@ionite/core 0.0.24-beta.20261003.17 → 0.0.24-beta.20261006.21

package/dist/index.js

@@ -1,2 +1,2 @@
-import{$ as Ct,A as Je,Aa as zt,B as Xe,Ba as Ft,Ca as qt,Da as Vt,Ea as Gt,Fa as Bt,G as Ze,Ga as Ht,H as Qe,Ha as Yt,I as et,Ia as Jt,J as tt,Ja as Xt,K as ot,Ka as Zt,L as rt,La as Qt,M as nt,Ma as eo,N as st,Na as to,O as it,P as at,Q as pt,Qa as oo,R as ct,Ra as ro,S as mt,Sa as no,T as lt,Ta as so,Ua as io,V as ut,Va as ao,W as dt,Wa as po,X as gt,Y as yt,Z as ft,_ as St,a as he,aa as Tt,b as Ie,ba as kt,c as be,ca as Rt,d as _e,da as Et,e as xe,ea as At,f as Oe,fa as ht,g as Pe,ga as x,h as we,ha as It,i as Me,ia as bt,j as ve,ja as O,k as Ke,ka as P,l as Ne,la as _t,m as De,ma as xt,n as Le,na as Ot,o as We,oa as Pt,p as je,pa as wt,q as Ue,qa as Mt,r as $e,ra as vt,s as ze,sa as Kt,t as Fe,ta as Nt,u as qe,ua as Dt,v as Ve,va as Lt,w as Ge,wa as Wt,x as Be,xa as jt,y as He,ya as Ut,z as Ye,za as $t}from"./shared/core-njzaahvy.js";var Y="0.0.24-beta.20261003.17";class y extends Error{constructor(e,t){super(e,t.cause!==void 0?{cause:t.cause}:void 0);this.name="ConfigSourceError",this.kind=t.kind,this.recoverable=t.recoverable,this.code=t.code,this.status=t.status,this.path=t.path,this.sourceType=t.sourceType,Object.setPrototypeOf(this,y.prototype)}}function J(e){return e instanceof y}var c=["workload"],C={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:c,recommendedSubjectTypes:c},T={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},k={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},R={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},E={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},A={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:c,recommendedSubjectTypes:c},h={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:c,recommendedSubjectTypes:c},I={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:c},b={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:c,recommendedSubjectTypes:c},_={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},X=[C,T,k,R,E,A,h,I,b,_],Z={"iam.read":{permission:C,subjectType:["workload"]},"iam.users.write":{permission:T,subjectType:["workload"]},"iam.groups.write":{permission:k,subjectType:["workload"]},"iam.workloads.write":{permission:R,subjectType:["workload"]},"iam.customers.write":{permission:E,subjectType:["workload"]},"iam.access-requests.write":{permission:A,subjectType:["workload"]},"capabilitiez.read":{permission:h,subjectType:["workload"]},"ciam.magic-link.create":{permission:I,subjectType:["workload","user"]},"authz.oaa.sync":{permission:b,subjectType:["workload"]},"tenant.manage":{permission:_,subjectType:["workload"]}};var Q=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function K(e){if(e===null||typeof e!=="object")return e;let t={};for(let[o,r]of Object.entries(e)){if(Q.includes(o)||o==="validators"||o==="setStores")continue;t[o]=r!==null&&typeof r==="object"&&!Array.isArray(r)&&Object.getPrototypeOf(r)===Object.prototype?K(r):r}return t}function ee(e){return K(e)}function f(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} must be an object.`);return e}function u(e,t){if(e===void 0)return;if(typeof e!=="string"||e.length===0||!Number.isFinite(Date.parse(e)))throw Error(`${t} must be a valid timestamp string.`);return e}function N(e,t,o){if(!Array.isArray(e)||!o.allowEmpty&&e.length===0)throw Error(`${t} keys must be ${o.allowEmpty?"an":"a non-empty"} array.`);let r=new Set;return e.map((s,n)=>{let i=f(s,`${t} keys[${n}]`);if(typeof i.id!=="string"||i.id.length===0)throw Error(`${t} keys[${n}].id must be a non-empty string.`);if(r.has(i.id))throw Error(`${t} contains duplicate key id "${i.id}".`);if(r.add(i.id),!["pending","active","deprecated","rotated","revoked"].includes(String(i.state)))throw Error(`${t} keys[${n}].state is invalid.`);if(i.value!==void 0&&(typeof i.value!=="string"||i.value.length===0))throw Error(`${t} keys[${n}].value must be a non-empty string when present.`);let p=i.meta===void 0?void 0:f(i.meta,`${t} keys[${n}].meta`);return{id:i.id,state:i.state,...i.value===void 0?{}:{value:i.value},...i.notBefore===void 0?{}:{notBefore:u(i.notBefore,`${t} keys[${n}].notBefore`)},...i.notAfter===void 0?{}:{notAfter:u(i.notAfter,`${t} keys[${n}].notAfter`)},...i.createdAt===void 0?{}:{createdAt:u(i.createdAt,`${t} keys[${n}].createdAt`)},...i.activatedAt===void 0?{}:{activatedAt:u(i.activatedAt,`${t} keys[${n}].activatedAt`)},...i.deprecatedAt===void 0?{}:{deprecatedAt:u(i.deprecatedAt,`${t} keys[${n}].deprecatedAt`)},...i.rotatedAt===void 0?{}:{rotatedAt:u(i.rotatedAt,`${t} keys[${n}].rotatedAt`)},...i.revokedAt===void 0?{}:{revokedAt:u(i.revokedAt,`${t} keys[${n}].revokedAt`)},...p?{meta:{...p}}:{}}})}function te(e,t,o){if(e===void 0)return;if(!Array.isArray(e))throw Error(`${o} slots must be an array.`);let r=new Set,s=e.map((n,i)=>{if(n===null)return null;if(typeof n!=="string"||n.length===0)throw Error(`${o} slots[${i}] must be a non-empty key id or null.`);if(r.has(n))throw Error(`${o} slots contain duplicate key id "${n}".`);r.add(n);let p=t.find((a)=>a.id===n);if(!p)throw Error(`${o} slot key "${n}" is not present in keys.`);if(p.state!=="active")throw Error(`${o} slot key "${n}" must have state "active".`);if(!p.value)throw Error(`${o} slot key "${n}" must include a value.`);return n});if(t.length===0&&s.some((n)=>n!==null))throw Error(`${o} slots must be omitted or all-null when keys is empty.`);return s}function oe(e){let o=f(e,"KMS pool");if(o.kind!=="kms")throw Error('KMS pool kind must be "kms".');let r=N(o.keys,"KMS pool",{allowEmpty:!0}),s=te(o.slots,r,"KMS pool");return s?{kind:"kms",slots:s,keys:r}:{kind:"kms",keys:r}}function re(e){let o=f(e,"KMS pool control document");if(o.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:N(o.keys,"KMS pool control document",{allowEmpty:!0})}}var ne={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function L(e){if(typeof e==="string")return e;try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function S(e){let t=L(e);return/^[A-Za-z0-9_./:@+|-]+$/.test(t)?t:JSON.stringify(t)}function se(e){return L(e).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function D(e,t,o){if(o==null)return;if(o instanceof Error){if(e.push(`${t}.name=${S(o.name)}`),e.push(`${t}.message=${S(o.message)}`),o.stack)e.push(`${t}.stack=${S(o.stack)}`);return}e.push(`${t}=${S(o)}`)}function d(e,t,o=[],r=new Date){let s=se(t instanceof Error?t.message:t??""),n=[];for(let[i,p]of o.entries()){if(p&&typeof p==="object"&&!Array.isArray(p)&&!(p instanceof Error)&&Object.getPrototypeOf(p)===Object.prototype){for(let[a,l]of Object.entries(p))D(n,a,l);continue}D(n,`param.${i}`,p)}return[r.toISOString(),ne[e],s,...n].filter(Boolean).join(" ")}var W={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},ie=W,ae={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},pe={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ce={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},me={trace:()=>{},debug:(e,...t)=>globalThis.console.debug(d("debug",e,t)),info:(e,...t)=>globalThis.console.info(d("info",e,t)),warn:(e,...t)=>globalThis.console.warn(d("warn",e,t)),error:(e,...t)=>globalThis.console.error(d("error",e,t))};function le(e,t){if(typeof t!=="number"||t<=0)return e;return new Promise((o,r)=>{let s=setTimeout(()=>{r(Error(`Authz catalog entry did not become ready within ${t}ms`))},t);e.then(()=>{clearTimeout(s),o()},(n)=>{clearTimeout(s),r(n)})})}function ue(e,t){let o=!1,r,s=t.then(()=>{o=!0},(i)=>{o=!1,r=i}),n=e;return Object.defineProperty(n,"ready",{enumerable:!1,configurable:!0,value:(i)=>le(s.then(()=>{if(!o)throw r}),i)}),Object.defineProperty(n,"isReady",{enumerable:!1,configurable:!0,value:()=>o}),n}var w=Object.freeze({jsonc:x,env:"text/x-dotenv",text:"text/plain",binary:P,yaml:"application/yaml",toml:"application/toml",xml:O});function M(e){if(!e.id.trim())throw Error("defineSecretType: id is required");let t=e.mimeType?.trim()||w[e.format],o=Object.freeze({id:e.id,...e.label?{label:e.label}:{},format:e.format,mimeType:t,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id});return Object.freeze({id:e.id,...e.label?{label:e.label}:{},format:e.format,mimeType:t,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},...e.schema?{schema:e.schema}:{},toRegistryEntry:()=>o})}function de(e="jsonc"){return{format:e,mimeType:w[e],typeId:e}}class j extends Error{constructor(e,t){super(`Secret content type mismatch: expected "${e.mimeType}" (${e.format}) but received "${t.mimeType}" (${t.format})`);this.name="SecretContentTypeMismatchError",this.expected=e,this.received=t}}var ge=M({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var z={beforeTenantSegments:["ui"]},F={beforeTenantSegments:["api"]};function U(e){return(e??[]).map((t)=>t.trim()).filter(Boolean)}function q(e){let t=e.trim();if(!t)return"/";let o=t.replace(/\\/g,"/").replace(/\/+/g,"/");return o.startsWith("/")?o:`/${o}`}function V(e){return q(e).split("/").filter(Boolean)}function g(e){return{beforeTenantSegments:U(e?.beforeTenantSegments),afterTenantSegments:U(e?.afterTenantSegments)}}function G(e){if(e?.type==="host")return{type:"host",baseDomain:v(e.baseDomain)};if(e?.type==="selector")return e;return{type:"path",ui:g(e?.ui??z),api:g(e?.api??F)}}function v(e){let t=e.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!t)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return t}function ye(e,t){let o=e.trim().replace(/\.$/,"").toLowerCase(),r=v(t);if(!o.endsWith(`.${r}`))return null;let s=o.slice(0,-(r.length+1));if(!s||s.includes("."))return null;return{id:s}}function fe(e,t){let o=g(t),r=o.beforeTenantSegments??[],s=o.afterTenantSegments??[],n=V(e),i=r.length+1+s.length;if(n.length<i)return null;for(let m=0;m<r.length;m++)if(n[m]!==r[m])return null;let p=r.length,a=n[p];if(!a)return null;for(let m=0;m<s.length;m++)if(n[p+1+m]!==s[m])return null;let l=n.slice(p+1+s.length);return{id:decodeURIComponent(a),restSegments:l,restPath:l.length>0?`/${l.join("/")}`:"/"}}function B(e,t="/",o){let r=g(o),s=r.beforeTenantSegments??[],n=r.afterTenantSegments??[],i=V(t),p=[...s,encodeURIComponent(e),...n,...i];return p.length>0?`/${p.join("/")}`:"/"}function Se(e,t="/",o,r="ui"){let s=G(o);if(s.type==="host"||s.type==="selector")return q(t);return B(e,t,s[r])}function Ce(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let o=t,r=[],s={...o},n=["iss","sub"];for(let a of n)if(a in o){if(typeof o[a]!=="string")r.push({message:`${a} must be a string`,path:[a]})}else r.push({message:`${a} is required`,path:[a]});if("aud"in o&&o.aud!==void 0){let a=o.aud;if(typeof a!=="string"&&!Array.isArray(a))r.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(a)&&!a.every((l)=>typeof l==="string"))r.push({message:"aud array must contain only strings",path:["aud"]})}let i=["jti","scope"];for(let a of i)if(a in o&&o[a]!==void 0){if(typeof o[a]!=="string")r.push({message:`${a} must be a string`,path:[a]})}let p=["exp","iat"];for(let a of p)if(a in o){if(typeof o[a]!=="number")r.push({message:`${a} must be a number`,path:[a]})}else r.push({message:`${a} is required`,path:[a]});if(r.length>0)return{issues:r};return{value:s}}}}}function Te(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let o=t,r=[],s={};if("access_token"in o)if(typeof o.access_token==="string")s.access_token=o.access_token;else r.push({message:"access_token must be a string",path:["access_token"]});else r.push({message:"access_token is required",path:["access_token"]});if("token_type"in o)if(typeof o.token_type==="string")s.token_type=o.token_type;else r.push({message:"token_type must be a string",path:["token_type"]});else r.push({message:"token_type is required",path:["token_type"]});if("scope"in o)if(typeof o.scope==="string"||o.scope===void 0)s.scope=o.scope;else r.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in o)if(typeof o.refresh_token==="string"||o.refresh_token===void 0)s.refresh_token=o.refresh_token;else r.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in o)if(typeof o.expires==="string"||o.expires===void 0)s.expires=o.expires;else r.push({message:"expires must be a string",path:["expires"]});if("expires_in"in o)if(typeof o.expires_in==="number"||o.expires_in===void 0)s.expires_in=o.expires_in;else r.push({message:"expires_in must be a number",path:["expires_in"]});if(r.length>0)return{issues:r};return{value:s}}}}}function ke(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}function Re(e){let t="",o=ke(e);for(let r=0;r<e;r++){let s=o[r]%32;t+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(s)}return t}function Ee(e,t){let o="";for(let r=t;r>0;r--){let s=e%32;o="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(s)+o,e=Math.floor(e/32)}return o}function Ae(e){let t=Date.now(),o=Ee(t,10),r=Re(16);return`${e??""}${o}${r}`}export{_t as ACCEPT_JSON,Pt as ACCEPT_OCTET_STREAM,xt as ACCEPT_SCIM,Ot as ACCEPT_XML,Ue as AssignmentPolicyError,Ke as CANONICAL_RISK_LEVELS,vt as CONTENT_TYPE_FORM,wt as CONTENT_TYPE_JSON,Nt as CONTENT_TYPE_OCTET_STREAM,Mt as CONTENT_TYPE_SCIM,Kt as CONTENT_TYPE_XML,y as ConfigSourceError,tt as DEFAULT_DISCOVERED_COOKIE_MAX,ot as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,et as DEFAULT_DISPLAY_COOKIE_MAX,Ne as DEFAULT_RISK_LEVEL,w as DEFAULT_SECRET_MIME_TYPES,F as DEFAULT_TENANT_API_NAMESPACE,z as DEFAULT_TENANT_UI_NAMESPACE,rt as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,Qe as DISPLAY_COOKIE_VERSION,ft as ECID_SCHEME,St as EcidFormatError,bt as FORM_MEDIA_TYPE,De as ION_AUTHZ_GROUP_SCHEMA,b as ION_AUTHZ_OAA_SYNC,h as ION_CAPABILITIEZ_READ,I as ION_CIAM_MAGIC_LINK_CREATE,Z as ION_ENDPOINT_PERMISSIONS,A as ION_IAM_ACCESS_REQUESTS_WRITE,E as ION_IAM_CUSTOMERS_WRITE,k as ION_IAM_GROUPS_WRITE,C as ION_IAM_READ,T as ION_IAM_USERS_WRITE,R as ION_IAM_WORKLOADS_WRITE,no as ION_SCIM_CUSTOMER_SCHEMA,oo as ION_SCIM_USER_EXTENSION_URN,ro as ION_SCIM_WORKLOAD_SCHEMA,X as ION_SDK_PERMISSIONS,_ as ION_TENANT_MANAGE,Qt as IoniteError,x as JSON_MEDIA_TYPE,xe as KNOWN_BASE_CUSTOMER_KEYS,_e as KNOWN_BASE_USER_KEYS,be as KNOWN_ENTITLEMENT_KEYS,Oe as KNOWN_WORKLOAD_KEYS,P as OCTET_STREAM_MEDIA_TYPE,Le as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,It as SCIM_MEDIA_TYPE,j as SecretContentTypeMismatchError,Xt as StoreConflictError,O as XML_MEDIA_TYPE,Je as accessRefId,Xe as accessRootId,Rt as assertEcid,je as assertRequiredSubjectType,We as assertValidSubjectTypeScoping,B as buildTenantPath,Se as buildTenantUrl,Ve as catalogEntityStore,Yt as claimsToUser,dt as compareDisplayExpiryDesc,Ie as configTrustedClientGrants,Pe as customAttributes,po as customerResourceSchema,ae as debugLogger,lt as decodeDisplayCookie,Jt as decodeUser,Gt as deepEqualPlain,at as defaultDisplayUser,ie as defaultLogger,de as defaultSecretContentType,Fe as defineCatalog,M as defineSecretType,He as deprecateRetiredCodeCatalogRows,yt as discoveredProfileCookieName,mt as encodeDisplayCookie,Tt as formatEcid,d as formatLogLine,Ae as generateULID,qe as getCodeCatalogEntity,io as groupResourceSchema,ht as idTokenClaimsSchema,pe as infoLogger,$e as isCodeCatalog,eo as isConfigLocator,J as isConfigSourceError,Ct as isEcid,Dt as isJsonResponse,Zt as isStoreConflictError,Ce as jwtAssertionClaimsSchema,we as list,Me as listGenerator,ye as matchTenantHost,fe as matchTenantPath,ve as matchesListFilter,Be as materializeCodeCatalogEntity,Ge as mergeCodeCatalogEntity,zt as mergeConfig,Ut as must,v as normalizeTenantBaseDomain,g as normalizeTenantPathNamespace,G as normalizeTenantRoutingStrategy,Et as oidcCallbackSchema,kt as parseEcid,qt as parseJsonc,re as parseKmsPoolControlDocument,oe as parseKmsPoolDocument,me as prettyLogger,gt as profileCookieName,ct as projectDisplayUser,ut as readDisplayCookies,Wt as readJsonResponse,ue as readyCatalogEntry,ge as remoteConfigSecretType,st as resolveDiscoveredCookieMax,it as resolveDiscoveredCookieTtlSeconds,nt as resolveDisplayCookieMax,pt as sanitizeDisplayUser,ee as serializeConfig,W as silentLogger,Bt as stableConfigHash,Ft as stripJsonComments,to as tmIntegrationState,ze as toCodeCatalog,At as tokenResponseSchema,Vt as trimTrailingSlash,he as trustedClientPermissionsForPrincipal,Lt as unexpectedBodySummary,Ye as unionCatalogRead,so as userSchema,$t as validationFailureResponse,Y as version,Ht as waitOn,ce as warnLogger,jt as withValidate,ao as workloadResourceSchema,Te as workloadTokenResponseSchema};
+import{J,je,d,A,I,v,o,j,c,Ne,Y,f,e,g,x,X,le,Ee,Le,Pe,N,L,T,K,Z,q,n,p,Ke,W,qe,We,Ve,ee,te,V,ne,me,fe,m,z,Ue,B,P,U,G,ze,_,_e,Be,Ge,O,ge,ye,he,Se,ke,be,Ce,Te,we,Re,se,Fe,oe,ie,y,s,He,D,Ae,Ie,i,ae,Je,Ye,r,w,h,Xe,Ze,Oe,F,a,l,t,ce,Qe,De,et,R,S,tt,nt,H,rt,k,M,ve,xe,st,u,b,C,it,at,ue,de}from"./shared/core-knezf9yx.js";var Mt="0.0.24-beta.20261006.21";class ft extends Error{constructor(E,Q){super(E,Q.cause!==void 0?{cause:Q.cause}:void 0);this.name="ConfigSourceError",this.kind=Q.kind,this.recoverable=Q.recoverable,this.code=Q.code,this.status=Q.status,this.path=Q.path,this.sourceType=Q.sourceType,Object.setPrototypeOf(this,ft.prototype)}}function Lt(E){return E instanceof ft}var Nt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function Rt(E){if(E===null||typeof E!=="object")return E;let Q={};for(let[re,pe]of Object.entries(E)){if(Nt.includes(re)||re==="validators"||re==="setStores")continue;Q[re]=pe!==null&&typeof pe==="object"&&!Array.isArray(pe)&&Object.getPrototypeOf(pe)===Object.prototype?Rt(pe):pe}return Q}function $t(E){return Rt(E)}function yt(E,Q){if(!E||typeof E!=="object"||Array.isArray(E))throw Error(`${Q} must be an object.`);return E}function ut(E,Q){if(E===void 0)return;if(typeof E!=="string"||E.length===0||!Number.isFinite(Date.parse(E)))throw Error(`${Q} must be a valid timestamp string.`);return E}function Et(E,Q,re){if(!Array.isArray(E)||!re.allowEmpty&&E.length===0)throw Error(`${Q} keys must be ${re.allowEmpty?"an":"a non-empty"} array.`);let pe=new Set;return E.map(($e,Me)=>{let ot=yt($e,`${Q} keys[${Me}]`);if(typeof ot.id!=="string"||ot.id.length===0)throw Error(`${Q} keys[${Me}].id must be a non-empty string.`);if(pe.has(ot.id))throw Error(`${Q} contains duplicate key id "${ot.id}".`);if(pe.add(ot.id),!["pending","active","deprecated","rotated","revoked"].includes(String(ot.state)))throw Error(`${Q} keys[${Me}].state is invalid.`);if(ot.value!==void 0&&(typeof ot.value!=="string"||ot.value.length===0))throw Error(`${Q} keys[${Me}].value must be a non-empty string when present.`);let ct=ot.meta===void 0?void 0:yt(ot.meta,`${Q} keys[${Me}].meta`);return{id:ot.id,state:ot.state,...ot.value===void 0?{}:{value:ot.value},...ot.notBefore===void 0?{}:{notBefore:ut(ot.notBefore,`${Q} keys[${Me}].notBefore`)},...ot.notAfter===void 0?{}:{notAfter:ut(ot.notAfter,`${Q} keys[${Me}].notAfter`)},...ot.createdAt===void 0?{}:{createdAt:ut(ot.createdAt,`${Q} keys[${Me}].createdAt`)},...ot.activatedAt===void 0?{}:{activatedAt:ut(ot.activatedAt,`${Q} keys[${Me}].activatedAt`)},...ot.deprecatedAt===void 0?{}:{deprecatedAt:ut(ot.deprecatedAt,`${Q} keys[${Me}].deprecatedAt`)},...ot.rotatedAt===void 0?{}:{rotatedAt:ut(ot.rotatedAt,`${Q} keys[${Me}].rotatedAt`)},...ot.revokedAt===void 0?{}:{revokedAt:ut(ot.revokedAt,`${Q} keys[${Me}].revokedAt`)},...ct?{meta:{...ct}}:{}}})}function Wt(E,Q,re){if(E===void 0)return;if(!Array.isArray(E))throw Error(`${re} slots must be an array.`);let pe=new Set,$e=E.map((Me,ot)=>{if(Me===null)return null;if(typeof Me!=="string"||Me.length===0)throw Error(`${re} slots[${ot}] must be a non-empty key id or null.`);if(pe.has(Me))throw Error(`${re} slots contain duplicate key id "${Me}".`);pe.add(Me);let ct=Q.find((pt)=>pt.id===Me);if(!ct)throw Error(`${re} slot key "${Me}" is not present in keys.`);if(ct.state!=="active")throw Error(`${re} slot key "${Me}" must have state "active".`);if(!ct.value)throw Error(`${re} slot key "${Me}" must include a value.`);return Me});if(Q.length===0&&$e.some((Me)=>Me!==null))throw Error(`${re} slots must be omitted or all-null when keys is empty.`);return $e}function Ut(E){let re=yt(E,"KMS pool");if(re.kind!=="kms")throw Error('KMS pool kind must be "kms".');let pe=Et(re.keys,"KMS pool",{allowEmpty:!0}),$e=Wt(re.slots,pe,"KMS pool");return $e?{kind:"kms",slots:$e,keys:pe}:{kind:"kms",keys:pe}}function Ft(E){let re=yt(E,"KMS pool control document");if(re.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Et(re.keys,"KMS pool control document",{allowEmpty:!0})}}var qt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function ht(E){if(typeof E==="string")return E;try{return JSON.stringify(E)??String(E)}catch{return String(E)}}function St(E){let Q=ht(E);return/^[A-Za-z0-9_./:@+|-]+$/.test(Q)?Q:JSON.stringify(Q)}function zt(E){return ht(E).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function At(E,Q,re){if(re==null)return;if(re instanceof Error){if(E.push(`${Q}.name=${St(re.name)}`),E.push(`${Q}.message=${St(re.message)}`),re.stack)E.push(`${Q}.stack=${St(re.stack)}`);return}E.push(`${Q}=${St(re)}`)}function dt(E,Q,re=[],pe=new Date){let $e=zt(Q instanceof Error?Q.message:Q??""),Me=[];for(let[ot,ct]of re.entries()){if(ct&&typeof ct==="object"&&!Array.isArray(ct)&&!(ct instanceof Error)&&Object.getPrototypeOf(ct)===Object.prototype){for(let[pt,lt]of Object.entries(ct))At(Me,pt,lt);continue}At(Me,`param.${ot}`,ct)}return[pe.toISOString(),qt[E],$e,...Me].filter(Boolean).join(" ")}var It={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Vt=It,jt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Bt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Gt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Ht={trace:()=>{},debug:(E,...Q)=>globalThis.console.debug(dt("debug",E,Q)),info:(E,...Q)=>globalThis.console.info(dt("info",E,Q)),warn:(E,...Q)=>globalThis.console.warn(dt("warn",E,Q)),error:(E,...Q)=>globalThis.console.error(dt("error",E,Q))};function Yt(E,Q){if(typeof Q!=="number"||Q<=0)return E;return new Promise((re,pe)=>{let $e=setTimeout(()=>{pe(Error(`Authz catalog entry did not become ready within ${Q}ms`))},Q);E.then(()=>{clearTimeout($e),re()},(Me)=>{clearTimeout($e),pe(Me)})})}function Jt(E,Q){let re=!1,pe,$e=Q.then(()=>{re=!0},(ot)=>{re=!1,pe=ot}),Me=E;return Object.defineProperty(Me,"ready",{enumerable:!1,configurable:!0,value:(ot)=>Yt($e.then(()=>{if(!re)throw pe}),ot)}),Object.defineProperty(Me,"isReady",{enumerable:!1,configurable:!0,value:()=>re}),Me}var Ct=Object.freeze({jsonc:s,env:"text/x-dotenv",text:"text/plain",binary:Ie,yaml:"application/yaml",toml:"application/toml",xml:Ae});function kt(E){if(!E.id.trim())throw Error("defineSecretType: id is required");let Q=E.mimeType?.trim()||Ct[E.format],re=Object.freeze({id:E.id,...E.label?{label:E.label}:{},format:E.format,mimeType:Q,...E.schemaUrl?{schemaUrl:E.schemaUrl}:{},typeId:E.id});return Object.freeze({id:E.id,...E.label?{label:E.label}:{},format:E.format,mimeType:Q,...E.schemaUrl?{schemaUrl:E.schemaUrl}:{},...E.schema?{schema:E.schema}:{},toRegistryEntry:()=>re})}function Xt(E="jsonc"){return{format:E,mimeType:Ct[E],typeId:E}}class bt extends Error{constructor(E,Q){super(`Secret content type mismatch: expected "${E.mimeType}" (${E.format}) but received "${Q.mimeType}" (${Q.format})`);this.name="SecretContentTypeMismatchError",this.expected=E,this.received=Q}}var Zt=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Pt={beforeTenantSegments:["ui"]},_t={beforeTenantSegments:["api"]};function xt(E){return(E??[]).map((Q)=>Q.trim()).filter(Boolean)}function Ot(E){let Q=E.trim();if(!Q)return"/";let re=Q.replace(/\\/g,"/").replace(/\/+/g,"/");return re.startsWith("/")?re:`/${re}`}function vt(E){return Ot(E).split("/").filter(Boolean)}function gt(E){return{beforeTenantSegments:xt(E?.beforeTenantSegments),afterTenantSegments:xt(E?.afterTenantSegments)}}function wt(E){if(E?.type==="host")return{type:"host",baseDomain:Tt(E.baseDomain)};if(E?.type==="selector")return E;return{type:"path",ui:gt(E?.ui??Pt),api:gt(E?.api??_t)}}function Tt(E){let Q=E.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!Q)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return Q}function Qt(E,Q){let re=E.trim().replace(/\.$/,"").toLowerCase(),pe=Tt(Q);if(!re.endsWith(`.${pe}`))return null;let $e=re.slice(0,-(pe.length+1));if(!$e||$e.includes("."))return null;return{id:$e}}function eo(E,Q){let re=gt(Q),pe=re.beforeTenantSegments??[],$e=re.afterTenantSegments??[],Me=vt(E),ot=pe.length+1+$e.length;if(Me.length<ot)return null;for(let mt=0;mt<pe.length;mt++)if(Me[mt]!==pe[mt])return null;let ct=pe.length,pt=Me[ct];if(!pt)return null;for(let mt=0;mt<$e.length;mt++)if(Me[ct+1+mt]!==$e[mt])return null;let lt=Me.slice(ct+1+$e.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Kt(E,Q="/",re){let pe=gt(re),$e=pe.beforeTenantSegments??[],Me=pe.afterTenantSegments??[],ot=vt(Q),ct=[...$e,encodeURIComponent(E),...Me,...ot];return ct.length>0?`/${ct.join("/")}`:"/"}function to(E,Q="/",re,pe="ui"){let $e=wt(re);if($e.type==="host"||$e.type==="selector")return Ot(Q);return Kt(E,Q,$e[pe])}function oo(E){return{"~standard":{version:1,vendor:E,validate:(Q)=>{if(typeof Q!=="object"||Q===null)return{issues:[{message:"Expected an object"}]};let re=Q,pe=[],$e={...re},Me=["iss","sub"];for(let pt of Me)if(pt in re){if(typeof re[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if("aud"in re&&re.aud!==void 0){let pt=re.aud;if(typeof pt!=="string"&&!Array.isArray(pt))pe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))pe.push({message:"aud array must contain only strings",path:["aud"]})}let ot=["jti","scope"];for(let pt of ot)if(pt in re&&re[pt]!==void 0){if(typeof re[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}let ct=["exp","iat"];for(let pt of ct)if(pt in re){if(typeof re[pt]!=="number")pe.push({message:`${pt} must be a number`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function ro(E){return{"~standard":{version:1,vendor:E,validate:(Q)=>{if(typeof Q!=="object"||Q===null)return{issues:[{message:"Expected an object"}]};let re=Q,pe=[],$e={};if("access_token"in re)if(typeof re.access_token==="string")$e.access_token=re.access_token;else pe.push({message:"access_token must be a string",path:["access_token"]});else pe.push({message:"access_token is required",path:["access_token"]});if("token_type"in re)if(typeof re.token_type==="string")$e.token_type=re.token_type;else pe.push({message:"token_type must be a string",path:["token_type"]});else pe.push({message:"token_type is required",path:["token_type"]});if("scope"in re)if(typeof re.scope==="string"||re.scope===void 0)$e.scope=re.scope;else pe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in re)if(typeof re.refresh_token==="string"||re.refresh_token===void 0)$e.refresh_token=re.refresh_token;else pe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in re)if(typeof re.expires==="string"||re.expires===void 0)$e.expires=re.expires;else pe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in re)if(typeof re.expires_in==="number"||re.expires_in===void 0)$e.expires_in=re.expires_in;else pe.push({message:"expires_in must be a number",path:["expires_in"]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function no(E){let Q=new Uint8Array(E);return crypto.getRandomValues(Q),Q}function so(E){let Q="",re=no(E);for(let pe=0;pe<E;pe++){let $e=re[pe]%32;Q+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)}return Q}function io(E,Q){let re="";for(let pe=Q;pe>0;pe--){let $e=E%32;re="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)+re,E=Math.floor(E/32)}return re}function ao(E){let Q=Date.now(),re=io(Q,10),pe=so(16);return`${E??""}${re}${pe}`}export{i as ACCEPT_JSON,Ye as ACCEPT_OCTET_STREAM,ae as ACCEPT_SCIM,Je as ACCEPT_XML,le as AssignmentPolicyError,Y as CANONICAL_RISK_LEVELS,h as CONTENT_TYPE_FORM,r as CONTENT_TYPE_JSON,Ze as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Xe as CONTENT_TYPE_XML,ft as ConfigSourceError,We as DEFAULT_DISCOVERED_COOKIE_MAX,Ve as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,qe as DEFAULT_DISPLAY_COOKIE_MAX,f as DEFAULT_RISK_LEVEL,Ct as DEFAULT_SECRET_MIME_TYPES,_t as DEFAULT_TENANT_API_NAMESPACE,Pt as DEFAULT_TENANT_UI_NAMESPACE,ee as DISCOVERED_COOKIE_PREFIX,Ke as DISPLAY_COOKIE_SUFFIX,W as DISPLAY_COOKIE_VERSION,ze as ECID_SCHEME,_ as EcidFormatError,D as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,we as ION_AUTHZ_OAA_SYNC,Ce as ION_CAPABILITIEZ_READ,Te as ION_CIAM_MAGIC_LINK_CREATE,Fe as ION_ENDPOINT_PERMISSIONS,be as ION_IAM_ACCESS_REQUESTS_WRITE,ke as ION_IAM_CUSTOMERS_WRITE,he as ION_IAM_GROUPS_WRITE,ge as ION_IAM_READ,ye as ION_IAM_USERS_WRITE,Se as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,u as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,se as ION_SDK_PERMISSIONS,Re as ION_TENANT_MANAGE,ve as IoniteError,s as JSON_MEDIA_TYPE,I as KNOWN_BASE_CUSTOMER_KEYS,A as KNOWN_BASE_USER_KEYS,d as KNOWN_ENTITLEMENT_KEYS,v as KNOWN_WORKLOAD_KEYS,Ie as OCTET_STREAM_MEDIA_TYPE,g as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,bt as SecretContentTypeMismatchError,k as StoreConflictError,Ae as XML_MEDIA_TYPE,n as accessRefId,p as accessRootId,O as assertEcid,X as assertRequiredSubjectType,x as assertValidSubjectTypeScoping,Kt as buildTenantPath,to as buildTenantUrl,L as catalogEntityStore,H as claimsToUser,P as compareDisplayExpiryDesc,je as configTrustedClientGrants,o as customAttributes,de as customerResourceSchema,jt as debugLogger,Ue as decodeDisplayCookie,rt as decodeUser,S as deepEqualPlain,me as defaultDisplayUser,Vt as defaultLogger,Xt as defaultSecretContentType,Pe as defineCatalog,kt as defineSecretType,Z as deprecateRetiredCodeCatalogRows,G as discoveredProfileCookieName,z as encodeDisplayCookie,Be as formatEcid,dt as formatLogLine,ao as generateULID,N as getCodeCatalogEntity,at as groupResourceSchema,y as idTokenClaimsSchema,Bt as infoLogger,Ee as isCodeCatalog,xe as isConfigLocator,Lt as isConfigSourceError,_e as isEcid,Oe as isJsonResponse,M as isStoreConflictError,oo as jwtAssertionClaimsSchema,j as list,c as listGenerator,Qt as matchTenantHost,eo as matchTenantPath,Ne as matchesListFilter,K as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,Qe as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,gt as normalizeTenantPathNamespace,wt as normalizeTenantRoutingStrategy,oe as oidcCallbackSchema,Ge as parseEcid,et as parseJsonc,Ft as parseKmsPoolControlDocument,Ut as parseKmsPoolDocument,Ht as prettyLogger,U as profileCookieName,m as projectDisplayUser,B as readDisplayCookies,a as readJsonResponse,Jt as readyCatalogEntry,Zt as remoteConfigSecretType,V as resolveDiscoveredCookieMax,ne as resolveDiscoveredCookieTtlSeconds,te as resolveDisplayCookieMax,fe as sanitizeDisplayUser,$t as serializeConfig,It as silentLogger,tt as stableConfigHash,De as stripJsonComments,st as tmIntegrationState,Le as toCodeCatalog,ie as tokenResponseSchema,R as trimTrailingSlash,J as trustedClientPermissionsForPrincipal,F as unexpectedBodySummary,q as unionCatalogRead,it as userSchema,ce as validationFailureResponse,Mt as version,nt as waitOn,Gt as warnLogger,l as withValidate,ue as workloadResourceSchema,ro as workloadTokenResponseSchema};