@ionite/core 0.0.21

package/dist/index.js

@@ -0,0 +1 @@
+import{A as K0,B as C0,C as W0,D as P0,E as D0,F as k0,G as E0,H as v0,I as w0,J as S0,K as R0,L as T0,M as b0,N as L0,Q as I0,R as N0,S as y0,T as A0,U as _0,V as f0,a as r,b as t,c as s,d as e,e as Q0,f as X0,l as $0,m as J0,n as V0,o as B0,p as x0,q as Z0,r as F0,s as H0,t as q0,u as G0,v as U0,w as j0,x as Y0,y as z0,z as M0}from"./shared/core-02035cvg.js";var S="0.0.21";class j extends Error{kind;recoverable;code;status;path;sourceType;constructor($,J){super($,J.cause!==void 0?{cause:J.cause}:void 0);this.name="ConfigSourceError",this.kind=J.kind,this.recoverable=J.recoverable,this.code=J.code,this.status=J.status,this.path=J.path,this.sourceType=J.sourceType,Object.setPrototypeOf(this,j.prototype)}}function R($){return $ instanceof j}var Z=["workload"],Y={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},z={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},K={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},C={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Z},W={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},P={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},T=[Y,z,M,K,C,W,P],b={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var L=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let J={};for(let[Q,X]of Object.entries($)){if(L.includes(Q)||Q==="validators"||Q==="setStores")continue;J[Q]=X!==null&&typeof X==="object"&&!Array.isArray(X)&&Object.getPrototypeOf(X)===Object.prototype?D(X):X}return J}function I($){return D($)}var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},N=k,y={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},A={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},_={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function f($,J){if(typeof J!=="number"||J<=0)return $;return new Promise((Q,X)=>{let B=setTimeout(()=>{X(Error(`Authz catalog entry did not become ready within ${J}ms`))},J);$.then(()=>{clearTimeout(B),Q()},(x)=>{clearTimeout(B),X(x)})})}function O($,J){let Q=!1,X,B=J.then(()=>{Q=!0},(F)=>{Q=!1,X=F}),x=$;return Object.defineProperty(x,"ready",{enumerable:!1,configurable:!0,value:(F)=>f(B.then(()=>{if(!Q)throw X}),F)}),Object.defineProperty(x,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),x}var h={beforeTenantSegments:["ui"]},p={beforeTenantSegments:["api"]};function E($){return($??[]).map((J)=>J.trim()).filter(Boolean)}function g($){let J=$.trim();if(!J)return"/";let Q=J.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function v($){return g($).split("/").filter(Boolean)}function U($){return{beforeTenantSegments:E($?.beforeTenantSegments),afterTenantSegments:E($?.afterTenantSegments)}}function d($){return{type:"path",ui:U($?.ui),api:U($?.api)}}function c($,J){let Q=U(J),X=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],x=v($),F=X.length+1+B.length;if(x.length<F)return null;for(let H=0;H<X.length;H++)if(x[H]!==X[H])return null;let q=X.length,V=x[q];if(!V)return null;for(let H=0;H<B.length;H++)if(x[q+1+H]!==B[H])return null;let G=x.slice(q+1+B.length);return{id:decodeURIComponent(V),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function m($,J="/",Q){let X=U(Q),B=X.beforeTenantSegments??[],x=X.afterTenantSegments??[],F=v(J),q=[...B,encodeURIComponent($),...x,...F];return q.length>0?`/${q.join("/")}`:"/"}function u($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={...Q},x=["iss","sub"];for(let V of x)if(V in Q){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))X.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((G)=>typeof G==="string"))X.push({message:"aud array must contain only strings",path:["aud"]})}let F=["jti","scope"];for(let V of F)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}let q=["exp","iat"];for(let V of q)if(V in Q){if(typeof Q[V]!=="number")X.push({message:`${V} must be a number`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if(X.length>0)return{issues:X};return{value:B}}}}}function l($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={};if("access_token"in Q)if(typeof Q.access_token==="string")B.access_token=Q.access_token;else X.push({message:"access_token must be a string",path:["access_token"]});else X.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")B.token_type=Q.token_type;else X.push({message:"token_type must be a string",path:["token_type"]});else X.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)B.scope=Q.scope;else X.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)B.refresh_token=Q.refresh_token;else X.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)B.expires=Q.expires;else X.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)B.expires_in=Q.expires_in;else X.push({message:"expires_in must be a number",path:["expires_in"]});if(X.length>0)return{issues:X};return{value:B}}}}}function n($){let J=new Uint8Array($);return crypto.getRandomValues(J),J}function a($){let J="",Q=n($);for(let X=0;X<$;X++){let B=Q[X]%32;J+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)}return J}function o($,J){let Q="";for(let X=J;X>0;X--){let B=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)+Q,$=Math.floor($/32)}return Q}function i($){let J=Date.now(),Q=o(J,10),X=a(16);return`${$??""}${Q}${X}`}export{l as workloadTokenResponseSchema,z0 as withValidate,_ as warnLogger,v0 as waitOn,S as version,K0 as validationFailureResponse,_0 as userSchema,B0 as unionCatalogRead,r as trustedClientPermissionsForPrincipal,D0 as trimTrailingSlash,j0 as tokenResponseSchema,J0 as toCodeCatalog,W0 as stripJsonComments,E0 as stableConfigHash,k as silentLogger,I as serializeConfig,O as readyCatalogEntry,P0 as parseJsonc,q0 as parseEcid,U0 as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,M0 as must,C0 as mergeConfig,c as matchTenantPath,e as listGenerator,s as list,u as jwtAssertionClaimsSchema,T0 as isStoreConflictError,F0 as isEcid,R as isConfigSourceError,L0 as isConfigLocator,$0 as isCodeCatalog,A as infoLogger,Y0 as idTokenClaimsSchema,f0 as groupResourceSchema,i as generateULID,H0 as formatEcid,V0 as defineCatalog,N as defaultLogger,k0 as deepEqualPlain,S0 as decodeUser,y as debugLogger,t as configTrustedClientGrants,w0 as claimsToUser,m as buildTenantPath,y0 as assertValidSubjectTypeScoping,G0 as assertEcid,X0 as accessRootId,Q0 as accessRefId,R0 as StoreConflictError,N0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,b0 as IoniteError,P as ION_TENANT_MANAGE,T as ION_SDK_PERMISSIONS,A0 as ION_SCIM_USER_EXTENSION_URN,z as ION_IAM_USERS_WRITE,Y as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,b as ION_ENDPOINT_PERMISSIONS,C as ION_CIAM_MAGIC_LINK_CREATE,K as ION_CAPABILITIEZ_READ,W as ION_AUTHZ_OAA_SYNC,I0 as ION_AUTHZ_GROUP_SCHEMA,Z0 as EcidFormatError,x0 as ECID_SCHEME,h as DEFAULT_TENANT_UI_NAMESPACE,p as DEFAULT_TENANT_API_NAMESPACE,j as ConfigSourceError};