.string().describe("User ID"),
  /**
   * Member's role within the organization
   * Common roles: 'owner', 'admin', 'member', 'guest'
   * Can be customized per application
   */
  role: zod.z.string().describe("Member role (e.g., owner, admin, member, guest)"),
  /**
   * Member creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Member creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp")
});
var InvitationStatus = zod.z.enum(["pending", "accepted", "rejected", "expired"]);
var InvitationSchema = zod.z.object({
  /**
   * Unique invitation identifier
   */
  id: zod.z.string().describe("Unique invitation identifier"),
  /**
   * Organization ID the invitation is for
   */
  organizationId: zod.z.string().describe("Organization ID"),
  /**
   * Email address of the invitee
   */
  email: zod.z.string().email().describe("Invitee email address"),
  /**
   * Role the invitee will receive upon accepting
   * Common roles: 'admin', 'member', 'guest'
   */
  role: zod.z.string().describe("Role to assign upon acceptance"),
  /**
   * Invitation status
   */
  status: InvitationStatus.default("pending").describe("Invitation status"),
  /**
   * Invitation expiration timestamp
   */
  expiresAt: zod.z.string().datetime().describe("Invitation expiry timestamp"),
  /**
   * User ID of the person who sent the invitation
   */
  inviterId: zod.z.string().describe("User ID of the inviter"),
  /**
   * Invitation creation timestamp
   */
  createdAt: zod.z.string().datetime().describe("Invitation creation timestamp"),
  /**
   * Last update timestamp
   */
  updatedAt: zod.z.string().datetime().describe("Last update timestamp")
});
var SCIM_SCHEMAS = {
  USER: "urn:ietf:params:scim:schemas:core:2.0:User",
  GROUP: "urn:ietf:params:scim:schemas:core:2.0:Group",
  ENTERPRISE_USER: "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
  RESOURCE_TYPE: "urn:ietf:params:scim:schemas:core:2.0:ResourceType",
  SERVICE_PROVIDER_CONFIG: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",
  SCHEMA: "urn:ietf:params:scim:schemas:core:2.0:Schema",
  LIST_RESPONSE: "urn:ietf:params:scim:api:messages:2.0:ListResponse",
  PATCH_OP: "urn:ietf:params:scim:api:messages:2.0:PatchOp",
  BULK_REQUEST: "urn:ietf:params:scim:api:messages:2.0:BulkRequest",
  BULK_RESPONSE: "urn:ietf:params:scim:api:messages:2.0:BulkResponse",
  ERROR: "urn:ietf:params:scim:api:messages:2.0:Error"
};
var SCIMMetaSchema = zod.z.object({
  /**
   * Resource type name
   * @example "User", "Group"
   */
  resourceType: zod.z.string().optional().describe("Resource type"),
  /**
   * Resource creation timestamp (ISO 8601)
   */
  created: zod.z.string().datetime().optional().describe("Creation timestamp"),
  /**
   * Last modification timestamp (ISO 8601)
   */
  lastModified: zod.z.string().datetime().optional().describe("Last modification timestamp"),
  /**
   * Resource location URI
   * Absolute URL to the resource
   */
  location: zod.z.string().url().optional().describe("Resource location URI"),
  /**
   * Entity tag for optimistic concurrency control
   * Used with If-Match header for conditional updates
   */
  version: zod.z.string().optional().describe("Entity tag (ETag) for concurrency control")
});
var SCIMNameSchema = zod.z.object({
  /**
   * Full name formatted for display
   * @example "Ms. Barbara Jane Jensen III"
   */
  formatted: zod.z.string().optional().describe("Formatted full name"),
  /**
   * Family name (surname)
   * @example "Jensen"
   */
  familyName: zod.z.string().optional().describe("Family name (last name)"),
  /**
   * Given name (first name)
   * @example "Barbara"
   */
  givenName: zod.z.string().optional().describe("Given name (first name)"),
  /**
   * Middle name
   * @example "Jane"
   */
  middleName: zod.z.string().optional().describe("Middle name"),
  /**
   * Honorific prefix
   * @example "Ms.", "Dr.", "Prof."
   */
  honorificPrefix: zod.z.string().optional().describe("Honorific prefix (Mr., Ms., Dr.)"),
  /**
   * Honorific suffix
   * @example "III", "Jr.", "Sr."
   */
  honorificSuffix: zod.z.string().optional().describe("Honorific suffix (Jr., Sr.)")
});
var SCIMEmailSchema = zod.z.object({
  /**
   * Email address value
   */
  value: zod.z.string().email().describe("Email address"),
  /**
   * Email type
   * @example "work", "home", "other"
   */
  type: zod.z.enum(["work", "home", "other"]).optional().describe("Email type"),
  /**
   * Display label for the email
   */
  display: zod.z.string().optional().describe("Display label"),
  /**
   * Whether this is the primary email
   */
  primary: zod.z.boolean().optional().default(false).describe("Primary email indicator")
});
var SCIMPhoneNumberSchema = zod.z.object({
  /**
   * Phone number value
   * Format is not enforced to support international numbers
   */
  value: zod.z.string().describe("Phone number"),
  /**
   * Phone type
   */
  type: zod.z.enum(["work", "home", "mobile", "fax", "pager", "other"]).optional().describe("Phone number type"),
  /**
   * Display label for the phone number
   */
  display: zod.z.string().optional().describe("Display label"),
  /**
   * Whether this is the primary phone
   */
  primary: zod.z.boolean().optional().default(false).describe("Primary phone indicator")
});
var SCIMAddressSchema = zod.z.object({
  /**
   * Full mailing address formatted for display
   */
  formatted: zod.z.string().optional().describe("Formatted address"),
  /**
   * Full street address
   */
  streetAddress: zod.z.string().optional().describe("Street address"),
  /**
   * City or locality
   */
  locality: zod.z.string().optional().describe("City/Locality"),
  /**
   * State or region
   */
  region: zod.z.string().optional().describe("State/Region"),
  /**
   * Zip code or postal code
   */
  postalCode: zod.z.string().optional().describe("Postal code"),
  /**
   * Country
   */
  country: zod.z.string().optional().describe("Country"),
  /**
   * Address type
   */
  type: zod.z.enum(["work", "home", "other"]).optional().describe("Address type"),
  /**
   * Whether this is the primary address
   */
  primary: zod.z.boolean().optional().default(false).describe("Primary address indicator")
});
var SCIMGroupReferenceSchema = zod.z.object({
  /**
   * Group identifier
   */
  value: zod.z.string().describe("Group ID"),
  /**
   * Direct reference to the group resource
   */
  $ref: zod.z.string().url().optional().describe("URI reference to the group"),
  /**
   * Human-readable group name
   */
  display: zod.z.string().optional().describe("Group display name"),
  /**
   * Type of group
   */
  type: zod.z.enum(["direct", "indirect"]).optional().describe("Membership type")
});
var SCIMEnterpriseUserSchema = zod.z.object({
  /**
   * Employee number
   */
  employeeNumber: zod.z.string().optional().describe("Employee number"),
  /**
   * Cost center
   */
  costCenter: zod.z.string().optional().describe("Cost center"),
  /**
   * Organization unit
   */
  organization: zod.z.string().optional().describe("Organization"),
  /**
   * Division
   */
  division: zod.z.string().optional().describe("Division"),
  /**
   * Department
   */
  department: zod.z.string().optional().describe("Department"),
  /**
   * Manager reference
   */
  manager: zod.z.object({
    value: zod.z.string().describe("Manager ID"),
    $ref: zod.z.string().url().optional().describe("Manager URI"),
    displayName: zod.z.string().optional().describe("Manager name")
  }).optional().describe("Manager reference")
});
var SCIMUserSchema = zod.z.object({
  /**
   * SCIM schema URIs
   * Must include at minimum the core User schema URI
   */
  schemas: zod.z.array(zod.z.string()).min(1).refine(
    (schemas) => schemas.includes(SCIM_SCHEMAS.USER),
    "Must include core User schema URI"
  ).default([SCIM_SCHEMAS.USER]).describe("SCIM schema URIs (must include User schema)"),
  /**
   * Unique identifier
   */
  id: zod.z.string().optional().describe("Unique resource identifier"),
  /**
   * External identifier
   * Identifier from the provisioning client
   */
  externalId: zod.z.string().optional().describe("External identifier from client system"),
  /**
   * Unique username
   * REQUIRED for user creation
   */
  userName: zod.z.string().describe("Unique username (REQUIRED)"),
  /**
   * Structured name
   */
  name: SCIMNameSchema.optional().describe("Structured name components"),
  /**
   * Display name
   */
  displayName: zod.z.string().optional().describe("Display name for UI"),
  /**
   * Nickname or casual name
   */
  nickName: zod.z.string().optional().describe("Nickname"),
  /**
   * Profile URL
   */
  profileUrl: zod.z.string().url().optional().describe("Profile page URL"),
  /**
   * Job title
   */
  title: zod.z.string().optional().describe("Job title"),
  /**
   * User type (employee, contractor, etc.)
   */
  userType: zod.z.string().optional().describe("User type (employee, contractor)"),
  /**
   * Preferred language (ISO 639-1)
   */
  preferredLanguage: zod.z.string().optional().describe("Preferred language (ISO 639-1)"),
  /**
   * Locale (e.g., en-US)
   */
  locale: zod.z.string().optional().describe("Locale (e.g., en-US)"),
  /**
   * Timezone (e.g., America/Los_Angeles)
   */
  timezone: zod.z.string().optional().describe("Timezone"),
  /**
   * Account active status
   */
  active: zod.z.boolean().optional().default(true).describe("Account active status"),
  /**
   * Password (write-only, never returned)
   */
  password: zod.z.string().optional().describe("Password (write-only)"),
  /**
   * Email addresses (multi-valued)
   */
  emails: zod.z.array(SCIMEmailSchema).optional().describe("Email addresses"),
  /**
   * Phone numbers (multi-valued)
   */
  phoneNumbers: zod.z.array(SCIMPhoneNumberSchema).optional().describe("Phone numbers"),
  /**
   * Instant messaging addresses
   */
  ims: zod.z.array(zod.z.object({
    value: zod.z.string(),
    type: zod.z.string().optional(),
    primary: zod.z.boolean().optional()
  })).optional().describe("IM addresses"),
  /**
   * Photos (profile pictures)
   */
  photos: zod.z.array(zod.z.object({
    value: zod.z.string().url(),
    type: zod.z.enum(["photo", "thumbnail"]).optional(),
    primary: zod.z.boolean().optional()
  })).optional().describe("Photo URLs"),
  /**
   * Physical addresses
   */
  addresses: zod.z.array(SCIMAddressSchema).optional().describe("Physical addresses"),
  /**
   * Group memberships
   */
  groups: zod.z.array(SCIMGroupReferenceSchema).optional().describe("Group memberships"),
  /**
   * User entitlements
   */
  entitlements: zod.z.array(zod.z.object({
    value: zod.z.string(),
    type: zod.z.string().optional(),
    primary: zod.z.boolean().optional()
  })).optional().describe("Entitlements"),
  /**
   * User roles
   */
  roles: zod.z.array(zod.z.object({
    value: zod.z.string(),
    type: zod.z.string().optional(),
    primary: zod.z.boolean().optional()
  })).optional().describe("Roles"),
  /**
   * X509 certificates
   */
  x509Certificates: zod.z.array(zod.z.object({
    value: zod.z.string(),
    type: zod.z.string().optional(),
    primary: zod.z.boolean().optional()
  })).optional().describe("X509 certificates"),
  /**
   * Resource metadata
   */
  meta: SCIMMetaSchema.optional().describe("Resource metadata"),
  /**
   * Enterprise user extension
   * Only present when enterprise extension is used
   */
  [SCIM_SCHEMAS.ENTERPRISE_USER]: SCIMEnterpriseUserSchema.optional().describe("Enterprise user attributes")
}).superRefine((data, ctx) => {
  const hasEnterpriseExtension = data[SCIM_SCHEMAS.ENTERPRISE_USER] != null;
  if (!hasEnterpriseExtension) {
    return;
  }
  const schemas = data.schemas || [];
  if (!schemas.includes(SCIM_SCHEMAS.ENTERPRISE_USER)) {
    ctx.addIssue({
      code: zod.z.ZodIssueCode.custom,
      path: ["schemas"],
      message: `schemas must include "${SCIM_SCHEMAS.ENTERPRISE_USER}" when enterprise user extension attributes are present`
    });
  }
});
var SCIMMemberReferenceSchema = zod.z.object({
  /**
   * Member identifier
   */
  value: zod.z.string().describe("Member ID"),
  /**
   * Direct reference to the member resource
   */
  $ref: zod.z.string().url().optional().describe("URI reference to the member"),
  /**
   * Member type (User or Group for nested groups)
   */
  type: zod.z.enum(["User", "Group"]).optional().describe("Member type"),
  /**
   * Human-readable member name
   */
  display: zod.z.string().optional().describe("Member display name")
});
var SCIMGroupSchema = zod.z.object({
  /**
   * SCIM schema URIs
   * Must include at minimum the core Group schema URI
   */
  schemas: zod.z.array(zod.z.string()).min(1).refine(
    (schemas) => schemas.includes(SCIM_SCHEMAS.GROUP),
    "Must include core Group schema URI"
  ).default([SCIM_SCHEMAS.GROUP]).describe("SCIM schema URIs (must include Group schema)"),
  /**
   * Unique identifier
   */
  id: zod.z.string().optional().describe("Unique resource identifier"),
  /**
   * External identifier
   */
  externalId: zod.z.string().optional().describe("External identifier from client system"),
  /**
   * Group display name
   * REQUIRED for group creation
   */
  displayName: zod.z.string().describe("Group display name (REQUIRED)"),
  /**
   * Group members
   */
  members: zod.z.array(SCIMMemberReferenceSchema).optional().describe("Group members"),
  /**
   * Resource metadata
   */
  meta: SCIMMetaSchema.optional().describe("Resource metadata")
});
var SCIMListResponseSchema = zod.z.object({
  /**
   * SCIM schema URI
   */
  schemas: zod.z.array(zod.z.string()).min(1).refine(
    (schemas) => schemas.includes(SCIM_SCHEMAS.LIST_RESPONSE),
    { message: `schemas must include ${SCIM_SCHEMAS.LIST_RESPONSE}` }
  ).default([SCIM_SCHEMAS.LIST_RESPONSE]).describe("SCIM schema URIs"),
  /**
   * Total number of results matching the query
   */
  totalResults: zod.z.number().int().min(0).describe("Total results count"),
  /**
   * Resources returned in this response
   * Use SCIMListResponseOf<T> for type-safe responses
   */
  Resources: zod.z.array(zod.z.union([SCIMUserSchema, SCIMGroupSchema, zod.z.record(zod.z.string(), zod.z.unknown())])).describe("Resources array (Users, Groups, or custom resources)"),
  /**
   * 1-based index of the first result
   */
  startIndex: zod.z.number().int().min(1).optional().describe("Start index (1-based)"),
  /**
   * Number of resources per page
   */
  itemsPerPage: zod.z.number().int().min(0).optional().describe("Items per page")
});
var SCIMErrorSchema = zod.z.object({
  /**
   * SCIM schema URI
   */
  schemas: zod.z.array(zod.z.string()).min(1).refine(
    (schemas) => schemas.includes(SCIM_SCHEMAS.ERROR),
    { message: `schemas must include ${SCIM_SCHEMAS.ERROR}` }
  ).default([SCIM_SCHEMAS.ERROR]).describe("SCIM schema URIs"),
  /**
   * HTTP status code
   */
  status: zod.z.number().int().min(400).max(599).describe("HTTP status code"),
  /**
   * SCIM error type
   */
  scimType: zod.z.enum([
    "invalidFilter",
    "tooMany",
    "uniqueness",
    "mutability",
    "invalidSyntax",
    "invalidPath",
    "noTarget",
    "invalidValue",
    "invalidVers",
    "sensitive"
  ]).optional().describe("SCIM error type"),
  /**
   * Human-readable error description
   */
  detail: zod.z.string().optional().describe("Error detail message")
});
var SCIMPatchOperationSchema = zod.z.object({
  /**
   * Operation type
   */
  op: zod.z.enum(["add", "remove", "replace"]).describe("Operation type"),
  /**
   * Attribute path to modify
   */
  path: zod.z.string().optional().describe("Attribute path (optional for add)"),
  /**
   * Value to set
   */
  value: zod.z.unknown().optional().describe("Value to set")
});
var SCIMPatchRequestSchema = zod.z.object({
  /**
   * SCIM schema URI
   */
  schemas: zod.z.array(zod.z.string()).min(1).refine(
    (schemas) => schemas.includes(SCIM_SCHEMAS.PATCH_OP),
    { message: "SCIM PATCH requests must include the PatchOp schema URI" }
  ).default([SCIM_SCHEMAS.PATCH_OP]).describe("SCIM schema URIs"),
  /**
   * Array of patch operations
   */
  Operations: zod.z.array(SCIMPatchOperationSchema).min(1).describe("Patch operations")
});
var SCIM = {
  /**
   * Create a basic SCIM user
   */
  user: (userName, email, givenName, familyName) => ({
    schemas: [SCIM_SCHEMAS.USER],
    userName,
    emails: [{ value: email, type: "work", primary: true }],
    name: {
      givenName,
      familyName
    },
    active: true
  }),
  /**
   * Create a SCIM group
   */
  group: (displayName, members) => ({
    schemas: [SCIM_SCHEMAS.GROUP],
    displayName,
    members: members || []
  }),
  /**
   * Create a list response
   */
  listResponse: (resources, totalResults) => ({
    schemas: [SCIM_SCHEMAS.LIST_RESPONSE],
    totalResults: totalResults ?? resources.length,
    Resources: resources,
    startIndex: 1,
    itemsPerPage: resources.length
  }),
  /**
   * Create an error response
   */
  error: (status, detail, scimType) => ({
    schemas: [SCIM_SCHEMAS.ERROR],
    status,
    detail,
    scimType
  })
};
var SCIMBulkOperationSchema = zod.z.object({
  /** HTTP method for this operation */
  method: zod.z.enum(["POST", "PUT", "PATCH", "DELETE"]).describe("HTTP method for the bulk operation"),
  /** Resource path (e.g. /Users, /Groups/{id}) */
  path: zod.z.string().describe("Resource endpoint path (e.g. /Users, /Groups/{id})"),
  /** Client-assigned identifier for cross-referencing operations */
  bulkId: zod.z.string().optional().describe("Client-assigned ID for cross-referencing between operations"),
  /** Request body for POST/PUT/PATCH operations */
  data: zod.z.record(zod.z.string(), zod.z.unknown()).optional().describe("Request body for POST/PUT/PATCH operations"),
  /** ETag value for optimistic concurrency control */
  version: zod.z.string().optional().describe("ETag for optimistic concurrency control")
});
var SCIMBulkRequestSchema = zod.z.object({
  /** SCIM schema URI for bulk request */
  schemas: zod.z.array(zod.z.literal(SCIM_SCHEMAS.BULK_REQUEST)).default([SCIM_SCHEMAS.BULK_REQUEST]).describe("SCIM schema URIs (BulkRequest)"),
  /** Array of operations to execute */
  operations: zod.z.array(SCIMBulkOperationSchema).min(1).describe("Bulk operations to execute (minimum 1)"),
  /** Stop processing after N errors */
  failOnErrors: zod.z.number().int().optional().describe("Stop processing after this many errors")
});
var SCIMBulkResponseOperationSchema = zod.z.object({
  /** HTTP method that was executed */
  method: zod.z.enum(["POST", "PUT", "PATCH", "DELETE"]).describe("HTTP method that was executed"),
  /** Client-assigned bulk operation ID */
  bulkId: zod.z.string().optional().describe("Client-assigned bulk operation ID"),
  /** URL of the created/modified resource */
  location: zod.z.string().optional().describe("URL of the created or modified resource"),
  /** HTTP status code as string */
  status: zod.z.string().describe('HTTP status code as string (e.g. "201", "400")'),
  /** Response body, typically present for errors */
  response: zod.z.unknown().optional().describe("Response body (typically present for errors)")
});
var SCIMBulkResponseSchema = zod.z.object({
  /** SCIM schema URI for bulk response */
  schemas: zod.z.array(zod.z.literal(SCIM_SCHEMAS.BULK_RESPONSE)).default([SCIM_SCHEMAS.BULK_RESPONSE]).describe("SCIM schema URIs (BulkResponse)"),
  /** Array of operation results */
  operations: zod.z.array(SCIMBulkResponseOperationSchema).describe("Results for each bulk operation")
});

exports.AUTH_CONSTANTS = AUTH_CONSTANTS;
exports.AUTH_ERROR_CODES = AUTH_ERROR_CODES;
exports.AccountSchema = AccountSchema;
exports.ApiKeySchema = ApiKeySchema;
exports.InvitationSchema = InvitationSchema;
exports.InvitationStatus = InvitationStatus;
exports.MemberSchema = MemberSchema;
exports.OrganizationSchema = OrganizationSchema;
exports.RoleSchema = RoleSchema;
exports.SCIM = SCIM;
exports.SCIMAddressSchema = SCIMAddressSchema;
exports.SCIMBulkOperationSchema = SCIMBulkOperationSchema;
exports.SCIMBulkRequestSchema = SCIMBulkRequestSchema;
exports.SCIMBulkResponseOperationSchema = SCIMBulkResponseOperationSchema;
exports.SCIMBulkResponseSchema = SCIMBulkResponseSchema;
exports.SCIMEmailSchema = SCIMEmailSchema;
exports.SCIMEnterpriseUserSchema = SCIMEnterpriseUserSchema;
exports.SCIMErrorSchema = SCIMErrorSchema;
exports.SCIMGroupReferenceSchema = SCIMGroupReferenceSchema;
exports.SCIMGroupSchema = SCIMGroupSchema;
exports.SCIMListResponseSchema = SCIMListResponseSchema;
exports.SCIMMemberReferenceSchema = SCIMMemberReferenceSchema;
exports.SCIMMetaSchema = SCIMMetaSchema;
exports.SCIMNameSchema = SCIMNameSchema;
exports.SCIMPatchOperationSchema = SCIMPatchOperationSchema;
exports.SCIMPatchRequestSchema = SCIMPatchRequestSchema;
exports.SCIMPhoneNumberSchema = SCIMPhoneNumberSchema;
exports.SCIMUserSchema = SCIMUserSchema;
exports.SCIM_SCHEMAS = SCIM_SCHEMAS;
exports.SessionSchema = SessionSchema;
exports.UserSchema = UserSchema;
exports.VerificationTokenSchema = VerificationTokenSchema;
//# sourceMappingURL=index.js.map
//# sourceMappingURL=index.js.map