@ionite/core 0.0.23-beta.20260812.3 → 0.0.23-beta.20260812.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
import{A as K0,B as b0,C as T0,D as L0,E as R0,F as N0,G as A0,H as _0,I as I0,J as f0,K as O0,L as v0,M as k0,N as w0,Q as y0,R as g0,S as h0,T as p0,U as m0,V as c0,a as $0,b as J0,c as V0,d as B0,e as Z0,f as F0,l as G0,m as H0,n as U0,o as q0,p as j0,q as Y0,r as z0,s as M0,t as C0,u as W0,v as D0,w as E0,x as P0,y as x0,z as S0}from"./shared/core-f0gk15rd.js";var A="0.0.23-beta.20260812.3";class z extends Error{kind;recoverable;code;status;path;sourceType;constructor(X,$){super(X,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,z.prototype)}}function _(X){return X instanceof z}var q=["workload"],M={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},W={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},E={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:q},P={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:q,recommendedSubjectTypes:q},x={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},I=[M,C,W,D,E,P,x],f={"iam.read":{permission:M,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:W,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:E,subjectType:["workload","user"]},"authz.oaa.sync":{permission:P,subjectType:["workload"]},"tenant.manage":{permission:x,subjectType:["workload"]}};var O=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(X){if(X===null||typeof X!=="object")return X;let $={};for(let[Q,J]of Object.entries(X)){if(O.includes(Q)||Q==="validators"||Q==="setStores")continue;$[Q]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?S(J):J}return $}function v(X){return S(X)}function j(X,$){if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`${$} must be an object.`);return X}function K(X,$){if(X===void 0)return;if(typeof X!=="string"||X.length===0||!Number.isFinite(Date.parse(X)))throw Error(`${$} must be a valid timestamp string.`);return X}function b(X,$,Q){if(!Array.isArray(X)||!Q.allowEmpty&&X.length===0)throw Error(`${$} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let J=new Set;return X.map((Z,F)=>{let B=j(Z,`${$} keys[${F}]`);if(typeof B.id!=="string"||B.id.length===0)throw Error(`${$} keys[${F}].id must be a non-empty string.`);if(J.has(B.id))throw Error(`${$} contains duplicate key id "${B.id}".`);if(J.add(B.id),!["pending","active","deprecated","revoked"].includes(String(B.state)))throw Error(`${$} keys[${F}].state is invalid.`);if(B.value!==void 0&&(typeof B.value!=="string"||B.value.length===0))throw Error(`${$} keys[${F}].value must be a non-empty string when present.`);let U=B.meta===void 0?void 0:j(B.meta,`${$} keys[${F}].meta`);return{id:B.id,state:B.state,...B.value===void 0?{}:{value:B.value},...B.notBefore===void 0?{}:{notBefore:K(B.notBefore,`${$} keys[${F}].notBefore`)},...B.notAfter===void 0?{}:{notAfter:K(B.notAfter,`${$} keys[${F}].notAfter`)},...U?{meta:{...U}}:{}}})}function k(X,$){let Q=`KMS ${$} pool`,J=j(X,Q);if(J.kind!==$)throw Error(`${Q} kind must be "${$}".`);if(typeof J.active!=="string"||J.active.length===0)throw Error(`${Q} active must be a non-empty key id.`);let Z=b(J.keys,Q,{allowEmpty:!1}),F=Z.find((B)=>B.id===J.active);if(!F)throw Error(`${Q} active key "${J.active}" is not present in keys.`);if(F.state!=="active")throw Error(`${Q} active key "${J.active}" must have state "active".`);if(!F.value)throw Error(`${Q} active key "${J.active}" must include a value.`);return{kind:$,active:J.active,keys:Z}}function w(X,$="token"){return k(X,$)}function y(X){let Q=j(X,"KMS allocation pool");if(Q.kind!=="allocation")throw Error('KMS allocation pool kind must be "allocation".');let J=b(Q.keys,"KMS allocation pool",{allowEmpty:!0}),Z=j(Q.assignments,"KMS allocation pool assignments"),F={},B=new Map(J.map((V)=>[V.id,V]));for(let[V,H]of Object.entries(Z)){if(V.length===0||typeof H!=="string"||H.length===0)throw Error("KMS allocation pool assignments must map non-empty client ids to non-empty key ids.");let G=B.get(H);if(!G)throw Error(`KMS allocation pool assignment for "${V}" references missing key "${H}".`);if(G.state!=="active"||!G.value)throw Error(`KMS allocation pool assignment for "${V}" must reference an active key with a value.`);F[V]=H}let U;if(Q.policy!==void 0){let V=j(Q.policy,"KMS allocation pool policy"),H=V.strategy;if(H!==void 0&&H!=="spread"&&H!=="low-quota-first")throw Error("KMS allocation pool policy.strategy is invalid.");let G=V.maxHoldersPerKey;if(G!==void 0&&(typeof G!=="number"||!Number.isInteger(G)||G<=0))throw Error("KMS allocation pool policy.maxHoldersPerKey must be a positive integer when present.");U={...H?{strategy:H}:{},...G===void 0?{}:{maxHoldersPerKey:G}}}return{kind:"allocation",keys:J,assignments:F,...U?{policy:U}:{}}}var T={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},g=T,h={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},p={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},m={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function c(X,$){if(typeof $!=="number"||$<=0)return X;return new Promise((Q,J)=>{let Z=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);X.then(()=>{clearTimeout(Z),Q()},(F)=>{clearTimeout(Z),J(F)})})}function u(X,$){let Q=!1,J,Z=$.then(()=>{Q=!0},(B)=>{Q=!1,J=B}),F=X;return Object.defineProperty(F,"ready",{enumerable:!1,configurable:!0,value:(B)=>c(Z.then(()=>{if(!Q)throw J}),B)}),Object.defineProperty(F,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),F}var d={beforeTenantSegments:["ui"]},l={beforeTenantSegments:["api"]};function L(X){return(X??[]).map(($)=>$.trim()).filter(Boolean)}function n(X){let $=X.trim();if(!$)return"/";let Q=$.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function R(X){return n(X).split("/").filter(Boolean)}function Y(X){return{beforeTenantSegments:L(X?.beforeTenantSegments),afterTenantSegments:L(X?.afterTenantSegments)}}function a(X){return{type:"path",ui:Y(X?.ui),api:Y(X?.api)}}function i(X,$){let Q=Y($),J=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],F=R(X),B=J.length+1+Z.length;if(F.length<B)return null;for(let G=0;G<J.length;G++)if(F[G]!==J[G])return null;let U=J.length,V=F[U];if(!V)return null;for(let G=0;G<Z.length;G++)if(F[U+1+G]!==Z[G])return null;let H=F.slice(U+1+Z.length);return{id:decodeURIComponent(V),restSegments:H,restPath:H.length>0?`/${H.join("/")}`:"/"}}function o(X,$="/",Q){let J=Y(Q),Z=J.beforeTenantSegments??[],F=J.afterTenantSegments??[],B=R($),U=[...Z,encodeURIComponent(X),...F,...B];return U.length>0?`/${U.join("/")}`:"/"}function r(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={...Q},F=["iss","sub"];for(let V of F)if(V in Q){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((H)=>typeof H==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let B=["jti","scope"];for(let V of B)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}let U=["exp","iat"];for(let V of U)if(V in Q){if(typeof Q[V]!=="number")J.push({message:`${V} must be a number`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if(J.length>0)return{issues:J};return{value:Z}}}}}function t(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:Z}}}}}function s(X){let $=new Uint8Array(X);return crypto.getRandomValues($),$}function e(X){let $="",Q=s(X);for(let J=0;J<X;J++){let Z=Q[J]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function Q0(X,$){let Q="";for(let J=$;J>0;J--){let Z=X%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,X=Math.floor(X/32)}return Q}function X0(X){let $=Date.now(),Q=Q0($,10),J=e(16);return`${X??""}${Q}${J}`}export{t as workloadTokenResponseSchema,x0 as withValidate,m as warnLogger,_0 as waitOn,A as version,K0 as validationFailureResponse,m0 as userSchema,q0 as unionCatalogRead,$0 as trustedClientPermissionsForPrincipal,R0 as trimTrailingSlash,E0 as tokenResponseSchema,H0 as toCodeCatalog,T0 as stripJsonComments,A0 as stableConfigHash,T as silentLogger,v as serializeConfig,u as readyCatalogEntry,w as parseKmsPoolDocument,y as parseKmsAllocationPool,L0 as parseJsonc,C0 as parseEcid,D0 as oidcCallbackSchema,a as normalizeTenantRoutingStrategy,Y as normalizeTenantPathNamespace,S0 as must,b0 as mergeConfig,i as matchTenantPath,B0 as listGenerator,V0 as list,r as jwtAssertionClaimsSchema,v0 as isStoreConflictError,z0 as isEcid,_ as isConfigSourceError,w0 as isConfigLocator,G0 as isCodeCatalog,p as infoLogger,P0 as idTokenClaimsSchema,c0 as groupResourceSchema,X0 as generateULID,M0 as formatEcid,U0 as defineCatalog,g as defaultLogger,N0 as deepEqualPlain,f0 as decodeUser,h as debugLogger,J0 as configTrustedClientGrants,I0 as claimsToUser,o as buildTenantPath,h0 as assertValidSubjectTypeScoping,W0 as assertEcid,F0 as accessRootId,Z0 as accessRefId,O0 as StoreConflictError,g0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,k0 as IoniteError,x as ION_TENANT_MANAGE,I as ION_SDK_PERMISSIONS,p0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,M as ION_IAM_READ,W as ION_IAM_GROUPS_WRITE,f as ION_ENDPOINT_PERMISSIONS,E as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,P as ION_AUTHZ_OAA_SYNC,y0 as ION_AUTHZ_GROUP_SCHEMA,Y0 as EcidFormatError,j0 as ECID_SCHEME,d as DEFAULT_TENANT_UI_NAMESPACE,l as DEFAULT_TENANT_API_NAMESPACE,z as ConfigSourceError};
|
|
1
|
+
import{A as K0,B as b0,C as T0,D as L0,E as R0,F as N0,G as A0,H as _0,I as I0,J as f0,K as O0,L as v0,M as k0,N as w0,Q as y0,R as g0,S as h0,T as p0,U as m0,V as c0,a as $0,b as J0,c as V0,d as B0,e as Z0,f as F0,l as G0,m as H0,n as U0,o as q0,p as j0,q as Y0,r as z0,s as M0,t as C0,u as W0,v as D0,w as E0,x as P0,y as x0,z as S0}from"./shared/core-f0gk15rd.js";var A="0.0.23-beta.20260812.4";class z extends Error{kind;recoverable;code;status;path;sourceType;constructor(X,$){super(X,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,z.prototype)}}function _(X){return X instanceof z}var q=["workload"],M={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},W={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},E={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:q},P={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:q,recommendedSubjectTypes:q},x={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},I=[M,C,W,D,E,P,x],f={"iam.read":{permission:M,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:W,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:E,subjectType:["workload","user"]},"authz.oaa.sync":{permission:P,subjectType:["workload"]},"tenant.manage":{permission:x,subjectType:["workload"]}};var O=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(X){if(X===null||typeof X!=="object")return X;let $={};for(let[Q,J]of Object.entries(X)){if(O.includes(Q)||Q==="validators"||Q==="setStores")continue;$[Q]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?S(J):J}return $}function v(X){return S(X)}function j(X,$){if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`${$} must be an object.`);return X}function K(X,$){if(X===void 0)return;if(typeof X!=="string"||X.length===0||!Number.isFinite(Date.parse(X)))throw Error(`${$} must be a valid timestamp string.`);return X}function b(X,$,Q){if(!Array.isArray(X)||!Q.allowEmpty&&X.length===0)throw Error(`${$} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let J=new Set;return X.map((Z,F)=>{let B=j(Z,`${$} keys[${F}]`);if(typeof B.id!=="string"||B.id.length===0)throw Error(`${$} keys[${F}].id must be a non-empty string.`);if(J.has(B.id))throw Error(`${$} contains duplicate key id "${B.id}".`);if(J.add(B.id),!["pending","active","deprecated","revoked"].includes(String(B.state)))throw Error(`${$} keys[${F}].state is invalid.`);if(B.value!==void 0&&(typeof B.value!=="string"||B.value.length===0))throw Error(`${$} keys[${F}].value must be a non-empty string when present.`);let U=B.meta===void 0?void 0:j(B.meta,`${$} keys[${F}].meta`);return{id:B.id,state:B.state,...B.value===void 0?{}:{value:B.value},...B.notBefore===void 0?{}:{notBefore:K(B.notBefore,`${$} keys[${F}].notBefore`)},...B.notAfter===void 0?{}:{notAfter:K(B.notAfter,`${$} keys[${F}].notAfter`)},...U?{meta:{...U}}:{}}})}function k(X,$){let Q=`KMS ${$} pool`,J=j(X,Q);if(J.kind!==$)throw Error(`${Q} kind must be "${$}".`);if(typeof J.active!=="string"||J.active.length===0)throw Error(`${Q} active must be a non-empty key id.`);let Z=b(J.keys,Q,{allowEmpty:!1}),F=Z.find((B)=>B.id===J.active);if(!F)throw Error(`${Q} active key "${J.active}" is not present in keys.`);if(F.state!=="active")throw Error(`${Q} active key "${J.active}" must have state "active".`);if(!F.value)throw Error(`${Q} active key "${J.active}" must include a value.`);return{kind:$,active:J.active,keys:Z}}function w(X,$="token"){return k(X,$)}function y(X){let Q=j(X,"KMS allocation pool");if(Q.kind!=="allocation")throw Error('KMS allocation pool kind must be "allocation".');let J=b(Q.keys,"KMS allocation pool",{allowEmpty:!0}),Z=j(Q.assignments,"KMS allocation pool assignments"),F={},B=new Map(J.map((V)=>[V.id,V]));for(let[V,H]of Object.entries(Z)){if(V.length===0||typeof H!=="string"||H.length===0)throw Error("KMS allocation pool assignments must map non-empty client ids to non-empty key ids.");let G=B.get(H);if(!G)throw Error(`KMS allocation pool assignment for "${V}" references missing key "${H}".`);if(G.state!=="active"||!G.value)throw Error(`KMS allocation pool assignment for "${V}" must reference an active key with a value.`);F[V]=H}let U;if(Q.policy!==void 0){let V=j(Q.policy,"KMS allocation pool policy"),H=V.strategy;if(H!==void 0&&H!=="spread"&&H!=="low-quota-first")throw Error("KMS allocation pool policy.strategy is invalid.");let G=V.maxHoldersPerKey;if(G!==void 0&&(typeof G!=="number"||!Number.isInteger(G)||G<=0))throw Error("KMS allocation pool policy.maxHoldersPerKey must be a positive integer when present.");U={...H?{strategy:H}:{},...G===void 0?{}:{maxHoldersPerKey:G}}}return{kind:"allocation",keys:J,assignments:F,...U?{policy:U}:{}}}var T={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},g=T,h={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},p={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},m={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function c(X,$){if(typeof $!=="number"||$<=0)return X;return new Promise((Q,J)=>{let Z=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);X.then(()=>{clearTimeout(Z),Q()},(F)=>{clearTimeout(Z),J(F)})})}function u(X,$){let Q=!1,J,Z=$.then(()=>{Q=!0},(B)=>{Q=!1,J=B}),F=X;return Object.defineProperty(F,"ready",{enumerable:!1,configurable:!0,value:(B)=>c(Z.then(()=>{if(!Q)throw J}),B)}),Object.defineProperty(F,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),F}var d={beforeTenantSegments:["ui"]},l={beforeTenantSegments:["api"]};function L(X){return(X??[]).map(($)=>$.trim()).filter(Boolean)}function n(X){let $=X.trim();if(!$)return"/";let Q=$.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function R(X){return n(X).split("/").filter(Boolean)}function Y(X){return{beforeTenantSegments:L(X?.beforeTenantSegments),afterTenantSegments:L(X?.afterTenantSegments)}}function a(X){return{type:"path",ui:Y(X?.ui),api:Y(X?.api)}}function i(X,$){let Q=Y($),J=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],F=R(X),B=J.length+1+Z.length;if(F.length<B)return null;for(let G=0;G<J.length;G++)if(F[G]!==J[G])return null;let U=J.length,V=F[U];if(!V)return null;for(let G=0;G<Z.length;G++)if(F[U+1+G]!==Z[G])return null;let H=F.slice(U+1+Z.length);return{id:decodeURIComponent(V),restSegments:H,restPath:H.length>0?`/${H.join("/")}`:"/"}}function o(X,$="/",Q){let J=Y(Q),Z=J.beforeTenantSegments??[],F=J.afterTenantSegments??[],B=R($),U=[...Z,encodeURIComponent(X),...F,...B];return U.length>0?`/${U.join("/")}`:"/"}function r(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={...Q},F=["iss","sub"];for(let V of F)if(V in Q){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((H)=>typeof H==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let B=["jti","scope"];for(let V of B)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}let U=["exp","iat"];for(let V of U)if(V in Q){if(typeof Q[V]!=="number")J.push({message:`${V} must be a number`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if(J.length>0)return{issues:J};return{value:Z}}}}}function t(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:Z}}}}}function s(X){let $=new Uint8Array(X);return crypto.getRandomValues($),$}function e(X){let $="",Q=s(X);for(let J=0;J<X;J++){let Z=Q[J]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function Q0(X,$){let Q="";for(let J=$;J>0;J--){let Z=X%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,X=Math.floor(X/32)}return Q}function X0(X){let $=Date.now(),Q=Q0($,10),J=e(16);return`${X??""}${Q}${J}`}export{t as workloadTokenResponseSchema,x0 as withValidate,m as warnLogger,_0 as waitOn,A as version,K0 as validationFailureResponse,m0 as userSchema,q0 as unionCatalogRead,$0 as trustedClientPermissionsForPrincipal,R0 as trimTrailingSlash,E0 as tokenResponseSchema,H0 as toCodeCatalog,T0 as stripJsonComments,A0 as stableConfigHash,T as silentLogger,v as serializeConfig,u as readyCatalogEntry,w as parseKmsPoolDocument,y as parseKmsAllocationPool,L0 as parseJsonc,C0 as parseEcid,D0 as oidcCallbackSchema,a as normalizeTenantRoutingStrategy,Y as normalizeTenantPathNamespace,S0 as must,b0 as mergeConfig,i as matchTenantPath,B0 as listGenerator,V0 as list,r as jwtAssertionClaimsSchema,v0 as isStoreConflictError,z0 as isEcid,_ as isConfigSourceError,w0 as isConfigLocator,G0 as isCodeCatalog,p as infoLogger,P0 as idTokenClaimsSchema,c0 as groupResourceSchema,X0 as generateULID,M0 as formatEcid,U0 as defineCatalog,g as defaultLogger,N0 as deepEqualPlain,f0 as decodeUser,h as debugLogger,J0 as configTrustedClientGrants,I0 as claimsToUser,o as buildTenantPath,h0 as assertValidSubjectTypeScoping,W0 as assertEcid,F0 as accessRootId,Z0 as accessRefId,O0 as StoreConflictError,g0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,k0 as IoniteError,x as ION_TENANT_MANAGE,I as ION_SDK_PERMISSIONS,p0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,M as ION_IAM_READ,W as ION_IAM_GROUPS_WRITE,f as ION_ENDPOINT_PERMISSIONS,E as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,P as ION_AUTHZ_OAA_SYNC,y0 as ION_AUTHZ_GROUP_SCHEMA,Y0 as EcidFormatError,j0 as ECID_SCHEME,d as DEFAULT_TENANT_UI_NAMESPACE,l as DEFAULT_TENANT_API_NAMESPACE,z as ConfigSourceError};
|