@enterprisestandard/core 0.0.20-beta.20260706.1 → 0.0.20

package/dist/index.js

@@ -1 +1 @@
-import{A as p5,B as r5,C as l5,D as n5,E as m5,F as i5,G as t5,H as o5,I as a5,J as s5,K as e5,L as JJ,M as yJ,N as kJ,O as wJ,P as xJ,Q as KJ,a as F5,b as Z5,c as G5,d as U5,e as E5,f as C5,g as Y5,h as L5,i as W5,j as b5,k as M5,l as D5,m as N5,ma as vJ,n as z5,o as I5,p as T5,q as A5,r as R5,s as S5,sa as BJ,t as O5,ta as PJ,u as c5,ua as fJ,v as g5,va as XJ,w as _5,wa as $J,x as u5,xa as QJ,y as d5,ya as VJ,z as h5,za as qJ}from"./shared/core-51h35vdb.js";var S="0.0.20-beta.20260706.1";var O=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function L(J){if(J===null||typeof J!=="object")return J;let k={};for(let[y,w]of Object.entries(J)){if(O.includes(y)||y==="validators"||y==="setStores")continue;k[y]=w!==null&&typeof w==="object"&&!Array.isArray(w)&&Object.getPrototypeOf(w)===Object.prototype?L(w):w}return k}function c(J){return L(J)}var f=["workload"],q={id:"es:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:f,recommendedSubjectTypes:f},H={id:"es:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:f,recommendedSubjectTypes:f},j={id:"es:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:f,recommendedSubjectTypes:f},F={id:"es:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:f,recommendedSubjectTypes:f},Z={id:"es:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:f},G={id:"es:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ESI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:f,recommendedSubjectTypes:f},U={id:"es:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ESI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:f,recommendedSubjectTypes:f},g=[q,H,j,F,Z,G,U],_={"iam.read":{permission:q,subjectType:["workload"]},"iam.users.write":{permission:H,subjectType:["workload"]},"iam.groups.write":{permission:j,subjectType:["workload"]},"capabilitiez.read":{permission:F,subjectType:["workload"]},"ciam.magic-link.create":{permission:Z,subjectType:["workload","user"]},"authz.oaa.sync":{permission:G,subjectType:["workload"]},"tenant.manage":{permission:U,subjectType:["workload"]}};function E(J,k){let y=new TextEncoder().encode(J),w=typeof k==="string"?new TextEncoder().encode(k):k,x=new Uint8Array(y.length+1+w.length);return x.set(y,0),x[y.length]=46,x.set(w,y.length+1),x}function u(J){let k=J.replace(/-/g,"+").replace(/_/g,"/"),y=k.length%4===0?"":"=".repeat(4-k.length%4),w=atob(k+y),x=new Uint8Array(w.length);for(let K=0;K<w.length;K++)x[K]=w.charCodeAt(K);return x}function d(J){let k="";for(let y of J)k+=String.fromCharCode(y);return btoa(k).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function W(J){let k=JSON.parse(J);if(!k||typeof k!=="object"||!Array.isArray(k.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return k}function h(J){return JSON.stringify(J)}async function p(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x},{name:"Ed25519"},!0,["verify"])}async function r(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x,d:J.d},{name:"Ed25519"},!0,["sign"])}async function l(J){let y=(typeof J.jwks==="string"?W(J.jwks):J.jwks).keys.find((w)=>w.kid===J.kid&&w.kty==="OKP"&&w.crv==="Ed25519");if(!y?.x)return!1;try{let w=await p(y),x=E(J.requestId,J.rawBody),K=u(J.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},w,K,x)}catch{return!1}}async function n(J){let k=await r(J.privateKeyJwk),y=E(J.requestId,J.rawBody),w=await crypto.subtle.sign({name:"Ed25519"},k,y);return d(new Uint8Array(w))}async function m(J){let k=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),y=await crypto.subtle.exportKey("jwk",k.privateKey),x=(await crypto.subtle.exportKey("jwk",k.publicKey)).x,K=y.d;if(!x||!K)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x,d:K,kid:J,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x,kid:J,alg:"EdDSA",use:"sig"}]}}}function C(J,k,y,w){let x=k.length,K=w??J,B=K>0?Math.floor(y/K)+1:1,P=K>0?Math.ceil(J/K):0;return{total:J,count:x,items:k,size:K,page:B,pages:P}}async function*i(J,k,y=1000){let w=0;while(!0){let x=await J(w,y);if(x.items.length===0)break;for(let K of x.items)yield(k?await k(K):K)??K;if(x.items.length<y||w+x.items.length>=x.total)break;w+=y}}var b={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},t=b,o={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},a={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},s={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function e(J,k){if(typeof k!=="number"||k<=0)return J;return new Promise((y,w)=>{let x=setTimeout(()=>{w(Error(`Authz catalog entry did not become ready within ${k}ms`))},k);J.then(()=>{clearTimeout(x),y()},(K)=>{clearTimeout(x),w(K)})})}function J5(J,k){let y=!1,w,x=k.then(()=>{y=!0},(B)=>{y=!1,w=B}),K=J;return Object.defineProperty(K,"ready",{enumerable:!1,configurable:!0,value:(B)=>e(x.then(()=>{if(!y)throw w}),B)}),Object.defineProperty(K,"isReady",{enumerable:!1,configurable:!0,value:()=>y}),K}class Y extends Error{status;statusText;constructor(J,k={}){super(J,{cause:k.cause});this.name="ESError",this.status=k.status,this.statusText=k.statusText,Object.setPrototypeOf(this,Y.prototype)}}function y5(J){if(typeof J!=="object"||J==null)return!1;let k=J.type;return k==="vault"||k==="aws"||k==="azure"||k==="gcp"}class M{tenants=new Map;async get(J){return this.tenants.get(J)}async list(J){let k=Array.from(this.tenants.values()),y=Math.max(0,J?.start??0),w=J?.limit,x=J?.sort;if(x?.length)k=[...k].sort((v,$)=>{for(let{field:X,direction:I}of x){let T=v[X],A=$[X],V=k5(T,A);if(V!==0)return I==="desc"?-V:V}return 0});let K=k.length,B=w!=null?y+w:void 0,P=k.slice(y,B);return C(K,P,y,w)}async upsert(J){return this.tenants.set(J.id,J),J}async delete(J){let k=this.tenants.has(J);return this.tenants.delete(J),k?1:0}}class D{store;createEs;constructor(J={}){this.createEs=J.createEs,this.store=new M}async get(J){return this.store.get(J)}async list(J){return this.store.list(J)}async upsert(J){return this.store.upsert(J)}async delete(J){return this.store.delete(J)}async getEs(J){let k=await this.get(J);if(!k)return;if(!this.createEs)throw Error(`${this.constructor.name} requires options.createEs to use getEs()`);return this.createEs(k)}}function k5(J,k){let y=J===void 0||J===null,w=k===void 0||k===null;if(y&&w)return 0;if(y)return 1;if(w)return-1;if(J instanceof Date&&k instanceof Date)return J.getTime()-k.getTime();let x=String(J),K=String(k);return x.localeCompare(K)}function w5(J,k,y){return(async()=>{try{let w=await fetch(J,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(k)});if(!w.ok)y.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure",status:w.status,statusText:w.statusText})}catch(w){y.error("Failed to send webhook update",{"es.operation":"webhook.update","es.outcome":"failure"},w)}})()}async function x5(J,k,y){return w5(J,k,y)}var K5={beforeTenantSegments:["ui"]},v5={beforeTenantSegments:["api"]};function N(J){return(J??[]).map((k)=>k.trim()).filter(Boolean)}function B5(J){let k=J.trim();if(!k)return"/";let y=k.replace(/\\/g,"/").replace(/\/+/g,"/");return y.startsWith("/")?y:`/${y}`}function z(J){return B5(J).split("/").filter(Boolean)}function Q(J){return{beforeTenantSegments:N(J?.beforeTenantSegments),afterTenantSegments:N(J?.afterTenantSegments)}}function P5(J){return{type:"path",ui:Q(J?.ui),api:Q(J?.api)}}function f5(J,k){let y=Q(k),w=y.beforeTenantSegments??[],x=y.afterTenantSegments??[],K=z(J),B=w.length+1+x.length;if(K.length<B)return null;for(let X=0;X<w.length;X++)if(K[X]!==w[X])return null;let P=w.length,v=K[P];if(!v)return null;for(let X=0;X<x.length;X++)if(K[P+1+X]!==x[X])return null;let $=K.slice(P+1+x.length);return{id:decodeURIComponent(v),restSegments:$,restPath:$.length>0?`/${$.join("/")}`:"/"}}function X5(J,k="/",y){let w=Q(y),x=w.beforeTenantSegments??[],K=w.afterTenantSegments??[],B=z(k),P=[...x,encodeURIComponent(J),...K,...B];return P.length>0?`/${P.join("/")}`:"/"}function $5(J){return{"~standard":{version:1,vendor:J,validate:(k)=>{if(typeof k!=="object"||k===null)return{issues:[{message:"Expected an object"}]};let y=k,w=[],x={...y},K=["iss","sub"];for(let v of K)if(v in y){if(typeof y[v]!=="string")w.push({message:`${v} must be a string`,path:[v]})}else w.push({message:`${v} is required`,path:[v]});if("aud"in y&&y.aud!==void 0){let v=y.aud;if(typeof v!=="string"&&!Array.isArray(v))w.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(v)&&!v.every(($)=>typeof $==="string"))w.push({message:"aud array must contain only strings",path:["aud"]})}let B=["jti","scope"];for(let v of B)if(v in y&&y[v]!==void 0){if(typeof y[v]!=="string")w.push({message:`${v} must be a string`,path:[v]})}let P=["exp","iat"];for(let v of P)if(v in y){if(typeof y[v]!=="number")w.push({message:`${v} must be a number`,path:[v]})}else w.push({message:`${v} is required`,path:[v]});if(w.length>0)return{issues:w};return{value:x}}}}}function Q5(J){return{"~standard":{version:1,vendor:J,validate:(k)=>{if(typeof k!=="object"||k===null)return{issues:[{message:"Expected an object"}]};let y=k,w=[],x={};if("access_token"in y)if(typeof y.access_token==="string")x.access_token=y.access_token;else w.push({message:"access_token must be a string",path:["access_token"]});else w.push({message:"access_token is required",path:["access_token"]});if("token_type"in y)if(typeof y.token_type==="string")x.token_type=y.token_type;else w.push({message:"token_type must be a string",path:["token_type"]});else w.push({message:"token_type is required",path:["token_type"]});if("scope"in y)if(typeof y.scope==="string"||y.scope===void 0)x.scope=y.scope;else w.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in y)if(typeof y.refresh_token==="string"||y.refresh_token===void 0)x.refresh_token=y.refresh_token;else w.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in y)if(typeof y.expires==="string"||y.expires===void 0)x.expires=y.expires;else w.push({message:"expires must be a string",path:["expires"]});if("expires_in"in y)if(typeof y.expires_in==="number"||y.expires_in===void 0)x.expires_in=y.expires_in;else w.push({message:"expires_in must be a number",path:["expires_in"]});if(w.length>0)return{issues:w};return{value:x}}}}}function V5(J){let k=new Uint8Array(J);return crypto.getRandomValues(k),k}function q5(J){let k="",y=V5(J);for(let w=0;w<J;w++){let x=y[w]%32;k+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(x)}return k}function H5(J,k){let y="";for(let w=k;w>0;w--){let x=J%32;y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(x)+y,J=Math.floor(J/32)}return y}function j5(J){let k=Date.now(),y=H5(k,10),w=q5(16);return`${J??""}${y}${w}`}export{Q5 as workloadTokenResponseSchema,A5 as withValidate,wJ as withSetCookies,s as warnLogger,h5 as waitOn,S as version,l as verifyLfvSignature,S5 as validationFailureResponse,VJ as userSchema,F5 as trustedClientPermissionsForPrincipal,_5 as trimTrailingSlash,I5 as tokenResponseSchema,c5 as stripJsonComments,h as stringifyLfvJwks,d5 as stableConfigHash,b as silentLogger,n as signLfvPayload,c as serializeESConfig,x5 as sendTenantWebhook,o5 as sameOriginRedirectRules,s5 as resolveRedirect,yJ as resolveCapturedRedirect,kJ as resolveAfterRedirect,J5 as readyCatalogEntry,W as parseLfvJwks,g5 as parseJsonc,D5 as parseEcid,z5 as oidcCallbackSchema,P5 as normalizeTenantRoutingStrategy,Q as normalizeTenantPathNamespace,R5 as must,O5 as mergeConfig,f5 as matchTenantPath,vJ as listSsoClientIdsFromCookies,i as listGenerator,C as list,$5 as jwtAssertionClaimsSchema,PJ as isStoreConflictError,a5 as isRedirectAllowed,b5 as isEcid,y5 as isConfigLocator,a as infoLogger,T5 as idTokenClaimsSchema,qJ as groupResourceSchema,j5 as generateULID,m as generateLfvEd25519KeyPair,M5 as formatEcid,C5 as expandRoot,xJ as discoverSessions,KJ as discoverSessionRecords,e5 as defaultRedirectPolicies,t as defaultLogger,u5 as deepEqualPlain,r5 as decodeUser,o as debugLogger,Z5 as configTrustedClientGrants,Y5 as collectReferencedDefinitions,p5 as claimsToUser,JJ as captureRedirect,X5 as buildTenantPath,E as buildLfvSigningInput,l5 as blockDangerousUrls,$J as assertValidSubjectTypeScoping,N5 as assertEcid,m5 as allowSameOrigin,n5 as allowRelativePaths,i5 as allowOrigins,t5 as allowHosts,U5 as accessRootId,G5 as accessRefId,BJ as StoreConflictError,XJ as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,D as InMemoryTenantStore,W5 as EcidFormatError,U as ES_TENANT_MANAGE,g as ES_SDK_PERMISSIONS,QJ as ES_SCIM_USER_EXTENSION_URN,H as ES_IAM_USERS_WRITE,q as ES_IAM_READ,j as ES_IAM_GROUPS_WRITE,_ as ES_ENDPOINT_PERMISSIONS,Z as ES_CIAM_MAGIC_LINK_CREATE,F as ES_CAPABILITIEZ_READ,G as ES_AUTHZ_OAA_SYNC,Y as ESError,fJ as ENTERPRISE_AUTHZ_GROUP_SCHEMA,L5 as ECID_SCHEME,K5 as DEFAULT_TENANT_UI_NAMESPACE,v5 as DEFAULT_TENANT_API_NAMESPACE,E5 as CatalogAdjacencyCache};
+import{A as K0,B as C0,C as W0,D as P0,E as D0,F as k0,G as v0,H as I0,I as N0,J as w0,K as R0,L as T0,M as b0,N as E0,Q as L0,R as O0,S as S0,T as y0,U as A0,V as _0,a as r,b as t,c as s,d as e,e as Q0,f as X0,l as $0,m as J0,n as V0,o as B0,p as x0,q as Z0,r as F0,s as H0,t as q0,u as G0,v as U0,w as j0,x as Y0,y as z0,z as M0}from"./shared/core-9dvscte3.js";var w="0.0.20";class j extends Error{kind;recoverable;code;status;path;sourceType;constructor($,J){super($,J.cause!==void 0?{cause:J.cause}:void 0);this.name="ConfigSourceError",this.kind=J.kind,this.recoverable=J.recoverable,this.code=J.code,this.status=J.status,this.path=J.path,this.sourceType=J.sourceType,Object.setPrototypeOf(this,j.prototype)}}function R($){return $ instanceof j}var T=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let J={};for(let[Q,X]of Object.entries($)){if(T.includes(Q)||Q==="validators"||Q==="setStores")continue;J[Q]=X!==null&&typeof X==="object"&&!Array.isArray(X)&&Object.getPrototypeOf(X)===Object.prototype?D(X):X}return J}function b($){return D($)}var Z=["workload"],Y={id:"es:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},z={id:"es:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},M={id:"es:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},K={id:"es:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},C={id:"es:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Z},W={id:"es:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ESI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},P={id:"es:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ESI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},E=[Y,z,M,K,C,W,P],L={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},O=k,S={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},y={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},A={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function _($,J){if(typeof J!=="number"||J<=0)return $;return new Promise((Q,X)=>{let B=setTimeout(()=>{X(Error(`Authz catalog entry did not become ready within ${J}ms`))},J);$.then(()=>{clearTimeout(B),Q()},(x)=>{clearTimeout(B),X(x)})})}function f($,J){let Q=!1,X,B=J.then(()=>{Q=!0},(F)=>{Q=!1,X=F}),x=$;return Object.defineProperty(x,"ready",{enumerable:!1,configurable:!0,value:(F)=>_(B.then(()=>{if(!Q)throw X}),F)}),Object.defineProperty(x,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),x}var h={beforeTenantSegments:["ui"]},p={beforeTenantSegments:["api"]};function v($){return($??[]).map((J)=>J.trim()).filter(Boolean)}function g($){let J=$.trim();if(!J)return"/";let Q=J.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function I($){return g($).split("/").filter(Boolean)}function U($){return{beforeTenantSegments:v($?.beforeTenantSegments),afterTenantSegments:v($?.afterTenantSegments)}}function d($){return{type:"path",ui:U($?.ui),api:U($?.api)}}function c($,J){let Q=U(J),X=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],x=I($),F=X.length+1+B.length;if(x.length<F)return null;for(let H=0;H<X.length;H++)if(x[H]!==X[H])return null;let q=X.length,V=x[q];if(!V)return null;for(let H=0;H<B.length;H++)if(x[q+1+H]!==B[H])return null;let G=x.slice(q+1+B.length);return{id:decodeURIComponent(V),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function m($,J="/",Q){let X=U(Q),B=X.beforeTenantSegments??[],x=X.afterTenantSegments??[],F=I(J),q=[...B,encodeURIComponent($),...x,...F];return q.length>0?`/${q.join("/")}`:"/"}function u($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={...Q},x=["iss","sub"];for(let V of x)if(V in Q){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))X.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((G)=>typeof G==="string"))X.push({message:"aud array must contain only strings",path:["aud"]})}let F=["jti","scope"];for(let V of F)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}let q=["exp","iat"];for(let V of q)if(V in Q){if(typeof Q[V]!=="number")X.push({message:`${V} must be a number`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if(X.length>0)return{issues:X};return{value:B}}}}}function l($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={};if("access_token"in Q)if(typeof Q.access_token==="string")B.access_token=Q.access_token;else X.push({message:"access_token must be a string",path:["access_token"]});else X.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")B.token_type=Q.token_type;else X.push({message:"token_type must be a string",path:["token_type"]});else X.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)B.scope=Q.scope;else X.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)B.refresh_token=Q.refresh_token;else X.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)B.expires=Q.expires;else X.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)B.expires_in=Q.expires_in;else X.push({message:"expires_in must be a number",path:["expires_in"]});if(X.length>0)return{issues:X};return{value:B}}}}}function n($){let J=new Uint8Array($);return crypto.getRandomValues(J),J}function a($){let J="",Q=n($);for(let X=0;X<$;X++){let B=Q[X]%32;J+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)}return J}function o($,J){let Q="";for(let X=J;X>0;X--){let B=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)+Q,$=Math.floor($/32)}return Q}function i($){let J=Date.now(),Q=o(J,10),X=a(16);return`${$??""}${Q}${X}`}export{l as workloadTokenResponseSchema,z0 as withValidate,A as warnLogger,I0 as waitOn,w as version,K0 as validationFailureResponse,A0 as userSchema,B0 as unionCatalogRead,r as trustedClientPermissionsForPrincipal,D0 as trimTrailingSlash,j0 as tokenResponseSchema,J0 as toCodeCatalog,W0 as stripJsonComments,v0 as stableConfigHash,k as silentLogger,b as serializeESConfig,f as readyCatalogEntry,P0 as parseJsonc,q0 as parseEcid,U0 as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,M0 as must,C0 as mergeConfig,c as matchTenantPath,e as listGenerator,s as list,u as jwtAssertionClaimsSchema,T0 as isStoreConflictError,F0 as isEcid,R as isConfigSourceError,E0 as isConfigLocator,$0 as isCodeCatalog,y as infoLogger,Y0 as idTokenClaimsSchema,_0 as groupResourceSchema,i as generateULID,H0 as formatEcid,V0 as defineCatalog,O as defaultLogger,k0 as deepEqualPlain,w0 as decodeUser,S as debugLogger,t as configTrustedClientGrants,N0 as claimsToUser,m as buildTenantPath,S0 as assertValidSubjectTypeScoping,G0 as assertEcid,X0 as accessRootId,Q0 as accessRefId,R0 as StoreConflictError,O0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,Z0 as EcidFormatError,P as ES_TENANT_MANAGE,E as ES_SDK_PERMISSIONS,y0 as ES_SCIM_USER_EXTENSION_URN,z as ES_IAM_USERS_WRITE,Y as ES_IAM_READ,M as ES_IAM_GROUPS_WRITE,L as ES_ENDPOINT_PERMISSIONS,C as ES_CIAM_MAGIC_LINK_CREATE,K as ES_CAPABILITIEZ_READ,W as ES_AUTHZ_OAA_SYNC,b0 as ESError,L0 as ENTERPRISE_AUTHZ_GROUP_SCHEMA,x0 as ECID_SCHEME,h as DEFAULT_TENANT_UI_NAMESPACE,p as DEFAULT_TENANT_API_NAMESPACE,j as ConfigSourceError};